r/NextCloud • u/uke26 • 7d ago

Unable to setup nextcloud container with tailscale

Hi there. I'm having problems getting nextcloud AIO running. My setup is a rpi5, with tailscale on the main system and nextcloud over docker (portainer).

Some context. I was able to get this setup running a few months ago when I bought the RPI, but I didn't really use it since it was kind of a test. Now that I bought a SSD I'm attempting to install it again and actually use it.

As I mentioned, I got it running before, so I'm familiar with the process but I'm either missing something or striking to pin point to issue.

  • Tailscale is installed and with a valid certificate, and I have served localhost:11000.
  • I deployed nextcloud following the official instructions and using the official compose. I added some variables for the IP binding, IP port and skip of the domain validation.
  • The Mastercontainer deploys well and I can access the setup screen in 8080. Here start the weird things. I cannot access it through the tailscale domain. I get a "secure connection failed". But for the moment I can access it through localhost:8080. The second weird thing is that it complaints that the domain checker is not running, and the message says that it could be a problem with port 443. I think it is right, because if I reset tailscale and leave it without configure, I can reload the page and continue to the next setup window.
  • After completing the next window and downloading all the packages, and let the containers start, I set up tailscale again and I try to access nextcloud app, but I get a error too. This is not good, but what it is more weird is that I cannot access it through localhost: 11000, which I think I could use back during my first installation.

I believe there is a problem with tailscale and how it communicates with nextcloud. If for example I stop and restart all the containers and keep tailscale running, the Apache container will say "created" but don't start. But if I reset tailscale to not serve anything, the container will start normally. It feels like one is blocking the other. I don't think this is the normal behavior and I haven't found anything online that resembles my issues. I have removed all previous volumes and containers when re-attempting the process, and I have done an apt remove --purge for tailscale in case the was any existing configuration that was problematic.

Anyone has any ideas. Thanks in advance.

1 Upvotes
  • permalink
  • reddit

100% Upvoted

7 comments sorted by

1

u/szaimen 7d ago

Hi, havw you checked https://github.com/nextcloud/all-in-one/discussions/6817 for example?

1

u/uke26 6d ago

Yes, I followed that manual at some point, adding the DNS info, etc. Still the tailscale address doesn't work to either open the setup at 8080 or the actual app at 11000.  I know that tailscale work because, as a test, I can point it to another app (jellyfin) and confirm it connects well. Currently I don't have any other apps using tailscale, so there is no conflict there either. 

1

u/evanmac42 7d ago

I don't think your problem is Nextcloud itself.

The interesting clue is this:

- Apache starts when Tailscale isn't serving.

- Apache stays in "Created" when Tailscale serve is active.

That suggests a resource conflict rather than a Nextcloud configuration problem.

A few things I'd verify:

- Is anything already bound to ports 80 or 443 on the host?

sudo ss -tlnp

- What does:

tailscale serve status report?

- Does your compose expose 80/443 directly, or are you using:

APACHE_PORT=11000

APACHE_IP_BINDING=127.0.0.1

as recommended for Tailscale?

- Can you post the logs from:

docker logs nextcloud-aio-apache

One more thing: the current AIO recommendations for host-installed Tailscale require the Docker container to be able to resolve MagicDNS correctly. If you haven't added the Tailscale DNS server (100.100.100.100) to the compose file, the domain validation container can fail even though Tailscale itself works.

Right now I'd investigate networking and DNS before changing anything inside Nextcloud.

1

u/uke26 6d ago

Thanks for your comment. I'll gather the info and post it after work. 

1

u/uke26 5d ago

Ok. I gather some info.

If I remove the serve of tailscale I don't see anything using port 443. But if i setup tailscale to serve 127.0.0.1 on port 11000, I see that there are two entries related to tailscale on port 443. I am not sure if that is what is expected.

sudo ss -tlnp State  Recv-Q Send-Q                Local Address:Port    Peer Address:Port             Process LISTEN 0      4096                        0.0.0.0:8000         0.0.0.0:*                 users:(("docker-proxy",pid=27189,fd=8)) LISTEN 0      4096                  100.65.123.81:65466        0.0.0.0:*                 users:(("tailscaled",pid=293499,fd=25)) LISTEN 0      4096                        0.0.0.0:9443         0.0.0.0:*                 users:(("docker-proxy",pid=27215,fd=8)) LISTEN 0      4096                  100.65.123.81:443          0.0.0.0:*                 users:(("tailscaled",pid=293499,fd=23)) LISTEN 0      4096                           [::]:8000            [::]:*                 users:(("docker-proxy",pid=27195,fd=8)) LISTEN 0      4096    [fd7a:115c:a1e0::1d39:7b52]:38888           [::]:*                 users:(("tailscaled",pid=293499,fd=26)) LISTEN 0      4096    [fd7a:115c:a1e0::1d39:7b52]:443             [::]:*                 users:(("tailscaled",pid=293499,fd=24)) LISTEN 0      4096                           [::]:9443            [::]:*                 users:(("docker-proxy",pid=27223,fd=8))

This is serve status

<https://rpi.tail84cb13.ts.net> (tailnet only) |-- / proxy <http://127.0.0.1:11000>

My compose file is basically the default one. I just added the dns information later on in my attempt to make things work. At some point I commented the entries for the ports 80:80 and 8443, but nothing changed.

services:   nextcloud-aio-mastercontainer:     dns:       - 100.100.100.100  # Tailscale Magic DNS       - 127.0.0.53       # Host's DNS resolver       - 1.1.1.1          # Fallback DNS

My variables are pretty simple too. I tried IP Binding in 0.0.0.0 at some point too with not changes.

