Replies: 121 comments 543 replies
|
hi , |
|
log file is pretty long, gonna attach it below. i'm fairly new to this so I'm not 100% sure what to make of it. |
|
I believe you have a typo in your Caddyfile. Can you add |
|
You are correct, I had missed the |
|
This should be sufficient |
|
awesome, was able to close it down and restart it, Caddy is happier now, but I'm still having DNS issues. Going thru the docker resource about it, but not 100% how i will go about fixing it. edit: realizing the log is throwing a fit about |
This comment has been hidden.
This comment has been hidden.
|
Yes, I've been running this setup for a few weeks now, and |
|
Nice! |
|
See #5460 |
|
This is amazing @flll , I am trying to achieve the same since a month. But I am not using docker. Can you KINDLY make a script like the one for nextcloud with nginx as server, caddy as reverse proxy, tailscale and cloudflare as DNS. regards |
|
Thankyou for the kind advice. I will go for it on Monday. Well I thought that I already am in lcx,doesn't it mean the same docker hardening? |
|
Can you please enlighten the disadvantage? |
|
with that AIO, can caddy be installed on different separate container/ VM . ( for example: caddy in a separate proxmox LCX container and nextcloud AIO in a separate Proxmox VM. but both VM and LXC are on same network but different subnets. Is this possible? |
I would recommend using Kubernetes or Docker Swarm. |
Docker-based deployment has very few disadvantages. |
This comment has been hidden.
This comment has been hidden.
|
I used the nginx.conf from the projects readme (link in my original comment) What is I simply used the docker compose from the README (I had to comment and uncomment some lines) |
|
apology, it's |
|
Is your configuration something like this? |
|
@flll what about my case? |
|
@A4alli |
|
Thank you for your work @flll . But no matter how many times I try the procedure, the hostname I give in the compose environment doesn't get created in the tailscale and rather a random ephemeral hostname is created after manually authenticating using the url in the log. My Internet and Network connection is fine. But I cannot log into the nextcloud instance even with the the randomly generated hostname in my tailnet. |
|
This error seems to be due to Caddy failing to connect to nextcloud-aio-apache.
Yes, using an OAuth key makes it ephemeral.
Example ACL configuration: {
"groups": {
"group:admin": ["example@mail.jp", "flll@github"],
"group:azuki": ["tuyu@azuki.com"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
]
}Note that "autogroup:admin" and "group:admin" are completely different groups. Please refer to Tailscale's autogroup documentation for more details. |
Thank you as well. I was able to respond quickly because I've made the same mistake before, haha. |
|
Non-ephemeral will make new nodes? Or ephemeral?? |
@flll - Thanks for this post. Really useful.
|
|
Thank you for providing this valuable information! 🙏 |
|
Did anyone get this error? docker compose up tailscale-1 | boot: 2024/10/24 22:18:21 Running 'tailscale up' |
Thank you for your help and for this amazing guide @flll . I was setting the host name to the same name as my server and I did not realized that it was making new machine server-1 in tailscale. Thank you again for your help!!! |
|
This was also the root of my issue. Remember that the hostname to provide both in compose.yml and the Nextcloud admin console is the new, ephemeral hostname created by Tailnet, not the current hostname of your physical machine! |
|
@MateuszFido what do you mean by new, ephemeral hostname created by Tailnet? Where can I find those? |
|
I read everything in this guild but still can not access Nextcloud using my endpoint |
|
The value of Supposing that your Tailnet name is |
|
Nice guide! Thanks so much. or Note: same goes for the |
|
Yes the |
|
well I am using only via tailscale network. So I will not need any ports to forward. next I toggol on HTTPS in tailscale Admin counsel which give me lets encrypt https. right now Im stuck on provisioning screen. I cannot visit my nextclous AIO via tailscale domain. I am pasting the required data asked by @flll, when he will analyze about what is wrong. |
|
Even with tailscale, you need those port to make it accessible inside your tailscale network |
How to open up these ports in tailscale, whether it has to be done on the newly created nextcloud node or the host/server node in tailscale n/w. |
|
I am running the whole system without any port forwarding or opening. Only in the docker compose there are the port mappings, to make the container accessible. The AIO master Container is only accessible over the ipadress from the Host running the Master container. But the rest of nextcloud does not need any port changing and is only accessible over your Domain you give into the environment variables. |
|
Okay, one question: Should I "sudo dnf install tailscale" on my host, then follow all this docker compose things? because how would I declare ACL dst 'nextcloud.your-tailnet.ts.net'? Or do I add my device manually in tailscale admin? I might be very less informed about ACL and tags, but I am trying to learn and doing all this to use nextcloud-aio is tiring, but I am trying my best. Thanks! PS: I was using this |
|
Hey @flll What I did:
I am sure I misunderstood a lot of things, looking for pointers, thanks! |
|
New Setup:
|
Please check the following conditions:
If it's not working even though the order is correct, execute the following commands: These commands will delete existing docker containers and networks.
