SSL Reverse Proxy support?

[lukasmrtvy]

I am running SSL Reverse Proxy (Traefik) in from of Nextcloud, but static content on context /core/ is loaded over http (mixed-content errors), other content is loaded OK.

I am aware of this https://docs.nextcloud.com/server/15/admin_manual/configuration_server/reverse_proxy_configuration.html#overwrite-parameters

,but there should be option in https://github.com/nextcloud/docker/blob/master/docker-entrypoint.sh to enable reverse proxy support.

I dont want to precreate file and volume for enabling SSL Reverse Proxy support.

Will be revamped #527 accepted?

Run

docker run -d \
--name nextcloud \
--network mynetwork \
--restart=unless-stopped \
--label "traefik.enable=true" \
--label "traefik.basic.frontend.rule=Host:nextcloud.example.com" \
--label "traefik.basic.port=80" \
--label "traefik.frontend.redirect.permanent=true" \
--label "traefik.frontend.redirect.regex=https://(.*)/.well-known/(card|cal)dav" \
--label "traefik.frontend.redirect.replacement=https://$$1/remote.php/dav/" \
-e POSTGRES_DB=nextcloud \
-e POSTGRES_HOST=nextcloud-postgres \
-e POSTGRES_PASSWORD=nextcloud \
-e POSTGRES_USER=postgres \
-e NEXTCLOUD_ADMIN_PASSWORD=admin \
-e NEXTCLOUD_ADMIN_USER=admin \
-e REDIS_HOST=nextcloud-redis \
-e NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.example.com \
nextcloud:latest

Workaround

docker exec -it -u www-data nextcloud bash -c './occ config:system:set overwriteprotocol --
value="https"'

[Heracles31]

Hey Luka,

Here is half a fix for you :
If you enable HSTS in your SSL proxy engine, clients will take note of it and will never call back your server over HTTP again. Even should they receive a link that says HTTP, they will rewrite it themselves to HTTPS and so will call you back on HTTPS.

It is only half a fix because the server keeps sending the HTTP links and a browser that would not obey HSTS would still go after HTTP. There is also a risk should your certificate turns to not trusted for any reason or you re-install the server and need to access it clear text first time to configure it. Your own browser will refuse to connect to it because of the HSTS violation.

Here, my complete solution is to have my config in a separate volume. Whenever I need to update, I just remount the volumes and the options survive the update. I do not use environment variables like you do. I have volumes for the configs, the website's root directory, the Apps and the themes. Of course, the data are also from an external path.

Hope this help you fix your problem,

[lukasmrtvy]

Hello,
Thanks for info.

Btw, HSTS is easy to enable in Traefik with:

--label "traefik.frontend.headers.customResponseHeaders=Strict-Transport-Security:15552000" \

[pnbecker]

HSTS seems to be ignored by the iOS and macOS app. I needed to set overweriteprotocol manually. I think #668 would be a good solution.