Replies: 8 comments 52 replies
-
|
hi , |
Beta Was this translation helpful? Give feedback.
-
|
The |
Beta Was this translation helpful? Give feedback.
-
Indeed, maybe this would make the guide even easier? |
Beta Was this translation helpful? Give feedback.
-
|
btw @flll did you already tested features like Nextcloud office and Nextcloud talk in this kind of setup? Do they work? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I've been running this setup for a few weeks now, and |
Beta Was this translation helpful? Give feedback.
-
|
Nice! |
Beta Was this translation helpful? Give feedback.
-
|
See #5460 |
Beta Was this translation helpful? Give feedback.
-
|
This is amazing @flll , I am trying to achieve the same since a month. But I am not using docker. Can you KINDLY make a script like the one for nextcloud with nginx as server, caddy as reverse proxy, tailscale and cloudflare as DNS. regards |
Beta Was this translation helpful? Give feedback.
-
|
Thankyou for the kind advice. I will go for it on Monday. Well I thought that I already am in lcx,doesn't it mean the same docker hardening? |
Beta Was this translation helpful? Give feedback.
-
|
Can you please enlighten the disadvantage? |
Beta Was this translation helpful? Give feedback.
-
|
with that AIO, can caddy be installed on different separate container/ VM . ( for example: caddy in a separate proxmox LCX container and nextcloud AIO in a separate Proxmox VM. but both VM and LXC are on same network but different subnets. Is this possible? |
Beta Was this translation helpful? Give feedback.
-
I would recommend using Kubernetes or Docker Swarm. |
Beta Was this translation helpful? Give feedback.
-
Docker-based deployment has very few disadvantages. |
Beta Was this translation helpful? Give feedback.
-
|
A few weeks ago I:
now my nextcloud is only available on devices on my tailscale |
Beta Was this translation helpful? Give feedback.
-
|
my nginx.conf are click! |
Beta Was this translation helpful? Give feedback.
-
|
Is your configuration something like this? |
Beta Was this translation helpful? Give feedback.
-
|
@flll what about my case? |
Beta Was this translation helpful? Give feedback.
-
|
@A4alli |
Beta Was this translation helpful? Give feedback.
-
|
Yes, I have surf the whole internet and found that nextxloud AIO is very very well documented. BTW I adopted legacy approach and deployed nextcloud. Nginx,php directly on the host in proxmox VM. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your work @flll . But no matter how many times I try the procedure, the hostname I give in the compose environment doesn't get created in the tailscale and rather a random ephemeral hostname is created after manually authenticating using the url in the log. My Internet and Network connection is fine. But I cannot log into the nextcloud instance even with the the randomly generated hostname in my tailnet. |
Beta Was this translation helpful? Give feedback.
-
|
No, I'm deleting all containers and I deleted the .env file and tried again with same results i.e. $TS_HOSTNAME is empty. Something interesting I notice is that in some containers nextcloud is misspelled as nextlcloud , CLICK!This is is the case even after several resets and I don't see any misspelling in my compose file - |
Beta Was this translation helpful? Give feedback.
-
- - TS_HOSTNAME = nextcloud
+ - TS_HOSTNAME=nextcloudThere should be no space between the key and value in the key-value pair. |
Beta Was this translation helpful? Give feedback.
-
|
That was it, I'm into nextcloud! Thank you so much my Japanese friend. The docker compose file as in the guide complained of map and kepair format and so I edited it but didn't know that space will cause issues. I see couple of errors in the caddy log of refusing connection to fonts.json, should I be concerned? Also two more questions,
|
Beta Was this translation helpful? Give feedback.
-
|
This error seems to be due to Caddy failing to connect to nextcloud-aio-apache.
Yes, using an OAuth key makes it ephemeral.
Example ACL configuration: {
"groups": {
"group:admin": ["example@mail.jp", "flll@github"],
"group:azuki": ["tuyu@azuki.com"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
]
}Note that "autogroup:admin" and "group:admin" are completely different groups. Please refer to Tailscale's autogroup documentation for more details. |
Beta Was this translation helpful? Give feedback.
-
Thank you as well. I was able to respond quickly because I've made the same mistake before, haha. |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone get this error? docker compose up tailscale-1 | boot: 2024/10/24 22:18:21 Running 'tailscale up' |
Beta Was this translation helpful? Give feedback.
-
|
Same situation here, Did you see the logs; does the Tailscale ask you to authenticate manually with an auth URL? Nevertheless even doing so doesn't make any difference apart from creating a random ephemeral hostname in the Taiscale which doesn't wokr with Nextcloud. |
Beta Was this translation helpful? Give feedback.
-
|
I am also having the same issue here is my config file: CLICK!In the master container logs get this error: checked tailscale logs and getting this error |
Beta Was this translation helpful? Give feedback.
-
I also have gone through the reverse proxy debug guide and am getting and output of |
Beta Was this translation helpful? Give feedback.