Please configure ACL according to your environment. |
|
@flll Brother, I finally did it. Nextcloud-AIO worked!!! What I did?
Thanks a lot! |
|
@blazing-ph0enix Crossing your fingers is indeed an essential step in solving technical problems! 😄 It's wonderful that you're planning to share what you've learned with others. A guide for beginners will be incredibly helpful for many people. I'm looking forward to your future experiments. If you make any new discoveries, please do share them. Your experiences will be a valuable source of information for the community. Keep up the great work. And remember, if you ever run into any issues, don't hesitate to ask for help. |
|
Thanks for the guide, it's great but I cannot make it work for myself. My compose.yaml: My ACL: Caddy seems to recognize the domain name correctly, i.e. it resolves $NC_DOMAIN correctly. Tailscale logs: Tried opening 443 (TCP and UDP), 80, 8080 (out of desperation) in firewall and even disabling the firewall completely, none of it helped Seems that no matter what I do, in the nextcloud container I see: Pinging the domain name within tailscale works without problems |
|
@MateuszFido
If you need to redo it, execute the following commands: These commands will delete existing docker containers and networks. |
|
Yep, did those many times, my friend Finally got it today: the same issue as @Kendellb, the hostname to configure is the new, ephemeral hostname generated by Tailscale, not the current hostname of the physical machine hosting Nextcloud in tailnet. Initially, I thought your machine was just named "nextcloud" in your tailnet before running all the containers. It's worth remembering that setting the hostname provided to Nextcloud in the admin console cannot be undone - so just removing the containers, and even doing This was totally unclear to me from the guide, maybe it could be mentioned? Anyway, thanks a lot, it's a great setup nonetheless 👍 |
|
I'm still having this issue. I'm using the ephemeral hostname but still having issues |
|
I hope your |
Right now, Unhealthy, because I haven't deleted old machines from admin console |
Can't use my pc right now. Will try tomorrow. |
|
Any update |
Yes, I will make a new comment for my specific case, I will add all the logs in it |
|
@flll if you please jump in to here to see the issues, KINDLY |
|
Finally access the domain. |
The funnel feature will expose your service to the public internet.
This error message indicates that debug information is currently hidden. While it's recommended to keep error details concealed in production environments for security purposes, you can temporarily enable detailed error display when troubleshooting is necessary. Once you've resolved the issue, it's advisable to return to the default secure configuration where error details are hidden from end users.
Please remove all containers and networks, then redeploy.
If you're unsure how to use it or don't plan to use it, I recommend not using it.
If Nextcloud is working, WebDAV should also be available by default.
