Repository navigation
SSL Reverse Proxy support? #792
Description
I am running SSL Reverse Proxy (Traefik) in from of Nextcloud, but static content on context /core/ is loaded over http (mixed-content errors), other content is loaded OK.
I am aware of this https://docs.nextcloud.com/server/15/admin_manual/configuration_server/reverse_proxy_configuration.html#overwrite-parameters
,but there should be option in https://github.com/nextcloud/docker/blob/master/docker-entrypoint.sh to enable reverse proxy support.
I dont want to precreate file and volume for enabling SSL Reverse Proxy support.
Will be revamped #527 accepted?
Run
docker run -d \
--name nextcloud \
--network mynetwork \
--restart=unless-stopped \
--label "traefik.enable=true" \
--label "traefik.basic.frontend.rule=Host:nextcloud.example.com" \
--label "traefik.basic.port=80" \
--label "traefik.frontend.redirect.permanent=true" \
--label "traefik.frontend.redirect.regex=https://(.*)/.well-known/(card|cal)dav" \
--label "traefik.frontend.redirect.replacement=https://$$1/remote.php/dav/" \
-e POSTGRES_DB=nextcloud \
-e POSTGRES_HOST=nextcloud-postgres \
-e POSTGRES_PASSWORD=nextcloud \
-e POSTGRES_USER=postgres \
-e NEXTCLOUD_ADMIN_PASSWORD=admin \
-e NEXTCLOUD_ADMIN_USER=admin \
-e REDIS_HOST=nextcloud-redis \
-e NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.example.com \
nextcloud:latest
Workaround
docker exec -it -u www-data nextcloud bash -c './occ config:system:set overwriteprotocol --
value="https"'
Reacted by Felix Schwarz, kosssi and mr-bolle
Activity
Heracles31 commentedon Jul 1, 2019
Hey Luka,
Here is half a fix for you :
If you enable HSTS in your SSL proxy engine, clients will take note of it and will never call back your server over HTTP again. Even should they receive a link that says HTTP, they will rewrite it themselves to HTTPS and so will call you back on HTTPS.
It is only half a fix because the server keeps sending the HTTP links and a browser that would not obey HSTS would still go after HTTP. There is also a risk should your certificate turns to not trusted for any reason or you re-install the server and need to access it clear text first time to configure it. Your own browser will refuse to connect to it because of the HSTS violation.
Here, my complete solution is to have my config in a separate volume. Whenever I need to update, I just remount the volumes and the options survive the update. I do not use environment variables like you do. I have volumes for the configs, the website's root directory, the Apps and the themes. Of course, the data are also from an external path.
Hope this help you fix your problem,
lukasmrtvy commentedon Jul 1, 2019
Hello,
Thanks for info.
Btw, HSTS is easy to enable in Traefik with:
pnbecker commentedon Oct 14, 2019
HSTS seems to be ignored by the iOS and macOS app. I needed to set overweriteprotocol manually. I think #668 would be a good solution.