Add two parameters when Nextcloud is behind a proxy

[naramski]

Added support for params overwriteprotocol and overwritehost when Nextcloud is behind a proxy and fails to detect hostname and protocol.

(see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/reverse_proxy_configuration.html)

[marceljd]

I tried the same thing 2 days ago: you have to run the update.sh script before the commit, then the script will run and test the other images.

[naramski]

Thanks @marceljd it worked :)

[J0WI]

You can also just set some headers, e.g. in nginx:

proxy_set_header Host $host;proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto $scheme;

[J0WI]

@naramski does #527 (comment) work for you?

[naramski]

@J0WI well I don't use Nginx and I prefer to have a standalone configuration for the nextcloud container itself.

[naramski]

So I guess it work, but it doesn't solve my problem. I still think that adding the new parameters doesn't hurt.

[J0WI]

@naramski NC 12 is no longer supported, but NC 15 have been added. Could you rebase your changes?
@tilosp this addresses a bunch of (#401, #528, #577) reasonable use cases. Do you agree with the new ENVs?
https://github.com/docker-library/docs/blob/master/nextcloud/content.md needs to be updated afterwards.

[naramski]

@J0WI I tried to rebase, but it seems that I have messed something :(.

[J0WI]

Would you like to open a new, clean PR?

[tilosp]

looks sane to me 👍
@J0WI are you sure that this fixes #528?
I am not sure if nextcloud actually updates the apache config if you set the overwriteprotocol to https.

[J0WI]

I haven't verified this so far. It would be great to get some feedback from @jkaberg or @funkypenguin.

[pgera]

I had to manually add 'overwriteprotocol' => 'https' for a different issue (nextcloud/server#6767).

[marceljd]

I have investigated these issues and to solve these proxy related problems on a new standard Apache installation this should be added. I have tried this with my Traefik proxy, can anyone test this on Nginx?

First: in entrypoint.sh (this will resolve the .well-known errors). Edit: add conditional PROXY_IP, not to be used in other situations:

if [ -n "${PROXY_IP+x}" ]; then
sed -i "s/caldav /caldav https:\/\/%{SERVER_NAME}/" /var/www/html/.htaccess
sed -i "s/carddav /carddav https:\/\/%{SERVER_NAME}/" /var/www/html/.htaccess
sed -i "s/webfinger /webfinger https:\/\/%{SERVER_NAME}/" /var/www/html/.htaccess
fi

Second: add a new file proxy.config.php in the .config (no HTTPS error in Password app and get the real IP adresses instead of the proxy IP). This is faster and easier than with OCC commands.

<?php
if (getenv('PROXY_IP')) {
$CONFIG = array (
'trusted_proxies' => getenv('PROXY_IP'),
'overwriteprotocol' => 'https',
);
}

There will be one extra environment variable: PROXY_IP with the ip address of the proxy.

[marceljd]

Some more tests and some more conclusions:

Apache running on 443 / SSL
The root cause of many issues is that Apache is configured for http (port 80) only. Nextcloud is designed to run on https (SSL port 443) and all built in security checks are a kind of expecting that it runs on SSL, and it should. In my test-environment I could get rid of the .well-known and HSTS security warnings this way. Besides that the apps that require SSL (Password, don't know if there are others) will work without warnings. The solutions I provided before are fighting the symptoms, the root cause is the Apache configuration.

I will make a seperate PR for this.

Proxy IP
The second change is to introduce an environment variable PROXY_IP (or IP's, could be multiple). This will tell Nextcloud that there is a proxy active. NC will autodiscover and automatically set the hostname in the config.php file, and (not tested) probably the path if NC is installed in a subdirectory. NC will also see the real IP address of the request, for Traefik there is no extra configuration necessary.

'trusted_proxies' => array('203.0.113.45', '198.51.100.128'),

There is another enviroment variable that could tell NC what headers to expect, perhaps this is needed for Nginx or HAproxy. Traefik works without this setting.

'forwarded_for_headers' => array('HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'),

I will make a seperate PR for this too.

With both solutions the Apache versions should work out-of-the-box. I do think this needs some testing on different setups to be sure it works on all proxies and nothing breaks on existing installations.

[marceljd]

See #644 for the SSL on Apache PR. I will create the trusted proxy PR next week, with both of them in place the SSL and proxy related errors are gone.

[GuyPaddock]

I know that this PR is focused on a solution at application-level, but in case it's useful to anyone using NGinx we just implemented a fix for this issue. In our fix, NGinx switches to relying on a new variable that is based on the X-Forwarded-Proto header (if it is available).

Here's the relevant commit:
Inveniem/nextcloud-azure-aks@53c03d8

In our case, the proxy is the NGinx ingress controller for Kubernetes.

[bencomp]

I don't know if this is the best solution direction, but the Dockerfiles contain git conflicts which should not be accepted.

[bencomp]

This is a git conflict.

[bencomp]

This is a git conflict.

[bencomp]

This is a git conflict.

[GuyPaddock]

Following-up on my earlier comment, in my project, we now also have a solution for Apache-based Nextcloud that does not require environment variables to explicitly override the protocol and host.

Here's the Apache version:
Inveniem/nextcloud-azure-aks@d09ee0c#diff-754ac7f0be091966820161830749036fR35

[J0WI]

I'll close this in favor of #819