Security settings are already included in nextcloud-aio-apache,
Are you trying to use both cloudflared and tailscaled tunnels? |
|
Amazing. My nextcloud is functioning well by default. I mean from starting. I think I have no need to remove and redeploy. But of course security and setup warnings will stay the same as in the pastebin. (Or should it remove and redeploy and will get rid of the warnings) Point 6. You have pasted a diagram. A bit confusion, if you may please help me with it. I want to use cloudflare as DNS not a reverse proxy or tunnel. I have caddy-dns-cloudflare-module. |
|
@flll @szaimen https://help.nextcloud.com/t/security-and-setup-warnings-nextcloud-aio-30-0-1/208752/2 |
|
moreover @flll the notify-push failed in here according to your guide |
THIS IS CREATING A TONS OF CLONE MACHINE IN MY TAILSCALE |
|
Hey, So I have tried a lot of things, now my experience is like this:
Apache logs: Nextcloud logs: Redis: Database: Notify Push: Nextcloud Mastercontainer Logs: My ACL of Tailscale: |
|
For me this guide work fine. Only problem is apache container showing unhealthy. But working |
|
I apologize for the delayed response. cURL error 6: Could not resolve host: server.rohu-nessie.ts.netThis error suggests that the nextcloud-aio network is constantly being created, and Tailscale might not be properly connecting to the network Here are the steps to resolve this:
docker compose down
# Stop containers containing "nextcloud" in their name
docker stop $(docker ps -a | grep nextcloud | awk '{print $1}')
# Remove containers containing "nextcloud" in their name
docker rm $(docker ps -a | grep nextcloud | awk '{print $1}')
I didn't find any issues with the ACL settings. |
Please disable the ephemeral setting.
It's recommended to keep the default state configuration.
This is likely a temporary issue.
Often this is due to insufficient permissions on the client-side Tailscale. |
Thankyou 😍 |
Hello @flll , thank you for the great work and support I did reset everything as instructed and read the full discussion here , but no luck getting this fixed ! I always end up with the same error PS : all containers shows healthy !, the machine is showing connect on Tailscale admin console! did try changing DNS, ACL , OAuth keys, no luck can you please tell me what I'm doing wrong ? |
|
Has anyone tried to deploy using the portainer stack? Caddy log: I have double-checked my NC_DOMAIN variable. compose.yml: services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line cannot be changed.
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- nextcloud-aio
ports:
- 0.0.0.0:8080:8080
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: 127.0.0.1
SKIP_DOMAIN_VALIDATION: true
caddy:
image: caddy:alpine
restart: unless-stopped
container_name: caddy
environment:
NC_DOMAIN: nextcloud.[redacted].ts.net # Change this to your domain ending with .ts.net in the format {$TS_HOSTNAME}.{tailnetdomain}
volumes:
- type: bind
source: /home/surya/Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # Mount the volume for /var/run/tailscale/tailscale.sock
read_only: true
network_mode: service:tailscale
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
environment:
TS_HOSTNAME: nextcloud # Enter the hostname for your tailnet
TS_AUTH_KEY: tskey-client-kYthXvJbHD21CNTRL-[redacted] # OAuth client key recommended
TS_EXTRA_ARGS: --advertise-tags=tag:nextcloud # Tags are required when using OAuth client
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # Mounting the entire /tmp folder to access tailscale.sock
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed.
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001" # Jumbo Frame
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1" # Harden aioTailscale ACL: "groups": {
"group:admin": ["js-surya@github"],
"group:users": ["user@example.com", "otheruser@example.com"],
},
"tagOwners": {
"tag:nextcloud": ["group:admin"],
},
"acls": [
// Allow general unrestricted access (you can comment this out if needed).
{"action": "accept", "src": ["*"], "dst": ["*:*"]},
// Allow users in "group:users" to access any devices tagged with "nextcloud".