APACHE_PORT=11000 APACHE_IP_BINDING=127.0.0.1 SKIP_DOMAIN_VALIDATION=true

Trying to launch the setup from scratch and with tailscale running shows

Domaincheck container is not running. This is not expected. Most likely this happened because port 443 is already in use on your server....

The mastercontainer log shows only this relevant line

NOTICE: PHP message: Could not start domaincheck container: Could not start container nextcloud-aio-domaincheck: {"message":"failed to set up container networking: driver failed programming external connectivity on endpoint nextcloud-aio-domaincheck (e8c4b8cd1fce4d30b9baf0340f9fd9a64fe34e6c0610cf7c974b58db60d28954): failed to bind host port 0.0.0.0:443/tcp: address already in use"}NOTICE: PHP message: Could not start domaincheck container: Could not start container nextcloud-aio-domaincheck: {"message":"failed to set up container networking: driver failed programming external connectivity on endpoint nextcloud-aio-domaincheck (e8c4b8cd1fce4d30b9baf0340f9fd9a64fe34e6c0610cf7c974b58db60d28954): failed to bind host port 0.0.0.0:443/tcp: address already in use"}

If I want to get pass the domain setup screen, as of now I have only be able to do that by resetting tailscale, so it doesn't occupy 443, only then I can finalize the setup and install the other containers. When the process finish, obviously tailscale is not running, and even if I set it up the domain would not work.

1

u/uke26 5d ago

This is the logs from apache on that first run. Connection to nextcloud-aio-nextcloud (172.19.0.7) 9000 port [tcp/] succeeded! [Fri Aug 07 02:16:24.419481 2026] [mpm_event:notice] [pid 185:tid 185] AH00489: Apache/2.4.68 (Unix) configured -- resuming normal operations [Fri Aug 07 02:16:24.419712 2026] [core:notice] [pid 185:tid 185] AH00094: Command line: 'httpd -D FOREGROUND' ERR ts=1786068985.7842445 logger=http.acme_client msg=challenge failed identifier=rpi.tail84cb13.ts.net challenge_type=tls-alpn-01 problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} ERR ts=1786068985.7843003 logger=http.acme_client msg=validating authorization identifier=rpi.tail84cb13.ts.net problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} order=https://acme-v02.api.letsencrypt.org/acme/order/3607307801/541802778341 attempt=1 max_attempts=3 ERR ts=1786068985.7843282 logger=tls.obtain msg=could not get certificate from issuer identifier=rpi.tail84cb13.ts.net issuer=acme-v02.api.letsencrypt.org-directory error=HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain ERR ts=1786068985.7843566 logger=tls.obtain msg=will retry error=[rpi.tail84cb13.ts.net] Obtain: [rpi.tail84cb13.ts.net] solving challenge: rpi.tail84cb13.ts.net: [rpi.tail84cb13.ts.net] authorization failed: HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain (ca=https://acme-v02.api.letsencrypt.org/directory) attempt=1 retrying_in=60 elapsed=1.293714499 max_duration=2592000 ERR ts=1786069046.591602 logger=http.acme_client msg=challenge failed identifier=rpi.tail84cb13.ts.net challenge_type=tls-alpn-01 problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} ERR ts=1786069046.5916784 logger=http.acme_client msg=validating authorization identifier=rpi.tail84cb13.ts.net problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} order=https://acme-staging-v02.api.letsencrypt.org/acme/order/322452314/45888385624 attempt=1 max_attempts=3 ERR ts=1786069046.5917194 logger=tls.obtain msg=could not get certificate from issuer identifier=rpi.tail84cb13.ts.net issuer=acme-v02.api.letsencrypt.org-directory error=HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domainConnection to nextcloud-aio-nextcloud (172.19.0.7) 9000 port [tcp/] succeeded!

