Reverse Proxy Configuration

[tuetenk0pp]

Hi, I have a problem with my reverse proxy configuration. It seems like Nextcloud does not get the correct X-Forwarded-For IP and assumes the reverse proxy IP:

compose.yml

version: "3.8"

services:
  caddy:
    image: caddy:alpine
    restart: unless-stopped
    container_name: caddy
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./certs:/certs
      - ./config:/config
      - ./data:/data
      - ./sites:/srv
    network_mode: host

  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080
    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=127.0.0.1
      - NEXTCLOUD_MEMORY_LIMIT=6000M
      - NEXTCLOUD_STARTUP_APPS=twofactor_totp
      - NEXTCLOUD_ADDITIONAL_APKS=imagemagick
      - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick
    depends_on:
      - caddy

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

Caddyfile

https://cloud.domain.tdl:443 {
    header Strict-Transport-Security max-age=31536000;
    reverse_proxy localhost:11000

#    handle_errors {
#        rewrite * /srv/500.html
#        file_server
#    }

}

https://cloud.domain.tld:8443 {
    reverse_proxy https://localhost:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

config.php

I tried to add 172.20.0.1 to config.php in the trusted_proxies section with this command: docker run -it --rm --volume nextcloud_aio_nextcloud:/var/www/html:rw alpine sh -c "apk add --no-cache nano && nano /var/www/html/config/config.php" and can confirm that the setting gets overwritten as mentioned in #3396.

[noogen]

For me it's different, I have my docker proxy in separate container/docker-compose so the setup is APACHE_IP_BINDING=0.0.0.0, which means I have to proxy with public IP. Let say my public IP is: 1.2.3.4

My firewall for Port 11000 only allow connection from 1.2.3.4
My nginx-proxy-manager would point to the public ip for reverse proxy http://1.2.3.4:11000

Then set set 1.2.3.4 to config.php in the trusted_proxies section. Simply:

'trusted_proxies' =>
  array (
    0 => '1.2.3.4'
  )

NOTE: I said set and NOT add You should only have single value like the above example. The example below would be add and it is WRONG!

'trusted_proxies' =>
  array (
    0 => '127.0.0.1',
    1 => '::1',
    2 => '1.2.3.4'
 ),

I struggle with the WRONG configuration above (which return 127.0.0.1 to my log) until I remove everything and leave only my Public IP.

[tuetenk0pp]

I see. My reverse proxy is on the same host as nextcloud (see docker compose above). And although I set network_mode: host it seems to connect via some docker network, since nextcloud reports the IP 172.20.0.1. Setting the trusted_proxy IP as you described does not preserve the setting unfortunately (I edited with this command from the docs: docker run -it --rm --volume nextcloud_aio_nextcloud:/var/www/html:rw alpine sh -c "apk add --no-cache nano && nano /var/www/html/config/config.php").

[tuetenk0pp]

it is the nextcloud-aio network:

docker network inspect nextcloud-aio
[
    {
        "Name": "nextcloud-aio",
        "Id": "",
        "Created": "2023-09-27T20:16:32.200673757+02:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.20.0.0/16",
                    "Gateway": "172.20.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
...

[szaimen]

Hi @tuetenk0pp, can you try the following command and check if that makes it work?

sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ config:system:set trusted_proxies 2 --value="172.20.0.1"

[tuetenk0pp]

This indeed worked. Thank you @szaimen! The setting survived a container recreation 🚀