NextPush configuration

jm355 · February 9, 2024, 2:19am

1. The problem I’m having:

I’m trying to set up NextPush on my nextcloud-aio server. I have the nextpush app installed on the server, but I don’t know how to configure the reverse proxy timeout and buffering settings, or the matrix gateway the way they describe in the README.md. They have examples for apache and nginx, and I don’t know how to translate them to Caddy. I can connect the android nextpush app to my server, and it works/sends notifications when I restart the service, but it constantly is disconnecting, likely due to not having my proxy set up with all the options the instructions call for.

2. Error messages and/or full log output:

N/A

3. Caddy version:

v2.7.6 h1:w0NymbG2m9PcvKWsrXO6EEkY9Ru4FJK8uQbYcev1p3A=

4. How I installed and ran Caddy:

a. System environment:

Debian 12 (bookworm)
docker --version
Docker version 20.10.24+dfsg1, build 297e128
docker-compose version

docker-compose version 1.29.2, build unknown
docker-py version: 5.0.3
CPython version: 3.11.2
OpenSSL version: OpenSSL 3.0.11 19 Sep 2023

b. Command:

sudo docker-compose up -d

c. Service/unit/compose file:

~/Caddy/Dockerfile

FROM caddy:latest AS builder

RUN caddy add-package github.com/caddy-dns/duckdns

FROM caddy:latest

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

~/compose.yaml

version: "3.6"

services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    ports:
      - "8080:8080"
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config 
      - /var/run/docker.sock:/var/run/docker.sock:ro 
    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=127.0.0.1
      - BORG_RETENTION_POLICY=--keep-within=7d --keep-monthly=6 --keep-yearly=4
      - NEXTCLOUD_STARTUP_APPS=deck twofactor_totp tasks calendar contacts notes 
      - NEXTCLOUD_ENABLE_DRI_DEVICE=true 
      - SKIP_DOMAIN_VALIDATION=true
    depends_on:
      - caddy
    networks:
      - nextcloud-aio

  caddy:
    build: ./Caddy
    restart: unless-stopped
    container_name: caddy
    volumes:
     - ./Caddyfile:/etc/caddy/Caddyfile
     - ./certs:/certs
     - ./config:/config
     - ./data:/data
     - ./sites:/srv
    network_mode: host

volumes: 
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer 

networks:
  nextcloud-aio:
    name: nextcloud-aio
    driver: bridge
    enable_ipv6: true

d. My complete Caddy config:

~/Caddyfile

{
	auto_https disable_redirects
}
https://my_personal_nextcloud_server.duckdns.org:443 {
	reverse_proxy localhost:11000
	tls {
		dns duckdns token
	}
}

5. Links to relevant resources:

github.com

nextcloud/all-in-one/blob/main/reverse-proxy.md

# Reverse Proxy Documentation

A [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) is basically a web server that enables computers on the internet to access a service in a [private subnet](https://en.wikipedia.org/wiki/Private_network).

**Please note:** Publishing the AIO interface with a valid certificate to the public internet is **not** the goal of this documentation! Instead, the main goal is to publish Nextcloud with a valid certificate to the public internet which is **not** running inside the mastercontainer but in a different container! If you need a valid certificate for the AIO interface, see [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface).

In order to run Nextcloud behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else), you need to specify the port that AIO's Apache container shall use, add a specific config to your web server or reverse proxy and modify the startup command a bit. All examples below will use port `11000` as example `APACHE_PORT` which will be exposed on the host to receive unencrypted HTTP traffic from the reverse proxy. **Advice:** If you need https between Nextcloud and the reverse proxy because it is running on a different server in the same network, simply add another reverse proxy to the chain that runs on the same server like AIO and takes care of https proxying (most likely via self-signed cert). Another option is to create a VPN between the server that runs AIO and the server that runs the reverse proxy which takes care of encrypting the connection.

**Attention:** The process to run Nextcloud behind a reverse proxy consists of at least steps 1, 2 and 4:
1. **Configure the reverse proxy! See [point 1](#1-configure-the-reverse-proxy)**
1. **Use this startup command! See [point 2](#2-use-this-startup-command)**
1. Optional: If the reverse proxy is installed on the same host and in the host network, you should limit the apache container to only listen on localhost. See [point 3](#3-limit-the-access-to-the-apache-container)
1. **Open the AIO interface. See [point 4](#4-open-the-aio-interface)**
1. Optional: Get a valid certificate for the AIO interface! See [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface)
1. Optional: How to debug things? See [point 6](#6-how-to-debug-things)

**Please note:** Since the Apache container gets created by the mastercontainer, there is **NO** way to provide custom docker labels or custom environmental variables for the Apache container. So please do not attempt to do this because you will fail! Only the documented way will work!

## 1. Configure the reverse proxy

This file has been truncated. show original

francislavoie · February 9, 2024, 3:37am

That’s the wrong way to build Caddy. Please see Build from source — Caddy Documentation.

You shouldn’t use caddy add-package, you should use xcaddy build.

Minor thing, you can simplify this to just:

my_personal_nextcloud_server.duckdns.org {

Specifying https:// and :443 is redundant.