-
|
Hmm... CLICK!
{
"groups": {
"group:admin": ["example@mail.jp"],
},
"tagOwners": {
"tag:nextcloud": ["autogroup:admin", "group:azuki"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
],
"nodeAttrs": [
{
"target": ["group:admin", "tag:nextcloud"],
"attr": ["funnel"],
},
],
}
|
Beta Was this translation helpful? Give feedback.
-
|
I think there might be a need for it, so I'll provide the compose.yml that I'm actually using in operation. It's almost the same as what's written in the guide. CLICK!services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # この行は変更できません。
volumes:
- type: volume
source: nextcloud_aio_mastercontainer
target: /mnt/docker-aio-config
volume:
nocopy: true
- type: bind
source: /var/run/docker.sock
target: /var/run/docker.sock
read_only: true
networks:
- nextcloud-aio
ports:
- 0.0.0.0:4445:8080
environment: # 以下のオプションのいずれかを使用する場合に必要です
AIO_DISABLE_BACKUP_SECTION: false # これをtrueに設定すると、AIOインターフェースのバックアップセクションを非表示にできます。https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section を参照してください
APACHE_PORT: 11000 # Webサーバーやリバースプロキシの背後で実行する場合に必要です。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
APACHE_IP_BINDING: 127.0.0.1 # 同じホスト上で実行されているWebサーバーやリバースプロキシの背後で実行する場合に設定する必要があります。https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md を参照してください
SKIP_DOMAIN_VALIDATION: true
BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # borgの保持ポリシーを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy を参照してください
COLLABORA_SECCOMP_DISABLED: false # これをtrueに設定すると、CollaboraのSeccomp機能を無効にできます。https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature を参照してください
NEXTCLOUD_DATADIR: /mnt/hdd_toshiba/ncdata # Nextcloudのデータディレクトリのホストディレクトリを設定できます。⚠️⚠️⚠️ 警告：初期のNextcloudインストールが完了した後にこの値を設定または調整しないでください！https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir を参照してください
NEXTCLOUD_MOUNT: /mnt/hdd_toshiba # Nextcloudコンテナがホストäã®選択したディレクトリにアクセスできるようにします。https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host を参照してください
NEXTCLOUD_UPLOAD_LIMIT: 10G # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud を参照してください
NEXTCLOUD_MAX_TIME: 7200 # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud を参照してください
NEXTCLOUD_MEMORY_LIMIT: 1024M # より多くが必要な場合は調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud を参照してください
#NEXTCLOUD_TRUSTED_CACERTS_DIR: /usr/local/share/ca-certificates # このディレクトリ内のCA証明書は、nextcloudコンテナのOSによって信頼されます（例：LDAPSに有用）。https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca を参照してください
NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # AIOを初めて起動する際にインストールされるNextcloudアプリを変更できます。https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup を参照してください
NEXTCLOUD_ADDITIONAL_APKS: imagemagick # Nextcloudコンテナに追加のパッケージを永続的に追加できます。デフォルトはimagemagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container を参照してください
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # Nextcloudコンテナに追加のPHP拡張機能を永続的に追加できます。デフォルトはimagickですが、この値を変更することで上書きできます。https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container を参照してください
#NEXTCLOUD_ENABLE_DRI_DEVICE: false # Nextcloudコンテナで/dev/driデバイスを有効にできます。⚠️⚠️⚠️ 警告：これはホスト上に'/dev/dri'デバイスが存在する場合にのみ機能します！ホスト上に存在しない場合は、trueに設定しないでください。そうしないとNextcloudコンテナが起動に失敗します！https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud を参照してください
#NEXTCLOUD_KEEP_DISABLED_APPS: false # これをtrueに設定すると、AIOインターフェースで無効化されているNextcloudアプリを保持し、インストールされている場合はアンインストールしません。https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps を参照してください
TALK_PORT: 3478 # talkコンテナが使用するポートを調整できます。https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port を参照してください
WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # ホスト上のdockerソケットがデフォルトの'/var/run/docker.sock'にない場合に指定する必要があります。そうしないとマスターコンテナの更新が失敗します。macOSの場合は'/var/run/docker.sock'である必要があります
APACHE_MAX_SIZE: 10737418240 # これは整数である必要があり、NEXTCLOUD_UPLOAD_LIMITと同期している必要があります。
security_opt: ["label:disable"] # SELinuxを使用する場合に必要です
nextcloud-aio-tailscale-caddy:
image: caddy:alpine
restart: unless-stopped
environment:
- NC_DOMAIN=nextcloud.qilin-scala.ts.net # {$TS_HOSTNAME}.{tailnet-domain}という.ts.netで終わるドメインに変更してください
volumes:
- type: bind
source: ./Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # /var/run/tailscale/tailscale.sockのボリュームをマウント
read_only: true
network_mode: service:nextcloud-aio-tailscale
nextcloud-aio-tailscale:
image: tailscale/tailscale:latest
environment:
- TS_HOSTNAME=nextcloud # tailnetでのホスト名を入力してください
- TS_AUTH_KEY=tskey-client-kbjbruk4Vm11CNTRL # OAuth clientsのkeyを取得することをオススメします
- TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # OAuth client-tskeyを使う場合、advertise-tagsにtagを付与するようにしてください。tagを作成するにはACLにタグを定義する必要があります。
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # /tmp/tailscale.sockのボリュームをマウント
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # この行は変更できません。変更すると組み込みのバックアップソリューションが機能しなくなります
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001"
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1"
If there are no discrepancies in the settings with this yml, then there's probably a misconfiguration in the Tailscale admin console. |
Beta Was this translation helpful? Give feedback.
