docker-compose examples for reverse proxies and other guides

[szaimen]

Since the configuration of AIO when using with a reverse proxy seems to be pretty complicated to understand, this thread is created to allow everyone to post their working docker-compose together with their reverse proxy configs. The general reverse proxy documentation is here: https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

Feel free to add your own working example to the thread!

Thanks everyone!

[szaimen]

In order to do a first start here, you can find a working caddy with docker-compose example here:
#575 (comment)

[apbarratt]

Hi guys,
I figured I'd talk through setup whilst it's fresh in my mind :)

So on my host machine, which for me is Ubuntu 20.04 and with Docker installed, I set up the following docker compose file in my home folder:

docker-compose.yml Read on before running this please ;)

version: "3"
services:
  nextcloud:
    container_name: nextcloud-aio-mastercontainer
    image: nextcloud/all-in-one:latest
    restart: always
    ports:
      - 8080:8080
    environment:
      - APACHE_PORT=11000
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
  nginx:
    container_name: nginx
    image: nginx:1.21.6
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      # - ./nginx:/etc/nginx
      - /etc/letsencrypt:/etc/letsencrypt

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

Now I need to draw your attention to the two volumes I've set up there. The first one is the nginx configuration folder, and it's commented out. Because unless you just so happen to have an nginx folder sitting on your host machine in the same folder as this file, nginx is just going to get upset by the lack of, well, anything to work with. We'll sort that in a second though, don't worry :)

The second one is the let's encrypt folder. This is where I have my SSL certificates that we absolutely need because reverse proxy mode requires a working SSL connection as it uses the address https://yourdomain.tld to connect.

_So if you're like me, and you don't have your own certificates (don't rely on cloudflare's ones!), let's get some installed. On your hostmachine, install the "certbot" to get yourself a letsencrypt certificate. To do that, follow the instructions for your setup here: https://certbot.eff.org/instructions

Once installed, just go ahead and run it, but let it know we're not actually all set up yet, so it doesn't need to try and install things for us, only give us our shiny new certificate :)
For me, that's sudo certbot certonly
Now you should have a nice new certificate. Assume you're using linux like me, it's probably been plonked inside /etc/letsencrypt/live/yourdomain.tld/blah blah names and things
If it's in a different location, go up and change that line in the docker compose file. Note that the left hand side is the location of letsencrypt on your host machine, so that's the side you should change.
Note also, and this is important, that you must bind the letsencrypt folder, not the live folder. It's a symlink. I won't get into it, but it's a pain in the arse._

Okay, so let's run it! Leave the nginx volume commented out, don't worry about that yet.
sudo docker up
If all runs well, you should see all those nice containers up and running without issue. If you're happy, hit [control]+[Z] to leave the process. Don't worry, the containers will stay running (unlike if you were to use [control]+[C], which would stop them).

Now then, we want to get that nginx folder out of the running container and onto our host machine. Let's do that!

sudo docker cp nginx:/etc/nginx ./nginx

Excellent! Now you can uncomment that volume line:
Change: # - ./nginx:/etc/nginx to just - ./nginx:/etc/nginx

And recreate the container by just running sudo docker up again. If you run sudo docker up -d you won't need to do [control]+[Z] to get out. But honestly, I prefer not to as I'm more likely to spot startup errors this way :)

Right then, now we can just configure nginx.

Open up your newly copied ./nginx/conf.d/default.conf file in your preferred text editor.

You can go ahead and edit this file into a reliable state, or if you prefer, just use what I've ended up on (for the time being):

./nginx/conf.d/default.conf

server {
    listen       80;
    server_name  localhost;
    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

server {
    listen      443 ssl;
    server_name cloud.barratt.scot;
    location / {
        proxy_pass http://192.168.8.3:11000; #the host ip address, localhost I assume would just come back to this docker container
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
    ssl_certificate /etc/letsencrypt/live/yourdomain.tld/fullchain.pem; # managed by certbot on host machine
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.tld/privkey.pem;
}

Note here that I've kept the default landing page on port 80, I just figured I wanted something there so I could check if the proxy was running etc.

I've also set the IP address for my host machine. For some reason I couldn't just use the host machine's host name, I'm not sure why. But make sure you change my 192.168.8.3 to whatever the correct IP is for your machine. (I'd recommend configuring your router to force the machine to always use the same IP address)

Note you'll also need to change yourdomain.tld to whatever domain your certbot certificate was made for :)

Now if you try to run the above, it'll fail with a message saying the variable named connection_upgrade does not exist.

So let's fix that by now editing the nginx.conf file that you will have copied as part of the rest of the folder.

./nginx/nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    

    keepalive_timeout  65;

    #gzip  on;

    ##
    # Connection header for WebSocket reverse proxy
    ##
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    include /etc/nginx/conf.d/*.conf;
}

The only thing I've changed here is to add the block near the end, the bit that says

    ##
    # Connection header for WebSocket reverse proxy
    ##
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

Now if you run sudo docker compose up you should see the nginx container recreate with the new stuff inside it as the new binding for the volume is linked up.
And if you were to just make changes to this config, you can just run sudo docker restart nginx instead.

Hopefully that should be you all sorted :)

I hope to tidy this up a bit so that less editing is involved as an out of the box solution would be nicer. I'm thinking I'll try and put the certbot part into a docker container of its own for instance as I do like the portability of docker. I also think there's probably a way to avoid using the IP address of the host machine.

