Want to create a Caddyfile for Caddy2 that references a nextcloud reverse proxy on separate computer

[EagleDTW (Daniel Witkin)]

1. Caddy version (caddy version):

v2.4.3

2. How I run Caddy:

Homeassistant Caddy 2 add-on

a. System environment:

HassOS, NextCloud on RPi4 Raspberrypi OS

b. Command:

Want to create a Caddyfile for Caddy2 that references a nextcloud reverse proxy on separate computer

c. Service/unit/compose file:

Paste full file contents here.
Make sure backticks stay on their own lines,
and the post looks nice in the preview pane.

d. My complete Caddyfile or JSON config:

https://domain.duckdns.org:port {

            root    * /usr/local/www/nextcloud
            file_server
            log {
                    output file     /var/log/nextcloud_access.log
                    format single_field common_log
            }

            tls {
                    ca https://acme-v02.api.letsencrypt.org/directory
            }

            php_fastcgi 192.168.1.XX:9000

            header {
                    Strict-Transport-Security               "max-age=15768000;"
                    X-Content-Type-Options                  "nosniff"
                    X-XSS-Protection                        "1; mode=block"
                    X-Robots-Tag                            "none"
                    X-Download-Options                      "noopen"
                    X-Permitted-Cross-Domain-Policies       "none"
                    X-Frame-Options "SAMEORIGIN"
                    Referrer-Policy                         "no-referrer"
            }

            header /core/fonts {
                    Cache-Control                           "max-age=604800"
            }

            @phpFiles {
                    path_regexp phpfile ^/(remote|public|cron|core/ajax/update|status|ocs/v1|ocs/v2)\.php
            }
            rewrite @phpFiles {http.regexp.phpfile.0}

            redir /.well-known/cardav /remote.php/dav 301
            redir /.well-known/caldav /remote.php/dav 301

            # .htaccess / data / config / ... shouldn't be accessible from outside
            @forbidden {
                    path    /.htaccess
                    path    /data/*
                    path    /config/*
                    path    /db_structure
                    path    /.xml
                    path    /README
                    path    /3rdparty/*
                    path    /lib/*
                    path    /templates/*
                    path    /occ
                    path    /console.php
            }

            respond @forbidden 404
}

3. The problem I’m having:

My website comes up with 404 error, I’m sure as it intends - but can’t connect.

4. Error messages and/or full log output:

5. What I already tried:

Help to migrate Caddyfile V1 to V2 for Nextcloud

@francislavoie, your solution is working, thank you ! This is my current Caddyfile V2 : mydomain.com { root * /usr/local/www/nextcloud file_server log { output file /var/log/nextcloud_access.log format single_field common_log } tls { ca https://acme-v02.api.letsencrypt.org/directory } php_fastcgi 127.0.0.1:9000 header { …

6. Links to relevant resources:

Caddy reverse proxy + Nextcloud + Collabora + Vaultwarden with local HTTPS

1. TL;DR This Wiki contains the info to setup a frontend Caddy reverse proxy service with a Let’s Encrypt authorized TLS certificate and a backend host running a Caddy reverse proxy / webserver which serves Nextcloud with Collabora integrated and Vaultwarden (formerly Bitwarden_rs). The frontend Caddy will also issue TLS certificates for the backend LAN connections and renew them periodically. With this setup the connection will be encrypted from A to Z. For quick references, just scroll down t…

[francislavoie]

Do you have the nextcloud files mounted to /usr/local/www/nextcloud on both machines?

Both Caddy and the php-fpm service need access to the files for proper functionality.

Caddy needs it for the try_files behaviour built-in, to determine what kinds of URL rewrites need to be performed.

[EagleDTW (Daniel Witkin)]

It looks like my homeassistant file system is readonly except for opening up samba share folders to config files location - should I be mounting the files from the RPi to the samba shares and how would I map/redirect the file locations for the HassOS?

[francislavoie]

I would say it would be easier to install Caddy on both machines, and reverse_proxy from the publicly accessible one to the other which is hosting nextcloud, instead of worrying about filesystem stuff.

[EagleDTW (Daniel Witkin)]

I’m down to try this method.

So I’d install Caddy on the RPi Nextcloud (Internal) and reverse proxy from the HA add-on of Caddy (External). What would a proxy like this look like to get Nextcloud accepting the http from the HA add-on?

Is this where your code such as this comes in?
nextcloud.mydomain.com {
reverse_proxy https://nextcloud.roadrunner {
header_up Host {http.reverse_proxy.upstream.hostport}
header_up X-Forwarded-Host {host}
}
}

[francislavoie]

Yeah. You’ll probably want to proxy over HTTP and not HTTPS though (because setting up mTLS is complicated and rarely worth the effort)

[EagleDTW (Daniel Witkin)]

If I have a config like this I’m getting 400 bad request sent http to https error on nextcloud, is there an easy solution port is 443, should I be moving off of that port up to a different one so that the reverse proxy coming funneling through is only http expected?

Blockquote
{
email username@mail.com
}
(common) {
tls {
dns duckdns {env.DUCKDNS_TOKEN}
}
header {
Strict-Transport-Security “max-age=31536000; includeSubdomains”
X-XSS-Protection “1; mode=block”
X-Content-Type-Options “nosniff”
Referrer-Policy “same-origin”
-Server
Content-Security-Policy “frame-ancestors domain.duckdns.org:port *.domain.duckdns.org:port”
Permissions-Policy “geolocation=(self), microphone=()”
}
}
https://domain.duckdns.org:port {
import common
reverse_proxy 192.168.1.XX:443 {
}
}

‘’’

[EagleDTW (Daniel Witkin)]

I have the port changed to 880 & 8443 and have a valid cert pulling up for the page Caddy config is implementing. I’m getting the webpage timing out and have tried changing the reverse proxy setting to https://192.168.1.XX:8443.

