fix(dev): use kind container's gateway IP instead of NC's proxy IP - #98
Merged
Merged
Conversation
Signed-off-by: Anupam Kumar <kyteinsky@gmail.com>
This skips the addition of master_default (NC's network) to the kind container and uses the host network for pod -> NC communication. All other communication takes place in host so it would be consistent, and make development easier. Signed-off-by: Anupam Kumar <kyteinsky@gmail.com>
Contributor
Author
|
not completely sure if they make sense in all other setups but might make development easier. |
oleksandr-nc
left a comment
oleksandr-nc
left a comment
Contributor
There was a problem hiding this comment.
Direction looks good!
A few notes:
- Do the
NC_DOCKER_NETWORK="master_default"in the config block is now unused? - Is
KIND_NODE="${KIND_CLUSTER}-control-plane"defined but the new docker inspectcall hardcodesnc-exapps-control-plane? Should we use"$KIND_NODE"so the two stay in sync if someone changesKIND_CLUSTER` ? - The failure branch still prints
WARNING: Could not detect proxy IP.- should we change that toCould not detect kind gateway IP?
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedNext included review available in 17 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe redeploy script now specifies that Nextcloud Docker-Dev must publish port 80 on the host and refers to the README for nginx vhost configuration. It removes the Priority: ⬇️ Low Merge Risk: 🟡 Moderate · up to With Docker-Dev’s default port binding, development pods cannot reach Nextcloud through the new alias. Make the proxy reachable from the kind network before merging. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to This change is limited to local development, but it changes how the cluster reaches Nextcloud. The new route depends on the host’s port 80 serving the intended proxy, and old hostname mappings may remain after configuration changes. No exploitable security issue was established. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: c10cf374-083f-4c38-9ae2-84c9bbb30a3d
📒 Files selected for processing (1)
development/redeploy_host_k8s.sh
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
Comment on lines
+34
to
+50
| # Detect the gateway IP of the kind Docker network for pod DNS resolution. | ||
| # Pods inside the kind cluster cannot resolve hostnames like "nextcloud.local" that only exist in the host's /etc/hosts. | ||
| # Try to inject hostAliases so that ExApp pods can reach Nextcloud. | ||
| echo "==> Detecting nginx proxy IP for host aliases..." | ||
| PROXY_IP=$(docker inspect master-proxy-1 \ | ||
| --format "{{(index .NetworkSettings.Networks \"$NC_DOCKER_NETWORK\").IPAddress}}" 2>/dev/null || true) | ||
| # The gateway is the host itself, where the nginx proxy publishes port 80, so an alias to it lets ExApp pods reach Nextcloud. | ||
| echo "==> Detecting the kind gateway IP for host aliases..." | ||
| KIND_HOST_IP=$(docker inspect "$KIND_NODE" \ | ||
| --format "{{(index .NetworkSettings.Networks \"kind\").Gateway}}" 2>/dev/null || true) | ||
| NC_HOSTNAME="$(echo "$NC_INSTANCE_URL" | awk -F'[/:]' '{print $4}')" | ||
| K8S_HOST_ALIASES="" | ||
| if [ -n "$PROXY_IP" ]; then | ||
| K8S_HOST_ALIASES="nextcloud.local:${PROXY_IP}" | ||
| echo " nextcloud.local -> $PROXY_IP" | ||
| if [ -z "$NC_HOSTNAME" ]; then | ||
| echo " WARNING: Could not extract a hostname from NC_INSTANCE_URL='$NC_INSTANCE_URL'." | ||
| elif [ "${NC_HOSTNAME#*[!0-9.]}" = "$NC_HOSTNAME" ]; then | ||
| echo " ${NC_HOSTNAME} is an IP address, no host alias needed." | ||
| elif [ -n "$KIND_HOST_IP" ]; then | ||
| K8S_HOST_ALIASES="${NC_HOSTNAME}:${KIND_HOST_IP}" | ||
| echo " ${NC_HOSTNAME} -> $KIND_HOST_IP" | ||
| else | ||
| echo " WARNING: Could not detect proxy IP. ExApp pods may not resolve nextcloud.local." | ||
| echo " WARNING: Could not detect the kind gateway IP. ExApp pods may not resolve ${NC_HOSTNAME}." |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
git diff --no-ext-diff --unified=50 21b30a1fd77346b8360f78022bbbdee2a522141b 2420725d96d5c6ac3384651a647370ba45814192 -- development/redeploy_host_k8s.sh
rg -n 'NC_INSTANCE_URL|publish.*80|nextcloud\.local|Docker-Dev|nginx vhost|NC_DOCKER_NETWORK' .