[CXwudi]

I see, that is what you mean by don't use docker label. I got confused for a second there. Sorrt for bothering

[Klaus15]

Hi,
in additon to the great explanation of @apbarratt I think it would make sense to update the nginx documentation section in reverse.md with this information:

---

Add this to your nginx site config:

location / {
        proxy_pass http://localhost:11000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

and this to the http{...}-section in your nginx.conf:

    ##
    # Connection header for WebSocket reverse proxy
    ##
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

(otherwise nginx will fail to start with a message saying the variable named connection_upgrade does not exist)

---

I've tested this with a fresh nginx 1.18 install on ubuntu 22.04. The $connection_upgrade block is not existent on a vanilla setup. So the location example above will definitely fail without the additional setting in nginx.conf.
Maybe that helps others to get the environment up and running even faster :)

[szaimen]

Sounds good to me! Can you edit the file and submit a Pull Request?

[sfoduntan]

Hi @szaimen and @apbarratt
I'm getting this error trying to enter the domain name while on the sudo certbot certonly step:

Requesting a certificate for yourdomain.tld


Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
  Domain: yourdomain.tld
  Type:   dns
  Detail: DNS problem: NXDOMAIN looking up A for yourdomain.tld - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for yourdomain.tld - check that a DNS record exists for this domain

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

Is there any mistake I am making or any thing I need to bypass this problem as I haven't run my compose file until I have received certification?

P.S. I'm hosting this on Ubuntu 24.04 LTS (desktop) if anyone's wondering

[4lexRed]

A)
You are trying to register a certificate for "yourdomain.tld" - which probably is not the name for your nextcloud service.
Most of the time its a subdomain alike "nextcloud.my-domain.com".

So I guess you decide first on your domain / subdomain, and forward that DNS record to your IP address.
Ask your hoster on how to do these tasks (this is not the right forum to help with these tasks).

B)
It depends on what you full setup looks like (vserver with a reverse proxy // real server at a fixed IP addres), when you need your certificate and how you handle the generation.

In my case, the NPM (nginx proxy manager) handles the certificate generation and refreshment

[Tom61]

NGINX PROXY MANAGER

I'm not familiar with this, but I read some HowTo's and put this together.

UPDATE:
Tested in the meantime (only IPv4):

• Synchronization of files and directories
• Synchronization of calendars and contacts
• OnlyOffice
• Collabora
• Talk

Everything works as expected :)

The AIO interface can only be reached locally at https://localhost:8080 (therefore only ports 80 and 443 need to be opened on the router/firewall).
The browser will show a security warning for https://localhost:8080. This is due to the self-signed certificate that is automatically generated during installation. A special permit can then be granted for this.

docker-compose.yml

version: "3.8"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
services:
  nginx_proxy_manager:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    container_name: nginx-proxy-manager
    network_mode: host
    environment: # Uncomment this if IPv6 is not enabled on your host
      - DISABLE_IPV6=true # Uncomment this if IPv6 is not enabled on your host
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
  nextcloud:
    image: nextcloud/all-in-one:latest
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    depends_on:
      - nginx_proxy_manager
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080
    environment:
      - APACHE_PORT=11000

Set your domain and the proxy host IP @ the last two lines

Nginx Proxy Manager settings:

The domain name has to be adapted to your OWN Nextcloud domain !!!
Set the IP to proxy host and Forward Port to 11000.
Check: 'Block Common Exploits' and 'Websockets Support'
DO NOT CHECK: 'Cache Assets'

Here is nothing to do :)

Here set your OWN Email Address for LetEncrypt

Here is nothing to do :)

That's all. Good luck. I hope it works.

[xnubil]

, this IP can change if container recreated (e.g. after an upgrade by Watchtower)

set your ip address for the service in docker-compose to prevent new IP addresses

networks:
  default:
    driver: bridge
  npm_proxy:
    name: npm_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.89.0/24
services:
 npm:
    container_name: nginx-proxy-manager
    image: 'jc21/nginx-proxy-manager:latest'
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.254 # You can specify a static IP
      nextcloud-aio:
    ports:
      - '80:80'
      - '443:443' 
      - '81:81' # Admin Web Port  Internal Home Network Access only - 192.168.89.254:81.
    volumes:
      - $DOCKERDIR/appdata/npm/config:/config
      - $DOCKERDIR/appdata/npm/letsencrypt:/etc/letsencrypt
      - $DOCKERDIR/appdata/npm/data:/data
    environment:
      DB_SQLITE_FILE: "/config/database.sqlite"
      DISABLE_IPV6: 'true'

[Zoey2936]

, this IP can change if container recreated (e.g. after an upgrade by Watchtower)

set your ip address for the service in docker-compose to prevent new IP addresses

networks:
  default:
    driver: bridge
  npm_proxy:
    name: npm_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.89.0/24
services:
 npm:
    container_name: nginx-proxy-manager
    image: 'jc21/nginx-proxy-manager:latest'
    networks:
      npm_proxy:
        ipv4_address: 192.168.89.254 # You can specify a static IP
      nextcloud-aio:
    ports:
      - '80:80'
      - '443:443' 
      - '81:81' # Admin Web Port  Internal Home Network Access only - 192.168.89.254:81.
    volumes:
      - $DOCKERDIR/appdata/npm/config:/config
      - $DOCKERDIR/appdata/npm/letsencrypt:/etc/letsencrypt
      - $DOCKERDIR/appdata/npm/data:/data
    environment:
      DB_SQLITE_FILE: "/config/database.sqlite"
      DISABLE_IPV6: 'true'

the aio container can't have a static ip

[mitohund]

EDIT / QUESTION: why is my below code rendered all in one line?