{"action": "accept", "src": ["group:users"], "dst": ["tag:nextcloud:*"]},I'm not an IT expert, and I'm relatively new to this. My IP is behind CGNAT, and I want to access my Nextcloud server outside my local network using Tailscale. I'm eager to learn, so any suggestions or help would be appreciated. |
|
NC_DOMAIN=nextcloud.talscale.ts.net Remember there is = and than no space |
TS_HOSTNAME=nextcloud # Hostname in Tailnet
NC_DOMAIN=nextcloud.mydomain.ts.net # Format: {$TS_HOSTNAME}.{$tailnetdomain}.ts.net
TS_AUTH_KEY=tskey-client-kYthXvJbHD21CNTRL-mykey # OAuth client key recommended
TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # For OAuth client key usageHere is my .env config |
|
check my config files above that work |
|
Apache is always unhealthy docker exec -it nextcloud-aio-apache bash -x /healthcheck.sh
|
|
Same here |
|
check my last comment below for solution with serve.json |
|
Checked it. Is there a way to check if a port is open to public? Will try and report. |
|
what about your security and setup warnings? |
|
I had the same problem. In my case, I noticed that the nextcloud-aio-nextcloud container wasn't joining the nextcloud-aio-apache network. To fix it, I had to delete the container, volumes, networks, and images and create a new "docker compos up." I think deleting the volumes was overkill. |
|
@flll Wanted to mention that I was able to get this working without needing caddy at all. I think it simplifies things a bit. Tailscale can natively proxy Note this employs tailscale serve (as opposed to tailscale funnel) so will only expose the service to your tailnet, not publicly. You could set a funnel flag to true in the json config below to expose it publicly, though some security and performance caveats would apply if you did.
|
|
No need of exposing port 8080. You call [tailscal].ts.net:8443 |
|
Hey all, i got the setup working with Tailscale server, thx for the info and guide. |
|
use funnel but it will expose to internet |
|
Hey All, @patrick-theprogrammer @js-surya @robante15 first of all thanks for the great summary. For me this guide is much more straightforward and easier rather than using Caddy, because I do not need that one. Based on your description I managed to put together a running Nextcloud, but what I cannot solve to use the Nextcloud office. If I understand right, the communications between the nextcloud + the collabora provides to use the full collabora office package but somehow it doesn't allow though WOPI. I have tried to not use https (use the same protocol), or add the IPs and links to the collabora etc. but is doesn't work. Did you manage to use it properly with this setup? Many thanks for your help in advance :) |
I would also like to run tailscale with caddy for when I am traveling and when I am home in my local network I would actually like to use my local network to access nextcloud. Is that doable and can someone share knowledge or sources? |
|
Sorry if this is too much of a newbie question, but how would I set the data directory to store everything on a mounted connected drive, say "/mnt/mydrive"? |
|
In your environment:
NEXTCLOUD_DATADIR: /mnt/my_drive # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
# NEXTCLOUD_MOUNT: /mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-hostYou may want to also define a volume for it. So your services:
nextcloud-aio-mastercontainer:
image: ghcr.io/nextcloud-releases/all-in-one:latest
# some text here
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
- /mnt/my_mydrive:/var/www/html
# more text here
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: '127.0.0.1'
SKIP_DOMAIN_VALIDATION: 'true'
NEXTCLOUD_DATADIR: "/mnt/my_drive"
# skipping lots of text here
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed.
caddy_certs:
caddy_config:
caddy_data:
tailscale:
tailscale_sock:
my_drive:
Also you can check the example compose.yml file https://github.com/nextcloud/all-in-one/blob/main/compose.yaml#L25-L26 |
|
thanks! This is very helpful. I'll see how it goes. |
|
FYI I managed to get it almost all running, following this guidance. I also reformatted the external drive to ext4 which fixed a lot of permissions issues. Now it is all working except collabora. To be honest, I don't even really know how I am supposed to be able to use collabora, but while the container is running it is throwing this to the log file: 2025-09-02T17:10:23.643514415Z wsd-00007-00011 2025-09-02 17:10:23.643412 +0000 [ asyncdns ] ERR Failed to lookup host [nextcloud.polydactyl-vibes.ts.net]: No address associated with hostname (EAGAIN: Resource temporarily unavailable)| net/NetUtil.cpp:108 I also followed the steps here: #1358 sudo docker exec -it nextcloud-aio-nextcloud bash I'm grateful for any hints on where to start. |
|
This is an excellent guide, but I've followed it exactly and I can't get Collabora to work. The only way I can get the Office config to go green is by using the collabora container's name (http://nextcloud-aio-collabora:9980) once I save that it goes green and shows both the browser URL and nextcloud url used by collabora are my tailnet url. Then I browse to files>Documents and click on the "Welcome to Nextcloud Hub.docx" and I get: 
Looking at the collabora logs I see "ERR Failed to lookup host [nextcloud.]: No address associated with hostname "
Any help would be greatly appreciated. Thank you, |
|
I just saw a comment above from @eliasamaral that said the host needs to be on the tailnet. This was not mentioned in the guide. I just added the host to the tailnet and stopped all the AIO containers and did a It should be clearly said that: Your host needs to be on your Tailnet. -Bill |
|
Although simple, I noticed that some people run into this situation. I thought about opening an issue to add it to the step-by-step guide, but I’m not sure if that’s the best approach. Maybe @flll could update the guide to make this clearer. |
Hi @bpeters504 , I'm very much a newbie, but that comment was for me. Can you say how you stopped all the AIO containers, and in which directory you need to be for the Thanks, Leon |
|
@balents When I say stop the AIO containers, I mean the containers that are started (and stopped) by clicking the button on the containers page. To get there you can go to Administration Settings and at the top of the Overview, you will see a link "Open Nextcloud AIO Interface." 
That will take you to a page where you can stop/start the AIO containers. 
You can bookmark that page for easy access. Then to stop the primary containers, you need to be in the directory that has you docker-compose.yml file and run the command Hope that helps, |
|
Thanks @bpeters504 . That is what I guessed, and it worked! Remarkable. Thanks so much! Leon |
|
Hi, I had some great advice earlier. With it, I now have everything working except collabora. To be honest, I don't even really know how I am supposed to be able to use collabora, but although the container is running it is throwing this to the log file: 2025-09-02T17:10:23.643514415Z wsd-00007-00011 2025-09-02 17:10:23.643412 +0000 [ asyncdns ] ERR Failed to lookup host [nextcloud.polydactyl-vibes.ts.net]: No address associated with hostname (EAGAIN: Resource temporarily unavailable)| net/NetUtil.cpp:108 This "nextcloud.polydactyl-vibes.ts.net" is of course my tailnet. I also followed the steps here: #1358 sudo docker exec -it nextcloud-aio-nextcloud bash I'm grateful for any hints on where to start. Thanks, Leon |
and
|
|
To confirm that DNS resolution is working, run Check if the |
|
This is what I get (outside the container): and inside the container: |
|
So we have another problem to solve. DNS resolution should also work inside your container. Since you installed Tailscale after the containers, let’s do the basics: create a fresh installation. Remember to remove the networks so Docker can create new ones. |
|
@eliasamaral Thanks so much for your help. I saw the comment from @bpeters504 and tried that, and it worked! Not only did many many errors go away from the admin pages, I successfully opened a word document, and made a spreadsheet. There is quite a bit of lag so maybe I'll look into that but still getting tailscale running on the host seems to have been the key. Thanks again! Leon |
|
OK, done. Do I just now try to restart or should I check something?
Leon
…--
Leon Balents
***@***.***
On Tue, Sep 2, 2025, at 3:43 PM, Elias Severiano Amaral wrote:
You need your host to also be on the Tailscale network. If you are using Ubuntu, go to https://login.tailscale.com/admin/machines/new-linux and follow the step-by-step instructions.
—
Reply to this email directly, view it on GitHub <#5439 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADHFI43UILUJPTAJQLT72L33QYMQDAVCNFSM6AAAAABQGBXP2KVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMRZGAZDAOI>.