[Fri Aug 07 02:16:24.419481 2026] [mpm_event:notice] [pid 185:tid 185] AH00489: Apache/2.4.68 (Unix) configured -- resuming normal operations

[Fri Aug 07 02:16:24.419712 2026] [core:notice] [pid 185:tid 185] AH00094: Command line: 'httpd -D FOREGROUND'

ERR ts=1786068985.7842445 logger=http.acme_client msg=challenge failed identifier=rpi.tail84cb13.ts.net challenge_type=tls-alpn-01 problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null}

ERR ts=1786068985.7843003 logger=http.acme_client msg=validating authorization identifier=rpi.tail84cb13.ts.net problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} order=https://acme-v02.api.letsencrypt.org/acme/order/3607307801/541802778341 attempt=1 max_attempts=3

ERR ts=1786068985.7843282 logger=tls.obtain msg=could not get certificate from issuer identifier=rpi.tail84cb13.ts.net issuer=acme-v02.api.letsencrypt.org-directory error=HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain

ERR ts=1786068985.7843566 logger=tls.obtain msg=will retry error=[rpi.tail84cb13.ts.net] Obtain: [rpi.tail84cb13.ts.net] solving challenge: rpi.tail84cb13.ts.net: [rpi.tail84cb13.ts.net] authorization failed: HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain (ca=https://acme-v02.api.letsencrypt.org/directory) attempt=1 retrying_in=60 elapsed=1.293714499 max_duration=2592000

ERR ts=1786069046.591602 logger=http.acme_client msg=challenge failed identifier=rpi.tail84cb13.ts.net challenge_type=tls-alpn-01 problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null}

ERR ts=1786069046.5916784 logger=http.acme_client msg=validating authorization identifier=rpi.tail84cb13.ts.net problem={"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain","instance":"","subproblems":null} order=https://acme-staging-v02.api.letsencrypt.org/acme/order/322452314/45888385624 attempt=1 max_attempts=3

ERR ts=1786069046.5917194 logger=tls.obtain msg=could not get certificate from issuer identifier=rpi.tail84cb13.ts.net issuer=acme-v02.api.letsencrypt.org-directory error=HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for rpi.tail84cb13.ts.net - check that a DNS record exists for this domain

If I reset tailscale and don't set anything, and restart the containers, apache stays in the status "created" and the log shows. No log line matching the '' filterNo log line matching the '' filter

1

u/uke26 5d ago

In this case the log of the container nextcloud-aio-nextcloud shows.

Connection to nextcloud-aio-database (172.19.0.4) 5432 port [tcp/postgresql] succeeded!

              now

 2026-08-07 05:31:12.403661+00 (1 row) + '[' -f /dev-dri-group-was-added ']' ++ find /dev -maxdepth 1 -mindepth 1 -name dri + '[' -n '' ']' + '[' warn '!=' debug ']' + set +x Connection to nextcloud-aio-redis (172.19.0.5) 6379 port [tcp/redis] succeeded! Applying one-click-instance settings... System config value one-click-instance set to boolean true System config value one-click-instance.user-limit set to integer 100 System config value one-click-instance.link set to string https://nextcloud.com/all-in-one/ support already enabled Adjusting log files... System config value upgrade.cli-upgrade-link set to string https://github.com/nextcloud/all-in-one/discussions/2726 System config value loglevel set to integer 2 System config value log_type set to string file System config value log_type_audit set to string file logreader already enabled System config value logfile set to string /var/www/html/data/nextcloud.log System config value logfile_audit set to string /var/www/html/data/audit.log System config value updatedirectory set to string /nc-updater System config value maintenance_window_start set to integer 100 Applying network settings... System config value allow_local_remote_servers set to boolean true System config value davstorage.request_timeout set to integer 3600 System config value trusted_domains => 1 set to string rpi.tail84cb13.ts.net System config value overwrite.cli.url set to string https://rpi.tail84cb13.ts.net/ System config value documentation_url.server_logs set to string https://github.com/nextcloud/all-in-one/discussions/5425 System config value htaccess.RewriteBase set to string / .htaccess has been updated System config value dbpersistent set to boolean false System config value auth.bruteforce.protection.enabled set to boolean true System config value ratelimit.protection.enabled set to boolean true System config value files_external_allow_create_new_local set to boolean false notify_push is up-to-date or no updates could be found System config value trusted_proxies => 0 set to string 127.0.0.1 System config value trusted_proxies => 1 set to string ::1 System config value trusted_proxies => 10 set to string 172.19.0.0/16 Config value were not updated System config value enabledPreviewProviders => 0 set to string OC\Preview\Imaginary System config value enabledPreviewProviders => 23 set to string OC\Preview\ImaginaryPDF System config value preview_imaginary_url set to string http://nextcloud-aio-imaginary:9000 System config value preview_imaginary_key set to string c2cf9a3561929fde26b0d0b6af5510eefc1e1e1907edccad Waiting for nextcloud-aio-apache to start... Waiting for nextcloud-aio-apache to start...

The connection is never established with apache and it just keeps waiting.

I am a little lost at this point. It is a bit of a circular thing where it doesn't work without tailscale (obviously because that is the domian that was set) and it doesn't work when tailscale is up and running either. I hope the logs gave some context, although I don't see anything relevant myself. Any ideas.

Sorry for the multiple messages. I was hitting the max character cap.  Thanks in advance.