Replies: 31 comments 236 replies
-
|
hi , |
Beta Was this translation helpful? Give feedback.
-
|
The |
Beta Was this translation helpful? Give feedback.
-
Indeed, maybe this would make the guide even easier? |
Beta Was this translation helpful? Give feedback.
-
|
I am still having some issues with the environment variables, such as this: Am I correct that for setting the environment variables inside the It should be this: ??? Then, if doing it inside the |
Beta Was this translation helpful? Give feedback.
-
This appears to be an old way of writing it. |
Beta Was this translation helpful? Give feedback.
This comment has been hidden.
This comment has been hidden.
-
|
Yes, I've been running this setup for a few weeks now, and |
Beta Was this translation helpful? Give feedback.
-
|
Nice! |
Beta Was this translation helpful? Give feedback.
-
|
See #5460 |
Beta Was this translation helpful? Give feedback.
-
|
This is amazing @flll , I am trying to achieve the same since a month. But I am not using docker. Can you KINDLY make a script like the one for nextcloud with nginx as server, caddy as reverse proxy, tailscale and cloudflare as DNS. regards |
Beta Was this translation helpful? Give feedback.
-
|
Thankyou for the kind advice. I will go for it on Monday. Well I thought that I already am in lcx,doesn't it mean the same docker hardening? |
Beta Was this translation helpful? Give feedback.
-
|
Can you please enlighten the disadvantage? |
Beta Was this translation helpful? Give feedback.
-
|
with that AIO, can caddy be installed on different separate container/ VM . ( for example: caddy in a separate proxmox LCX container and nextcloud AIO in a separate Proxmox VM. but both VM and LXC are on same network but different subnets. Is this possible? |
Beta Was this translation helpful? Give feedback.
-
I would recommend using Kubernetes or Docker Swarm. |
Beta Was this translation helpful? Give feedback.
-
Docker-based deployment has very few disadvantages. |
Beta Was this translation helpful? Give feedback.
This comment has been hidden.
This comment has been hidden.
-
|
I used the nginx.conf from the projects readme (link in my original comment) What is I simply used the docker compose from the README (I had to comment and uncomment some lines) |
Beta Was this translation helpful? Give feedback.
-
|
apology, it's |
Beta Was this translation helpful? Give feedback.
-
|
Is your configuration something like this? |
Beta Was this translation helpful? Give feedback.
-
|
@flll what about my case? |
Beta Was this translation helpful? Give feedback.
-
|
@A4alli |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your work @flll . But no matter how many times I try the procedure, the hostname I give in the compose environment doesn't get created in the tailscale and rather a random ephemeral hostname is created after manually authenticating using the url in the log. My Internet and Network connection is fine. But I cannot log into the nextcloud instance even with the the randomly generated hostname in my tailnet. |
Beta Was this translation helpful? Give feedback.
-
- - TS_HOSTNAME = nextcloud
+ - TS_HOSTNAME=nextcloudThere should be no space between the key and value in the key-value pair. |
Beta Was this translation helpful? Give feedback.
-
|
That was it, I'm into nextcloud! Thank you so much my Japanese friend. The docker compose file as in the guide complained of map and kepair format and so I edited it but didn't know that space will cause issues. I see couple of errors in the caddy log of refusing connection to fonts.json, should I be concerned? Also two more questions,
|
Beta Was this translation helpful? Give feedback.
-
|
This error seems to be due to Caddy failing to connect to nextcloud-aio-apache.
Yes, using an OAuth key makes it ephemeral.
Example ACL configuration: {
"groups": {
"group:admin": ["[email protected]", "flll@github"],
"group:azuki": ["[email protected]"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
]
}Note that "autogroup:admin" and "group:admin" are completely different groups. Please refer to Tailscale's autogroup documentation for more details. |
Beta Was this translation helpful? Give feedback.
-
Thank you as well. I was able to respond quickly because I've made the same mistake before, haha. |
Beta Was this translation helpful? Give feedback.
-
|
Non-ephemeral will make new nodes? Or ephemeral?? |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone get this error? docker compose up tailscale-1 | boot: 2024/10/24 22:18:21 Running 'tailscale up' |
Beta Was this translation helpful? Give feedback.
-
I also have gone through the reverse proxy debug guide and am getting and output of |
Beta Was this translation helpful? Give feedback.
-
|
Hmm... CLICK!
{
"groups": {
"group:admin": ["[email protected]"],
},
"tagOwners": {
"tag:nextcloud": ["autogroup:admin", "group:azuki"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
],
"nodeAttrs": [
{
"target": ["group:admin", "tag:nextcloud"],
"attr": ["funnel"],
},
],
}
|
Beta Was this translation helpful? Give feedback.
