Anleitung: nextcloud mit nginx reverse proxy und LetsEncrypt auf Docker

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
        ssl_prefer_server_ciphers off;
resolver 127.0.0.11;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
    server_name _; # This is just an invalid value which will never trigger on a real hostname.
    listen 80;
    access_log /var/log/nginx/access.log vhost;
    return 503;
}
server {
    server_name _; # This is just an invalid value which will never trigger on a real hostname.
    listen 443 ssl http2;
    access_log /var/log/nginx/access.log vhost;
    return 503;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/default.crt;
    ssl_certificate_key /etc/nginx/certs/default.key;
}
# nextcloud.zinnik.de
upstream nextcloud.zinnik.de {
                # Cannot connect to network of this container
                server 127.0.0.1 down;
                ## Can be connected with "nextcloud_proxy-tier" network
            # nextcloud_web_1
            server 172.29.4.4:80;
}
server {
    server_name nextcloud.zinnik.de;
    listen 80 ;
    access_log /var/log/nginx/access.log vhost;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://nextcloud.zinnik.de;
    }
}
server {
    server_name nextcloud.zinnik.de;
    listen 443 ssl http2 ;
    access_log /var/log/nginx/access.log vhost;
    return 500;
    ssl_certificate /etc/nginx/certs/default.crt;
    ssl_certificate_key /etc/nginx/certs/default.key;
}

version: '3'

services:
  db:
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/mariadb:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=donchillo0501
    env_file:
      - db.env

  app:  
    image: nextcloud:fpm
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html
    environment:
      - MYSQL_HOST=db
    env_file:
      - db.env
    depends_on:
      - db

  web:
    build: ./web
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html:ro
    environment:
      - VIRTUAL_HOST=nextcloud.zinnik.de
      - LETSENCRYPT_HOST=nextcloud.zinnik.de
      - LETSENCRYPT_EMAIL=zinnik.sven@gmail.com
    depends_on:
      - app
    ports:
      - 4080:80
    networks:
      - proxy-tier
      - default

  proxy:
    build: ./proxy
    restart: always
    ports:
      - 443:443
      - 80:80
#    environment:
#      - VIRTUAL_PROTO=https
#      - VIRTUAL_PORT=443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs:ro
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-conf.d:/etc/nginx/conf.d
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy
      
networks:
  proxy-tier:

Creating/renewal nextcloud.zinnik.de certificates... (nextcloud.zinnik.de)


2019-09-30 08:26:00,167:INFO:simp_le:1479: Generating new certificate private key


2019-09-30 08:26:05,128:ERROR:simp_le:1446: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v01.api.letsencrypt.org/acme/authz-v3/566433076


Challenge validation has failed, see error log.




Debugging tips: -v improves output verbosity. Help is available under --help.


/app


Sleep for 3600s

version: '3'
services:
  db:
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/mariadb:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=donchillo0501
    env_file:
      - db.env
  app:  
    image: nextcloud:fpm
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html
    environment:
      - MYSQL_HOST=db
      - VIRTUAL_HOST=nextcloud.zinnik.de
      - LETSENCRYPT_HOST=nextcloud.zinnik.de
      - LETSENCRYPT_EMAIL=zinnik.sven@gmail.com
    env_file:
      - db.env
    depends_on:
      - db
  web:
    build: ./web
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html:ro
    depends_on:
      - app
    ports:
      - 4080:80
    networks:
      - proxy-tier
      - default
  proxy:
    build: ./proxy
    restart: always
    ports:
      - 443:443
      - 80:80
#    environment:
#      - VIRTUAL_PROTO=https
#      - VIRTUAL_PORT=443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs:ro
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-conf.d:/etc/nginx/conf.d
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier
  letsencrypt-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy
      
networks:
  proxy-tier: