Replies: 72 comments 415 replies
-
|
hi , |
Beta Was this translation helpful? Give feedback.
-
|
log file is pretty long, gonna attach it below. i'm fairly new to this so I'm not 100% sure what to make of it. |
Beta Was this translation helpful? Give feedback.
-
|
I believe you have a typo in your Caddyfile. Can you add |
Beta Was this translation helpful? Give feedback.
-
|
You are correct, I had missed the |
Beta Was this translation helpful? Give feedback.
-
|
This should be sufficient |
Beta Was this translation helpful? Give feedback.
-
|
awesome, was able to close it down and restart it, Caddy is happier now, but I'm still having DNS issues. Going thru the docker resource about it, but not 100% how i will go about fixing it. edit: realizing the log is throwing a fit about |
Beta Was this translation helpful? Give feedback.
This comment has been hidden.
This comment has been hidden.
-
|
Yes, I've been running this setup for a few weeks now, and |
Beta Was this translation helpful? Give feedback.
-
|
Nice! |
Beta Was this translation helpful? Give feedback.
-
|
See #5460 |
Beta Was this translation helpful? Give feedback.
-
|
This is amazing @flll , I am trying to achieve the same since a month. But I am not using docker. Can you KINDLY make a script like the one for nextcloud with nginx as server, caddy as reverse proxy, tailscale and cloudflare as DNS. regards |
Beta Was this translation helpful? Give feedback.
-
|
Thankyou for the kind advice. I will go for it on Monday. Well I thought that I already am in lcx,doesn't it mean the same docker hardening? |
Beta Was this translation helpful? Give feedback.
-
|
Can you please enlighten the disadvantage? |
Beta Was this translation helpful? Give feedback.
-
|
with that AIO, can caddy be installed on different separate container/ VM . ( for example: caddy in a separate proxmox LCX container and nextcloud AIO in a separate Proxmox VM. but both VM and LXC are on same network but different subnets. Is this possible? |
Beta Was this translation helpful? Give feedback.
-
I would recommend using Kubernetes or Docker Swarm. |
Beta Was this translation helpful? Give feedback.
-
Docker-based deployment has very few disadvantages. |
Beta Was this translation helpful? Give feedback.
This comment has been hidden.
This comment has been hidden.
-
|
I used the nginx.conf from the projects readme (link in my original comment) What is I simply used the docker compose from the README (I had to comment and uncomment some lines) |
Beta Was this translation helpful? Give feedback.
-
|
apology, it's |
Beta Was this translation helpful? Give feedback.
-
|
Is your configuration something like this? |
Beta Was this translation helpful? Give feedback.
-
|
@flll what about my case? |
Beta Was this translation helpful? Give feedback.
-
|
@A4alli |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your work @flll . But no matter how many times I try the procedure, the hostname I give in the compose environment doesn't get created in the tailscale and rather a random ephemeral hostname is created after manually authenticating using the url in the log. My Internet and Network connection is fine. But I cannot log into the nextcloud instance even with the the randomly generated hostname in my tailnet. |
Beta Was this translation helpful? Give feedback.
-
- - TS_HOSTNAME = nextcloud
+ - TS_HOSTNAME=nextcloudThere should be no space between the key and value in the key-value pair. |
Beta Was this translation helpful? Give feedback.
-
|
That was it, I'm into nextcloud! Thank you so much my Japanese friend. The docker compose file as in the guide complained of map and kepair format and so I edited it but didn't know that space will cause issues. I see couple of errors in the caddy log of refusing connection to fonts.json, should I be concerned? Also two more questions,
|
Beta Was this translation helpful? Give feedback.
-
|
This error seems to be due to Caddy failing to connect to nextcloud-aio-apache.
Yes, using an OAuth key makes it ephemeral.
Example ACL configuration: {
"groups": {
"group:admin": ["example@mail.jp", "flll@github"],
"group:azuki": ["tuyu@azuki.com"],
},
"acls": [
{
"action": "accept",
"src": ["group:admin"],
"dst": ["tag:nextcloud:*"],
},
]
}Note that "autogroup:admin" and "group:admin" are completely different groups. Please refer to Tailscale's autogroup documentation for more details. |
Beta Was this translation helpful? Give feedback.
-
Thank you as well. I was able to respond quickly because I've made the same mistake before, haha. |
Beta Was this translation helpful? Give feedback.
-
|
Non-ephemeral will make new nodes? Or ephemeral?? |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone get this error? docker compose up tailscale-1 | boot: 2024/10/24 22:18:21 Running 'tailscale up' |
Beta Was this translation helpful? Give feedback.
-
Thank you for your help and for this amazing guide @flll . I was setting the host name to the same name as my server and I did not realized that it was making new machine server-1 in tailscale. Thank you again for your help!!! |
Beta Was this translation helpful? Give feedback.
-
|
This was also the root of my issue. Remember that the hostname to provide both in compose.yml and the Nextcloud admin console is the new, ephemeral hostname created by Tailnet, not the current hostname of your physical machine! |
Beta Was this translation helpful? Give feedback.
-
|
@MateuszFido what do you mean by new, ephemeral hostname created by Tailnet? Where can I find those? |
Beta Was this translation helpful? Give feedback.
-
|
I read everything in this guild but still can not access Nextcloud using my endpoint |
Beta Was this translation helpful? Give feedback.