sed -n '1,100p' development/redeploy_host_k8s.shRepository: nextcloud/HaRP
Length of output: 12115
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- README local Docker-Dev sections ---'
sed -n '470,535p' README.md
printf '%s\n' '--- README NC_INSTANCE_URL contract ---'
sed -n '245,270p' README.md
printf '%s\n' '--- candidate setup files ---'
git ls-files | grep -E '(^|/)(docker-compose|compose|.*docker.*dev|.*kubernetes.*local|.*kind|README)' | head -80
printf '%s\n' '--- host-alias and NC URL consumers ---'
rg -n -C 3 'HP_K8S_HOST_ALIASES|HOST_ALIASES|NC_REQ_URL|NC_INSTANCE_URL|requests\.(get|post)|curl|urlopen' --glob '!*.lock' --glob '!vendor/**' .
printf '%s\n' '--- port mappings and listener references ---'
rg -n -C 3 '(127\.0\.0\.1:80|0\.0\.0\.0:80|:80:|:443:|listen\s+80|listen\s+443|published.*80|published.*443|port 80|port 443)' --glob '!*.lock' .Repository: nextcloud/HaRP
Length of output: 24763
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- parser outputs ---'
for url in \
'http://nextcloud.local' \
'https://cloud.acme.com' \
'http://nextcloud.local:8080' \
'https://cloud.acme.com:8443' \
'http://127.0.0.1:8080'
do
printf '%s -> ' "$url"
printf '%s\n' "$url" | awk -F'[/:]' '{printf "1=<%s> 2=<%s> 3=<%s> 4=<%s>\n", $1,$2,$3,$4}'
done
printf '%s\n' '--- resolved NC request construction and calls ---'
sed -n '25,75p' haproxy_agent.py
rg -n -C 8 'NC_REQ_URL|EX_APP_URL|USER_INFO_URL|aiohttp|ClientSession|_k8s.*pod|hostAliases|K8S_HOST_ALIASES' haproxy_agent.py
printf '%s\n' '--- README proxy/listener contract ---'
sed -n '105,125p' README.md
sed -n '608,625p' README.mdRepository: nextcloud/HaRP
Length of output: 35357
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- changed script with line numbers ---'
nl -ba development/redeploy_host_k8s.sh | sed -n '1,78p'
printf '%s\n' '--- Kubernetes deployment construction ---'
nl -ba haproxy_agent.py | sed -n '2145,2235p'
printf '%s\n' '--- deployment creation and alias initialization callers ---'
rg -n -C 8 '_k8s_build_deployment_manifest|_k8s_ensure_coredns_host_aliases|CreateExApp|create.*deployment|/apis/apps|/deployments' haproxy_agent.py
printf '%s\n' '--- all repository NC_INSTANCE_URL examples ---'
rg -n -C 2 'NC_INSTANCE_URL=' README.md development Dockerfile haproxy_agent.py
printf '%s\n' '--- base/head changed-file status ---'
git diff --no-ext-diff --name-status 21b30a1fd77346b8360f78022bbbdee2a522141b 2420725d96d5c6ac3384651a647370ba45814192Repository: nextcloud/HaRP
Length of output: 24663
🌐 Web query:
nextcloud-docker-dev nginx proxy published ports 80 443 nextcloud.local
💡 Result:
<source_evidence>
<source>
<title>nextcloud/nextcloud-docker-dev</title>
<location>https://github.com/nextcloud/nextcloud-docker-dev/</location>
<excerpt># nextcloud/nextcloud-docker-dev Nextcloud development environment using docker-compose - Stars: 187 - Forks: 102 - Watchers: 187 - Open issues: 72 - License: GNU Affero General Public License v3.0 - Homepage: https://nextcloud.github.io/nextcloud-docker-dev/ - Default branch: master - Created: 2017-10-08T14:34:50Z ## Languages - C - Dockerfile - HTML - Makefile - PHP - Python - Shell - TypeScript ## Topics - development-environment - docker-compose - nextcloud ## Top Contributors - juliusknorr (554 contributions) - renovate[bot] (53 contributions) - christianlupus (28 contributions) - SystemKeeper (22 contributions) - dependabot[bot] (18 contributions) - CarlSchwan (15 contributions) - Antreesy (9 contributions) - max-nextcloud (6 contributions) - fflorent (5 contributions) - SwikritiT (4 contributions) --- ## README # Nextcloud development environment on Docker Compose Documentation | Nextcloud Developer Portal Nextcloud&`#39`;s development environment using Docker Compose providing a large variety of services for Nextcloud server and app development and testing. ⚠ **DO NOT USE THIS IN PRODUCTION** Various settings in this setup are considered insecure and default passwords and secrets are used all over the place - ☁ Nextcloud containers for running multiple versions - 🐘 Multiple PHP versions - 🔒 Nginx proxy with optional SSL termination - 🛢️ MySQL/PostgreSQL/MariaDB/SQLite/MaxScale, Redis cache - 💾 Local or S3 primary storage - 👥 LDAP with example user data, Keycloak - ✉ Mailhog for testing mail sending - 🚀 Blackfire, Xdebug for profiling and debugging - 📄 Lots of integrating service containers: Collabora Online, Onlyoffice, Elasticsearch, ... ## Tutorial You can find a step-by-step tutorial on how to use this setup in the Nextcloud Developer Portal. It will guide you through the setup and show you how to use it for app development: https://cloud.nextcloud.com/s/iyNGp8ryWxc7Efa?path=%2F1%20Setting%20up%20a%20development%20environment In detail explanation of the setup and its features and configuration options can be found in the nextcloud-docker-dev documentation. ## Quickstart ### Persistent development setup > [!TIP] > This is the recommended way to run the setup for development. You will have a local clone of all required source code. To start the setup run the following commands to clone the repository and bootstrap the setup. This will prepare your setup and clone the Nextcloud server repository and required apps into the `workspace` folder. ```bash git clone https://github.com/nextcloud/nextcloud-docker-dev cd nextcloud-docker-dev ./bootstrap.sh ``` Depending on your docker version you will need to use `docker-compose` instead of `docker compose` in the following commands. This may take some time depending on your internet connection speed. Once done you can start the Nextcloud container using: ```bash docker compose up nextcloud ``` You can also start it in the background using `docker compose up -d nextcloud`. You can then access your Nextcloud instance at http://nextcloud.local. The default username is `admin` and the password is `admin`. Other users can be found in the documentation. > [!WARN] > Note that for performance reasons the server repository might have been cloned with `--depth=1` by default. To get the full history it is highly recommended to run: > > ```bash > cd workspace/server > git fetch --unshallow > git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*" > git fetch origin > ``` ### Standalone containers > [!TIP] > This is a very simple way but doesn&`#39`;t cover all features. If you are looking for a fully featured setup you may skip to the next section There is a standalone version of the Nextcloud containers available that can be used to run Nextcloud without the other services. This is useful if you are just wanting to get started with app development against a specific server version, or to just have a quick way to…[truncated]</excerpt>
</source>
<source>
<title>README.md</title>
<location>https://github.com/nextcloud/nextcloud-docker-dev/blob/master/README.md</location>
<excerpt># README.md - Branch: master - Repository: nextcloud/nextcloud-docker-dev --- # Nextcloud development environment on Docker Compose Documentation | Nextcloud Developer Portal Nextcloud&`#39`;s development environment using Docker Compose providing a large variety of services for Nextcloud server and app development and testing. ⚠ **DO NOT USE THIS IN PRODUCTION** Various settings in this setup are considered insecure and default passwords and secrets are used all over the place - ☁ Nextcloud containers for running multiple versions - 🐘 Multiple PHP versions - 🔒 Nginx proxy with optional SSL termination - 🛢️ MySQL/PostgreSQL/MariaDB/SQLite/MaxScale, Redis cache - 💾 Local or S3 primary storage - 👥 LDAP with example user data, Keycloak - ✉ Mailhog for testing mail sending - 🚀 Blackfire, Xdebug for profiling and debugging - 📄 Lots of integrating service containers: Collabora Online, Onlyoffice, Elasticsearch, ... ## Tutorial You can find a step-by-step tutorial on how to use this setup in the Nextcloud Developer Portal. It will guide you through the setup and show you how to use it for app development: https://cloud.nextcloud.com/s/iyNGp8ryWxc7Efa?path=%2F1%20Setting%20up%20a%20development%20environment In detail explanation of the setup and its features and configuration options can be found in the nextcloud-docker-dev documentation. ## Quickstart ### Persistent development setup > [!TIP] > This is the recommended way to run the setup for development. You will have a local clone of all required source code. To start the setup run the following commands to clone the repository and bootstrap the setup. This will prepare your setup and clone the Nextcloud server repository and required apps into the `workspace` folder. ```bash git clone https://github.com/nextcloud/nextcloud-docker-dev cd nextcloud-docker-dev ./bootstrap.sh ``` Depending on your docker version you will need to use `docker-compose` instead of `docker compose` in the following commands. This may take some time depending on your internet connection speed. Once done you can start the Nextcloud container using: ```bash docker compose up nextcloud ``` You can also start it in the background using `docker compose up -d nextcloud`. You can then access your Nextcloud instance at http://nextcloud.local. The default username is `admin` and the password is `admin`. Other users can be found in the documentation. > [!WARN] > Note that for performance reasons the server repository might have been cloned with `--depth=1` by default. To get the full history it is highly recommended to run: > > ```bash > cd workspace/server > git fetch --unshallow > git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*" > git fetch origin > ``` ### Standalone containers > [!TIP] > This is a very simple way but doesn&`#39`;t cover all features. If you are looking for a fully featured setup you may skip to the next section There is a standalone version of the Nextcloud containers available that can be used to run Nextcloud without the other services. This is useful if you are just wanting to get started with app development against a specific server version, or to just have a quick way to develop, test or debug. These containers support automatic fetching of the server source code and use SQLite as the database. The server source code is fetched from the official Nextcloud server repository and the version can be specified using the `NEXTCLOUD_VERSION` environment variable. The default version is `master`. Running the containers does not need this repository to be cloned. Example for running a Nextcloud server from the master branch of server: ```bash docker run --rm -p 8080:80 ghcr.io/nextcloud/nextcloud-dev-php81:latest ``` For app development you can mount your app directly into the container: ```bash docker run --rm -p 8080:80 -v ~/path/to/appid:/var/www/html/apps-extra/appid ghcr.io/nextcloud/nextcloud-dev-php81:latest `…[truncated]</excerpt>
</source>
<source>
<title>docker-compose.yml at master · juliusknorr/nextcloud-docker-dev</title>
<location>https://github.com/juliusknorr/nextcloud-docker-dev/blob/master/docker-compose.yml</location>
<excerpt>```yml services: # Proxy for ssl termination and easier hostname access # SSL certificates with the virtual host name need to be added to ./data/ssl proxy: image: ghcr.io/juliusknorr/nextcloud-dev-nginx:latest ports: - "${IP_BIND:-127.0.0.1}:${PROXY_PORT_HTTP:-80}:80" - "${IP_BIND:-127.0.0.1}:${PROXY_PORT_HTTPS:-443}:443" volumes: - ${DOCKER_SOCKET-/var/run/docker.sock}:/tmp/docker.sock:ro - ./data/ssl/:/etc/nginx/certs - ./data/nginx/vhost.d/:/etc/nginx/vhost.d environment: DHPARAM_BITS: 2048 DHPARAM_GENERATION: "false" HTTPS_METHOD: "noredirect" HSTS: "off" cap_add: - SYS_ADMIN networks: default: aliases: - nextcloud${DOMAIN_SUFFIX} - nextcloud2${DOMAIN_SUFFIX} - nextcloud3${DOMAIN_SUFFIX} - stable16${DOMAIN_SUFFIX} - stable17${DOMAIN_SUFFIX} - stable18${DOMAIN_SUFFIX} - stable19${DOMAIN_SUFFIX} - stable20${DOMAIN_SUFFIX} - stable21${DOMAIN_SUFFIX} - stable22${DOMAIN_SUFFIX} - stable23${DOMAIN_SUFFIX} - stable24${DOMAIN_SUFFIX} - stable25${DOMAIN_SUFFIX} - stable26${DOMAIN_SUFFIX} - stable27${DOMAIN_SUFFIX} - stable28${DOMAIN_SUFFIX} - stable29${DOMAIN_SUFFIX} - stable30${DOMAIN_SUFFIX} - stable31${DOMAIN_SUFFIX} - stable32${DOMAIN_SUFFIX} - stable33${DOMAIN_SUFFIX} - mail${DOMAIN_SUFFIX} - sso${DOMAIN_SUFFIX} - minio${DOMAIN_SUFFIX} - rustfs${DOMAIN_SUFFIX} - imap${DOMAIN_SUFFIX} - collabora${DOMAIN_SUFFIX} - codedev${DOMAIN_SUFFIX} - onlyoffice${DOMAIN_SUFFIX} - proxy${DOMAIN_SUFFIX} - hpb${DOMAIN_SUFFIX} - push${DOMAIN_SUFFIX} - keycloak${DOMAIN_SUFFIX} - portal${DOMAIN_SUFFIX} - gs1${DOMAIN_SUFFIX} - gs2${DOMAIN_SUFFIX} - lookup${DOMAIN_SUFFIX} - elasticsearch${DOMAIN_SUFFIX} - elasticsearch-ui${DOMAIN_SUFFIX} - pgadmin${DOMAIN_SUFFIX} - phpmyadmin${DOMAIN_SUFFIX} - talk-signaling${DOMAIN_SUFFIX} - talk-recording${DOMAIN_SUFFIX} - authentik${DOMAIN_SUFFIX} extra_hosts: - host.docker.internal:host-gateway haproxy: image: haproxy expose: - 80 environment: VIRTUAL_HOST: "proxy${DOMAIN_SUFFIX}" volumes: - ./docker/configs/haproxy.conf:/usr/local/etc/haproxy/haproxy.cfg:ro ... nextcloud: image: ghcr.io/juliusknorr/nextcloud-dev-php${PHP_VERSION:-82}:latest environment: SQL: ${SQL:-mysql} NEXTCLOUD_AUTOINSTALL: ${NEXTCLOUD_AUTOINSTALL:-YES} NEXTCLOUD_AUTOINSTALL_APPS: WITH_REDIS: "YES" VIRTUAL_HOST: "nextcloud${DOMAIN_SUFFIX}" ADDITIONAL_APPS_PATH: NEXTCLOUD_TRUSTED_DOMAINS: BLACKFIRE_CLIENT_ID: BLACKFIRE_CLIENT_TOKEN: PRIMARY: ${PRIMARY:-local} PHP_XDEBUG_MODE: ${PHP_XDEBUG_MODE:-develop} volumes: - &`#39`;${REPO_PATH_SERVER}:/var/www/html&`#39`; - &`#39`;${REPO_PATH_SERVER}/apps-extra:/var/www/html/apps-extra&`#39`; - &`#39`;${ADDITIONAL_APPS_PATH:-./data/apps-extra}:/var/www/html/apps-shared&`#39`; - data:/var/www/html/data - config:/var/www/html/config - apps-writable:/var/www/html/apps-writable - ./data/skeleton/:/skeleton - ./data/additional.config.php:/var/www/html/config/additional.config.php:ro - ./data/shared:/shared depends_on: - database-${SQL:-mysql} - redis - mail - ${PROXY_SERVICE:-proxy} extra_hosts: - host.docker.internal:host-gateway nextcloud2: image: ghcr.io/juliusknorr/nextcloud-dev-php${PHP_VERSION:-82}:latest environment: SQL: ${SQL:-mysql} VIRTUAL_HOST: "nextcloud2${DOMAIN_SUFFIX}" PHP_XDEBUG_MODE: ${PHP_XDEBUG_MODE:-develop} volumes: - &`#39`;${REPO_PATH_SERVER}:/var/www/html&`#39`; - &`#39`;${REPO_PATH_SERVER}/apps-extra:/var/www/html/apps-extra&`#39`; - &`#39`;${ADDITIONAL_APPS_PATH:-./data/apps-extra}:/var/www/html/apps-shared&`#39`; - data2:/var/www/html/data - config2:/var/www/html/config - apps-writable2:/var/www/html/apps-writable - ./data/skeleton/:/skeleton - ./data/additional.config.php:/var/www/html/config/additional.config.php:ro - ./data/shared:/shared ports: - "${IP_BIND:-127.0.0.1}:${PORTBASE:-800}1:80" depends_on: - database-${SQL:-mysql} - redis - mail - ${PROXY_SERVICE:-proxy} extra_hosts: - host.docker.internal:host-gateway nextcloud ... : image: ghcr.io/juliusknorr/nextcloud-dev-php${PHP_VERSION:…[truncated]</excerpt>
</source>
<source>
<title>Reverse proxy — Nextcloud 34 Administration Manual</title>
<location>https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/reverse_proxy_configuration.html</location>
<excerpt>The automatic hostname, protocol or webroot detection of Nextcloud can fail in certain reverse proxy situations. This configuration allows the automatic detection to be manually overridden. If Nextcloud fails to automatically detect the hostname, protocol or webroot you can use the overwrite parameters inside the `config/config.php`. ... - `overwritehost` set the hostname of the proxy. You can also specify a port. - `overwriteprotocol` set the protocol of the proxy. You can choose between the two options http and https. - `overwritewebroot` set the absolute web path of the proxy to the Nextcloud folder. - `overwritecondaddr` overwrite the values dependent on the remote address. The value must be a regular expression of the IP addresses of the proxy. This is useful when you use a reverse SSL proxy only for https access and you want to use the automatic detection for http access. - `overwrite.cli.url` the base URL for any URLs which are generated within Nextcloud using any kind of command line tools. For example, the value set here will be used by the notifications area. ... ### NGINX ... If using nginx as Nextcloud’s webserver from behind another nginx reverse proxy, put this only in the reverse proxy’s configuration. ... ``` location /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } location /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } location ^~ /.well-known { return 301 $scheme://$host/index.php$uri; } ``` ... When using NGINX Proxy Manager, the entry `proxy_hide_header Upgrade;` must be added in the “Advanced Settings” of the proxy host under “Custom Nginx Configuration”, otherwise mobile devices (iPad, iPhone etc.) will simply receive the Error Message “Connection Closed”. ... ### Nextcloud behind a reverse proxy (subdirectory) ... If your Nextcloud is served at a subdirectory, for example https://example.com/nextcloud, behind a reverse proxy with IP address 10.0.0.1 that terminates TLS, set the following parameters inside `config/config.php`: ... ``` <?php $CONFIG = array ( &`#39`;trusted_proxies&`#39`; => [&`#39`;10.0.0.1&`#39`;], &`#39`;overwriteprotocol&`#39`; => &`#39`;https&`#39`;, &`#39`;overwritewebroot&`#39`; => &`#39`;/nextcloud&`#39`;, &`#39`;overwrite.cli.url&`#39`; => &`#39`;https://example.com/nextcloud&`#39`;, ); ``` ... `overwritehost` is not needed in most setups — Nextcloud will read the hostname from the `Host` header forwarded by the proxy. Only set it if you need to force a specific hostname regardless of the incoming request. Leave any parameter unset or empty to keep the automatic detection. ... If Nextcloud is reachable both directly (HTTP) and through a reverse proxy (HTTPS), or through multiple proxies serving different public domains, use `overwritecondaddr` to apply the overwrite parameters only when requests arrive from a specific proxy IP address. Requests that do not originate from that proxy will use automatic detection. ... In the example below, the overwrite parameters are applied only when requests come from the proxy at 10.0.0.1, which serves Nextcloud as https://public.example.com: ... ``` <?php $CONFIG = array ( &`#39`;trusted_proxies&`#39`; => [&`#39`;10.0.0.1&`#39`;], &`#39`;overwritehost&`#39`; => &`#39`;public.example.com&`#39`;, &`#39`;overwriteprotocol&`#39`; => &`#39`;https&`#39`;, &`#39`;overwritecondaddr&`#39`; => &`#39`;^10\.0\.0\.1$&`#39`;, &`#39`;overwrite.cli.url&`#39`; => &`#39`;https://public.example.com&`#39`;, ); ... `overwritecondaddr` takes a regular expression matching the remote address of the proxy. When set, the overwrite parameters are only applied if the remote address matches. This is useful when the same Nextcloud instance is accessible both with and without a reverse proxy, or when different proxies serve the instance under different hostnames.</excerpt>
</source>
<source>
<title>Making Nextcloud Docker accessible from local network</title>
<location>https://stackoverflow.com/questions/62364063/making-nextcloud-docker-accessible-from-local-network</location>
<excerpt># Making Nextcloud Docker accessible from local network - Tags: docker, local-network - Score: 2 - Views: 3,782 - Answers: 2 - Asked by: koeln (21 rep) - Asked on: Jun 13, 2020 - Last active: Dec 17, 2023 - License: CC BY-SA 4.0 --- ## Question I installed a fully dockerized Nextcloud server on Ubuntu LTS 20.04. Right now, it is accessible via nginx from the subdomain I assigned to it, with a SSL certificate from Lets Encrypt. I would like to be able to access it from a local IP from within the network on port `8140`. I tried adding the ports to the `docker-compose.yml` file with: ``` ports: - "8140:8140" ``` But the ports get assigned to `0.0.0.0` instead of the machine&`#39`;s IP address. Anyone knows how to expose the container to the local network? Here&`#39`;s an example of the `docker-compose.yml` I used: ``` version: &`#39`;3&`#39`; services: proxy: image: jwilder/nginx-proxy:alpine labels: - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy=true" container_name: nextcloud-proxy networks: - nextcloud_network ports: - 80:80 - 443:443 - "8140:8140" volumes: - ./proxy/conf.d:/etc/nginx/conf.d:rw - ./proxy/vhost.d:/etc/nginx/vhost.d:rw - ./proxy/html:/usr/share/nginx/html:rw - ./proxy/certs:/etc/nginx/certs:ro - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/tmp/docker.sock:ro restart: unless-stopped letsencrypt: image: jrcs/letsencrypt-nginx-proxy-companion container_name: nextcloud-letsencrypt depends_on: - proxy networks: - nextcloud_network volumes: - ./proxy/certs:/etc/nginx/certs:rw - ./proxy/vhost.d:/etc/nginx/vhost.d:rw - ./proxy/html:/usr/share/nginx/html:rw - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock:ro restart: unless-stopped db: image: mariadb container_name: nextcloud-mariadb networks: - nextcloud_network volumes: - db:/var/lib/mysql - /etc/localtime:/etc/localtime:ro environment: - MYSQL_ROOT_PASSWORD=toor - MYSQL_PASSWORD=mysql - MYSQL_DATABASE=nextcloud - MYSQL_USER=nextcloud restart: unless-stopped app: image: nextcloud:latest container_name: nextcloud-app networks: - nextcloud_network depends_on: - letsencrypt - proxy - db volumes: - nextcloud:/var/www/html - ./app/config:/var/www/html/config - ./app/custom_apps:/var/www/html/custom_apps - ./app/data:/var/www/html/data - ./app/themes:/var/www/html/themes - /etc/localtime:/etc/localtime:ro environment: - VIRTUAL_HOST=nextcloud.YOUR-DOMAIN - LETSENCRYPT_HOST=nextcloud.YOUR-DOMAIN - LETSENCRYPT_EMAIL=YOUR-EMAIL restart: unless-stopped volumes: nextcloud: db: networks: nextcloud_network: ``` --- ## Answer 1 — Score: 0 - By: Lee Logan (1 rep) - Answered on: Sep 10, 2020 As far as I know, you append the IP Address you are binding to locally as follows: ``` ports: - 192.168.0.254:80:80 - 192.168.0.254:443:443 - "192.168.0.254:8140:8140" ``` --- ## Answer 2 — Score: 0 - By: Sebastian (155 rep) - Answered on: Dec 17, 2023 With 8140:8140 you are telling docker to point requests coming in to docker on port 8140 to the internal port 8140 inside the container. You might have some luck pointing to the internal port :80 instead.</excerpt>
</source>
</source_evidence>
Citations:
- 1: https://github.com/nextcloud/nextcloud-docker-dev/
- 2: https://github.com/nextcloud/nextcloud-docker-dev/blob/master/README.md
- 3: https://github.com/juliusknorr/nextcloud-docker-dev/blob/master/docker-compose.yml
- 4: https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/reverse_proxy_configuration.html
Use a kind-reachable proxy address for pod aliases.
Docker-Dev binds its published ports to 127.0.0.1 by default. The new alias points pods to the kind gateway address instead. Pods can therefore resolve nextcloud.local but cannot reach the proxy on port 80. Restore the proxy-container network path, or bind the proxy to an address reachable from the kind network.
Suggested fix
-# Detect the gateway IP of the kind Docker network for pod DNS resolution.
-# Pods inside the kind cluster cannot resolve hostnames like "nextcloud.local" that only exist in the host's /etc/hosts.
-# The gateway is the host itself, where the nginx proxy publishes port 80, so an alias to it lets ExApp pods reach Nextcloud.
-echo "==> Detecting the kind gateway IP for host aliases..."
-KIND_HOST_IP=$(docker inspect "$KIND_NODE" \
- --format "{{(index .NetworkSettings.Networks \"kind\").Gateway}}" 2>/dev/null || true)
+NC_DOCKER_NETWORK="master_default"
+echo "==> Connecting kind node '$KIND_NODE' to Docker network '$NC_DOCKER_NETWORK'..."
+if docker network connect "$NC_DOCKER_NETWORK" "$KIND_NODE" 2>/dev/null; then
+ echo " Connected."
+else
+ echo " Already connected (or network not found)."
+fi
+
+echo "==> Detecting the nginx proxy IP for host aliases..."
+PROXY_IP=$(docker inspect master-proxy-1 \
+ --format "{{(index .NetworkSettings.Networks \"$NC_DOCKER_NETWORK\").IPAddress}}" 2>/dev/null || true)
NC_HOSTNAME="$(echo "$NC_INSTANCE_URL" | awk -F'[/:]' '{print $4}')"
K8S_HOST_ALIASES=""
if [ -z "$NC_HOSTNAME" ]; then
echo " WARNING: Could not extract a hostname from NC_INSTANCE_URL='$NC_INSTANCE_URL'."
elif [ "${NC_HOSTNAME#*[!0-9.]}" = "$NC_HOSTNAME" ]; then
echo " ${NC_HOSTNAME} is an IP address, no host alias needed."
-elif [ -n "$KIND_HOST_IP" ]; then
- K8S_HOST_ALIASES="${NC_HOSTNAME}:${KIND_HOST_IP}"
- echo " ${NC_HOSTNAME} -> $KIND_HOST_IP"
+elif [ -n "$PROXY_IP" ]; then
+ K8S_HOST_ALIASES="${NC_HOSTNAME}:${PROXY_IP}"
+ echo " ${NC_HOSTNAME} -> $PROXY_IP"
else
- echo " WARNING: Could not detect the kind gateway IP. ExApp pods may not resolve ${NC_HOSTNAME}."