---

Hey @Shurov, I do not use IP addresses at all, but container names instead, which remain unchanged when the container is recreated.

You need these bits in your Nginx Proxy Manager docker compose:

networks:
  nextcloud-aio:
    external: true
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy-manager
    networks:
      - nextcloud-aio

And in your NPM you do this:

[Shurov]

Thanks for the tips. I've fixed docker-compose.yml:

networks:
  nextcloud-aio:
    external: true

services:
  app:
    image: jc21/nginx-proxy-manager:latest
    ...
    networks: 
      - nextcloud-aio

Now NPM is registered within NC-AIO network:

same as NC-AIO itself:

I've also pointed NPM NC host destination to http://nextcloud-aio-apache:11000, but it's still not reachable - now I'm getting HTTP 301 NS_ERROR_REDIRECT_LOOP.

Within NC docker-compose env config I have both APACHE options uncommented:

  - APACHE_PORT=11000
  - APACHE_IP_BINDING=127.0.0.1

(with APACHE_IP_BINDING commented out, also getting redirect loop)
............
BTW, @mitohund, to have multiline code block you need to wrap it into tripple quotes (I mean, single quote x3) ``` instead of a single ones.
............
UPDATE:
I realised that NPM SSL setting were causing redirects...
So the maximum security options that can be kept on are:

(the SSL certificate is created and used, it's just I removed it to hide my domain name for the screenshot)
When all toggles are off - NC is also working. But whenever I turn Force SSL on, I get HTTP 301 and can't reach it.

[mitohund]

First off, thanks for the hint about the triple ```.

As for your issue, is your network_mode set to host? Your IPs look like host IPs, don't they? Mine is set to bridge.

For reference, here are my NPM SSL settings:

[NiciTheNici]

Hello everyone, after many hours of trial and error i managed to get my own reverse proxy running.

Reverse Proxy: Caddy
Domain Provider(?): NameCheap
Hardware: Old Lenovo thinkpad Tower PC
Operating System: Arch Linux

Heres my own step by step guide:

1. Set up DDNS (Dynamic DNS)

Check if your router itself has a DDNS setting and set it through that.

Otherwise there are other ways to do the same thing, that I will not cover here. I suggest referring to the Arch wiki

2. NameCheap

1. Point your owned domain to the DDNS created in the previous section (green)
2. Create subdomain (orange/blue)

3. FORWARD PORTS!!

Man I'm kind of embarrassed of how long this took me. Needless to say, make sure to forward ports 80 and 443 that point to your local servers respective 80 and 443 ports

4. Set up Caddy

1. Install caddy via sudo pacman -Sy caddy
2. Update the caddyfile at /etc/caddy/Caddyfile with:

nextcloud.yournewsubdomain.com:443 {
    reverse_proxy localhost:11000
}

3. Enable and start caddy service

sudo systemctl enable caddy
sudo systemctl start caddy

5. Install the nextcloud docker

# For x64 CPUs:
sudo docker run -it \
--name nextcloud-aio-mastercontainer \
--restart always \
-p 8080:8080 \
-e APACHE_PORT=11000 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
nextcloud/all-in-one:latest

6. Nextcloud AIO setup

After the initial startup, you should be able to open the Nextcloud AIO Interface now on port 8080 of this server.
E.g. https://ip.address.of.this.server:8080

7. Docker-compose

...I havent actually implemented it yet but will update this section if i eventually do (although everything is working flawlessly on my system as of now)

Questions

• What about the "Talk container" ports? Im not sure how to use them in conjunction with this reverse proxy I just set up. They are just open ports for now and I havent tested their functionallity yet.

Final words

This sure was a journey! I learned an incredible amount about networking, DNS, ports and so much more stuff that will no doubt be handy at some point in the future. Thank you so much for making all of this possible <3

[woetenwondla]

How to setup Nextcloud AIO Dockerimage with self signed certificates and Caddy for LAN only

Before you follow this setup, be aware that self signed certificates are not supported and it will probably cause problems for certain components. As I didn't know this, when setting it up myself I tried it out anyway and got it to work. For now most things seem to work, but I also didn't properly test it out.

1. Setup a DNS

---

I used Dnsmasq for it, but it shouldn't make a difference. The only important thing is, that you set a domain that is resolved to the host, the reverseproxy is running on. Make also sure that your machines are using then this dns server throughout the network for resolving the domain, by setting the ip of the nameserver per machine or in your router settings.

2. Install Caddy and set it up as reverseproxy

---

I installed it directly on my machine, because in the readme this was recommended, otherwise you needed some extra steps. Look here for further info: https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md (you can edit the Caddyfile then in /etc/caddy/Caddyfile and reload caddy)
The important part here is to add tls internal to the Caddyfile, so it automatically creates a self signed certificate:

https://<your-nc-domain>:443 {
    tls internal
    reverse_proxy localhost:11000 
}

Enable it and start it and then it should be ready to go.

3. Install the Nextcloud AIO Image

---

Then you can install the Nextcloud AIO Image with the following command:
docker run -d --name nextcloud-aio-mastercontainer --restart always -p 8080:8080 -e APACHE_PORT=11000 -e APACHE_IP_BINDING=127.0.0.1 -e SKIP_DOMAIN_VALIDATION=true --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config --volume /var/run/docker.sock:/var/run/docker.sock:ro nextcloud/all-in-one:latest
Here it is important to put -e SKIP_DOMAIN_VALIDATION=true, because it is a self signed certificate and there exists no real domain in the internet. The -e APACHE_IP_BINDING=127.0.0.1 is optional and should only be set if your reverseproxy is installed on the same machine.
Login in now at https://ip.address.of.the.host:8080 and put in your domain afterwards, when it asks for it. Then it should work out and you should be able to continue with the setup.

Hope this helped and have fun!

[mrtargaryen]

Just want to say thank you for posting this. I followed what you wrote and successfully got Nextcloud AIO running locally.

[brccabral]

Thank you, SKIP_DOMAIN_VALIDATION=true worked, but I also set docker to check my local DNS through my LAN IP and through the docker bridge IP.
/etc/docker/daemon.json

{
  "dns": ["192.168.0.12", "172.17.0.1"]
}

[9qUmV4]

Docker in Docker Setup for nextcloud AIO

Hi everyone,

I build a setup to run nextcloud AIO in a docker in docker setup (dind). This has some benefits, but also drawbacks. Please familiarize yourself with docker in docker first.

This is not a complete reverse proxy guide. Instead I want to provide a different way besides the official. Use it and experiment yourself with it. Please share your own changes, thoughts, improvments below this tweet. I would like to hear about them and improve this setup.

1 Advantages and disadvantages

Advantages

• You can use port mappings and networks (no need to expose the apache port to the host)
• You can run multiple instances of nextcloud AIO in one docker environment (Alternative to running in VMs or docker rootless)
• Backups can be saved into named volumes. (Which brings its own drawbacks, make shure they are save.)

Disadvantages

• Docker in Docker is not a recommended usecase of docker. Tools like sysbox are better for that.
• Running docker in docker grants the container running docker daemon root privileges on the host.
• If you not carefull, you can easily delete your data, so make shure you know what you do.

-> If there is another way for you to run nextcloud, use the other way instead and use dind only if you have to.

2 HOW TO

The goal is to run a docker daemon in a docker container on the host and use another container to start a docker compose specifing docker-aio-mastercontainer on this dockerized daemon. So we need two docker-compose files.

projectDir
   + docker-compose.yml
   + docker-compose.inside.yml

docker-compose.yml

version: '3.9'

services:
  docker:
    image: docker:dind # Using daemon version
    restart: unless-stopped
    privileged: true  # Necessary to run docker in docker THIS CONTAINER HAS HOST ROOT PRIVILAGES
    ports:
      - 8080:8080 # Nextcloud AIO admin panel
      # Uncommend to expose ports on host instead of using an external network for reverse proxy
      # - 11000:11000 # Web port
      # - 3478:3478   # Nextcloud Talk port
    environment:
      - DOCKER_TLS_CERTDIR=/certs
    volumes:
      - certs-client:/certs/client
      - certs:/certs
      - docker-data:/var/lib/docker
      #   - /mnt/backup:/mnt/backup # Mount backup to where you want
    networks:
      - default
      - net

  aiorunner:
    image: docker:latest # Using cli version
    restart: unless-stopped
    depends_on:
      - docker
    volumes:
      - certs-client:/certs/client:ro
      - ./docker-compose.inside.yml:/compose/docker-compose.yml:ro
    networks:
      - default
    environment:
      - DOCKER_HOST=tcp://docker:2376
      - DOCKER_TLS_CERTDIR=/certs
    command: [
      "docker", "compose", "-f", "/compose/docker-compose.yml", "up",
      "--exit-code-from", "nextcloud",
      "--quiet-pull",
      "--no-log-prefix",
      "--no-recreate",
    ]


volumes:
  certs-client:    # Volume to mount docker daemon tls certificates into aiorunner
  certs:              # Persist privat keys
  docker-data:  # Persist all data

networks:
  net:
    # In this network the services for the reverse proxy are exposed.
    external: true

docker-compose.inside.yml

version: "3.9"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed

services:
  nextcloud:
    image: nextcloud/all-in-one:latest
    restart: "no"
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080 # admin web interface
    environment:
      - APACHE_PORT=11000
      - TALK_PORT=3478
      # - NEXTCLOUD_MOUNT=/mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
      # - DISABLE_BACKUP_SECTION=true # Setting this to true allows to hide the backup section in the AIO interface.
      # - NEXTCLOUD_UPLOAD_LIMIT=10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
      # - NEXTCLOUD_MAX_TIME=3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
      # - NEXTCLOUD_MEMORY_LIMIT=512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
      # - NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defiend-certification-authorities-ca
      # - COLLABORA_SECCOMP_DISABLED=false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
      # - NEXTCLOUD_STARTUP_APPS=twofactor_totp deck tasks calendar contacts apporder # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
      # - NEXTCLOUD_ADDITIONAL_APKS=imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-packets-permanently-to-the-nextcloud-container
      # - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container

Please note that Im using a reverse proxy configured in another docker compose file and an "global" network net to connect the reverse proxy to the services. This is not necessary; change it if you like.