I don’t know anything about NextPush. You haven’t shown your Caddy logs (enable the debug global option), so I have no evidence of a problem. Can’t help troubleshoot if I can’t see symptoms of the problem.

jm355 · February 9, 2024, 3:54am

When I use the xcaddy version of the dockerfile as specified in the build from source page, I get

jerry@server ~> sudo docker-compose up -d --build
[sudo] password for jerry: 
Building caddy
Sending build context to Docker daemon  2.048kB
Step 1/4 : FROM caddy:latest AS builder
 ---> 66978cebfbcc
Step 2/4 : RUN xcaddy build --with github.com/caddy-dns/duckdns
 ---> Running in 1b9c5a851288
/bin/sh: xcaddy: not found
The command '/bin/sh -c xcaddy build --with github.com/caddy-dns/duckdns' returned a non-zero code: 127
ERROR: Service 'caddy' failed to build : Build failed

the add-package version works, what’s wrong with it?

I don’t know anything about NextPush. You haven’t shown your Caddy logs (enable the debug global option), so I have no evidence of a problem. Can’t help troubleshoot if I can’t see symptoms of the problem.

I don’t need help troubleshooting a problem, I need help translating apache or nginx configuration to the Caddyfile format. uppush/README.md at main - NextPush/uppush - Codeberg.org has the configuration I’m trying to imitate, and links to example files to see the settings in context uppush/reverse_proxy_examples at main - NextPush/uppush - Codeberg.org

francislavoie · February 9, 2024, 3:58am

This is wrong too. You need to use the builder image variant, not latest. Review the docs I linked.

It’s downloading a build from Caddy’s build server (i.e. Download Caddy), you’re not actually building Caddy locally. This adds pressure to the build server (especially if automated in CI pipelines etc). And we cannot guarantee uptime of the build server, so it can randomly fail if the build server is down.

Using xcaddy builds from source using Go tooling, which will always work correctly.

Caddy’s proxy has no timeouts by default, so those aren’t relevant.

Again, we need to see logs to see how it’s failing to be able to help you.

jm355 · February 9, 2024, 4:08am

Good to know, I’ll try to switch

jerry@server ~> sudo docker-compose up -d --build
Building caddy
Sending build context to Docker daemon  2.048kB
Step 1/4 : FROM caddy:latest-builder AS builder
manifest for caddy:latest-builder not found: manifest unknown: manifest unknown
ERROR: Service 'caddy' failed to build : Build failed
jerry@server ~ [1]> cat Caddy/Dockerfile 
FROM caddy:latest-builder AS builder

RUN caddy add-package github.com/caddy-dns/duckdns

FROM caddy:latest

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Caddy’s proxy has no timeouts by default, so those aren’t relevant

Cool, that’s good to know. What about proxy_buffering off; (Nginx) or <Proxy "fcgi://localhost/" disablereuse=on flushpackets=on max=10></Proxy> (Apache)?

For the matrix gateway, would adding reverse_proxy /_matrix/push/v1/notify localhost:11000/index.php/apps/uppush/gateway/matrix be the correct way to redirect that path? For reference:

location /_matrix/push/v1/notify {
    proxy_pass http://127.0.0.1:5000/index.php/apps/uppush/gateway/matrix;
}

(nginx example)
ProxyPass "/_matrix/push/v1/notify" http://127.0.0.1:5000/index.php/apps/uppush/gateway/matrix (Apache example)

francislavoie · February 9, 2024, 4:25am

There’s no latest-builder tag. You must use a specific version tag.

FROM caddy:2.7.6-builder

No. The reverse_proxy upstreams cannot have a path, it must be only an host:port. See the docs.

You can use the rewrite directive to change the request path before proxying.

But again… without your Caddy logs and evidence of a problem, I can’t suggest anything specific to try.

Please share your logs.

jm355 · February 10, 2024, 2:40am

Ok, updating the dockerfile to use xcaddy with 2.7.6 worked. Is there a way to have it use the latest version and fill it in, e.g. FROM caddy:${latest}-builer AS builder?

My plain Caddyfile seems to work as expected! So I guess I was overthinking it trying to configure things as directed. Thanks for your help though!

{
	auto_https disable_redirects
}
my_personal_nextcloud_server.duckdns.org {
	rewrite /_matrix/push/v1/notify /index.php/apps/uppush/gateway/matrix
	reverse_proxy localhost:11000

	tls {
		dns duckdns token
	}
}

francislavoie · February 10, 2024, 7:09am

No. Using latest is an anti-pattern. You should never use latest.

There’s plenty of articles out there that explain why it’s a bad idea to use latest. For example: What's Wrong With The Docker :latest Tag? · vsupalov.com

jm355 · February 11, 2024, 4:29pm

Ah good to know, I didn’t realize “latest” meant something different than I thought. Is there a similar tag like “stable” or something I can use so I don’t have to go and look up what specific version numbers are available?

francislavoie · February 11, 2024, 4:49pm

No, the whole point is that you don’t rely on a moving target. The problem is that if a breaking change happens, your config won’t match. So you should deliberately update the version regularly.

system · March 12, 2024, 4:49pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.