Traefik / nextcloud configuration.

[anthony_COPPET]

HI , Fighting for 4 days. I cannot configure Traefk/nexcloud as others services. REally need help . I can connect to nextcloud whith traefik but even Labels in docker compose… Still have informations (errors) about well knows url , https… All configuration below : # ================================

Section : docker-compose.yml

================================

version: “3.8”

services:
nextcloud:
image: nextcloud:latest
container_name: nextcloud
restart: always
networks:
- MY-NETWORK
environment:
# Trusted Domains pour accéder à Nextcloud
- NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.example.com,authelia.example.com,nas.example.com,example.com,ldap.example.com
# Trusted Proxies pour gérer les proxys de confiance
- NEXTCLOUD_TRUSTED_PROXIES=192.168.1.10,10.0.0.0/8,172.17.0.0/16,172.19.0.0/16,172.22.0.0/16,192.168.10.0/25,172.23.0.0/16
# Protocoles et hôtes
- NEXTCLOUD_OVERWRITEPROTOCOL=https
- NEXTCLOUD_OVERWRITEHOST=nextcloud.example.com
# Base de données
- MYSQL_HOST=nextcloud-db
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud_user
- MYSQL_PASSWORD=securepassword
# Redis
- REDIS_HOST=nextcloud-redis
- REDIS_HOST_PASSWORD=securepassword
# Limites de téléchargement et mémoire
- NEXTCLOUD_MAX_UPLOAD=16G
- PHP_MEMORY_LIMIT=512M
- PHP_UPLOAD_LIMIT=16G
- PHP_POST_MAX_SIZE=16G
volumes:
- ./nextcloud/data:/var/www/html/data
- ./nextcloud/config:/var/www/html/config
- ./nextcloud/apps:/var/www/html/custom_apps
- ./nextcloud/themes:/var/www/html/themes
labels:
- traefik.enable=true
- traefik.http.routers.nextcloud.entrypoints=https
- traefik.http.routers.nextcloud.rule=Host(nextcloud.example.com)
- traefik.http.routers.nextcloud.middlewares=chain-nextcloud@file
- traefik.http.routers.nextcloud.tls=true
- traefik.http.services.nextcloud.loadbalancer.server.port=80
- traefik.http.middlewares.nextcloud-redirect-caldav.redirectregex.regex=^/.well-known/(carddav|caldav)
- traefik.http.middlewares.nextcloud-redirect-caldav.redirectregex.replacement=/remote.php/dav
- traefik.http.middlewares.nextcloud-redirect-caldav.redirectregex.permanent=true
- traefik.http.middlewares.nextcloud-redirect-webfinger.redirectregex.regex=^/.well-known/(webfinger|nodeinfo)
- traefik.http.middlewares.nextcloud-redirect-webfinger.redirectregex.replacement=/index.php/.well-known/$1
- traefik.http.middlewares.nextcloud-redirect-webfinger.redirectregex.permanent=true

nextcloud-db:
image: mariadb:latest
container_name: nextcloud-db
restart: always
networks:
- MY-NETWORK
environment:
- MYSQL_ROOT_PASSWORD=securepassword
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud_user
- MYSQL_PASSWORD=securepassword
volumes:
- ./db_data:/var/lib/mysql

nextcloud-redis:
image: redis:latest
container_name: nextcloud-redis
restart: always
networks:
- MY-NETWORK
command: redis-server --requirepass “securepassword”
volumes:
- ./redis_data:/data

networks:
MY-NETWORK:
external: true

================================

Section : middlewares.yml

================================

http:
middlewares:
chain-nextcloud:
chain:
middlewares:
- authelia@docker
- middleware-rewrite-ip
- middlewares-trailingslash

# Middleware pour réécrire l'IP réelle
middleware-rewrite-ip:
  headers:
    customRequestHeaders:
      X-Real-IP: "%{index:X-Forwarded-For|,|0}"

# Middleware pour ajouter un slash de fin dans les URLs
middlewares-trailingslash:
  redirectRegex:
    regex: '^(https?://[^/]+/[a-z0-9_]+)$'
    replacement: ${1}/
    permanent: true

================================

Section : chains.yml

================================

http:
middlewares:
chain-nextcloud:
chain:
middlewares:
- authelia@docker
- middleware-rewrite-ip
- middlewares-trailingslash

[wwe]

Hi @anthony_COPPET, welcome to Nextcloud community

please use search many issues have been discussed already, especially check the tags traefik reverseproxy setup_warning and Frequent Nextcloud 29 (Hub 8) update issues