-
|
I think there might be a need for it, so I'll provide the compose.yml that I'm actually using in operation. It's almost the same as what's written in the guide. CLICK!services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # この行は変更できません。
volumes:
- type: volume
source: nextcloud_aio_mastercontainer
target: /mnt/docker-aio-config
volume:
nocopy: true
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
read_only: true
networks:
- nextcloud-aio
ports:
- 0.0.0.0:4445:8080
environment: # 以下のオプションのいずれかを使用する場合に必要です
AIO_DISABLE_BACKUP_SECTION: false # これをtrueに設定すると、AIOインターフェースのバックアップセクションを非表示にできます。https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section を参照してください
APACHE_PORT: 11000 # Webサーバーやリバースプロキシの背後で実行する場合に必要です。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
APACHE_IP_BINDING: 127.0.0.1 # 同じホスト上で実行されているWebサーバーやリバースプロキシの背後で実行する場合に設定する必要があります。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
SKIP_DOMAIN_VALIDATION: true
BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # borgの保持ポリシーを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy を参照してください
COLLABORA_SECCOMP_DISABLED: false # これをtrueに設定すると、CollaboraのSeccomp機能を無効にできます。https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature を参照してください
NEXTCLOUD_DATADIR: /mnt/hdd_toshiba/ncdata # Nextcloudのデータディレクトリのホストディレクトリを設定できます。⚠️⚠️⚠️ 警告：初期のNextcloudインストールが完了した後にこの値を設定または調整しないでください！https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir を参照してください
NEXTCLOUD_MOUNT: /mnt/hdd_toshiba # Nextcloudコンテナがホストäã®選択したディレクトリにアクセスできるようにします。https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host を参照してください
NEXTCLOUD_UPLOAD_LIMIT: 10G # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud を参照してください
NEXTCLOUD_MAX_TIME: 7200 # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud を参照してください
NEXTCLOUD_MEMORY_LIMIT: 1024M # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud を参照してください
#NEXTCLOUD_TRUSTED_CACERTS_DIR: /usr/local/share/ca-certificates # このディレクトリ内のCA証明書は、nextcloudコンテナのOSによって信頼されます（例：LDAPSに有用）。https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca を参照してください
NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # AIOを初めて起動する際にインストールされるNextcloudアプリを変更できます。https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup を参照してください
NEXTCLOUD_ADDITIONAL_APKS: imagemagick # Nextcloudコンテナに追加のパッケージを永続的に追加できます。デフォルトはimagemagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container を参照してください
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # Nextcloudコンテナに追加のPHP拡張機能を永続的に追加できます。デフォルトはimagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container を参照してください
#NEXTCLOUD_ENABLE_DRI_DEVICE: false # Nextcloudコンテナで/dev/driデバイスを有効にできます。⚠️⚠️⚠️ 警告：これはホスト上に'/dev/dri'デバイスが存在する場合にのみ機能します！ホスト上に存在しない場合は、trueに設定しないでください。そうしないとNextcloudコンテナが起動に失敗します！https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud を参照してください
#NEXTCLOUD_KEEP_DISABLED_APPS: false # これをtrueに設定すると、AIOインターフェースで無効化されているNextcloudアプリを保持し、インストールされている場合はアンインストールしません。https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps を参照してください
TALK_PORT: 3478 # talkコンテナが使用するポートを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port を参照してください
WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # ホスト上のdockerソケットがデフォルトの'/var/run/docker.sock'にない場合に指定する必要があります。そうしないとマスターコンテナの更新が失敗します。macOSの場合は'/var/run/docker.sock'である必要があります
APACHE_MAX_SIZE: 10737418240 # これは整数である必要があり、NEXTCLOUD_UPLOAD_LIMITと同期している必要があります。
security_opt: ["label:disable"] # SELinuxを使用する場合に必要です
nextcloud-aio-tailscale-caddy:
image: caddy:alpine
restart: unless-stopped
environment:
- NC_DOMAIN=nextcloud.qilin-scala.ts.net # {$TS_HOSTNAME}.{tailnet-domain}という.ts.netで終わるドメインに変更してください
volumes:
- type: bind
source: ./Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # /var/run/tailscale/tailscale.sockのボリュームをマウント
read_only: true
network_mode: service:nextcloud-aio-tailscale
nextcloud-aio-tailscale:
image: tailscale/tailscale:latest
environment:
- TS_HOSTNAME=nextcloud # tailnetでのホスト名を入力してください
- TS_AUTH_KEY=tskey-client-kbjbruk4Vm11CNTRL # OAuth clientsのkeyを取得することをオススメします
- TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # OAuth client-tskeyを使う場合、advertise-tagsにtagを付与するようにしてください。tagを作成するにはACLにタグを定義する必要があります。
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # /tmp/tailscale.sockのボリュームをマウント
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # この行は変更できません。変更すると組み込みのバックアップソリューションが機能しなくなります
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001"
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1"
If there are no discrepancies in the settings with this yml, then there's probably a misconfiguration in the Tailscale admin console. |
Beta Was this translation helpful? Give feedback.
