Reverse proxy documentation using nginx

[rallisf1]

I understand caddy is a better fit for this but since I already use nginx for all my other containers, I'd appreciate an nginx section in the reverse-proxy documentation, preferabbly with TLS offloading (you'll need to share the certs between the containers).

Cheers!

[szaimen]

Hey, feel free to investigate yourself how it could work behind nginx. I'll gladly add it to the reverse proxy documentation then.

As a starting point simply translate the caddy reverse proxy config into nginx syntax and then follow the rest of the reverse proxy documentation. (of course you need to provide your own certificates in the config for nginx which is not necessary using caddy as reverse proxy)

[twwd]

At the first glance, my Nginx config seems to work. I've startet the AIO container with the custom APACHE_PORT=11000 and then used the following config in my server block (besides the TLS stuff etc.):

location / {
    proxy_pass http://localhost:11000;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# Websockets for Push
location /push/ {
    proxy_pass http://localhost:11000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
}

# Websockets for Collabora
location /cool/ {
    proxy_pass http://localhost:11000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
}

[szaimen]

Thanks @twwd !

Are you sure that the block below is really neded though? (Doesn't it work without?)

# Websockets for Push
location /push/ {
    proxy_pass http://localhost:11000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
}

# Websockets for Collabora
location /cool/ {
    proxy_pass http://localhost:11000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
}

Or maybe aren't you able to enable websocket connections for the whole domain? This would eliminate the need to configure every endpoint manually

[twwd]

My first config was without these parts and it didn't work. I'm not a Nginx pro, but I'm not aware of a method to combine all three blocks.

[szaimen]

Thanks! So I guess enabling websocket connections for the whole domain does not work?

[twwd]

Regarding to SO, it might work. I'll try in the next days and give an update here.

[twwd]

At the first glance, the combined config seems to work:

location / {
        proxy_pass http://localhost:11000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

[szaimen]

Nice!

[twwd]

I'm sorry, I forgot to mention this part that must be declared in the http block (outside a server block):

# From https://www.nginx.com/blog/websocket-nginx/
map $http_upgrade $connection_upgrade {
    default Upgrade;
    ''      close;
}

[happyreacer]

I used the

location / {
        proxy_pass http://localhost:11000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

but no notifications in my android apps work

[szaimen]

Are you sure that this is not due to nextcloud/android#8684?

See e.g.

The NC (and NC Talk) app from f-droid lack in push notifications completely.

[happyreacer]

@szaimen No, unfortunately it is not. I have taken other parameters. However, this has gone through trying. Unfortunately, I do not know what the individual values have for effects. But it worked as follows with the nginx-proxy docker from linuxserver/swag

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name www.*;

    include /config/nginx/ssl.conf;
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomians; preload;";
    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app nextcloud-aio-apache;
        set $upstream_port 11000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_max_temp_file_size 2048m;
    }
}

Maybe someone who knows how to do this can optimize it