The server is not reachable on Port 443

[farzadha2]

Hi
Recently installed the version 1.2.0 and i get to the part where it says

The server is not reachable on Port 443.

when i access my server i see this

using nginx reverse proxy

   server {

#        listen 80;
   listen 443 ssl;
         server_name nube.domain.com;

  ssl_certificate /etc/letsencrypt/live/nube.domain.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/nube.domain.com/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
       ssl_prefer_server_ciphers on;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
       ssl_stapling_verify on;

location ~ /.well-known {
        root /var/www/letsencrypt;
        allow all;
    }

location / {
        proxy_pass http://localhost:11000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }




        }

the docker compose

version: "3.8"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

services:
  nextcloud:
    image: nextcloud/all-in-one:latest # Must be changed to 'nextcloud/all-in-one:latest-arm64' when used with an arm64 CPU
    restart: always
    container_name: nextcloud-aio-mastercontainer
    environment: # Is needed when using any of the options below
     - APACHE_PORT=11000 # Is needed when running behind a reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md  
     - NEXTCLOUD_DATADIR=/data2/ncdata
     - NEXTCLOUD_MOUNT=/data2/
    volumes:
     - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
     - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080

thank you

[szaimen]

Hello, this looks good to me in general. Did you see https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#how-to-continue?
Edit: we will make it better debuggable with #680

[farzadha2]

thank you for the reply, but i didnt understand the solution?

currently the proxy is pointing to the apache port
from the wiki

https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#nginx

[szaimen]

are you using cloudflare for your domain?

[farzadha2]

thanks for the reply, using godaddy,

[szaimen]

@farzadha2 can you please check if port 443 is open by using 'https://portchecker.co/' and entering your domain there as ip-address and port 443 as port? Thanks!

[farzadha2]

currently in the nginx proxy using other sub domains, not sure if that might be the issue? whats odd is that i can access the website and shows correctly

[szaimen]

did you enter your domain in the port checker or the ip-address?

[farzadha2]

thanks for the reply, attaching picture

[szaimen]

alright. Thanks for testing. We'll improve things with #680.

[szaimen]

currently not, yes

[farzadha2]

i was able to work around this issue on the container i put the hosts to point internally and it worked

[szaimen]

I think I found out why this happens. Looks like 0.1 seconds sometimes are simply sometimes not enough to open the fscocket connection...
This will be improved with #680

[szaimen]

So it looks like this was indeed a bug on our side which happens only under specific circumstances

[farzadha2]

Thank you so much, if anyone else get this issue they need to edit the host file on the docker config (did it though portrainer) which worked

[rhatguy]

I have a similar issue to this. Using HAproxy on pfsense on another host as my reverse. When I bring up http://hostname:11000 using a browser on my laptop using my home network I get a string of letters and numbers. When I use my phone to come in from the outside I bring up https://hostname (which uses port 443) and I get a similar string of letters/numbers. This seems to indicate that my reverse proxy is working. portchecker.co also indicates my port 443 is open.

When I enter my domain name on the AIO page, it immediately responds that this server is not available on port 443. @farzadha2 which hosts file did you edit, and what did you put in the file to get this working?

[farzadha2]

hi there, what i did edit the hosts file using portrainer WEBGUI, whats odd is that im not using HAproxy

[szaimen]

I think the container was hitting my internal IP trying to check if port 443 was up, and it was not, so it was failing.

Did it show the ip-address that it tried to connect you to? This should now be shown in the error message which shouls hopefully make debugging a bit easier.

[szaimen]

Apart from that there is this parameter to overwrite hosts (IIRC)
https://stackoverflow.com/questions/32079364/how-can-you-make-the-docker-container-use-the-host-machines-etc-hosts-file/58994501#58994501

[rhatguy]

@szaimen I do not remember it showing the ip address in the error. I can try to test it again tonight. I've kinda paused my deployment for now to do some thinking about how best to deploy this with my haproxy reverse proxy. I want my nextcloud instance to be easy to troubleshoot as I depend on it for things like storing my password managers files. The installation processes seems very rigid in general right now where if you don't have it in exactly the right environment it bombs. Don't get me wrong, I LOVE all of the things that get setup automatically, but I fear that with those benefits may come complexity in troubleshooting if things go wrong.