-
Thank you for your help and for this amazing guide @flll . I was setting the host name to the same name as my server and I did not realized that it was making new machine server-1 in tailscale. Thank you again for your help!!! |
Beta Was this translation helpful? Give feedback.
-
|
This was also the root of my issue. Remember that the hostname to provide both in compose.yml and the Nextcloud admin console is the new, ephemeral hostname created by Tailnet, not the current hostname of your physical machine! |
Beta Was this translation helpful? Give feedback.
-
|
Nice guide! Thanks so much. or Note: same goes for the |
Beta Was this translation helpful? Give feedback.
-
|
Yes the |
Beta Was this translation helpful? Give feedback.
-
|
well I am using only via tailscale network. So I will not need any ports to forward. next I toggol on HTTPS in tailscale Admin counsel which give me lets encrypt https. right now Im stuck on provisioning screen. I cannot visit my nextclous AIO via tailscale domain. I am pasting the required data asked by @flll, when he will analyze about what is wrong. |
Beta Was this translation helpful? Give feedback.
-
|
Even with tailscale, you need those port to make it accessible inside your tailscale network |
Beta Was this translation helpful? Give feedback.
-
How to open up these ports in tailscale, whether it has to be done on the newly created nextcloud node or the host/server node in tailscale n/w. |
Beta Was this translation helpful? Give feedback.
-
|
I am running the whole system without any port forwarding or opening. Only in the docker compose there are the port mappings, to make the container accessible. The AIO master Container is only accessible over the ipadress from the Host running the Master container. But the rest of nextcloud does not need any port changing and is only accessible over your Domain you give into the environment variables. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, one question: Should I "sudo dnf install tailscale" on my host, then follow all this docker compose things? because how would I declare ACL dst 'nextcloud.your-tailnet.ts.net'? Or do I add my device manually in tailscale admin? I might be very less informed about ACL and tags, but I am trying to learn and doing all this to use nextcloud-aio is tiring, but I am trying my best. Thanks! PS: I was using this |
Beta Was this translation helpful? Give feedback.
-
|
Hey @flll What I did:
I am sure I misunderstood a lot of things, looking for pointers, thanks! |
Beta Was this translation helpful? Give feedback.
-
|
New Setup:
|
Beta Was this translation helpful? Give feedback.
-
Please check the following conditions:
If it's not working even though the order is correct, execute the following commands: These commands will delete existing docker containers and networks.
Please configure ACL according to your environment. |
Beta Was this translation helpful? Give feedback.
-
|
@flll Brother, I finally did it. Nextcloud-AIO worked!!! What I did?
Thanks a lot! |
Beta Was this translation helpful? Give feedback.
-
|
@blazing-ph0enix Crossing your fingers is indeed an essential step in solving technical problems! 😄 It's wonderful that you're planning to share what you've learned with others. A guide for beginners will be incredibly helpful for many people. I'm looking forward to your future experiments. If you make any new discoveries, please do share them. Your experiences will be a valuable source of information for the community. Keep up the great work. And remember, if you ever run into any issues, don't hesitate to ask for help. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the guide, it's great but I cannot make it work for myself. My compose.yaml: My ACL: Caddy seems to recognize the domain name correctly, i.e. it resolves $NC_DOMAIN correctly. Tailscale logs: Tried opening 443 (TCP and UDP), 80, 8080 (out of desperation) in firewall and even disabling the firewall completely, none of it helped Seems that no matter what I do, in the nextcloud container I see: Pinging the domain name within tailscale works without problems |
Beta Was this translation helpful? Give feedback.
-
|
@MateuszFido
If you need to redo it, execute the following commands: These commands will delete existing docker containers and networks. |
Beta Was this translation helpful? Give feedback.
-
|
Yep, did those many times, my friend Finally got it today: the same issue as @Kendellb, the hostname to configure is the new, ephemeral hostname generated by Tailscale, not the current hostname of the physical machine hosting Nextcloud in tailnet. Initially, I thought your machine was just named "nextcloud" in your tailnet before running all the containers. It's worth remembering that setting the hostname provided to Nextcloud in the admin console cannot be undone - so just removing the containers, and even doing This was totally unclear to me from the guide, maybe it could be mentioned? Anyway, thanks a lot, it's a great setup nonetheless 👍 |
Beta Was this translation helpful? Give feedback.
