Replies: 11 comments 76 replies
-
|
hi , |
Beta Was this translation helpful? Give feedback.
-
|
The |
Beta Was this translation helpful? Give feedback.
-
Indeed, maybe this would make the guide even easier? |
Beta Was this translation helpful? Give feedback.
-
|
@flll how can I get caddy with dns-cloudflare-module here in this guide? |
Beta Was this translation helpful? Give feedback.
-
|
btw @flll did you already tested features like Nextcloud office and Nextcloud talk in this kind of setup? Do they work? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I've been running this setup for a few weeks now, and |
Beta Was this translation helpful? Give feedback.
-
|
Nice! |
Beta Was this translation helpful? Give feedback.
-
|
See #5460 |
Beta Was this translation helpful? Give feedback.
-
|
This is amazing @flll , I am trying to achieve the same since a month. But I am not using docker. Can you KINDLY make a script like the one for nextcloud with nginx as server, caddy as reverse proxy, tailscale and cloudflare as DNS. regards |
Beta Was this translation helpful? Give feedback.
-
|
Thankyou for the kind advice. I will go for it on Monday. Well I thought that I already am in lcx,doesn't it mean the same docker hardening? |
Beta Was this translation helpful? Give feedback.
-
|
Can you please enlighten the disadvantage? |
Beta Was this translation helpful? Give feedback.
-
|
with that AIO, can caddy be installed on different separate container/ VM . ( for example: caddy in a separate proxmox LCX container and nextcloud AIO in a separate Proxmox VM. but both VM and LXC are on same network but different subnets. Is this possible? |
Beta Was this translation helpful? Give feedback.
-
I would recommend using Kubernetes or Docker Swarm. |
Beta Was this translation helpful? Give feedback.
-
Docker-based deployment has very few disadvantages. |
Beta Was this translation helpful? Give feedback.
-
|
A few weeks ago I:
now my nextcloud is only available on devices on my tailscale |
Beta Was this translation helpful? Give feedback.
-
|
I used the nginx.conf from the projects readme (link in my original comment) What is I simply used the docker compose from the README (I had to comment and uncomment some lines) |
Beta Was this translation helpful? Give feedback.
-
|
apology, it's |
Beta Was this translation helpful? Give feedback.
-
|
Is your configuration something like this? |
Beta Was this translation helpful? Give feedback.
-
|
@flll what about my case? |
Beta Was this translation helpful? Give feedback.
-
|
@A4alli |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your work @flll . But no matter how many times I try the procedure, the hostname I give in the compose environment doesn't get created in the tailscale and rather a random ephemeral hostname is created after manually authenticating using the url in the log. My Internet and Network connection is fine. But I cannot log into the nextcloud instance even with the the randomly generated hostname in my tailnet. |
Beta Was this translation helpful? Give feedback.
-
|
No, I'm deleting all containers and I deleted the .env file and tried again with same results i.e. $TS_HOSTNAME is empty. Something interesting I notice is that in some containers nextcloud is misspelled as nextlcloud , CLICK!This is is the case even after several resets and I don't see any misspelling in my compose file - |
Beta Was this translation helpful? Give feedback.
-
- - TS_HOSTNAME = nextcloud
+ - TS_HOSTNAME=nextcloudThere should be no space between the key and value in the key-value pair. |
Beta Was this translation helpful? Give feedback.
-
|
That was it, I'm into nextcloud! Thank you so much my Japanese friend. The docker compose file as in the guide complained of map and kepair format and so I edited it but didn't know that space will cause issues. I see couple of errors in the caddy log of refusing connection to fonts.json, should I be concerned? Also two more questions,
|
Beta Was this translation helpful? Give feedback.
-
|
This error seems to be due to Caddy failing to connect to nextcloud-aio-apache.
Yes, using an OAuth key makes it ephemeral.
Example ACL configuration: {
"groups": {
"group:admin": ["[email protected]", "flll@github"],
"group:azuki": ["[email protected]"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
]
}Note that "autogroup:admin" and "group:admin" are completely different groups. Please refer to Tailscale's autogroup documentation for more details. |
Beta Was this translation helpful? Give feedback.
-
Thank you as well. I was able to respond quickly because I've made the same mistake before, haha. |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone get this error? docker compose up tailscale-1 | boot: 2024/10/24 22:18:21 Running 'tailscale up' |
Beta Was this translation helpful? Give feedback.
-
I also have gone through the reverse proxy debug guide and am getting and output of |
Beta Was this translation helpful? Give feedback.
-
|
Hmm... CLICK!
{
"groups": {
"group:admin": ["[email protected]"],
},
"tagOwners": {
"tag:nextcloud": ["autogroup:admin", "group:azuki"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
],
"nodeAttrs": [
{
"target": ["group:admin", "tag:nextcloud"],
"attr": ["funnel"],
},
],
}
|
Beta Was this translation helpful? Give feedback.
-
|
I think there might be a need for it, so I'll provide the compose.yml that I'm actually using in operation. It's almost the same as what's written in the guide. CLICK!services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # この行は変更できません。
volumes:
- type: volume
source: nextcloud_aio_mastercontainer
target: /mnt/docker-aio-config
volume:
nocopy: true
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
read_only: true
networks:
- nextcloud-aio
ports:
- 0.0.0.0:4445:8080
environment: # 以下のオプションのいずれかを使用する場合に必要です
AIO_DISABLE_BACKUP_SECTION: false # これをtrueに設定すると、AIOインターフェースのバックアップセクションを非表示にできます。https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section を参照してください
APACHE_PORT: 11000 # Webサーバーやリバースプロキシの背後で実行する場合に必要です。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
APACHE_IP_BINDING: 127.0.0.1 # 同じホスト上で実行されているWebサーバーやリバースプロキシの背後で実行する場合に設定する必要があります。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
SKIP_DOMAIN_VALIDATION: true
BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # borgの保持ポリシーを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy を参照してください
COLLABORA_SECCOMP_DISABLED: false # これをtrueに設定すると、CollaboraのSeccomp機能を無効にできます。https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature を参照してください
NEXTCLOUD_DATADIR: /mnt/hdd_toshiba/ncdata # Nextcloudのデータディレクトリのホストディレクトリを設定できます。⚠️⚠️⚠️ 警告：初期のNextcloudインストールが完了した後にこの値を設定または調整しないでください！https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir を参照してください
NEXTCLOUD_MOUNT: /mnt/hdd_toshiba # Nextcloudコンテナがホストäã®選択したディレクトリにアクセスできるようにします。https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host を参照してください
NEXTCLOUD_UPLOAD_LIMIT: 10G # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud を参照してください
NEXTCLOUD_MAX_TIME: 7200 # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud を参照してください
NEXTCLOUD_MEMORY_LIMIT: 1024M # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud を参照してください
#NEXTCLOUD_TRUSTED_CACERTS_DIR: /usr/local/share/ca-certificates # このディレクトリ内のCA証明書は、nextcloudコンテナのOSによって信頼されます（例：LDAPSに有用）。https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca を参照してください
NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # AIOを初めて起動する際にインストールされるNextcloudアプリを変更できます。https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup を参照してください
NEXTCLOUD_ADDITIONAL_APKS: imagemagick # Nextcloudコンテナに追加のパッケージを永続的に追加できます。デフォルトはimagemagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container を参照してください
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # Nextcloudコンテナに追加のPHP拡張機能を永続的に追加できます。デフォルトはimagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container を参照してください
#NEXTCLOUD_ENABLE_DRI_DEVICE: false # Nextcloudコンテナで/dev/driデバイスを有効にできます。⚠️⚠️⚠️ 警告：これはホスト上に'/dev/dri'デバイスが存在する場合にのみ機能します！ホスト上に存在しない場合は、trueに設定しないでください。そうしないとNextcloudコンテナが起動に失敗します！https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud を参照してください
#NEXTCLOUD_KEEP_DISABLED_APPS: false # これをtrueに設定すると、AIOインターフェースで無効化されているNextcloudアプリを保持し、インストールされている場合はアンインストールしません。https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps を参照してください
TALK_PORT: 3478 # talkコンテナが使用するポートを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port を参照してください
WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # ホスト上のdockerソケットがデフォルトの'/var/run/docker.sock'にない場合に指定する必要があります。そうしないとマスターコンテナの更新が失敗します。macOSの場合は'/var/run/docker.sock'である必要があります