-
|
Nice guide! Thanks so much. or Note: same goes for the |
Beta Was this translation helpful? Give feedback.
-
|
Follow up. After provisioning the nextcloud, I haven't been able to connect using the NC_DOMAIN because of connection timed out. Any idea why? |
Beta Was this translation helpful? Give feedback.
-
|
Please check the following conditions:
If you need to redo it, execute the following commands: These commands will delete existing docker containers and networks. |
Beta Was this translation helpful? Give feedback.
-
|
Hmm everything looks to be correct so I am not sure what is causing the problem. So, after deploying the nextcloud-aio, there are two clients in my tailscale network which are actually the same device, both both are ping-able. Is it possible that might cause a conflict or something? |
Beta Was this translation helpful? Give feedback.
-
|
Update: for some reason, now it works. All I did was simply reset and restart the process several times so I'm not really sure what was the problem as I didn't change any of the configuration file. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, one question: Should I "sudo dnf install tailscale" on my host, then follow all this docker compose things? because how would I declare ACL dst 'nextcloud.your-tailnet.ts.net'? Or do I add my device manually in tailscale admin? I might be very less informed about ACL and tags, but I am trying to learn and doing all this to use nextcloud-aio is tiring, but I am trying my best. Thanks! PS: I was using this |
Beta Was this translation helpful? Give feedback.
-
{
"acls": [
{
"action": "accept",
"src": ["autogroup:admin","tag:trust"],
"dst": ["tag:nextcloud:*"]
}
]
}It is recommended to specify tags for "src" and "dst" Users and nodes that have the same tag can communicate by default. |
Beta Was this translation helpful? Give feedback.
-
Hey, I tried to do it myself (just saw your reply), and everything went well, it's just my nextcloud-aio-apache container is "unhealthy" and I can't connect to "NC_domain" like "fedora.tail12345f.ts.net", it says "Problem loading page". My docker logs apache says: and docker logs nextcloud-aio-mastercontainer says: Thanks |
Beta Was this translation helpful? Give feedback.
-
|
Hey @flll What I did:
I am sure I misunderstood a lot of things, looking for pointers, thanks! |
Beta Was this translation helpful? Give feedback.
-
|
New Setup:
|
Beta Was this translation helpful? Give feedback.
-
Please check the following conditions:
If it's not working even though the order is correct, execute the following commands: These commands will delete existing docker containers and networks.
Please configure ACL according to your environment. |
Beta Was this translation helpful? Give feedback.
-
Disclaimer: It might be possible that the config below is not working 100% correctly, yet. Improvements to it are very welcome!
This setup integrates Nextcloud All-in-One (AIO) with Tailscale, using Caddy as a reverse proxy.
Since Tailscale currently only allows communication with localhost(127.0.0.1), we use a sidecar with Caddy to communicate with AIO.
serve.jsonconfiguration (This document does not provide an example ofserve.json)1. Set Environment Variables
Set the following environment variables:
Note
We will not create a .env file, but instead write directly into the compose.yml file later.
If you do create a .env file, compose will automatically read it. In this case, set the key-value format in service[].environment[] of the compose.yml to keys only, allowing compose to pass variables to the service.
Ensure NC_DOMAIN is in the correct format.
When using OAuth client key, set tags in TS_EXTRA_ARGS and define them in ACL.
For more detailed information, please refer to:
https://tailscale.com/blog/docker-tailscale-guide
2. Configure Docker Compose File
Create a compose.yml file with the following content. Replace environment variables as appropriate.
compose.yml
Important
Make sure to replace
NC_DOMAIN,TS_HOSTNAME,TS_AUTH_KEY, andTS_EXTRA_ARGSwith your actual values before running the docker compose file.3. Create Caddyfile
Create a Caddyfile in the current directory with the following content:
Caddyfile
Note
Do not manually replace the
{$NC_DOMAIN}variable. It will be automatically populated with the value set in your environment variables.4. Set Up Nextcloud AIO
docker compose up -dhttps://$NC_DOMAIN/(e.g., https://nextcloud.your-tailnet.ts.net/)Beta Was this translation helpful? Give feedback.
All reactions