Nextcloud AIO on separate host machine from Nginx Proxy Manager Proxy - Is this Even possible?

[Alex-Dikeman]

I've been fighting this for hours and I can't even find an example of someone making it work.

Basically, I have nextcloud AIO running on one machine, and my NPM runs on another machine in the same LAN. My forwarded 80/443 ports point to the NPM machine. Nextcloud AIO won't pass the domain check because of that. Even with the domain check bypassed, it seems like the apache container never starts correctly. This is the error message I get when running docker logs -f nextcloud-aio-apache:

Waiting for Nextcloud to start... Waiting for Nextcloud to start... Waiting for Nextcloud to start... Connection to nextcloud-aio-nextcloud (172.19.0.5) 9000 port [tcp/*] succeeded! [Wed Aug 14 11:01:59.175503 2024] [mpm_event:notice] [pid 38:tid 38] AH00489: Apache/2.4.62 (Unix) configured -- resuming normal operations [Wed Aug 14 11:01:59.175555 2024] [core:notice] [pid 38:tid 38] AH00094: Command line: '/usr/local/apache2/bin/httpd -D FOREGROUND' {"level":"info","ts":1723633319.1913033,"msg":"using config from file","file":"/tmp/Caddyfile"} {"level":"info","ts":1723633319.1931784,"msg":"adapted config to JSON","adapter":"caddyfile"} {"level":"info","ts":1723633319.1950862,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."} {"level":"info","ts":1723633319.195692,"msg":"[INFO][FileStorage:/mnt/data/caddy] Lock for 'issue_cert_mydomain.cloud' is stale (created: 2024-08-14 10:56:08.935465711 +0000 UTC, last update: 2024-08-14 10:56:58.998595494 +0000 UTC); removing then retrying: /mnt/data/caddy/locks/issue_cert_mydomain.cloud.lock"} {"level":"error","ts":1723633320.1153455,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"mydomain.cloud","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"{my ip}: remote error: tls: no application protocol","instance":"","subproblems":[]}} {"level":"error","ts":1723633320.115404,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"mydomain.cloud","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"{my ip}: remote error: tls: no application protocol","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1890437576/296177772226","attempt":1,"max_attempts":3} {"level":"error","ts":1723633320.1154492,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"mydomain.cloud","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:tls - {my ip}: remote error: tls: no application protocol"} {"level":"error","ts":1723633320.115598,"logger":"tls.obtain","msg":"will retry","error":"[mydomain.cloud] Obtain: [mydomain.cloud] solving challenge: mydomain.cloud: [mydomain.cloud] authorization failed: HTTP 400 urn:ietf:params:acme:error:tls - {my ip}: remote error: tls: no application protocol (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":0.91629998,"max_duration":2592000} {"level":"error","ts":1723633380.9210916,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"mydomain.cloud","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"{my ip}: remote error: tls: no application protocol","instance":"","subproblems":[]}} {"level":"error","ts":1723633380.9211144,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"mydomain.cloud","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"{my ip}: remote error: tls: no application protocol","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/159356083/18405394853","attempt":1,"max_attempts":3} {"level":"error","ts":1723633380.9211318,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"mydomain.cloud","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:tls - {my ip}: remote error: tls: no application protocol"}

Anyone have any suggestions or even examples of working configs from two separate machines?

[szaimen]

Nextcloud AIO on separate host machine from Nginx Proxy Manager Proxy - Is this Even possible?

Yes it is. Can you follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md?

[Alex-Dikeman]

I've followed this quite a bit. The problem I am running into is that even when following this, the errors I get lead me to discussions where the solution is to make sure that both containers are on the same docker network, which isn't possible in the same way with two different machines. Again, I haven't seen any examples of working configs with specifically two separate machines one running AIO and one running Nginx Proxy Manager.

[szaimen]

Instead of localhost simply point at the private ip-address of the server running AIO.

[Alex-Dikeman]

I already am. This is the error I get. I can ping each container from each other so I know they can reach each other. The problem I am running into right now is that the apache server doesn't seem to use the domain correctly.

[szaimen]

Have you set the APACHE_PORT to something else than 443? This is necessary to make it work behind a reverse proxy

[Edu-Ape]

First of all, sorry for being a noob and for my bad English.
I have the same problem, with NPS (NGINX) running a frontend server and NextCloud AIO on a backend server, with docker compose and on the same LAN.
I already follow all indications from different pages and forums, without luck.
APACHE_PORT=11000
On Nginx
proxy_pass https://192.168.100.201$request_uri; #Backend static IP address
After a long time testing configurations, I can access my subdomain from the public internet, but I was never able to validate the domain.
So I set SKIP_DOMAIN_VALIDATION=true, but now Apache Server gives HTTP 403 unauthorized error (seen on docker Apache log).
Can you get a working configuration for this setup?
Thank you for your support