-
|
I'm still having this issue. I'm using the ephemeral hostname but still having issues |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Right now, Unhealthy, because I haven't deleted old machines from admin console |
Beta Was this translation helpful? Give feedback.
-
Can't use my pc right now. Will try tomorrow. |
Beta Was this translation helpful? Give feedback.
-
|
Any update |
Beta Was this translation helpful? Give feedback.
-
Yes, I will make a new comment for my specific case, I will add all the logs in it |
Beta Was this translation helpful? Give feedback.
-
|
@flll if you please jump in to here to see the issues, KINDLY |
Beta Was this translation helpful? Give feedback.
-
|
Finally access the domain. |
Beta Was this translation helpful? Give feedback.
-
The funnel feature will expose your service to the public internet.
This error message indicates that debug information is currently hidden. While it's recommended to keep error details concealed in production environments for security purposes, you can temporarily enable detailed error display when troubleshooting is necessary. Once you've resolved the issue, it's advisable to return to the default secure configuration where error details are hidden from end users.
Please remove all containers and networks, then redeploy.
If you're unsure how to use it or don't plan to use it, I recommend not using it.
If Nextcloud is working, WebDAV should also be available by default.
Security settings are already included in nextcloud-aio-apache,
Are you trying to use both cloudflared and tailscaled tunnels? |
Beta Was this translation helpful? Give feedback.
-
|
Amazing. My nextcloud is functioning well by default. I mean from starting. I think I have no need to remove and redeploy. But of course security and setup warnings will stay the same as in the pastebin. (Or should it remove and redeploy and will get rid of the warnings) Point 6. You have pasted a diagram. A bit confusion, if you may please help me with it. I want to use cloudflare as DNS not a reverse proxy or tunnel. I have caddy-dns-cloudflare-module. |
Beta Was this translation helpful? Give feedback.
-
|
@flll @szaimen https://help.nextcloud.com/t/security-and-setup-warnings-nextcloud-aio-30-0-1/208752/2 |
Beta Was this translation helpful? Give feedback.
-
|
moreover @flll the notify-push failed in here according to your guide |
Beta Was this translation helpful? Give feedback.
-
THIS IS CREATING A TONS OF CLONE MACHINE IN MY TAILSCALE |
Beta Was this translation helpful? Give feedback.
-
|
Hey, So I have tried a lot of things, now my experience is like this:
Apache logs: Nextcloud logs: Redis: Database: Notify Push: Nextcloud Mastercontainer Logs: My ACL of Tailscale: |
Beta Was this translation helpful? Give feedback.
-
|
Your tailscale is not connected as per above logs |
Beta Was this translation helpful? Give feedback.
-
|
For me this guide work fine. Only problem is apache container showing unhealthy. But working |
Beta Was this translation helpful? Give feedback.
-
|
I apologize for the delayed response. cURL error 6: Could not resolve host: server.rohu-nessie.ts.netThis error suggests that the nextcloud-aio network is constantly being created, and Tailscale might not be properly connecting to the network Here are the steps to resolve this:
docker compose down
# Stop containers containing "nextcloud" in their name
docker stop $(docker ps -a | grep nextcloud | awk '{print $1}')
# Remove containers containing "nextcloud" in their name
docker rm $(docker ps -a | grep nextcloud | awk '{print $1}')
I didn't find any issues with the ACL settings. |
Beta Was this translation helpful? Give feedback.
-
Please disable the ephemeral setting.
It's recommended to keep the default state configuration.
This is likely a temporary issue.
Often this is due to insufficient permissions on the client-side Tailscale. |
Beta Was this translation helpful? Give feedback.
-
Thankyou 😍 |
Beta Was this translation helpful? Give feedback.
-
|
Has anyone tried to deploy using the portainer stack? Caddy log: I have double-checked my NC_DOMAIN variable. compose.yml: services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line cannot be changed.
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- nextcloud-aio
ports:
- 0.0.0.0:8080:8080
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: 127.0.0.1
SKIP_DOMAIN_VALIDATION: true
caddy:
image: caddy:alpine
restart: unless-stopped
container_name: caddy
environment:
NC_DOMAIN: nextcloud.[redacted].ts.net # Change this to your domain ending with .ts.net in the format {$TS_HOSTNAME}.{tailnetdomain}
volumes:
- type: bind
source: /home/surya/Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # Mount the volume for /var/run/tailscale/tailscale.sock
read_only: true
network_mode: service:tailscale
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
environment:
TS_HOSTNAME: nextcloud # Enter the hostname for your tailnet
TS_AUTH_KEY: tskey-client-kYthXvJbHD21CNTRL-[redacted] # OAuth client key recommended
TS_EXTRA_ARGS: --advertise-tags=tag:nextcloud # Tags are required when using OAuth client
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # Mounting the entire /tmp folder to access tailscale.sock
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed.