[szaimen]

All right!

We tried to make it as good to troubleshoot and debuggable as possible.
However in the end you probably still need to understand how docker works.

On possibility is this:
https://github.com/nextcloud/all-in-one/tree/main/manual-install
(It is the docker-compose mirror of what we are doing internally although except the mastercontainer, domaincheck container and backup container)

[szaimen]

Regarding possible problems due to internal ip-addresses, I'll create a check for this in #745

[bwragg]

Hi @szaimen and @farzadha2,

Hope you don't find me hijacking this discussion but after chasing my tail for days I found this thread which seems the closest to what I'm facing. I am also having same issues as #717 and my questions may connect with #684 .

In short, I can't find a clear answer on what is and isn't currently possible with AIO. Maybe what I'm trying to achieve is currently impossible?

The setup I'm trying to deploy in is as follows:

• Totally off the internet, behind a router/firewall. So it will only be accessed internally, never externally.
• We have setup our internal DNS to resolve nextcloud.domain.com to an internal IP.
• We have purchased our own SSL Certificate for nextcloud.domin.com
• We are running traefik internally so we can load up our own SSL Cert easily.

So few options:

1. Can AIO be installed like this:
   As described in the documentation, Nextcloud AIO running off port 11000, and having Traefik host the SSL cert but it all is done with internal IPs.

Currently this is the approach we are trying getting the hexidecimal string returned that @farzadha2 was getting.
Also we are getting the error @LuFlo was getting: "Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')" when we try to install

From what @szaimen said in this thread and the others am I right in saying this isn't possible? Or can it be done with the beta for 1.3.1? or can it be done if installed manually?

2. Or would this approach work (I know its messy!):

• redirect the routers ports temp to the server so that the domain resolves externally. Temp change the internal DNS to resolve to the public IP
• Start up Traefik
• Install AIO via port 8080
• Close the ports to isolate the installation from the internet
• Change the internal DNS entry to resolve to an internal IP

Would this work either using the AIO page to install or manual? If it would work, in 3 months when the certificate for Nextcloud from letsencrypt expires would it all fall apart?

3. or would this be possible:

• Scrap using Traefik
• Install Nextcloud AIO without a proxy but somehow install our purchased certificate?
• use Nextcloud directly on port 80,443
• Down the track if they want to move to the cloud do a second install on the cloud server and just use the backup/restore function to move everything over?

Sorry for all the questions, just thought I'd ask the experts before I waste another couple of days trying stuff that will never work.

Thanks heaps

[farzadha2]

hi there, so currently were you able to install the nextcloud?,
what i did on the container to point the hosts locally so it can install with no issue
if you have nginx infront not in the container then you would only need to point NAT to that container and reverse proxy to your nextcloud container

[bwragg]

Hi @farzadha2,

Thanks for your reply. I can install nextcloud only if I open up port 443 & 80 on the router. If I don't have 443 open it won't install. From what I've now read on this and other threads I believe this is the only way to install. As we want the install to be off the web i am worried about opening the ports just to get it installed and then closing them...feel like something will break down the track?

When you said: "if you have nginx infront not in the container then you would only need to point NAT to that container and reverse proxy to your nextcloud container"
Yeah I agree, i was trying to do this with traefik. but I just couldn't get nextcloud to install when doing this.

But I don't quite get what you mean you changed on the container so that the host point local? e.g for us:
-public dns for nextcloud.domainname.com points to the public ip
-internal dns for nextcloud.domainname.com point to the internal ip

So I figured the internal containers would be getting the internal ip? Is that what you mean when you said you "point the hosts locally". Could you please clarify what you means? Thanks

[farzadha2]

Hi there,
So currently im using portrainer to manage my dockers, in every container of nextcloud i edit the container at the part of network i would add like this

in that way i was able to install because even if i had the port 443 opened it wouldn't work
hope this helps