You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
|
repeat the commands in the terminal
|
|
I guess you mean this: |
|
Within the container? If yes, then the result did not change.
…--
Leon Balents
***@***.***
On Tue, Sep 2, 2025, at 3:54 PM, Elias Severiano Amaral wrote:
repeat the commands in the terminal
—
Reply to this email directly, view it on GitHub <#5439 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADHFI44BY2G6CS43PCD4P7D3QYNZPAVCNFSM6AAAAABQGBXP2KVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMRZGAZDMNA>.
You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
|
I am running collabora in nextcloud aio following this guide and with help from this forum.H appily it works but the performance is very slow and laggy. I wonder if there is a fix? I loaded a .docx file and copied the collabora log that resulted below. There is a line about performance:
|
|
Yah facing the same issue. Collabora is slow. Did you manage to fix it? |
|
I got two questions. Question #1, would it be better to update the docker compose config above to explicitly define the ephemeral and preauthorized parameters? I have Tailscale Lock enabled and every time the container restarts, since it tis ephemeral I have to go sign it to allow traffic to it. I think preauthorized=true solves that issue.
Question #2, I'm trying to share the nextcloud node with another tailnet (not inviting the user to my tailnet, but instead just sharing the node with them). The issue is that since the container/node is ephemeral, every time the container restarts and deletes the node and creates a new one. This causes the need to create a new node invitation link and go through the whole process again. If the docker compose is set with the ephemeral key set to true, it still doesn't solve the issue as when the container reboots it still create a new node. Any suggestions on how this can be solved? |
|
Hey, Might be a little late for you, but maybe someone else finds it useful. You may need to first wipe the tailscale volume mapped to /var/lib/tailscale . Following these steps you should have a permanent machine that you can share and will be re-used after container restart. |
|
Hello, |
|
So the guide worked! However my nextcloud-domaincheck container is refusing to start because its saying port 1100 is already bound to another container. (Ive only used that port for nextcloud but i used it in other attempts to get this working.) Here is the error message:
I dont know if i should remove all the containers for nextcloud look into my docker network ID's and remove the appropriate ones or should i remove all the docker containers and change the port number to like 1101 and redo the docker container? Im so close now but nextcloud has been a constant pain in my ass for awhile now. This guide is the only thing thats got me past the initial setup EDIT: I took down all the containers changed the port of the apache line to 11001 and every container is now running. However i still cant seem to access my nextcloud. When i hit the AIO pages "Open your nextcloud" the page doesnt load. When i use the docker bridge ip it brings me to the AIO page but says something about automatic login. |
|
Hey, thanks for the awesome guide, I've been using it for half a year now and everything works quite smoothly. One question on tailscale though: If I want to update the tailscale inside the docker container how can I do this safely? I tried it once but then I ended up on the nextcloud configuration screen again and wasnt able to reach my instance anymore, although the data was still there, but the setup was not reachable. Any help appreciated! |
|
Followed this guide to setup caddy with tailscale for reverse proxy but couldn't get Nextcloud Office to work. I would greatly appreciate your help in troubleshooting my setup. This is the setup: compose.yml services:
nextcloud-aio-mastercontainer:
image: ghcr.io/nextcloud-releases/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line cannot be changed
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock.raw:/var/run/docker.sock:ro
networks:
- nextcloud-aio
ports:
- 8080:8080
environment:
NEXTCLOUD_DATADIR: "/Volumes/Samsung PSSD T7 Media/NextCloud/data_dir"
APACHE_PORT: 11000
APACHE_IP_BINDING: 127.0.0.1
SKIP_DOMAIN_VALIDATION: true
#for nextcloud office to work
collabora:
image: collabora/code
container_name: collaborac
restart: unless-stopped
ports:
- 9980:9980
environment:
- username=admin
- password=Secret.Password
- extra_params=--o:ssl.enable=false --o:ssl.termination=true
cap_add:
- MKNOD
- SYS_ADMIN
networks:
- nextcloud-aio
depends_on:
- nextcloud-aio-mastercontainer
caddy:
build:
context: .