-
|
The value of Supposing that your Tailnet name is |
Beta Was this translation helpful? Give feedback.
-
|
Nice guide! Thanks so much. or Note: same goes for the |
Beta Was this translation helpful? Give feedback.
-
|
Yes the |
Beta Was this translation helpful? Give feedback.
-
|
well I am using only via tailscale network. So I will not need any ports to forward. next I toggol on HTTPS in tailscale Admin counsel which give me lets encrypt https. right now Im stuck on provisioning screen. I cannot visit my nextclous AIO via tailscale domain. I am pasting the required data asked by @flll, when he will analyze about what is wrong. |
Beta Was this translation helpful? Give feedback.
-
|
Even with tailscale, you need those port to make it accessible inside your tailscale network |
Beta Was this translation helpful? Give feedback.
-
How to open up these ports in tailscale, whether it has to be done on the newly created nextcloud node or the host/server node in tailscale n/w. |
Beta Was this translation helpful? Give feedback.
-
|
I am running the whole system without any port forwarding or opening. Only in the docker compose there are the port mappings, to make the container accessible. The AIO master Container is only accessible over the ipadress from the Host running the Master container. But the rest of nextcloud does not need any port changing and is only accessible over your Domain you give into the environment variables. |
Beta Was this translation helpful? Give feedback.
-
|
Okay, one question: Should I "sudo dnf install tailscale" on my host, then follow all this docker compose things? because how would I declare ACL dst 'nextcloud.your-tailnet.ts.net'? Or do I add my device manually in tailscale admin? I might be very less informed about ACL and tags, but I am trying to learn and doing all this to use nextcloud-aio is tiring, but I am trying my best. Thanks! PS: I was using this |
Beta Was this translation helpful? Give feedback.
-
|
Hey @flll What I did:
I am sure I misunderstood a lot of things, looking for pointers, thanks! |
Beta Was this translation helpful? Give feedback.
-
|
New Setup:
|
Beta Was this translation helpful? Give feedback.
-
Please check the following conditions:
If it's not working even though the order is correct, execute the following commands: These commands will delete existing docker containers and networks.
Please configure ACL according to your environment. |
Beta Was this translation helpful? Give feedback.
-
|
@flll Brother, I finally did it. Nextcloud-AIO worked!!! What I did?
Thanks a lot! |
Beta Was this translation helpful? Give feedback.
-
|
@blazing-ph0enix Crossing your fingers is indeed an essential step in solving technical problems! 😄 It's wonderful that you're planning to share what you've learned with others. A guide for beginners will be incredibly helpful for many people. I'm looking forward to your future experiments. If you make any new discoveries, please do share them. Your experiences will be a valuable source of information for the community. Keep up the great work. And remember, if you ever run into any issues, don't hesitate to ask for help. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the guide, it's great but I cannot make it work for myself. My compose.yaml: My ACL: Caddy seems to recognize the domain name correctly, i.e. it resolves $NC_DOMAIN correctly. Tailscale logs: Tried opening 443 (TCP and UDP), 80, 8080 (out of desperation) in firewall and even disabling the firewall completely, none of it helped Seems that no matter what I do, in the nextcloud container I see: Pinging the domain name within tailscale works without problems |
Beta Was this translation helpful? Give feedback.
-
|
@MateuszFido
If you need to redo it, execute the following commands: These commands will delete existing docker containers and networks. |
Beta Was this translation helpful? Give feedback.
-
|
Yep, did those many times, my friend Finally got it today: the same issue as @Kendellb, the hostname to configure is the new, ephemeral hostname generated by Tailscale, not the current hostname of the physical machine hosting Nextcloud in tailnet. Initially, I thought your machine was just named "nextcloud" in your tailnet before running all the containers. It's worth remembering that setting the hostname provided to Nextcloud in the admin console cannot be undone - so just removing the containers, and even doing This was totally unclear to me from the guide, maybe it could be mentioned? Anyway, thanks a lot, it's a great setup nonetheless 👍 |
Beta Was this translation helpful? Give feedback.
-
|
I'm still having this issue. I'm using the ephemeral hostname but still having issues |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Right now, Unhealthy, because I haven't deleted old machines from admin console |
Beta Was this translation helpful? Give feedback.
-
Can't use my pc right now. Will try tomorrow. |
Beta Was this translation helpful? Give feedback.
-
|
Any update |
Beta Was this translation helpful? Give feedback.
-
Yes, I will make a new comment for my specific case, I will add all the logs in it |
Beta Was this translation helpful? Give feedback.
-
|
@flll if you please jump in to here to see the issues, KINDLY |
Beta Was this translation helpful? Give feedback.
-
|
Finally access the domain. |
Beta Was this translation helpful? Give feedback.
-
The funnel feature will expose your service to the public internet.
This error message indicates that debug information is currently hidden. While it's recommended to keep error details concealed in production environments for security purposes, you can temporarily enable detailed error display when troubleshooting is necessary. Once you've resolved the issue, it's advisable to return to the default secure configuration where error details are hidden from end users.
Please remove all containers and networks, then redeploy.
If you're unsure how to use it or don't plan to use it, I recommend not using it.
If Nextcloud is working, WebDAV should also be available by default.