APACHE_MAX_SIZE: 10737418240 # これは整数である必要があり、NEXTCLOUD_UPLOAD_LIMITと同期している必要があります。
security_opt: ["label:disable"] # SELinuxを使用する場合に必要です
nextcloud-aio-tailscale-caddy:
image: caddy:alpine
restart: unless-stopped
environment:
- NC_DOMAIN=nextcloud.qilin-scala.ts.net # {$TS_HOSTNAME}.{tailnet-domain}という.ts.netで終わるドメインに変更してください
volumes:
- type: bind
source: ./Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # /var/run/tailscale/tailscale.sockのボリュームをマウント
read_only: true
network_mode: service:nextcloud-aio-tailscale
nextcloud-aio-tailscale:
image: tailscale/tailscale:latest
environment:
- TS_HOSTNAME=nextcloud # tailnetでのホスト名を入力してください
- TS_AUTH_KEY=tskey-client-kbjbruk4Vm11CNTRL # OAuth clientsのkeyを取得することをオススメします
- TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # OAuth client-tskeyを使う場合、advertise-tagsにtagを付与するようにしてください。tagを作成するにはACLにタグを定義する必要があります。
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # /tmp/tailscale.sockのボリュームをマウント
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # この行は変更できません。変更すると組み込みのバックアップソリューションが機能しなくなります
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001"
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1"
If there are no discrepancies in the settings with this yml, then there's probably a misconfiguration in the Tailscale admin console. |
Beta Was this translation helpful? Give feedback.
-
Thank you for your help and for this amazing guide @flll . I was setting the host name to the same name as my server and I did not realized that it was making new machine server-1 in tailscale. Thank you again for your help!!! |
Beta Was this translation helpful? Give feedback.
-
|
This was also the root of my issue. Remember that the hostname to provide both in compose.yml and the Nextcloud admin console is the new, ephemeral hostname created by Tailnet, not the current hostname of your physical machine! |
Beta Was this translation helpful? Give feedback.
-
|
Nice guide! Thanks so much. or Note: same goes for the |
Beta Was this translation helpful? Give feedback.
-
|
Update: for some reason, now it works. All I did was simply reset and restart the process several times so I'm not really sure what was the problem as I didn't change any of the configuration file. |
Beta Was this translation helpful? Give feedback.
-
|
Update: I think the problem is because I also have nginx running that occupies port 80. So make sure that no process is blocking port 80 and 443 |
Beta Was this translation helpful? Give feedback.
-
but isn't is running on 8080 as per the guidelines above?. I too get timeout error. |
Beta Was this translation helpful? Give feedback.
-
|
Yes the |
Beta Was this translation helpful? Give feedback.
-
|
well I am using only via tailscale network. So I will not need any ports to forward. next I toggol on HTTPS in tailscale Admin counsel which give me lets encrypt https. right now Im stuck on provisioning screen. I cannot visit my nextclous AIO via tailscale domain. I am pasting the required data asked by @flll, when he will analyze about what is wrong. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, one question: Should I "sudo dnf install tailscale" on my host, then follow all this docker compose things? because how would I declare ACL dst 'nextcloud.your-tailnet.ts.net'? Or do I add my device manually in tailscale admin? I might be very less informed about ACL and tags, but I am trying to learn and doing all this to use nextcloud-aio is tiring, but I am trying my best. Thanks! PS: I was using this |
Beta Was this translation helpful? Give feedback.
-
|
Hey @flll What I did:
I am sure I misunderstood a lot of things, looking for pointers, thanks! |
Beta Was this translation helpful? Give feedback.
-
|
New Setup:
|
Beta Was this translation helpful? Give feedback.
-
Please check the following conditions:
If it's not working even though the order is correct, execute the following commands: These commands will delete existing docker containers and networks.
Please configure ACL according to your environment. |
Beta Was this translation helpful? Give feedback.
