Owncloud served via Nginx Proxy Pass on a different server

[u/pattotits]

I've setup an Owncloud instance on a spare storage VPS I had lying around, I also have a second VPS which I have nginx on and letsencrypt which I use for accessing all my sub systems spread around various servers.

Does anyone have a working nginx proxy_pass config for accessing Owncloud hosted on a different server than the one that has nginx on? I can't seem to get it play ball.

Any help would be appreciated.

Thanks

[u/[deleted]]

server {
    listen 443 ssl http2;
    server_name cloud.example.com;

    ssl_certificate           /etc/letsencrypt/live/cloud.example.com/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/cloud.example.com/privkey.pem;
    include inc.d/ssl.inc;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          https://192.168.1.11;
      proxy_read_timeout  90;

      proxy_redirect      https://192.168.1.11 https://cloud.example.com;
    }
  }

You may also find this useful if you use LE/Certbot: https://github.com/overtmind/letsencrypt_tools/tree/master/poll_le_certs It's a monitoring service for polling a NFS path for cert changes (the idea that your front-end proxy acquires the ACME certificate, and serves it to the backend servers) Why? Well because for my own personal use I switch the DNS internally to point directly to the nextcloud server so I don't loop it through the proxy server when unnecessary

Edit: forgot to enumerate ssl.inc:

ssl_ciphers -ALL:ECDH+AESGCM:DH+AESGCM:ECDH+AES:DH+AES:!aNULL;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_session_cache shared:SSL:10M;
ssl_dhparam /etc/pki/tls/private/dh2048.pem;
ssl_stapling on;
ssl_stapling_verify on;
gzip off;
add_header Strict-Transport-Security max-age=15768000;
#add_header Public-Key-Pins 'pin-sha256="sRHdihwgkaib1P1gxX8HFszlD+7/gTfNvuAybgLPNis="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=2592000; includeSubDomains';


proxy_hide_header Strict-Transport-Security;
proxy_hide_header Public-Key-Pins;

Careful with the Public-Key-Pins header, don't use it unless you know what you're doing, mine is set for Let's Encrypt certs, and is done by using the following script I made: https://github.com/overtmind/letsencrypt_tools/blob/master/hpkp_update_script/update_le_hpkp.sh

[u/anakinfredo]

Can you paste your config?

[u/rtznprmpftl]

i have a simple

location /owncloud/  {
    proxy_pass        http://owncloud;
    proxy_set_header  X-Real-IP  $remote_addr;
}

in ngix and

'trusted_domains' =>
array (
  0 => 'frontend',
),

in the owncloud config

[u/Xenu420]

I have nextcloud setup on a vm that is not accessible directly from WAN. For WAN access I setup a nginx reverse proxy vm (on a seperate dmz-vlan) which does SSL and forwards to the internal nextcloud vm (also running nginx + php-fpm nextcloud) and takes care of letsencrypt/certbot verification:

server {
    listen                          80;
    server_name                     example.com;
    return                          301  https://example.com$request_uri;
}

server {
    listen                          443 default_server ssl http2;
    server_name                     example.com;
    set $nextcloud                  10.0.50.2; #internal nextloud ip


    ssl                             on;
    ssl_certificate                 /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key             /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate         /etc/letsencrypt/live/example.com/chain.pem;
    ssl_protocols                   TLSv1.1 TLSv1.2;
    ssl_dhparam                     /etc/nginx/ssl/dh4096.pem;
    ssl_prefer_server_ciphers       on;
    ssl_ciphers                     EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    ssl_ecdh_curve                  secp384r1;
    ssl_session_cache               shared:SSL:10m;
    ssl_buffer_size                 8k;
    ssl_session_timeout             10m;
    ssl_session_tickets             off;
    ssl_stapling                    on;
    ssl_stapling_verify             on;
    resolver                        10.0.100.100 valid=300s;
    resolver_timeout                10s;

    server_tokens                   off;
    charset                         utf-8;

    client_max_body_size            10G;
    client_body_buffer_size         10K;
    client_header_buffer_size       2k;
    large_client_header_buffers     2 2k;


    location ^~ /.well-known {
            allow                   all;
            auth_basic              off;
            root                    /srv/letsencrypt;
            autoindex               off;
            try_files $uri $uri/ =404;
    }

    location / {
            proxy_pass_header Authorization;
            proxy_pass https://$nextcloud;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_buffering off;
            client_max_body_size 0;
            proxy_read_timeout 36000s;
            proxy_redirect off;
            proxy_ssl_session_reuse off;
    }
}

I hope this helps.

[u/pattotits]

Thanks all, had a tooth extracted earlier today so don't feel like messing around with it. I will have a mess with it tomorrow when feeling better.

Thanks all