3 Testing

I tested basic things. If you find something that is not working, let me know.

[WeiChihChern]

Interesting, thanks for sharing

[martin-77]

OK, This is a really nice project - after running nextcloud in different VMs and lxc and several problems with nextcloud talk (high performance backend is not the best experience when we talk about installation. however - here a liite walkthrough - maybe some things are missing.

The whole installation is running on an oracle free tier - config: 4 arm64 cores, 24GB, 200GB
Installed standard ubuntu + docker via curl command.

Next steps are installing portainer and nginx proxy manager

Important on the Oracle Cloud: you need to add ingress rules for your virtual network - as a minimal config I think 11000,80,81,443,3478,8000,8080,9000,9443 could be enough - I´m not shure, but these ports should be enough.

And the docker-compose.yml files:

NGINX proxy Manager

version: "3"
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
      # Add any other Stream port you want to expose
      # - '21:21' # FTP

    # Uncomment the next line if you uncomment anything in the section
    # environment:
      # Uncomment this if you want to change the location of 
      # the SQLite DB file within the container
      # DB_SQLITE_FILE: "/data/database.sqlite"

      # Uncomment this if IPv6 is not enabled on your host
      # DISABLE_IPV6: 'true'

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
      - `/var/run/docker.sock:/tmp/docker.sock:ro

Nextcloud AIO

version: "3.8"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed

services:
  nextcloud:
    image: nextcloud/all-in-one:latest-arm64 # Must be changed to 'nextcloud/all-in-one:latest-arm64' when used with an arm64 CPU
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation
    ports:
      # - 8111:80 # Can be removed when running behind a reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - 8088:8080
      # - 4443:8443 # Can be removed when running behind a reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    environment:
# Is needed when using any of the options below
       - APACHE_PORT=11000 # Is needed when running behind a reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # - APACHE_IP_BINDING=127.0.0.1 # Should be set when running behind a reverse proxy that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      # - TALK_PORT=3478 # This allows to adjust the port that the talk container is using.
      # - NEXTCLOUD_DATADIR=/mnt/ncdata # Allows to set the host directory for Nextcloud's datadir. See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
      # - NEXTCLOUD_MOUNT=/mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
       - DOCKER_SOCKET_PATH=/var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail.
      # - DISABLE_BACKUP_SECTION=true # Setting this to true allows to hide the backup section in the AIO interface.
       - NEXTCLOUD_UPLOAD_LIMIT=10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
      # - NEXTCLOUD_MAX_TIME=3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
       - NEXTCLOUD_MEMORY_LIMIT=2048M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
      # - NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-u>
      # - COLLABORA_SECCOMP_DISABLED=false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
      # - NEXTCLOUD_STARTUP_APPS=deck tasks calendar contacts apporder # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-ap>
      # - NEXTCLOUD_ADDITIONAL_APKS=imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/a>
      # - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nex>
      # - SKIP_DOMAIN_VALIDATION=true
  # # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
  # # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588
#  caddy:
#     image: caddy:alpine
#     restart: always
#     container_name: caddy
#     volumes:
#       - ./Caddyfile:/etc/caddy/Caddyfile
#       - ./certs:/certs
#       - ./config:/config
#       - ./data:/data
#       - ./sites:/srv
#     network_mode: "host"

[szaimen]

Thanks for sharing but please remove the lines below from your docker-compose ay they are not used and not needed.

        - APACHE_DISABLE_REWRITE_IP=1
        - NEXTCLOUD_TrUSTED_DOMAINS=domain.external.com externalIPfromOracle
        - TRUSTED_PROXIES=externalIPfromOracle

[martin-77]

Thanks for your reply!
Tried without these entries before, but without these lines, the domain-check failed.
Maybe I'll try again in future. I'm not sure, if these lines are needed in the oracle environment.

Not used means, they are not the base for the domain-check and the entries in the config.php?

[szaimen]

These values are not used by the mastercontainer so they should be removed! You probably misconfigured something else then.

[martin-77]

tried removing the lines and restarted by docker compose up -d --force-recreate - seems to work.
Will try to setup a clean instance in future (maybe with the release of aio hub3?).
Depends on available time, but I´ll try to write a guide how to setup Nextcloud aio on the oracle free tier.

Thanks for your correction und your incredible work!

Question: do you have a guide how to setup the talk high performance backend - preferred by single docker compose?

Thanks for your correction und your incredible work!

[szaimen]

Question: do you have a guide how to setup the talk high performance backend - preferred by single docker compose?

I suppose you could have a look at this for an example https://github.com/nextcloud/all-in-one/tree/main/manual-install. However you need to follow the mentioned update routine also for that.