Security settings are already included in nextcloud-aio-apache,
Are you trying to use both cloudflared and tailscaled tunnels? |
Beta Was this translation helpful? Give feedback.
-
|
Amazing. My nextcloud is functioning well by default. I mean from starting. I think I have no need to remove and redeploy. But of course security and setup warnings will stay the same as in the pastebin. (Or should it remove and redeploy and will get rid of the warnings) Point 6. You have pasted a diagram. A bit confusion, if you may please help me with it. I want to use cloudflare as DNS not a reverse proxy or tunnel. I have caddy-dns-cloudflare-module. |
Beta Was this translation helpful? Give feedback.
-
|
@flll @szaimen https://help.nextcloud.com/t/security-and-setup-warnings-nextcloud-aio-30-0-1/208752/2 |
Beta Was this translation helpful? Give feedback.
-
|
moreover @flll the notify-push failed in here according to your guide |
Beta Was this translation helpful? Give feedback.
-
THIS IS CREATING A TONS OF CLONE MACHINE IN MY TAILSCALE |
Beta Was this translation helpful? Give feedback.
-
|
Hey, So I have tried a lot of things, now my experience is like this:
Apache logs: Nextcloud logs: Redis: Database: Notify Push: Nextcloud Mastercontainer Logs: My ACL of Tailscale: |
Beta Was this translation helpful? Give feedback.
-
|
Your tailscale is not connected as per above logs |
Beta Was this translation helpful? Give feedback.
-
|
For me this guide work fine. Only problem is apache container showing unhealthy. But working |
Beta Was this translation helpful? Give feedback.
-
|
I apologize for the delayed response. cURL error 6: Could not resolve host: server.rohu-nessie.ts.netThis error suggests that the nextcloud-aio network is constantly being created, and Tailscale might not be properly connecting to the network Here are the steps to resolve this:
docker compose down
# Stop containers containing "nextcloud" in their name
docker stop $(docker ps -a | grep nextcloud | awk '{print $1}')
# Remove containers containing "nextcloud" in their name
docker rm $(docker ps -a | grep nextcloud | awk '{print $1}')
I didn't find any issues with the ACL settings. |
Beta Was this translation helpful? Give feedback.
-
Please disable the ephemeral setting.
It's recommended to keep the default state configuration.
This is likely a temporary issue.
Often this is due to insufficient permissions on the client-side Tailscale. |
Beta Was this translation helpful? Give feedback.
-
Thankyou 😍 |
Beta Was this translation helpful? Give feedback.
-
|
Has anyone tried to deploy using the portainer stack? Caddy log: I have double-checked my NC_DOMAIN variable. compose.yml: services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line cannot be changed.
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- nextcloud-aio
ports:
- 0.0.0.0:8080:8080
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: 127.0.0.1
SKIP_DOMAIN_VALIDATION: true
caddy:
image: caddy:alpine
restart: unless-stopped
container_name: caddy
environment:
NC_DOMAIN: nextcloud.[redacted].ts.net # Change this to your domain ending with .ts.net in the format {$TS_HOSTNAME}.{tailnetdomain}
volumes:
- type: bind
source: /home/surya/Caddyfile
target: /etc/caddy/Caddyfile
- type: volume
source: caddy_certs
target: /certs
- type: volume
source: caddy_data
target: /data
- type: volume
source: caddy_config
target: /config
- type: volume
source: tailscale_sock
target: /var/run/tailscale/ # Mount the volume for /var/run/tailscale/tailscale.sock
read_only: true
network_mode: service:tailscale
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
environment:
TS_HOSTNAME: nextcloud # Enter the hostname for your tailnet
TS_AUTH_KEY: tskey-client-kYthXvJbHD21CNTRL-[redacted] # OAuth client key recommended
TS_EXTRA_ARGS: --advertise-tags=tag:nextcloud # Tags are required when using OAuth client
init: true
restart: unless-stopped
volumes:
- /dev/net/tun:/dev/net/tun
- type: volume
source: tailscale
target: /var/lib/tailscale
- type: volume
source: tailscale_sock
target: /tmp # Mounting the entire /tmp folder to access tailscale.sock
cap_add:
- NET_ADMIN
- NET_RAW
networks:
- nextcloud-aio
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed.
caddy_certs:
name: caddy_certs
caddy_data:
name: caddy_data
caddy_config:
name: caddy_config
tailscale:
name: tailscale
tailscale_sock:
name: tailscale_sock
networks:
nextcloud-aio:
name: nextcloud-aio
driver: bridge
enable_ipv6: false
driver_opts:
com.docker.network.driver.mtu: "9001" # Jumbo Frame
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1" # Harden aioTailscale ACL: "groups": {
"group:admin": ["js-surya@github"],
"group:users": ["user@example.com", "otheruser@example.com"],
},
"tagOwners": {
"tag:nextcloud": ["group:admin"],
},
"acls": [
// Allow general unrestricted access (you can comment this out if needed).
{"action": "accept", "src": ["*"], "dst": ["*:*"]},
// Allow users in "group:users" to access any devices tagged with "nextcloud".
{"action": "accept", "src": ["group:users"], "dst": ["tag:nextcloud:*"]},I'm not an IT expert, and I'm relatively new to this. My IP is behind CGNAT, and I want to access my Nextcloud server outside my local network using Tailscale. I'm eager to learn, so any suggestions or help would be appreciated. |
Beta Was this translation helpful? Give feedback.