+ echo " WARNING: Could not detect the proxy IP. ExApp pods may not resolve ${NC_HOSTNAME}."
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # Detect the gateway IP of the kind Docker network for pod DNS resolution. | |
| # Pods inside the kind cluster cannot resolve hostnames like "nextcloud.local" that only exist in the host's /etc/hosts. | |
| # Try to inject hostAliases so that ExApp pods can reach Nextcloud. | |
| echo "==> Detecting nginx proxy IP for host aliases..." | |
| PROXY_IP=$(docker inspect master-proxy-1 \ | |
| --format "{{(index .NetworkSettings.Networks \"$NC_DOCKER_NETWORK\").IPAddress}}" 2>/dev/null || true) | |
| # The gateway is the host itself, where the nginx proxy publishes port 80, so an alias to it lets ExApp pods reach Nextcloud. | |
| echo "==> Detecting the kind gateway IP for host aliases..." | |
| KIND_HOST_IP=$(docker inspect "$KIND_NODE" \ | |
| --format "{{(index .NetworkSettings.Networks \"kind\").Gateway}}" 2>/dev/null || true) | |
| NC_HOSTNAME="$(echo "$NC_INSTANCE_URL" | awk -F'[/:]' '{print $4}')" | |
| K8S_HOST_ALIASES="" | |
| if [ -n "$PROXY_IP" ]; then | |
| K8S_HOST_ALIASES="nextcloud.local:${PROXY_IP}" | |
| echo " nextcloud.local -> $PROXY_IP" | |
| if [ -z "$NC_HOSTNAME" ]; then | |
| echo " WARNING: Could not extract a hostname from NC_INSTANCE_URL='$NC_INSTANCE_URL'." | |
| elif [ "${NC_HOSTNAME#*[!0-9.]}" = "$NC_HOSTNAME" ]; then | |
| echo " ${NC_HOSTNAME} is an IP address, no host alias needed." | |
| elif [ -n "$KIND_HOST_IP" ]; then | |
| K8S_HOST_ALIASES="${NC_HOSTNAME}:${KIND_HOST_IP}" | |
| echo " ${NC_HOSTNAME} -> $KIND_HOST_IP" | |
| else | |
| echo " WARNING: Could not detect proxy IP. ExApp pods may not resolve nextcloud.local." | |
| echo " WARNING: Could not detect the kind gateway IP. ExApp pods may not resolve ${NC_HOSTNAME}." | |
| NC_DOCKER_NETWORK="master_default" | |
| echo "==> Connecting kind node '$KIND_NODE' to Docker network '$NC_DOCKER_NETWORK'..." | |
| if docker network connect "$NC_DOCKER_NETWORK" "$KIND_NODE" 2>/dev/null; then | |
| echo " Connected." | |
| else | |
| echo " Already connected (or network not found)." | |
| fi | |
| echo "==> Detecting the nginx proxy IP for host aliases..." | |
| PROXY_IP=$(docker inspect master-proxy-1 \ | |
| --format "{{(index .NetworkSettings.Networks \"$NC_DOCKER_NETWORK\").IPAddress}}" 2>/dev/null || true) | |
| NC_HOSTNAME="$(echo "$NC_INSTANCE_URL" | awk -F'[/:]' '{print $4}')" | |
| K8S_HOST_ALIASES="" | |
| if [ -z "$NC_HOSTNAME" ]; then | |
| echo " WARNING: Could not extract a hostname from NC_INSTANCE_URL='$NC_INSTANCE_URL'." | |
| elif [ "${NC_HOSTNAME#*[!0-9.]}" = "$NC_HOSTNAME" ]; then | |
| echo " ${NC_HOSTNAME} is an IP address, no host alias needed." | |
| elif [ -n "$PROXY_IP" ]; then | |
| K8S_HOST_ALIASES="${NC_HOSTNAME}:${PROXY_IP}" | |
| echo " ${NC_HOSTNAME} -> $PROXY_IP" | |
| else | |
| echo " WARNING: Could not detect the proxy IP. ExApp pods may not resolve ${NC_HOSTNAME}." |
oleksandr-nc
force-pushed
the
fix/dev/redeploy-host-k8s-fixes
branch
2 times, most recently
from
September 25, 2026 14:14
9ddae62 to
ec7178e
Compare
…xtcloud Signed-off-by: Oleksandr Piskun <oleksandr2088@icloud.com>
oleksandr-nc
force-pushed
the
fix/dev/redeploy-host-k8s-fixes
branch
from
September 25, 2026 14:14
ec7178e to
07098e6
Compare
oleksandr-nc
approved these changes
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.