[szaimen]

Here is a working version for docker-desktop on Windows with caddy as reverse proxy:
https://caddy.community/t/timeout-during-connect-likely-firewall-problem/18680/4

[oleksii-honchar]

Hi there! When I first encountered Nextcloud a couple of months ago, I found that it required a lot of manual configuration to get it up and running (I'm using Mac). Additionally, my current ISP setup(no NAT-loopback) and lack of a static public IP make it quite challenging to use, especially inside my local network with mobile app. After checking of AIO configuration options and failed to find one which will solve my case I decided to write my own solution. So, in the following config I'm using Nginx-Reversy-Proxy (NRP) with automatic server configuration and a lot of other features. AIO config pretty simple and follows official documentation:

version: '3.8'
services:
  nrp:
    env_file:
      - project.env
    environment:
      - TZ=Europe/Madrid
    image: tuiteraz/nginx-reverse-proxy:0.5.0
    restart: unless-stopped
    container_name: nrp
    ports:
      - 80:80
      - 443:443
      - 3128:3128
    volumes:
      - ./nrp.yaml:/etc/nrp.yaml
      - letsencrypt:/etc/letsencrypt
      - /etc/localtime:/etc/localtime:ro
    networks:
      nextcloud:
    cap_add:
      - NET_ADMIN
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

  nextcloud-aio-mastercontainer:
    env_file:
      - project.env
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer 
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config 
      - /var/run/docker.sock:/var/run/docker.sock:ro 
    ports:
      - 8080:8080
    environment: 
      - APACHE_PORT=${NEXTCLOUD_PORT} 
      - APACHE_IP_BINDING=0.0.0.0
      - SKIP_DOMAIN_VALIDATION=true 
    networks:
      nextcloud:
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

networks:
  nextcloud:
    driver: bridge

volumes:
  letsencrypt:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer 

In addition, simple nrp.yaml used to tell NRP which service to proxy to:

public-ip:
  checkAndUpdate: yes
  schedule: 1h
  dryRun: no
letsencrypt:
  email: $CERTBOT_CONTACT_EMAIL
services:
- name: nextcloud
  serviceIp: $NEXTCLOUD_IP
  servicePort: $NEXTCLOUD_PORT
  domainName: $NEXTCLOUD_DOMAIN
  domainRegistrant: route53

Working example can be found here
I hope it can help somebody :-)

[wgnr]

I have been struggling with the config and here it's my docker-compose file

version: '3.8'

volumes:
  # other volumes ...
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

networks:
  # other networks ...
  nextcloud-aio:
    name: nextcloud-aio # This line is not allowed to be changed as otherwise the created network will not be used by the other containers of AIO
    driver: bridge
    enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: fd12:3456:789a:2::/64 # IPv6 subnet to use

services:
  # other services ...

  nginx:
    container_name: iagnosis-server
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - iagnosis-server-data:/data
      - iagnosis-server-letsencrypt:/etc/letsencrypt
    healthcheck:
      test: [ "CMD", "/bin/check-health" ]
      interval: 10s
      timeout: 3s
    networks:
      - nextcloud-aio
      # other networks ...

  nextcloud-aio-mastercontainer:
    profiles:
      - nextcloud
    image: nextcloud/all-in-one:latest
    init: true
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    ports:
      - 8080:8080
    environment:
      - AIO_DISABLE_BACKUP_SECTION=false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
      - APACHE_PORT=11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - APACHE_IP_BINDING=0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    networks:
      - nextcloud-aio
    depends_on:
      - nginx

And this my nginx proxy manager config:

nextcloud-aio-apache

client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;

I hope you all find this useful 🙂 thanks for this great project!!

[sharky98]

Knowing that NextCloud AIO create the nextcloud-aio network, even though it is not documented is the saving cue! I would have preferred that the containers to be added to my nginx network, but eh! can't have everything!

[livethisdream]

I wrestled with this for a long time. Full details are on my github repo, but here's the short version.

Setup

• Mac Mini (late 2014) with/ OS X Catalina w/ Docker Desktop v4.15
• Cloudflare DNS (A record, proxied)
• Nextcloud-AIO behind a Caddy reverse proxy (v2, alpine)

docker-compose

version: "3.8"
# filename: nc-aio-caddy.yml
# run with: docker-compose -f nc-aio-caddy.yml up --force-recreate
# specifically made for Mac OS X Catalina
services:
  caddy:
    image: caddy:cloudflaredns # see below for how to build this image
    restart: unless-stopped
    container_name: caddy
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./certs:/certs # prob not required
      - ./config:/config # prob not required
      - ./data:/data # prob not required
      - ./sites:/srv # prob not required
    ports:
      - "443:443"
      - "80:80"    # oh, it hurts! probably not needed, but caddy will redirect to https
    #network_mode: "host" # incompatible with mac os x docker desktop, blocks 443

  nextcloud:
    image: nextcloud/all-in-one:latest
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    ports:
      - "8080:8080"
      - "3478:3478"
      - "8443:8443"
    environment:
      - APACHE_PORT=11001 # because ¯\_(ツ)_/¯
      - APACHE_IP_BINDING=0.0.0.0
      #- SKIP_DOMAIN_VALIDATION=true # I really tried not to use this
      - NEXTCLOUD_DATADIR=/Volumes/Nextcloud/Nextcloud-AIO
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock.raw:/var/run/docker.sock:ro

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

Caddyfile

{
       email [email protected] # fill in your email
}

https://nextcloud.mydomain.net:443 {
	tls {
		dns cloudflare <APIKEY> # get your API KEY from Cloudflare
	}
	header Strict-Transport-Security max-age=31536000;
	reverse_proxy host.docker.internal:11001. # instead of network_mode: "host" in docker-compose
}

Caddy container w/ Cloudflare DNS

# this will build a caddy container containing the Cloudflare DNS plugin. 
# build with: docker build -f caddyDockerfile -t caddy:cloudflaredns .