dockerfile: Caddy.Dockerfile
restart: unless-stopped
environment:
NC_DOMAIN: nextcloud.greyhound-byzantine.ts.net
COLLABORA_DOMAIN: collabora.greyhound-byzantine.ts.net
volumes:
- type: bind
source: ./Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/
read_only: true
network_mode: service:tailscale
tailscale:
image: tailscale/tailscale:v1.94
environment:
TS_HOSTNAME: nextcloud
TS_AUTH_KEY: tskey-client-kmfmc # Your OAuth client key
TS_EXTRA_ARGS: --advertise-tags=tag:nextcloud # Required for OAuth client
TS_STATE_DIR: /var/lib/tailscale # this was to present being ephemeral in tailscale but did not work
init: true
healthcheck:
test: tailscale status --peers=false --json | grep 'Online.*true'
start_period: 3s
interval: 1s
retries: 3
restart: unless-stopped
devices:
- /dev/net/tun:/dev/net/tun
volumes:
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # Mount entire /tmp folder to access tailscale.sock
cap_add:
- NET_ADMIN
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed
caddy_certs:
caddy_config:
caddy_data:
tailscale:
tailscale_sock:
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "1280" # Can be set to 9001 for jumbo frames
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1" # Security hardening
com.docker.network.bridge.enable_icc: "true"
com.docker.network.bridge.default_bridge: "false"
com.docker.network.bridge.enable_ip_masquerade: "true"Caddyfile: https://{$COLLABORA_DOMAIN} {
reverse_proxy collabora.nextcloud.orb.local:9980 {
header_up X-Forwarded-Proto "https"
header_up Host {host}
}
}
http://{$COLLABORA_DOMAIN} {
reverse_proxy collabora.nextcloud.orb.local:9980 {
header_up X-Forwarded-Proto "http"
header_up Host {host}
}
}
https://{$NC_DOMAIN} {
reverse_proxy nextcloud-aio-apache:11000 {
header_up X-Forwarded-Proto "https"
header_up Host {host}
}
}
http://{$NC_DOMAIN} {
reverse_proxy nextcloud-aio-apache:11000 {
header_up X-Forwarded-Proto "http"
header_up Host {host}
}
}Caddy.Dockerfile: FROM caddy:2.9.1-builder-alpine AS builder
RUN xcaddy build --with github.com/mholt/caddy-l4@87e3e5e2c7f986b34c0df373a5799670d7b8ca03
FROM caddy:2.9.1-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddyThank you! |
|
@flll can you help with the collabora issue specially in rootless docker |
|
Could you explain why the |
|
I was getting this log message when I try to start nextcloud-aio ( Adding the tailscale_sock volume to the nextcloud-aio-mastercontainer seems to fix it. - type: volume
source: tailscale_sock
target: /var/run/tailscale/ # Mount the volume for /var/run/tailscale/tailscale.sock
read_only: true
The full section: services:
nextcloud-aio-mastercontainer:
image: ghcr.io/nextcloud-releases/all-in-one:beta
init: true
restart: unless-stopped
container_name: nextcloud-aio-mastercontainer # This line cannot be changed
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # Mount the volume for /var/run/tailscale/tailscale.sock
read_only: true
networks:
- nextcloud-aio
ports:
- 0.0.0.0:8080:8080
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: 127.0.0.1
SKIP_DOMAIN_VALIDATION: trueIs this necessary for everyone or just me? |
|
With the configurations as posted I was unable to acces the AIO admin page at Looking at the logs in the containers it seems that I am able to reach the tailscale container but it isn't able to connect to the mastercontainer via caddy.