-
|
NC_DOMAIN=nextcloud.talscale.ts.net Remember there is = and than no space |
Beta Was this translation helpful? Give feedback.
-
TS_HOSTNAME=nextcloud # Hostname in Tailnet
NC_DOMAIN=nextcloud.mydomain.ts.net # Format: {$TS_HOSTNAME}.{$tailnetdomain}.ts.net
TS_AUTH_KEY=tskey-client-kYthXvJbHD21CNTRL-mykey # OAuth client key recommended
TS_EXTRA_ARGS=--advertise-tags=tag:nextcloud # For OAuth client key usageHere is my .env config |
Beta Was this translation helpful? Give feedback.
-
|
check my config files above that work |
Beta Was this translation helpful? Give feedback.
-
|
Apache is always unhealthy docker exec -it nextcloud-aio-apache bash -x /healthcheck.sh
|
Beta Was this translation helpful? Give feedback.
-
|
Same here |
Beta Was this translation helpful? Give feedback.
-
|
check my last comment below for solution with serve.json |
Beta Was this translation helpful? Give feedback.
-
|
Checked it. Is there a way to check if a port is open to public? Will try and report. |
Beta Was this translation helpful? Give feedback.
-
|
what about your security and setup warnings? |
Beta Was this translation helpful? Give feedback.
-
|
@flll Wanted to mention that I was able to get this working without needing caddy at all. I think it simplifies things a bit. Tailscale can natively proxy Note this employs tailscale serve (as opposed to tailscale funnel) so will only expose the service to your tailnet, not publicly. You could set a funnel flag to true in the json config below to expose it publicly, though some security and performance caveats would apply if you did.
|
Beta Was this translation helpful? Give feedback.
-
I am utilizing the native proxy method provided by @patrick-theprogrammer, as detailed in 1 and 2, without employing Caddy as a sidecar. Please take a look at his compose file and serve-config.json there, you can find the serve config variable and volume. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @patrick-theprogrammer! This feels like a much better approach for me personally ( A couple of things to note in case others run into similar issues:
nextcloud-aio:
image: nextcloud/all-in-one:latest
container_name: nextcloud-aio-mastercontainer # app requirement
depends_on:
- nextcloud-tailscale
ports:
- 8080:8080 <----------------------------
|
Beta Was this translation helpful? Give feedback.
-
|
No need of exposing port 8080. You call [tailscal].ts.net:8443 |
Beta Was this translation helpful? Give feedback.
-
|
Hey all, i got the setup working with Tailscale server, thx for the info and guide. |
Beta Was this translation helpful? Give feedback.
-
|
use funnel but it will expose to internet |
Beta Was this translation helpful? Give feedback.
-
|
Hi. Thanks a lot for this guide! I was having a lot of trouble with the Cloudflare DNS tunnel and the setup using Tailscale is much simpler. However, I was not able to access the instance locally from a LAN device not connected to my Tailscale network. I have my pihole local DNS server point Do you have any suggestion on how to make this work? Would it help to use |
Beta Was this translation helpful? Give feedback.
-
|
The Tailscale logs showed packet loss, and I was constantly monitoring to see if it was a firewall issue. The cause turned out to be the service startup order and MTU value. Since Caddy depends on the Tailscale socket, if Caddy starts first, it can't find the socket and things go wrong. The serve.json file is not necessary. Also, it seems that when the MTU value is above 1280, packets are silently dropped. I discovered that when sending jumbo frames on a network with switches that don't support jumbo frames, the packets can be discarded at the switch level and never reach the destination. For the changes, we'll modify the MTU value to what Tailscale recommends. services:
nextcloud-aio-caddy:
build:
context: .
dockerfile: Caddy.Dockerfile
container_name: nextcloud-aio-caddy
+ depends_on:
+ - nextcloud-aio-tailscale
restart: unless-stopped
(...)
nextcloud-aio-tailscale:
image: tailscale/tailscale:v1.80.3
+ healthcheck:
+ test: tailscale status --peers=false --json | grep 'Online.*true'
+ start_period: 3s
+ interval: 1s
+ retries: 3
(...)
networks:
nextcloud-aio:
driver_opts:
- com.docker.network.driver.mtu: "9001"
+ com.docker.network.driver.mtu: "1280"
com.docker.network.bridge.host_binding_ipv4: "127.0.0.1" # Harden aioYou'll need to rebuild the nextcloud-aio network, so please refer to the "Docker Reset Commands" in the wiki to reset everything. Please restart your client and try accessing the site again. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! I'll give it a try next week-end. |
Beta Was this translation helpful? Give feedback.
-
|
@flll I've tried your changes, but it didn't help. Running Do you know how can I troubleshoot the issue? My |
Beta Was this translation helpful? Give feedback.
-
|
Not sure how much it helps, but it seems I am now getting a TLS handshake error when attempting local access: @flll please let me know if you have ideas how to debug this further. |
Beta Was this translation helpful? Give feedback.
-
|
@flll will tailscale, caddy sidecar work with synapse+coturn? I wonder if it is possiable? |
Beta Was this translation helpful? Give feedback.
-
|
I don't understand what Synapse and Coturn are. |
Beta Was this translation helpful? Give feedback.