FROM caddy:2-builder-alpine AS builder

RUN xcaddy build \
    --with github.com/caddy-dns/cloudflare

FROM caddy:2-alpine

RUN apk add curl
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

I hope this helps someone. Someday, I'll reimage this thing to Ubuntu and that should significantly reduce the pain in my life.

[jaajuu]

I was basically trying to follow the instructions by Tom61 above, but failed so many times until I finally got it working with help of few other resources on the web that I found after digging around long enough. My setup is the following:

• WS2019 on bare metal
• Ubuntu 22.04 VM on hyper-v
• Docker running in ubuntu.

So what I had to do were pretty much like this:

1. Setup a duckDNS to point to my public IP
2. Install npm and nextcloud with the following docker-compose.yml:

version: "3.8"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
services:
  nginx_proxy_manager:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    container_name: nginx-proxy-manager
    network_mode: host
    environment: # Uncomment this if IPv6 is not enabled on your host
      - DISABLE_IPV6=true # Uncomment this if IPv6 is not enabled on your host
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
  nextcloud:
    image: nextcloud/all-in-one:latest
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    depends_on:
      - nginx_proxy_manager
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080
    environment:
      - APACHE_PORT=11000
      - APACHE_DISABLE_REWRITE_IP=1
      - NEXTCLOUD_TRUSTED_DOMAINS=example.duckdns.org 192.168.1.11 # Your domain name + proxy host IP
      - TRUSTED_PROXIES=192.168.1.11 # proxy host IP

3. Change /etc/hostname:

example.duckdns.org

4. Change /etc/hosts:
   127.0.0.1 localhost
   192.168.1.11 example.duckdns.org example

5. Setup npm like in the above with example.duckdns.com on the domain name and ip as 192.168.1.11, but I had to use DNS challenge.

6. Open/fwd ports 80, 443, 3478, 8080 & 8443 on my route(s).

and that's it.

I'll be using it locally only so I guess I'll remove the port forwarding completely.

Just though I'd post this here for a "review" if what I have done is more or less okay and hopefully it could be help full for others too.

[jaajuu]

I think I have come across few, while looking other problems. Quickly googling found this : https://pakstech.com/blog/nextcloud-cloudflare-tunnel/ <https://pakstech.com/blog/nextcloud-cloudflare-tunnel/>

…

On 1. Feb 2024, at 4.18, MrTargaryen ***@***.***> wrote: Are there any examples using Cloudflare Tunnel? — Reply to this email directly, view it on GitHub <#588 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AW3OHFZDXTD5FNP4Q2UZHYDYRLUNHAVCNFSM5VHXZS72U5DIOJSWCZC7NNSXTOKENFZWG5LTONUW63SDN5WW2ZLOOQ5TQMZSHE2DAMA>. You are receiving this because you commented.

[maxhambraeus]

Here's my working config for nginx-proxy-manager, after struggling for a bit:

services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    depends_on:
      - nginx_proxy_manager
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    ports:
      - 8080:8080
    environment: # Is needed when using any of the options below
      - APACHE_PORT=11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - APACHE_IP_BINDING=127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - NEXTCLOUD_DATADIR=/mnt/nextclouddata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
      - NEXTCLOUD_ADDITIONAL_APKS=imagemagick exiftool # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
     
  nginx_proxy_manager:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    network_mode: host


volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work

[4lexRed]

As I had quite a struggle with NPM forwarding and Nextcloud AIO - I eventually extended my question post with the experience I made and made a guide with a breakdown of the steps necessary to the get NPM forwarding the right ports at the right time to the containers that are created during the setup of Nextcloud AIO.

The breakdown includes a working compose file.

Here is the link to the post on Github.
Hope it helps anyone who also struggles with the setup of NPM.

• TLDR - Short answer for exposed hosts running NPM:
  configure NPM to forward "nextcloud.yourhost.com" to port 11000 on the public ip address(111.222.33.44)

[Snuupy]

For https://github.com/linuxserver/docker-swag, I was not happy to use the host IP as it should use docker internal networking.

However, swag does not support host.docker.internal

Instead. to make swag work, do the following:

• bypass the url check
• in docker-swag/config/nginx/proxy-confs/nextcloud.subdomain.conf, your proxy_pass should be: proxy_pass $upstream_proto://nextcloud-aio-apache:11000$request_uri;
• in your swag docker-compose.yml:
  • add a line under networks: with nextcloud-aio
  • and at the end, add:

  •   nextcloud-aio:
        external: true
    

for nextcloud.subdomain.conf in config/nginx/proxy-confs:

# Connection header for WebSocket reverse proxy

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name nextcloud.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/resolver.conf;
        set $upstream_app nextcloud;
        set $upstream_port 443;
        set $upstream_proto http;

        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Proxy "";
        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Disable proxy buffering
        proxy_buffering off;
        proxy_pass $upstream_proto://nextcloud-aio-apache:11000$request_uri;
    }
}

[alamoudimoh]

Since the configuration of AIO when using with a reverse proxy seems to be pretty complicated to understand, this thread is created to allow everyone to post their working docker-compose together with their reverse proxy configs. The general reverse proxy documentation is here: https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

Feel free to add your own working example to the thread!

