Nginx Proxy on VM to AIO docker image on separate VM

[ddxv]

Hi, I need some pointers as I am a bit lost following the documenation as there are a few different places nginx could go.

I currently have:

mydomain.com -> home router -> VM1 (nginx)

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 http://$host$request_uri;
    }

    listen 443 ssl;      # for nginx v1.25.1+
    listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6

    server_name nc.mydomain.com;

    location / {
        proxy_pass https://192.168.0.201:8080$request_uri;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_set_header Host $host;

        client_body_buffer_size 512k;
        proxy_read_timeout 86400s;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

... 
SSL handled by cerbot
...

And on the second VM2 I have AIO running in docker compose:

  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer 
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    network_mode: bridge # add to the same network as docker run would do
    ports:
      - 8080:8080
      - 80:80
    environment:
      APACHE_PORT: 11000 
      APACHE_IP_BINDING: 0.0.0.0 

Doing this, when I visit https://nc.mydomain.com I'm able to login with the pass phrase, but can't get past the domain check. With the current config above, the error when checking the domain is:

Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')

Reading the logs and docs, I've just gone in a few circles, so I want to check a few things:

1. Should/can the Certbot SSL be run from the VM1 Nginx? While this seems to be working, I'm not sure if it needed to be run from the VM2 AIO instead?

2. Should the VM2 AIO be running it's own instance of nginx outside of docker? To clarify this would go -> router -> VM1 Nginx -> VM2 Nginx -> VM2 docker

Any other pointers or advice is helpful!

[vawaver]

I have NGINX Proxy server on VM1 and Nextcloud AIO on VM2.
Here are my settings.

[ddxv]

Thanks for your reply, I have a couple questions here, apologies for my confusion

I see you, and the official documentation, use port 11000, but this doesn't work for me for some reason at all. It shows a random string of numbers when I visit it. Port 8080 does sort of work in that it loads the passphrase challenge and the page after that. If port 8080 isn't going to be used by applications outside of docker, why do we expose port 8080 in the docker compose? Or is your proxy above actually running from within docker as well?

[vawaver]

I am sending you my docker-compose.yml

192.168.1.57 - LAN IP for VM1- here I have my NGINX proxy
192.168.1.58 - LAN IP for VM2- here I have Nextcloud AIO

version: "3.4"

volumes:
 nextcloud_aio_mastercontainer:
   name: nextcloud_aio_mastercontainer
services:
 nextcloud:
   image: nextcloud/all-in-one:latest
   restart: unless-stopped
   container_name: nextcloud-aio-mastercontainer
   volumes:
     - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
     - /var/run/docker.sock:/var/run/docker.sock:ro
   ports:
     - 6789:8080 # change the port on the left side if it's already in use on your host system.
   environment:
     - APACHE_PORT=11000
     - APACHE_DISABLE_REWRITE_IP=1
     - NEXTCLOUD_TRUSTED_DOMAINS=my.subdomain.com 192.168.1.57 # Your domain name + proxy host IP (here I have my NGINX proxy server)
     - TRUSTED_PROXIES=192.168.1.57 # proxy host IP (here I have my NGINX proxy server on VM1)

Then you can reach the Nextcloud AIO - https://192.168.1.58:6789/

Then you can setup your subdomain/domain on NGINX as I have sent the screenshots above.

[ddxv]

Thanks! I really appreciate the patience. You finally helped me realize what was stated in the docs, but it hadn't clicked with me. I needed to do the setup in the order:

1. Certbot & Nginx setup
2. Visit https://192.168.1.58:8080/ in my browser to continue the setup

Somehow I had gotten it in my head I needed to complete the setup on https://my.domain.com, but I actually needed to be setting it up the first time on the local IP.

Just an FYI, in your docker setup above, at least on the latest version of NextCloud, you can simplify it by removing these variables, which I saw in the logs:

Creating docker group internally with id 988
The environmental variable APACHE_DISABLE_REWRITE_IP has been set which is not supported by AIO. Please remove it!
The environmental variable NEXTCLOUD_TRUSTED_DOMAINS has been set which is not supported by AIO. Please remove it!
The environmental variable TRUSTED_PROXIES has been set which is not supported by AIO. Please remove it!