-
|
https://github.com/element-hq/synapse
|
Beta Was this translation helpful? Give feedback.
-
|
any chance? |
Beta Was this translation helpful? Give feedback.
-
|
@flll want to know how nextcloud use coturn server. I want it for synapse? |
Beta Was this translation helpful? Give feedback.
-
|
This was a great guide, thank you @flll! My only feedback: Thanks again! |
Beta Was this translation helpful? Give feedback.
-
|
omg i tried for so long with portainer (im new to it) and thought i was just not getting something. |
Beta Was this translation helpful? Give feedback.
-
How to setup with TSDproxy in order to have multiple apps:TSDproxy is a tailscale reverse proxy that allows you to deploy multiple docker apps without the needing sidecars. In this following example, we'll configure TSDproxy to redirect to:
PLEASE NOTE: Create a 90-day, no-ephemeral key.
media:
filename: /config/media.yaml
defaultProxyProvider: default
defaultProxyAccessLog: false
nextcloud:
url: http://nextcloud-aio-apache:11000
Check your machine list into tailscale, you should see the different hosts. PLEASE NOTE: I wasn't able to make it work the turn/stun server for "nextcloud-aio-talk:3478" upstream using TSDproxy. Improvements are welcome! |
Beta Was this translation helpful? Give feedback.
-
|
Having issues getting this to work, did you not need to use the tsdproxy labels for nextcloud-aio? |
Beta Was this translation helpful? Give feedback.
-
|
Great. But how about synapse server and coturn server
…On Mon, Mar 24, 2025, 10:46 Chris Coria ***@***.***> wrote:
How to setup with TSDproxy in order to have multiple apps:
TSDproxy is a tailscale reverse proxy
<https://almeidapaulopt.github.io/tsdproxy/> that allows you to deploy
multiple docker apps without the needing sidecars.
In this following example, we'll configure TSDproxy to redirect to:
- Nextcloud
- Vaultwarden
- Pi-hole
- Dashy
- Stirling PDF
- Calibre web
PLEASE NOTE: Create a 90-day, no-ephemeral key
<https://login.tailscale.com/admin/settings/keys>.
docker-compose.yml:
services:
## TSDproxy
tsdproxy:
image: almeidapaulopt/tsdproxy:latest
container_name: tsdproxy
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- tsdproxy_data:/data
- tsdproxy_config:/config
environment:
# Get AuthKey from your Tailscale account
- TSDPROXY_AUTHKEY=tskey-auth-XXXXXXXXXXXXX # Change: put your tailscale key.
# Address of docker server (access to example.com ports)
# - TSDPROXY_HOSTNAME=192.168.xxx.xxx
- DOCKER_HOST=unix:///var/run/docker.sock
restart: unless-stopped
ports:
- 8086:8080 # For the dashboard
networks:
- proxy-net
- nextcloud-aio
## NEXTCLOUD
nextcloud:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line cannot be changed.
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "8080:8080"
environment:
- NEXTCLOUD_DATADIR=/mnt/data/nextcloud # Change: Use your own dir.
# - AIO_DISABLE_BACKUP_SECTION=true
- APACHE_PORT=11000
- APACHE_IP_BINDING=0.0.0.0
- SKIP_DOMAIN_VALIDATION=false
- NEXTCLOUD_ENABLE_DRI_DEVICE=true # Change this if you don't have DRI supported.
networks:
- nextcloud-aio
## PI-HOLE
pihole:
image: pihole/pihole:latest
container_name: pihole
restart: always
labels:
tsdproxy.enable: "true"
tsdproxy.name: "pi"
tsdproxy.container_port: 80
tsdproxy.ephemeral: "false"
environment:
- TZ="America/Mexico_City"
- WEBPASSWORD="XXXXXXXXXX" # Change: choose password.
- DNS1=8.8.8.8
- DNS2=8.8.4.4
ports:
- "5353:53/udp" # DNS port
- "8083:80" # Dashboard
volumes:
- pihole_config:/etc/pihole
- pihole_dnsmasq:/etc/dnsmasq.d
networks:
- proxy-net
## VAULTWARDEN
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: always
labels:
tsdproxy.enable: "true"
tsdproxy.name: "vault"
tsdproxy.ephemeral: "false"
volumes:
- /mnt/data/vaultwarden:/data # Change: choose your location
environment:
- WEBSOCKET_ENABLED=true
- SIGNUPS_ALLOWED=true
ports:
- "8081:80" # Publicar puerto 80 del contenedor en el puerto 8081 del host
networks:
- proxy-net
## DASHY
dashy:
image: lissy93/dashy:latest
container_name: dashy
restart: always
labels:
tsdproxy.enable: "true"
tsdproxy.name: "dashy"
tsdproxy.ephemeral: "false"
ports:
- "8082:8080" # Dashboard
volumes:
- dashy_config:/config
networks:
- proxy-net
## PDF
stirling-pdf:
image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
container_name: stirling-pdf
labels:
tsdproxy.enable: "true"
tsdproxy.name: "pdf"
tsdproxy.ephemeral: "false"
ports:
- 8084:8080
volumes:
- StirlingPDF_trainingData:/usr/share/tessdata # Required for extra OCR languages
- StirlingPDF_extraConfigs:/configs
- StirlingPDF_customFiles:/customFiles/
- StirlingPDF_logs:/logs/
- StirlingPDF_pipeline:/pipeline/
environment:
- DOCKER_ENABLE_SECURITY=false
- LANGS=en_US
networks:
- proxy-net
## CALIBRE WEB
calibre-web:
image: lscr.io/linuxserver/calibre-web:latest
container_name: calibre-web
labels:
tsdproxy.enable: "true"
tsdproxy.name: "books"
tsdproxy.ephemeral: "false"
environment:
- PUID=1000
- PGID=1000
- TZ=Etc/UTC
- DOCKER_MODS=linuxserver/mods:universal-calibre #optional
- OAUTHLIB_RELAX_TOKEN_SCOPE=1 #optional
volumes:
- calibre_data:/config
- /mnt/data/calibre/library:/books
ports:
- 8085:8083
restart: unless-stopped
networks:
- proxy-net
volumes:
tsdproxy_data:
name: tsdproxy-data
tsdproxy_config:
name: tsdproxy-config
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line cannot be changed.
dashy_config:
name: dashy_config
pihole_config:
name: pihole_config
pihole_dnsmasq:
name: pihole_dnsmasq
calibre_data:
name: calibre_data
StirlingPDF_trainingData:
name: StirlingPDF_trainingData
StirlingPDF_extraConfigs:
name: StirlingPDF_extraConfigs
StirlingPDF_customFiles:
name: StirlingPDF_customFiles
StirlingPDF_logs:
name: StirlingPDF_logs
StirlingPDF_pipeline:
name: StirlingPDF_pipeline
networks:
proxy-net:
name: proxy-net
driver: bridge
nextcloud-aio:
external: true # Use the existing Nextcloud network
1. Run with sudo docker compose up -d
2. Then stop all using sudo docker compose down
3. Inspect the tsdproxy config volume using: sudo docker volume ls
4. Then inspect the container using: sudo docker volume inspect
tsdproxy-config, you'll see the config docker dir.
5. Enter into root using sudo su and then cd
/var/lib/docker/volumes/tsdproxy-config/_data. Check current files
using ls, you'll see a file called tsdproxy.yaml.
6. Then edit tsdproxy.yaml and add into files::
media:
filename: /config/media.yaml
defaultProxyProvider: default
defaultProxyAccessLog: false
7. Save it. Now create a new file in the working dir
(/var/lib/docker/volumes/tsdproxy-config/_data) named media.yaml and
add:
nextcloud:
url: http://nextcloud-aio-apache:11000
8. Save it. You're good to go! You'll see
—
Reply to this email directly, view it on GitHub
<#5439 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BMKVEZZN24AWSF7KE2VFCO32V6LZZAVCNFSM6AAAAABQGBXP2KVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENJZG43DINI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
I now can start my Nextcloud. Thanks guy. |
Beta Was this translation helpful? Give feedback.
-
|
Awesome guide—really well documented... Appreciate the efforts! 🙌 Even I got everything up and running (learned about docker and everything.. 3 weeks ago.. hah), but I’m struggling with local (as in not via tailscale/internet) access since it seems somehow impossible to reach Nextcloud directly from the LAN. I tried setting up a local DNS entry in pihole ( Also, performance over Tailscale is really slow and sometimes unresponsive, especially on Android using the nextcloud client (shows no internet, then works but sluggishly). Not sure if this is expected or if I'm doing something wrong. (despite fiber-optics inet access) Any pointers? Would love your guys insights—thanks again for putting this together! 🚀 But... in this state its kinda useless to be completely frank.. haha 😅 |
Beta Was this translation helpful? Give feedback.
-
Got AIO working with Tailscale based on cristo357's approachI finally managed to get Nextcloud AIO working with Tailscale subdomains by following the approach described by cristo357. Here's how I did it. 1. Get a Tailscale auth keyFirst, obtain an auth key from Tailscale by going to Settings → Keys → Auth Keys. IMPORTANT: Make sure to create it as "Reusable" or it will stop working after a single use. 2. Create the required Docker networksdocker network create tsdproxy_default
docker network create nextcloud_aio_network3. Set up tsdproxyCreate a services:
tsdproxy:
image: almeidapaulopt/tsdproxy:latest
container_name: tsdproxy
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./tsdproxy_data:/data
- ./tsdproxy_config:/config
environment:
- TSDPROXY_AUTHKEY=tskey-auth-xxxxxx-xxxxxxx # Change this
- DOCKER_HOST=unix:///var/run/docker.sock
restart: unless-stopped
ports:
- "8086:8080" # For the control panel (accessible from any interface)
networks:
- tsdproxy_default
- nextcloud_aio_network
networks:
tsdproxy_default:
external: true
nextcloud_aio_network:
external: trueNote: "latest" works as of April 1, 2025. If it doesn't work, try the tag "almeidapaulopt/tsdproxy:1.4.7" Start the container: docker compose up -dIf successful, two new folders should be created: 4. Configure the Proxy ListNow we need to configure a Proxy List so that when we launch the Nextcloud container, it can generate the subdomain. Adding a label to the AIO docker-compose doesn't work since we only have a container launcher. We need to interact with the Apache container on port 11000, and we can't do that by editing the AIO compose file. This part took me many hours to understand. More information about Proxy Lists can be found at https://almeidapaulopt.github.io/tsdproxy/docs/list/ Edit the newly created configuration file: nano tsdproxy_config/tsdproxy.yamlAnd set it up like this: defaultproxyprovider: default
docker:
local:
host: unix:///var/run/docker.sock
targethostname: 172.31.0.1
files:
media:
filename: /config/media.yaml
defaultProxyProvider: default
defaultProxyAccessLog: false
tailscale:
providers:
default:
authkey: tskey-auth-xxxxx-xxxxxx
controlurl: https://controlplane.tailscale.com
datadir: /data/
http:
hostname: 0.0.0.0
port: 8080
log:
level: info
json: false
proxyaccesslog: trueBasically, we've added the "media" section. Now create the nextcloud:
url: http://nextcloud-aio-apache:11000This will make our subdomain "nextcloud.tailcxxxxx.ts.net" and we'll see a service with that name in our Tailscale network. 5. Start the proxyIf you want to verify that the proxy is working properly, at least the general part, you can run: docker run -d --name sample-nginx -p 8111:80 --label "tsdproxy.enable=true" nginx:latestThis will start a test nginx instance. If you access your tailnet network on port 8086, you should see the proxy dashboard, along with the nginx button. Clicking the button should open nginx from its subdomain. 6. Set up Nextcloud AIOCreate the Nextcloud folder and add the compose file: services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
container_name: nextcloud-aio-mastercontainer
init: true
restart: always
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "8080:8080"
environment:
- NEXTCLOUD_DATADIR=/mnt/external/nextcloud
- APACHE_PORT=11000
- APACHE_IP_BINDING=0.0.0.0
- APACHE_ADDITIONAL_NETWORK=tsdproxy_default
- SKIP_DOMAIN_VALIDATION=true
- DISABLE_IP_RESTRICTIONS=true
- NEXTCLOUD_MOUNT=/mnt/external
networks:
- nextcloud_aio_network
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer
networks:
tsdproxy_default:
name: tsdproxy_default
driver: bridge
nextcloud_aio_network:
external: trueLaunch it and it should open the container configuration menu. After starting them, it should work. TroubleshootingIf it doesn't work, check these things:
In my case, the problem was that I was applying the labels to the AIO container, and I spent many hours until I understood that they needed to be applied to the Apache container, which was impossible to do directly. You have to configure the media from the proxy. The second problem I had was with "nextcloud-1", which made any configuration attempt unsuccessful. It's possible that the compose files can be simplified with fewer configuration options, but this worked for me. |
Beta Was this translation helpful? Give feedback.
-
Yes, my fault! I will edit now. Thank you |
Beta Was this translation helpful? Give feedback.
-
|
that is good tutorial. Much Appreciation |
Beta Was this translation helpful? Give feedback.
-
|
can you tell me your security and privacy logs in nextcloud instance? |
Beta Was this translation helpful? Give feedback.
-
|
Can confirm this works! I did have to restart my docker after the nextcloud containers started for the first time, so the nextcloud machine to appear. Can also confirm if you restart your server everything still works |
Beta Was this translation helpful? Give feedback.
-
|
First of all, thank you for this guide. I had found the tsdproxy docker on my own, but was unsure of how to go about using it. This got me much closer to actual success, but I'm still having issues. I'm seeing a log message that the auth key is set, but the state is NoState so the authkey is ignored. Is this an expected state? Should we follow the log direction and put the environment variable in there to force the use of the auth key? I'm seeing a message about needing to enable HTTPS in the admin panel to proceed. I thought I saw that http support was being added and that was already complete, but I could be wrong. Do I need to enable HTTPS? That wasn't mentioned in the instructions, so I didn't do it. Also, in step 5 you talk about accessing the tailnet on port 8086. Did you mean to try accessing what would be the host address for the nextcloud on that port? That instruction is confusing. I'm still fairly new to docker and tailscale especially, but I feel like this brought me at least closer. There's just some things that are unknowns as to whether I should be expected to see them. Please advise when you can. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
I'm new to docker, trailscale, coding, self-hosting, etc.....
I'm sorry to ask such basic questions. I've been trying to research all of this but I'm keep getting links that take me back to this page. |
Beta Was this translation helpful? Give feedback.
-
|
What is the my ts_host name supposed to be? Where do I find it? |
Beta Was this translation helpful? Give feedback.
-
|
you dont need to change that, leave it as nextcloud. unless thats where ive been going wrong too lmao, but nah looks like you dont need to change it |
Beta Was this translation helpful? Give feedback.
-
|
It's still failing to authorize. Still with the same log: The auth key starting in k41 is not what I have in my docker-compose file. How is the build accessing an old deleted key? |
Beta Was this translation helpful? Give feedback.
-
|
did you create a .env or something? you dont need to do that, you need to put those values in the docker compose, theres variables already in there |
Beta Was this translation helpful? Give feedback.
-
|
I did on my first attempt, but then I scrapped that project and started over. I can't find any .env files currently. But the details from the env file are showing up on every build, so it must be somewhere. I even uninstalled and reinstalled docker and nothing has changed. |
Beta Was this translation helpful? Give feedback.
-
|
This was working for me just last week on a VM that I scrapped. Trying it again today and it's creating a bunch of nextcloud machine clones. Tried a handful of times but the same issue, so I'm confused. One difference was this time the tailscale and caddy container had a "-1" at the end |
Beta Was this translation helpful? Give feedback.