-
|
@flll Brother, I finally did it. Nextcloud-AIO worked!!! What I did?
Thanks a lot! |
Beta Was this translation helpful? Give feedback.
-
|
@blazing-ph0enix Crossing your fingers is indeed an essential step in solving technical problems! 😄 It's wonderful that you're planning to share what you've learned with others. A guide for beginners will be incredibly helpful for many people. I'm looking forward to your future experiments. If you make any new discoveries, please do share them. Your experiences will be a valuable source of information for the community. Keep up the great work. And remember, if you ever run into any issues, don't hesitate to ask for help. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the guide, it's great but I cannot make it work for myself. My compose.yaml: My ACL: Caddy seems to recognize the domain name correctly, i.e. it resolves $NC_DOMAIN correctly. Tailscale logs: Tried opening 443 (TCP and UDP), 80, 8080 (out of desperation) in firewall and even disabling the firewall completely, none of it helped Seems that no matter what I do, in the nextcloud container I see: Pinging the domain name within tailscale works without problems |
Beta Was this translation helpful? Give feedback.
-
|
@MateuszFido
If you need to redo it, execute the following commands: These commands will delete existing docker containers and networks. |
Beta Was this translation helpful? Give feedback.
-
|
Yep, did those many times, my friend Finally got it today: the same issue as @Kendellb, the hostname to configure is the new, ephemeral hostname generated by Tailscale, not the current hostname of the physical machine hosting Nextcloud in tailnet. Initially, I thought your machine was just named "nextcloud" in your tailnet before running all the containers. It's worth remembering that setting the hostname provided to Nextcloud in the admin console cannot be undone - so just removing the containers, and even doing This was totally unclear to me from the guide, maybe it could be mentioned? Anyway, thanks a lot, it's a great setup nonetheless 👍 |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
nextcloud security and setup warnings |
Beta Was this translation helpful? Give feedback.
-
|
Do I have to enable HTTPS in tailscale admin counsel? |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
logs of nextcloud-aio-mastercontainer |
Beta Was this translation helpful? Give feedback.
-
|
I think this is the reason nextcloud-aio-apache container is unhealthy. But using tailscale doesn't need any port to forward/open. |
Beta Was this translation helpful? Give feedback.
-
|
Finally access the domain. |
Beta Was this translation helpful? Give feedback.
-
|
Also make sure to change your tailnet (in Tailscale DNS) |
Beta Was this translation helpful? Give feedback.
-
Disclaimer: It might be possible that the config below is not working 100% correctly, yet. Improvements to it are very welcome!
This setup integrates Nextcloud All-in-One (AIO) with Tailscale, using Caddy as a reverse proxy.
Since Tailscale currently only allows communication with localhost(127.0.0.1), we use a sidecar with Caddy to communicate with AIO.
serve.jsonconfiguration (This document does not provide an example ofserve.json)1. Set Environment Variables
Set the following environment variables:
Note
We will not create a .env file, but instead write directly into the compose.yml file later.
If you do create a .env file, compose will automatically read it. In this case, set the key-value format in service[].environment[] of the compose.yml to keys only, allowing compose to pass variables to the service.
Ensure NC_DOMAIN is in the correct format.
When using OAuth client key, set tags in TS_EXTRA_ARGS and define them in ACL.
For more detailed information, please refer to:
https://tailscale.com/blog/docker-tailscale-guide
2. Configure Docker Compose File
Create a compose.yml file with the following content. Replace environment variables as appropriate.
compose.yml
Important
Make sure to replace
NC_DOMAIN,TS_HOSTNAME,TS_AUTH_KEY, andTS_EXTRA_ARGSwith your actual values before running the docker compose file.3. Create Caddyfile
Create a Caddyfile in the current directory with the following content:
Caddyfile
Note
Do not manually replace the
{$NC_DOMAIN}variable. It will be automatically populated with the value set in your environment variables.4. Set Up Nextcloud AIO
docker compose up -dhttps://$NC_DOMAIN/(e.g., https://nextcloud.your-tailnet.ts.net/)Beta Was this translation helpful? Give feedback.
All reactions