I was able to fix this by adding a layer 4 route proxy in the same manner as the Nextcloud Talk application. The full Caddyfile now looks like this: |
|
I was able to get this to work using the caddy-tailscale plugin. Also shows how to connect a CIFS mount as the data directory. You can see the repo at https://github.com/jordaninskeep/nextcloud |
and others
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
🌐 Nextcloud All-in-One with Tailscale Integration Guide
📋 Overview
This comprehensive guide walks you through integrating Nextcloud All-in-One (AIO) with Tailscale, using Caddy as a reverse proxy. Since Tailscale currently only allows communication with localhost (127.0.0.1), we use a sidecar container with Caddy to communicate with AIO.
✨ Key Benefits
serve.jsonconfiguration🚀 Step 1: Tailscale Configuration
Before setting up Docker containers, you need to properly configure Tailscale:
🏷️ 1.1 Copy Your Tailnet Domain Name
{tailnetdomain}.ts.net)🔒 1.2 Enable HTTPS Certificates
🏷️ 1.3 Create Nextcloud Tag in ACL
nextcloudtag in thetagOwnerssection🔑 1.4 Generate OAuth Client
nextcloudtagOAuth Scopes Configuration:
TS_AUTH_KEYenvironment variable)⚙️ Step 2: Environment Variables Setup
Configure the following environment variables for your setup:
Note
Important Configuration Notes:
.envfile, but instead write directly into thecompose.ymlfile.envfile, compose will automatically read itNC_DOMAINfollows the correct format:{TS_HOSTNAME}.{tailnetdomain}.ts.netTS_EXTRA_ARGSand define them in ACL📖 For more detailed information: Docker Tailscale Guide
🐳 Step 3: Docker Compose Configuration
Create a
compose.ymlfile with the following content. Replace environment variables with your actual values.compose.yml
Important
🔧 Before Setup: Make sure to replace
NC_DOMAIN,TS_HOSTNAME,TS_AUTH_KEY, andTS_EXTRA_ARGSwith your actual values!📝 Step 4: Caddy Configuration Files
Create the necessary Caddy configuration files in your current directory:
4. Create Caddyfile and Caddy.Dockerfile
Create a Caddyfile in the current directory with the following content:
Caddyfile
{ layer4 { 127.0.0.1:3478 { route { proxy { upstream nextcloud-aio-talk:3478 } } } 127.0.0.1:3479 { route { proxy { upstream nextcloud-aio-talk:3479 } } } } } https://{$NC_DOMAIN} { reverse_proxy nextcloud-aio-apache:11000 { header_up X-Forwarded-Proto "https" header_up Host {host} } } http://{$NC_DOMAIN} { reverse_proxy nextcloud-aio-apache:11000 { header_up X-Forwarded-Proto "http" header_up Host {host} } }Note
🚨 Do NOT manually replace the
{$NC_DOMAIN}variable. It will be automatically populated with the value from your environment variables.🐳 Caddy.Dockerfile
Create a
Caddy.Dockerfilewith the following content:🎯 Step 5: Deploy Nextcloud AIO
Follow these steps to set up and access your Nextcloud instance:
🚀 Deployment Steps
Start the containers:
Monitor the logs:
Access the AIO interface:
https://ip.address.of.server:8080/https://192.168.0.2:8080/Configure your domain:
$NC_DOMAINProvision Nextcloud:
Access your Nextcloud:
https://$NC_DOMAIN/https://nextcloud.your-tailnet.ts.net/🎉 Setup Complete!
🔧 Troubleshooting
❗ If It Doesn't Work
Try the following solutions:
🔄 Docker Reset Commands
If nothing else works, use these commands to completely reset your setup:
Caution
Only use this as a last resort.
🔴 CLICK TO REVEAL RESET COMMANDS
🔍 Post-Reset Verification
After force stopping, verify that the Nextcloud entry is no longer visible in the Tailscale Admin Console:
Important Steps:
🙏 Acknowledgments
Special thanks to frazar for valuable advice and contributions.
📅 Latest Updates
beta, updated command todocker compose up --pull alwaysservice:tailscaleAll reactions