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001" # Jumbo Frame
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1" # Harden aioTailscale ACL: "groups": {
"group:admin": ["js-surya@github"],
"group:users": ["[email protected]", "[email protected]"],
},
"tagOwners": {
"tag:nextcloud": ["group:admin"],
},
"acls": [
// Allow general unrestricted access (you can comment this out if needed).
{"action": "accept", "src": ["*"], "dst": ["*:*"]},
// Allow users in "group:users" to access any devices tagged with "nextcloud".
{"action": "accept", "src": ["group:users"], "dst": ["tag:nextcloud:*"]},I'm not an IT expert, and I'm relatively new to this. My IP is behind CGNAT, and I want to access my Nextcloud server outside my local network using Tailscale. I'm eager to learn, so any suggestions or help would be appreciated. |
Beta Was this translation helpful? Give feedback.
-
|
NC_DOMAIN=nextcloud.talscale.ts.net Remember there is = and than no space |
Beta Was this translation helpful? Give feedback.
-
TS_HOSTNAME=nextcloud # Hostname in Tailnet
NC_DOMAIN=nextcloud.mydomain.ts.net # Format: {$TS_HOSTNAME}.{$tailnetdomain}.ts.net
TS_AUTH_KEY=tskey-client-kYthXvJbHD21CNTRL-mykey # OAuth client key recommended
TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # For OAuth client key usageHere is my .env config |
Beta Was this translation helpful? Give feedback.
-
|
check my config files above that work |
Beta Was this translation helpful? Give feedback.
-
|
Apache is always unhealthy docker exec -it nextcloud-aio-apache bash -x /healthcheck.sh
|
Beta Was this translation helpful? Give feedback.
-
|
Same here |
Beta Was this translation helpful? Give feedback.
-
|
check my last comment below for solution with serve.json |
Beta Was this translation helpful? Give feedback.
-
|
Checked it. Is there a way to check if a port is open to public? Will try and report. |
Beta Was this translation helpful? Give feedback.
-
|
what about your security and setup warnings? |
Beta Was this translation helpful? Give feedback.
-
|
@flll Wanted to mention that I was able to get this working without needing caddy at all. I think it simplifies things a bit. Tailscale can natively proxy Note this employs tailscale serve (as opposed to tailscale funnel) so will only expose the service to your tailnet, not publicly. You could set a funnel flag to true in the json config below to expose it publicly, though some security and performance caveats would apply if you did.
|
Beta Was this translation helpful? Give feedback.
-
Enable Funnel in the Tailscale admin console PS: Also add node attributes in the ACL policy file. For more info see the official doc - https://tailscale.com/kb/1223/funnel |
Beta Was this translation helpful? Give feedback.
-
|
@js-surya thanks a lot for the json for Funnel; where would the json file need to be added? We haven't set a volume as they show in the official Tailscale docs https://tailscale.com/blog/docker-tailscale-guide And related question, we haven't set the tailscale variable for serve, is that something that needs to be added to the docker-compose? |
Beta Was this translation helpful? Give feedback.
-
I am utilizing the native proxy method provided by @patrick-theprogrammer, as detailed in 1 and 2, without employing Caddy as a sidecar. Please take a look at his compose file and serve-config.json there, you can find the serve config variable and volume. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @patrick-theprogrammer! This feels like a much better approach for me personally ( A couple of things to note in case others run into similar issues:
nextcloud-aio:
image: nextcloud/all-in-one:latest
container_name: nextcloud-aio-mastercontainer # app requirement
depends_on:
- nextcloud-tailscale
ports:
- 8080:8080 <----------------------------
|
Beta Was this translation helpful? Give feedback.
-
|
No need of exposing port 8080. You call [tailscal].ts.net:8443 |
Beta Was this translation helpful? Give feedback.
-
|
@patrick-theprogrammer there is no port assigned to nextcloud-aio, how you assess to containers? and assign domain etc? |
Beta Was this translation helpful? Give feedback.
-
|
moreover have you changed anything in VM domain, /etc/hosts, /etc/hostname. |
Beta Was this translation helpful? Give feedback.