I’ve added the computer that is doing the reverse proxy as a trusted proxy in the config.php and added ‘forwarded_for_headers’ => array(‘HTTP_X_FORWARDED_FOR’), and set ‘overwriteprotocol’ => ‘http’, (I’ve actually tried this set to both https and http).

This is a better copy of my Caddyfile:

(common) {
        tls {
                dns duckdns {env.DUCKDNS_TOKEN}
        }
        header {
                Strict-Transport-Security "max-age=31536000; includeSubdomains"
                X-XSS-Protection "1; mode=block"
                X-Content-Type-Options "nosniff"
                Referrer-Policy "same-origin"
                -Server
                Content-Security-Policy "frame-ancestors domain.duckdns.org:port *.domain.duckdns.org:port"
                Permissions-Policy "geolocation=(self), microphone=()"
        }
}
https://domain.duckdns.org:port {
    import common
    reverse_proxy https://192.168.1.XX:8443 {
    } 
}

I appreciate your advice Francis. Please, any advice is welcome - I feel like I’m really close.

[francislavoie]

So you’re running two instances of Caddy now, right? What are the configs for both? What are in your logs on both (make sure to turn on the debug global option to see full logs)?

[EagleDTW (Daniel Witkin)]

Hi Francis,

I actually didn’t set up Caddy on the other computer yet and can install using the directions from here:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo tee /etc/apt/trusted.gpg.d/caddy-stable.asc
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

But what other config would I need to establish the connection correctly?

Really appreciate your advice - Thank you, Daniel

[francislavoie]

I’m confused as to where you’re at, at this point. Could you recap what you have set up now? It would help if you paint a picture of your networking setup and what you’re trying to do.

[EagleDTW (Daniel Witkin)]

Sure, I have Caddy2 add-on for HA setup on a VM HassOS on a Mac and serving a reverse proxy to a separate RPi with NextCloud instance moved to port 880 and 8443. I can access my unsecure login from the local network by the https://ip_address:8443. when I access the network by the external domain name using browser I get a blank screen and using curl I get a 502 bad gateway message, Server: Caddy, content-Length: 0.

My goal is to have the external site be secure for accessing Nextcloud Talk feature and not have to open up port 443 on the router as you would if you were having Nextcloud do the letsencrypt route. I also think in network design, I would want my external domain to have the certs for ssl and my internal network to communicate over https but not be using ssl.

I’m not quite sure how a secondary caddy server on the Nextcloud RPi would help to accomplish the handshake between the 2 servers – ahhhh, unless you just mean set up a separate Caddy for the Nextcloud all by itself and not have it worry about the Caddy on the HA server, of course that makes sense. Same technology just reduce the middle routes altogether.

[EagleDTW (Daniel Witkin)]

@EagleDTW

php_fastcgi 192.168.1.XX:9000

I think that I want to use the config of the Caddyfile from the 1st comment, but insert “localhost” is it port 9000 or 8443 for NextCloud? all examples I’ve seen have port 9000 used and I’m not sure if that is correct for my instance.

I’m not sure where the Caddyfile is stored and how to reference it when you type caddy run?

[EagleDTW (Daniel Witkin)]

I’ve figured out how to save the caddyfile and use it, now I’m wondering if I want the initial config that has the config for nextcloud adapted off of someone in the communities V1 to V2 file or if I want to simply have the reverse proxy setting?

[EagleDTW (Daniel Witkin)]

Hi Francis,

I have Caddy running on the Nextcloud Server and it issued a cert for the reverse proxy, but the website is saying 400 bad request you’re speaking plain http to an SSL-enabled server port.

Any idea what’s the culprit?

Thank you,
Daniel

[EagleDTW (Daniel Witkin)]

Should I run the reverse proxy to https://127.0.0.1:8443?

[francislavoie]

See this article:

Using Caddy as a reverse proxy in a home network

If you want to run a service inside a Local Area Network (LAN) such as your home or office – and especially if you want to be able to access it from outside that network – Caddy can help you accomplish this quite easily. This guide will show you how. It assumes you’ve never done this before, but that you have some technical proficiency and are somewhat knowledgable about your own network. Do this at your own risk. There are several ways to make private services accessible from other n…

Once you’re in your own network, there’s no reason to proxy over HTTPS, unless you have reason to believe something could intercept requests between Caddy and your upstream, maliciously.

[EagleDTW (Daniel Witkin)]

Do I then setup my Nextcloud instance to not be SSL secured in apache2 and how does that affect things like talk that require ssl configuration?

[francislavoie]

It’s Caddy’s job to encrypt connections between itself and the clients (browsers). Once the request reaches Caddy, it’s inside of your own network. It doesn’t need to be re-encrypted to communicate with Apache.

[EagleDTW (Daniel Witkin)]

but the nextcloud instance is https with the domain setup and the SSL certfile and key established and the reverse proxy is http on the local domain - so I’m getting the error. Do I need to take off SSL setting off of the apache2 instance running my Nextcloud and if I do that does that take off the security that is required to run talk add-on?