Nextcloud Security Warnings

swingarm

Dabbler
Joined
Apr 19, 2019
Messages
44
I'm fairly new to the hosting Nextcloud game and I'm getting this:
1696746871864.png


Since I'm hosting through a Cloudfare tunnel do I need to worry about this? I'm using the Truenas offical Nextcloud and Truecharts Traefik and Cloudfare. I am getting a secure connection to the outside world.
 

sos_nz

Explorer
Joined
Mar 17, 2023
Messages
58
There's a bit to unpack here. I've had and solved all these errors / warnings in my installation....but I use nextcloud under a TrueNAS scale linux (Arch) VM, not the app. The following is from memory....

1. To solve the secure connection error, you need to specify the trusted proxies in nextcloud's config.php file. This is easier said than done if using either the official or Truecharts app, and is the main reason why I run nextcloud in a linux VM, rather than as an app. In config.php:
Code:
  'trusted_proxies' =>
  array (
    0 => '192.168.1.1',
  ),
  'overwriteprotocol' => 'https',
  'overwritehost' => 'nextcloud.myhost.org',

2. the caldav and carrdav errors require you to enter the address you use to access your nextcloud externally into the .htaccess file, which should be at the root of your nextcloud install e.g. /var/www/nextcloud/.htaccess (note, it's a hidden file, as denoted by beginning with a period '.'). Adjust the https://address to yours.
Code:
  RewriteRule ^\.well-known/carddav https://mynextcloud.org/remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/caldav https://mynextcloud.org/remote.php/dav/ [R=301,L]

3. Email server details should be trivial to enter in the web gui as instructed
4. database locking requires a redis server, and you have to set transactional file locking - again in the config.php:
Code:
  'memcache.local' => '\OC\Memcache\APCu',
  'memcache.locking' => '\OC\Memcache\Redis',
  'redis' => [
    'host' => 'localhost',
    'port' => 6379,

In Arch, I had to install redis server (install redis php-redis php-igbinary php-imagick php-apcu), and enable the php modules in php.ini as follows:
extension=bcmath
extension=curl
extension=exif
extension=gd
extension=gmp
extension=int
extension=mysqli
extension=pdo_mysql
extension=pdo_sqlite
extension=sysvsem
zend_extension=opcache
extension=zip
extension=igbinary
extension=redis
extension=apcu
apc.ttl=7200
apc.enable_cli=1
apc.enable=1


5. Set the phone region in config.php e.g.
Code:
  'default_phone_region' => 'US',


Obviously adjust the paths / details above as needed for your specific situation / location. Read the nextcloud documentation, which is not the clearest, but still gives some pointers.

Some of the above may not be relevant to the cloudflare tunnel situation, so take that with a grain of salt...the above are what I use behind my self-hosted reverse proxy (HAproxy in OPNsense).

IMHO the biggest issue is how locked down the containerised nextcloud apps are (out of necessity for simplicity), which doesn't lend themselves well to more custom configurations behind proxies etc.

If I recall, the official app doesn't come with Redis, but the Truecharts one does. Enjoy!
 
Last edited:

swingarm

Dabbler
Joined
Apr 19, 2019
Messages
44
So I got the HSTS fixed by changing something in Cloudflare.

Do I just add that code in point #1 into my config.php?
 
Top