-
|
No I did not make any changes on the host machine outside of creating the serve config file. I didn't explicitly expose any ports or do any dns setup because that is basically what using the Tailscale docker container and Tailscale serve does for you. The Nextcloud container has network mode set to the Tailscale container, which routes all of its network traffic through the Tailscale container. The Tailscale docs really explain this best, I would highly recommend reading through them in detail before attempting to understand how to use it for Nextcloud specifically. The setup for Nextcloud isn't fundamentally any different than using Tailscale to expose any other docker app. |
Beta Was this translation helpful? Give feedback.
-
|
thank you. I have gone through their documents. but still some hardship to understand completely. also in contact with Tailscale dev team. |
Beta Was this translation helpful? Give feedback.
-
|
You're welcome! I understand, these topics can be challenging to learn. The full serve config I posted in my setup proxies https://nextcloud.yourtailnet.ts.net:8443 to the Nextcloud AIO app itself running at port 8080 within its container, so that's what you would want to use to initially access the AIO interface for setup. Alternatively, you should be able to use the Tailscale assigned IP address of the machine called "nextcloud" (you can find this IP address in your tailscale admin console, it should start with 100). This will give you direct access to the Nextcloud AIO container's network, so you would do https://100.x.y.z:8080 |
Beta Was this translation helpful? Give feedback.
-
|
Also, I know you mentioned wanting to use a custom domain name that you own, rather than your tailnet domain. You can use something like cloudflare to make eg The Tailscale team has a good video on this topic below: There's also this cool tool that will apparently automate some of this process for you across all the apps you host through Tailscale: I've been wanting to try this myself, but haven't gotten around to it yet. I would definitely get Nextcloud working on your tailnet before attempting any custom domain stuff since it adds a whole other layer of complexity to learn. |
Beta Was this translation helpful? Give feedback.
-
|
If Others are interested I can write up how I was able to do this without caddy using tailscale serve. I was having issues with the caddy container so decided to use serve to route traffic to the apache port when you vist nextcloud.tailnet.ts.net. So far has been working well. |
Beta Was this translation helpful? Give feedback.
-
|
yes, please do write. It's good approach. I talked to Tailscale dev via email. they also suggested to use serve instead of caddy. |
Beta Was this translation helpful? Give feedback.
-
|
FYI I did a write up on how to set it up that way earlier in the thread already. Feel free to add to that thread if you have any additional improvements. |
Beta Was this translation helpful? Give feedback.
-
|
@patrick-theprogrammer Ill check it out and see if I can add anything! |
Beta Was this translation helpful? Give feedback.
-
|
Go check out @patrick-theprogrammer guide above ^ my docker compose looks almost the same and same serve.json |
Beta Was this translation helpful? Give feedback.
-
I havent tried that but I run a tailscale as a side car with other docker containers and use the magic dns names instead. Such as nextcloud.tail.ts.net for my nextcloud instance. |
Beta Was this translation helpful? Give feedback.
-
|
The environment Variable in the Caddyfile seems not to work for me in that way. Everything else worked now, I'm thinking if there is maybe a possibility to have variables in the compose file itself... So that I don't need the Hostname 2x |
Beta Was this translation helpful? Give feedback.
-
|
@flll and @patrick-theprogrammer has done incredible work without any doubt. Bravoo <3 |
Beta Was this translation helpful? Give feedback.
-
|
Sorry for the confusion, but the Damain Validation is now also not working anymore for me. I have used a wrong caddyfile at the beginning which made it working. |
Beta Was this translation helpful? Give feedback.
-
|
It works for me with caddy. Just without domain validation. |
Beta Was this translation helpful? Give feedback.
-
|
Heyo, first of all, thank you for this guide. 2 Questions are rising: For testing purpose i connected into the docker containers, e.g. into the nextcloud-aio-nextcloud with bash, and tried to ping my tailscale network. But i can acccess my nextcloud whatsover, everything is working. Any suggestions? |
Beta Was this translation helpful? Give feedback.
-
|
I recreated everything last night And it worked on a fresh install. But first I had a massive IOdelay, caused by collabora, which caused my whole server rack to went very slow. |
Beta Was this translation helpful? Give feedback.
-
Nice to have someone who made it also work, so it's not just a coincidence! 👍 |
Beta Was this translation helpful? Give feedback.
-
|
its basically loopback DNS issue which can be settle on the router. but need some settings and experience, though few guides on Google. installing Tailscale on host directly solve that problem automatically without fingering in router settings |
Beta Was this translation helpful? Give feedback.
-
|
I am kind of new to routing and DNS, so this solution seems for me the best for now. Will report if I feel like something is not smooth in the future. |
Beta Was this translation helpful? Give feedback.
-
|
Well do try the NAT thing in router. |
Beta Was this translation helpful? Give feedback.