I would recommend you start simple

• remove all the middlewares you added, this might cause some issues (especially -trailingslash)
• review reverse proxy docs, I think you are missing some attributes

[anthony_COPPET]

Hi , thx for your answer
What is wrong here. Read the manual over and over
services:
nextcloud:
image: nextcloud:latest
container_name: nextcloud
restart: always
networks:
- MY-NETWORK
environment:
# Database configuration
- MYSQL_HOST=nextcloud-db
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=dbuser
- MYSQL_PASSWORD=dbpassword123
# Nextcloud configuration
- NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.example.com,auth.example.com
- NEXTCLOUD_TRUSTED_PROXIES=10.0.100.5,10.0.100.0/27,172.16.0.5,172.16.0.1,127.0.0.1
- NEXTCLOUD_OVERWRITEPROTOCOL=https
- NEXTCLOUD_OVERWRITEHOST=nextcloud.example.com
- NEXTCLOUD_OVERWRITEWEBROOT=/ # Set /nextcloud if served from a subfolder
- NEXTCLOUD_OVERWRITECONDADDR=^10.0.100.5$|^172.16.0.5$|^172.16.0.1$|^127.0.0.1$
- NEXTCLOUD_DEFAULT_PHONE_REGION=US
# Redis configuration (caching)
- REDIS_HOST=nextcloud-redis
- REDIS_HOST_PASSWORD=redispassword123
# Maintenance tasks (executed during off-peak hours)
- NEXTCLOUD_CRON_MINIMUM_LAST_JOB=02:00:00
volumes:
- ./nextcloud/data:/var/www/html/data
- ./nextcloud/config:/var/www/html/config
- ./nextcloud/apps:/var/www/html/custom_apps
labels:
# Enable Traefik for Nextcloud
- traefik.enable=true
# Traefik router for Nextcloud
- traefik.http.routers.nextcloud.entrypoints=https
- traefik.http.routers.nextcloud.rule=Host(nextcloud.example.com)
- traefik.http.routers.nextcloud.middlewares=middlewares-redirect-to-https,nextcloud_headers,nextcloud_redirectregex,authelia_auth
- traefik.http.routers.nextcloud.tls=true
- traefik.http.services.nextcloud.loadbalancer.server.port=80

  # Middleware to enforce HTTPS
  - traefik.http.middlewares.middlewares-redirect-to-https.redirectscheme.scheme=https
  - traefik.http.middlewares.middlewares-redirect-to-https.redirectscheme.permanent=true

  # Middleware for HTTP headers (includes all required headers)
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.X-Content-Type-Options=nosniff
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.X-XSS-Protection=1; mode=block
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.Referrer-Policy=no-referrer
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.Strict-Transport-Security=max-age=15552000; includeSubDomains; preload
  - traefik.http.middlewares.nextcloud_headers.headers.customResponseHeaders.Permissions-Policy=camera=(), microphone=(), geolocation=()
  - traefik.http.middlewares.nextcloud_headers.headers.customRequestHeaders.X-Forwarded-Proto=https
  - traefik.http.middlewares.nextcloud_headers.headers.customRequestHeaders.X-Forwarded-Host=nextcloud.example.com

  # Middleware for .well-known redirections
  - traefik.http.middlewares.nextcloud_redirectregex.redirectregex.regex=^/.well-known/(carddav|caldav)
  - traefik.http.middlewares.nextcloud_redirectregex.redirectregex.replacement=/remote.php/dav
  - traefik.http.middlewares.nextcloud_redirectregex.redirectregex.permanent=true

  # Middleware for Authelia integration
  - traefik.http.middlewares.authelia_auth.forwardauth.address=https://auth.example.com/api/verify
  - traefik.http.middlewares.authelia_auth.forwardauth.trustForwardHeader=true
  - traefik.http.middlewares.authelia_auth.forwardauth.authResponseHeaders=Remote-User,Remote-Name,Remote-Email,Remote-Groups

nextcloud-db:
image: mariadb:10.6
container_name: nextcloud-db
restart: always
networks:
- MY-NETWORK
environment:
# Database configuration
- MYSQL_ROOT_PASSWORD=dbrootpassword123
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=dbuser
- MYSQL_PASSWORD=dbpassword123
volumes:
- ./db_data:/var/lib/mysql

nextcloud-redis:
image: redis
container_name: nextcloud-redis
restart: always
networks:
- MY-NETWORK
command: redis-server --requirepass “redispassword123”
volumes:
- ./redis_data:/data

networks:
MY-NETWORK:
external: true