-
This was the only setup I could get to work to even load into nextcloud-aio, my question is if nextcloud and ccollabora aren't communicating re: "failed to connect to remote server" error, could this mean that we need additional arguments in the Docker-Compose and CaddyFile to add the collabora sever for communication something like
Or is it possible collabora needs to be added to tailscale the same way nextcloud is with its own tag? |
Beta Was this translation helpful? Give feedback.
-
|
I've made it through the first three steps. My containers and tailscale are up and running. But how do I proceed from here?
|
Beta Was this translation helpful? Give feedback.
-
|
I need help connecting to http://localhost:8080 on my old laptop being used a testing bench. I want to get this running to get a feel on it before i apply it on a stronger pc for the actual home server. Laptop: Windows 10, i5 3rd Gen, 256GB Storage, 4GB RAM I was able to follow the steps here until the Nextcloud AIO Provision all containers were up and running (green) but when I tried to open Nextcloud following the Provision, localhost:8080 doesnt load. After a few troubleshooting with chatgpt, it was seen that Caddy and apache container are not connecting properly. Apache is giving a bad gateway and when i try doing Chatgpt's solution which is to connect the two manually, It displays the same thing in which i am now in a loop and i don't know what else to do now. |
Beta Was this translation helpful? Give feedback.
-
|
https instead of http |
Beta Was this translation helpful? Give feedback.
-
|
Still cannot be reached. ERR_CONNECTION_REFUSED |
Beta Was this translation helpful? Give feedback.
-
|
I think i figured it out now on caddy container, I had "networks: -nextcloud-aio" instead of "network_mode: service:nextcloud-aio-tailscale" from the troubleshooting with chatgpt. I just noticed it from trying a fresh start. I am now running it, hopefully it works! Will update soon. |
Beta Was this translation helpful? Give feedback.
-
|
I have done everything till step 4. When I navigate to my Nextcloud's domain i.e. Tailscale's domain, the domain does not respond. To troubleshoot, I ran the following commands and got this response: docker logs nexcloud-aio-nextcloud docker logs containers-nextcloud-aio-caddy-1 Could someone please help me? Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
You need to enable LetsEncrypt support in Tailscale: https://tailscale.com/kb/1153/enabling-https |
Beta Was this translation helpful? Give feedback.
-
|
How can I publish this to the internet using Tailscale funnels? I've tried following the exact guide above and it works inside my tailnet network, but I tried "tailscale funnel --bg https://localhost:80" and the same with 443 inside the tailscale container, as well as on the server itself to publish the website, but the website doesn't seem to work (it gives http 502 when doing it inside the Tailscale container and just straight up doesn't seem to find the website when trying to make the funnel on the host) |
Beta Was this translation helpful? Give feedback.
and others
-
Disclaimer: It might be possible that the config below is not working 100% correctly, yet. Improvements to it are very welcome!
This setup integrates Nextcloud All-in-One (AIO) with Tailscale, using Caddy as a reverse proxy.
Since Tailscale currently only allows communication with localhost(127.0.0.1), we use a sidecar with Caddy to communicate with AIO.
serve.jsonconfiguration (This document does not provide an example ofserve.json)1. Set Environment Variables
Set the following environment variables:
Note
We will not create a .env file, but instead write directly into the compose.yml file later.
If you do create a .env file, compose will automatically read it. In this case, set the key-value format in service[].environment[] of the compose.yml to keys only, allowing compose to pass variables to the service.
Ensure NC_DOMAIN is in the correct format.
When using OAuth client key, set tags in TS_EXTRA_ARGS and define them in ACL.
For more detailed information, please refer to:
https://tailscale.com/blog/docker-tailscale-guide
2. Configure Docker Compose File
Create a compose.yml file with the following content. Replace environment variables as appropriate.
compose.yml
Important
Make sure to replace
NC_DOMAIN,TS_HOSTNAME,TS_AUTH_KEY, andTS_EXTRA_ARGSwith your actual values before running the docker compose file.3. Create Caddyfile and Caddy.Dockerfile
Create a Caddyfile in the current directory with the following content:
Caddyfile
{ layer4 { 127.0.0.1:3478 { route { proxy { upstream nextcloud-aio-talk:3478 } } } 127.0.0.1:3479 { route { proxy { upstream nextcloud-aio-talk:3479 } } } } } https://{$NC_DOMAIN} { reverse_proxy nextcloud-aio-apache:11000 } http://{$NC_DOMAIN} { reverse_proxy nextcloud-aio-apache:11000 }Note
Do not manually replace the
{$NC_DOMAIN}variable. It will be automatically populated with the value set in your environment variables.Create Caddy.Dockerfile
4. Set Up Nextcloud AIO
docker compose up --build --waitanddocker compose logs --followhttps://$NC_DOMAIN/(e.g., https://nextcloud.your-tailnet.ts.net/)If it doesn't work
Please try the following:
Docker Reset Commands
If things don't work, use the following commands to reset
Caution
Only use this if nothing else works.
CLICK!
After force stopping, check that the Nextcloud entry is no longer visible in the Tailscale admin console
Thank you for your advice, frazar
Beta Was this translation helpful? Give feedback.
All reactions