-
|
I have a slight issue and I'm guessing it's a rookie error. I put the $NC_DOMAIN as my Unraid server's full domain (the one on the tailscale network) and when I open nextcloud in the nextcloud UI, it sends me to my Unraid server's GUI. Where have I gone wrong here? |
Beta Was this translation helpful? Give feedback.
-
|
These are my ACLs and its working: |
Beta Was this translation helpful? Give feedback.
-
|
I am speechless. Omg, thank you both so much. It was the tags!!!!! It's all working, you absolute legends!!!!! |
Beta Was this translation helpful? Give feedback.
-
|
Does the nextcloud office work? |
Beta Was this translation helpful? Give feedback.
-
|
If office you mean like being able to create files etc? Then yes, mines working. |
Beta Was this translation helpful? Give feedback.
-
|
I mean Nextloud Office (collabora). |
Beta Was this translation helpful? Give feedback.
-
|
@patrick-theprogrammer your script compose.yml and serve.json is absolutely fine. The trick is in the tailscale, which also need to be installed on host machine as well. Apache container is Healthy and only three security and setup warnings which can be managed manually. |
Beta Was this translation helpful? Give feedback.
-
|
I installed Tailscale on host machine and than did fresh installation. All well. |
Beta Was this translation helpful? Give feedback.
-
|
@patrick-theprogrammer how to run 'occ maintenance:repair --include-expensive' |
Beta Was this translation helpful? Give feedback.
-
|
@flll great work with this how-to, and the comments really helped me. A few comments that may be useful to others (which could be added to your original post)
Also just a note, it might take some time to get the files all the setup ready on Tailscale's side when starting up the Docker environment. It took 10 minutes for me, having the error in the Nextcloud AIO interface "Failed to connect to server", just be patient (I tried debugging for no reason facepalm). |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for participating. A) Docker compose does not make a difference between "true" and true. B) with : it is a valid form for environment variables. And Are the same. Sometimes, when debugging, we find "errors" which don't exist. 😁 |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for this; we learn everyday! |
Beta Was this translation helpful? Give feedback.
-
|
Hi y’all! First of all, thank you So Much for writing this guide; I was trying to set up the AIO container with Tailscale a few months ago, and I couldn’t get the networking to work for the life of me. That said, I’m having a problem following this guide. I’ve only gotten as far as the initial I’m sure this is a noob error—I’m still pretty new to both networking and containers—but could you clarify what I might be doing wrong, please? |
Beta Was this translation helpful? Give feedback.
-
|
The logs from tailscale should not relate to the try to connecting to the AIO master Container, due this should work outside of tailscale. Find your hosts LOCAL - not tailscale - ipadress (the Server or VM which is running the docker command), and enter it into the browser with the port you defined in the docker compose file for the Master container. That should lead you to the First login screen on the Master container. |
Beta Was this translation helpful? Give feedback.
-
|
Ohh, okay, thank you so much! That did the trick; I’m in the initial setup now. |
Beta Was this translation helpful? Give feedback.
-
|
Hello everyone! First I would like to say that this is an excellent guide, @flll! Thank you! Now, I'm interested in running It's worth mentioning that I already have managed to run |
Beta Was this translation helpful? Give feedback.
-
|
Install tailscale also native on the host machine itself. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the reply! I did and it actually worked! But... Can someone, please, explain why it is necessary? |
Beta Was this translation helpful? Give feedback.
-
|
I think is has something to do with the /etc/resolv.conf, because this gets overridden when installing tailscale. I think it should not be necessary, due the docker containers should use the network from the tailscale container, but this is where my knowledge ends. |
Beta Was this translation helpful? Give feedback.
-
|
@patrick-theprogrammer After new Tailscale update, the setup you have describe earlier is not working. Tailscale cannot connect to endpoint. Tailscale container restarting frequently |
Beta Was this translation helpful? Give feedback.
-
|
I had similar issue and I moved from from serve config of Tailscale to caddy, but no help. Unable to connect to Nextcloud instance in Tailscale. |
Beta Was this translation helpful? Give feedback.
-
|
My tailscale with caddy setup still works, but my host machine had its resolve.conf overwritten for any reasons. |
Beta Was this translation helpful? Give feedback.
-
|
its a Tailscale update bug. They will fix it soon. Basically bug in docker tailscale. They have posted it yesterday. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I tried it but couldn't get it working. |
Beta Was this translation helpful? Give feedback.
-
|
there is something new in market. TSDPROXY. Anyone tried it? |
Beta Was this translation helpful? Give feedback.