Thanks everyone!

apologies if i am bringing something that is already answered, but i spent the last 11 hrs till i got AIO to work with cloudflare zero trust and the whole thing was just to set the port in cloudflare to 11000, i will do some write ups which could be used.

my question is:
now everything works perfectly through internet. my publich domain xxx.me.public
can i have a way to make it work locally using xxx.me.home for example?

i tried to the ip address with port 8080 but i get the following:

Nextcloud AIO Login
The login is blocked since Nextcloud is running.

my docker run is as follows:

sudo docker run \
--init \
--sig-proxy=false \
--name nextcloud-aio-mastercontainer \
--restart always \
--publish 8080:8080 \
--env APACHE_PORT=11000 \
--env APACHE_IP_BINDING=0.0.0.0 \
--env SKIP_DOMAIN_VALIDATION=true \
--env NEXTCLOUD_DATADIR="/Pool-Storage/NextCloud/data" \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
nextcloud/all-in-one:latest

[szaimen]

See https://github.com/nextcloud/all-in-one#how-can-i-access-nextcloud-locally

[alamoudimoh]

See https://github.com/nextcloud/all-in-one#how-can-i-access-nextcloud-locally

Thanks. I was away for a while

I tried to set up at the initial setup i used the public url that i set at CloudFlare.

And then i did in NPM the local url, however when i access the local url as soon as i login it redirected me to the public url

[mrchilliballs]

My Config and Setup

I got Nextcloud running on an Ubuntu 22.04 Oracle Cloud Free instance behind Cloudflare (with HSTS enabled), using their SSL certificates generated with certbot and the dns_cloudflare plugin. I'm also using firewalld instead of ufw for my firewall; remember to also add all the IPs to the ingress rules if you're on Oracle.
nextcloud.conf:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    # listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      # for nginx versions below v1.25.1
    # listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6

    # listen 443 ssl;      # for nginx v1.25.1+
    # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6

    # http2 on;                                 # uncomment to enable HTTP/2        - supported on nginx v1.25.1+
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
    # listen [::]:443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6

    server_name <your-nc-domain>;

    location / {
        proxy_pass http://127.0.0.1:11000$request_uri;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_set_header Host $host;
    
        client_body_buffer_size 512k;
        proxy_read_timeout 86400s;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine, 
    # the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain. 
    # In this case the subdomain should already be secured without additional actions
    ssl_certificate /etc/letsencrypt/live/<your-nc-domain>/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /etc/letsencrypt/live/<your-nc-domain>/privkey.pem; # managed by certbot on host machine

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers on;

    # Optional settings:

    # OCSP stapling
    # ssl_stapling on;
    # ssl_stapling_verify on;
    # ssl_trusted_certificate /etc/letsencrypt/live/<your-nc-domain>/chain.pem;

    # replace with the IP address of your resolver
    # resolver 127.0.0.1; # needed for oscp stapling: e.g. use 94.140.15.15 for adguard / 1.1.1.1 for cloudflared or 8.8.8.8 for google - you can use the same nameserver as listed in your /etc/resolv.conf file
}

server { 
   listen 8443 ssl; 
   server_name <your-nc-domain>; 

   ssl_certificate /etc/letsencrypt/live/<your-nc-domain>/fullchain.pem;   # managed by certbot on host machine 
   ssl_certificate_key /etc/letsencrypt/live/<your-nc-domain>t/privkey.pem; # managed by certbot on host machine 
    
   location / { 
       proxy_pass https://localhost:8080; 
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  

       proxy_set_header X-Forwarded-Proto https;

       proxy_ssl_session_reuse on;
       proxy_ssl_verify off;
   }
}

• Notice that if you look at the end of the file, you can see the extra section I added for the AIO panel to function with SSL.

My docker install script is pretty standard with the only addition being the --env SKIP_DOMAIN_VALIDATION=true flag. The AIO panel wouldn't work if I had the --network host flag, so maybe don't use that.

sudo docker run --init --sig-proxy=false --name nextcloud-aio-mastercontainer --restart always --publish 8080:8080 --env APACHE_PORT=11000 --env APACHE_IP_BINDING=0.0.0.0 --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config --volume /var/run/docker.sock:/var/run/docker.sock:ro --env SKIP_DOMAIN_VALIDATION=true nextcloud/all-in-one:latest

A Suggestion

I'd like to address something that could be improved on the docs. The section "get a valid certificate for the AIO interface" only has an example config for Caddy, and although I'm sure someone decently proficient with Nginx or their reverse proxy could write an equivalent configuration, but it would be nice to have it organized something like the section "Configure the reverse proxy" with dropdowns and such.
Here's the section of my config file that matters:

server { 
   listen 8443 ssl; 
   server_name <your-nc-domain>; 

   ssl_certificate /etc/letsencrypt/live/<your-nc-domain>/fullchain.pem;   # managed by certbot on host machine 
   ssl_certificate_key /etc/letsencrypt/live/<your-nc-domain>/privkey.pem; # managed by certbot on host machine 
    
   location / { 
       proxy_pass https://localhost:8080; 
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  

       proxy_set_header X-Forwarded-Proto https;

       proxy_ssl_session_reuse on;
       proxy_ssl_verify off;
   }
}

I think an encouragement on the page for others to post their configurations to add to the list would be a good addition as well. What do you all think?