-
|
This is definitely something I plan to try in the future. Basically someone took tailscale's programmatic go plugin (tsnet) and wrote their own web proxy around it. So you can have one tsdproxy container with access to the whole docker internal network rather than one docker sidecar container per app you are hosting. Should reduce complexity and resource usage when self hosting a bunch of apps. There's some limitations in that it's not as configurable since it's not actually running the whole Tailscale app just programmatically integrating with your tailnet. For simple use it should work well though. There's also tailscale's experimental own caddy extension https://github.com/tailscale/caddy-tailscale which has been out for a while and serves a similar purpose / is worth a look. I was never able to get this working the exact way I wanted to when it launched though, but maybe I'll try again in the future. |
Beta Was this translation helpful? Give feedback.
-
|
Looking forward for that. |
Beta Was this translation helpful? Give feedback.
-
|
Well I'm confused regarding my setup. Don't know what is causing issue. I have to install tailscale on host machine separately in order to solve the DNS resolver for tailscale + nextcloud-aio in docker on same host. |
Beta Was this translation helpful? Give feedback.
-
|
moreover, what if apache_bind to 127.0.0.1. instead of 0.0.0.0 |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @flll @A4alli . Excellent guide. Finally, I was able to run Nextcloud server locally. Silly me, I didn't enable HTTPS in tailscale admin due to which I was unable to access. Learnt a lot!! |
Beta Was this translation helpful? Give feedback.
-
|
Hi there! Error seems to be EDIT : I just fixed the UDP Buffer size, and that error doesn't show anymore, but it won't let me in due to the abovementioned error. |
Beta Was this translation helpful? Give feedback.
-
|
Moreover, use tailscale serve config by @patrick-theprogrammer |
Beta Was this translation helpful? Give feedback.
-
|
Does the serve config use the serve functionality from tailscale? |
Beta Was this translation helpful? Give feedback.
-
|
Serve never expose any port and not to public internet. That is funnel which do open to public internet. With caddy setup you are exposing port to internal host. But with server you can also avoid that |
Beta Was this translation helpful? Give feedback.
-
I got this error after doing everything. The only differing step was that I couldn't run |
Beta Was this translation helpful? Give feedback.
-
|
Well, are the containers running then? Check with docker ps, if the containers are running. |
Beta Was this translation helpful? Give feedback.
-
|
@chamabreu did you get theme error in logs? Further more did you get rid of those mime-type and email + phone warnings in Security Warning and setup tab inside nextcloud instance settings? |
Beta Was this translation helpful? Give feedback.
-
|
I did not even tried to remove them, cause they don't seem to have any impact on the instance. |
Beta Was this translation helpful? Give feedback.
-
|
Yes not related to this setup specifically. Well phone-region is easy to get rid. For email I tried but not succeeded. And mime-type I did try but could solve |
Beta Was this translation helpful? Give feedback.
-
|
One annoying thing in log is HAMS or something like it. Don't exactly remember. But this error occurs when 2FA via app for nextcloud app is setup for login. |
Beta Was this translation helpful? Give feedback.
and others
-
Disclaimer: It might be possible that the config below is not working 100% correctly, yet. Improvements to it are very welcome!
This setup integrates Nextcloud All-in-One (AIO) with Tailscale, using Caddy as a reverse proxy.
Since Tailscale currently only allows communication with localhost(127.0.0.1), we use a sidecar with Caddy to communicate with AIO.
serve.jsonconfiguration (This document does not provide an example ofserve.json)1. Set Environment Variables
Set the following environment variables:
Note
We will not create a .env file, but instead write directly into the compose.yml file later.
If you do create a .env file, compose will automatically read it. In this case, set the key-value format in service[].environment[] of the compose.yml to keys only, allowing compose to pass variables to the service.
Ensure NC_DOMAIN is in the correct format.
When using OAuth client key, set tags in TS_EXTRA_ARGS and define them in ACL.
For more detailed information, please refer to:
https://tailscale.com/blog/docker-tailscale-guide
2. Configure Docker Compose File
Create a compose.yml file with the following content. Replace environment variables as appropriate.
compose.yml
Important
Make sure to replace
NC_DOMAIN,TS_HOSTNAME,TS_AUTH_KEY, andTS_EXTRA_ARGSwith your actual values before running the docker compose file.3. Create Caddyfile
Create a Caddyfile in the current directory with the following content:
Caddyfile
Note
Do not manually replace the
{$NC_DOMAIN}variable. It will be automatically populated with the value set in your environment variables.4. Set Up Nextcloud AIO
docker compose up -dhttps://$NC_DOMAIN/(e.g., https://nextcloud.your-tailnet.ts.net/)Beta Was this translation helpful? Give feedback.
All reactions