Caddy front + back end results in "Domain does not point to this server or the reverse proxy is not configured correctly"

[kbdcrazy]

Hello all

I am hitting this error message during setup of the AIO image when entering the domain of the new AIO instance - up to this point it worked fine and I can refer to https://my.nextcloud-domain.org from an external host:
"Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')"

All log messages of the nextcloud-aio-mastercontainer after entering the domain name and hitting submit:

nextcloud-aio-mastercontainer | 172.22.0.2:8000 localhost - - [12/Jul/2022:18:47:09 +0000] "GET / HTTP/1.1" 302 424 "-" "-"
nextcloud-aio-mastercontainer | localhost - - [12/Jul/2022:18:47:09 +0000] "GET / HTTP/1.1" 302 424 "-" "-"
nextcloud-aio-mastercontainer | 172.22.0.2:8080 blue - - [12/Jul/2022:18:47:09 +0000] "GET / HTTP/1.1" 302 3160 "-" "-"
nextcloud-aio-mastercontainer | blue - - [12/Jul/2022:18:47:09 +0000] "GET / HTTP/1.1" 302 3160 "-" "-"
nextcloud-aio-mastercontainer | [Tue Jul 12 18:47:09.384162 2022] [php:notice] [pid 152] [client 127.0.0.1:37226] The response of the connection attempt to "https://my.nextcloud-domain.org:443" was: , referer: https://my.nextcloud-domain.org/containers
nextcloud-aio-mastercontainer | [Tue Jul 12 18:47:09.384203 2022] [php:notice] [pid 152] [client 127.0.0.1:37226] Expected was: 1c7549411e53b6090a1ade2f7e280c63e74dcfaee13e54d8, referer: https://my.nextcloud-domain.org/containers
nextcloud-aio-mastercontainer | [Tue Jul 12 18:47:09.384209 2022] [php:notice] [pid 152] [client 127.0.0.1:37226] The error message was: , referer: https://my.nextcloud-domain.org/containers
nextcloud-aio-mastercontainer | 172.22.0.2:8000 localhost - - [12/Jul/2022:18:47:09 +0000] "POST /api/configuration HTTP/1.1" 422 546 "https://my.nextcloud-domain.org/containers" "Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0"
nextcloud-aio-mastercontainer | localhost - - [12/Jul/2022:18:47:09 +0000] "POST /api/configuration HTTP/1.1" 422 546 "https://my.nextcloud-domain.org/containers" "Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0"
nextcloud-aio-mastercontainer | 172.22.0.2:8080 blue - - [12/Jul/2022:18:47:09 +0000] "POST /api/configuration HTTP/1.1" 422 3282 "https://my.nextcloud-domain.org/containers" "Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0"
nextcloud-aio-mastercontainer | blue - - [12/Jul/2022:18:47:09 +0000] "POST /api/configuration HTTP/1.1" 422 3282 "https://my.nextcloud-domain.org/containers" "Mozilla/5.0 (X11; Linux x86_64; rv:101.0)Gecko/20100101 Firefox/101.0"

Due to the fact, that I can reach https://my.nextcloud-domain.org up to this point I do not see what could be wrong.

I have noticed what appears to me as an empty string right before the comma - in both these 2 log messages:
"The response of the connection attempt to "[...]" was: , referer: [...]"
"The error message was: , referer: [...]"

Can somebody help me understand how to debug this further or maybe you have a good idea what the issue could be ?

Cheers,
Martin

---

My setup:

• Host 1:
  Runs:

  • Wireguard server
  • DNS Unbound server and
  • Caddy front end (native OS process run as root)
    Public host with public DNS A record: "my.nextcloud-domain.org" with static IP
    Unbound DNS A record: "proxy-front.red" (192.168.69.1 on the same wireguard subnet as "proxy-back.red") resolvable by Wireguard server and clients (Hosts 1,2)

• Host 2:
  Runs:

  • Wireguard client
  • Nextcloud AIO via Docker and
  • Caddy back end (native OS process run as root)
    Private host in a private LAN
    Unbound DNS A record "proxy-back.red" (192.168.69.2 on the same wireguard subnet as "proxy-front.red") resolvable by Wireguard server and clients (Hosts 1,2)
    Hostname is set as "blue"

NOTE: Due to the Wireguard VPN host 1 and 2 are practically on the same network with the hostnames (proxy-front.red and proxy-back.red) used in the caddy files resolving to the wireguard network IP addresses.

Host 1: Caddy front end (proxy-front.red)

# Global Option Block
{
  debug
}
# ACME Server
proxy-front.red {
        acme_server
        tls internal
}
# Nextcloud
my.nextcloud-domain.org {
        reverse_proxy https://proxy-back.red {
                header_up Host {http.reverse_proxy.upstream.hostport}
                header_up X-Forwarded-Host {host}
        }
}

Host 2: Caddy back end (proxy-back.red)

# Global Option Block
{
        # General Option
        debug

        # TLS Options
        acme_ca https://proxy-front.red/acme/local/directory
        acme_ca_root /etc/pki/ca-trust/source/anchors/root.crt
}
# Nextcloud
proxy-back.red {
    reverse_proxy https://localhost:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

Host 2: docker-compose.yml for Nextcloud AIO

version: "3.8"

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed

services:
  nextcloud:
    image: nextcloud/all-in-one:latest # Must be changed to 'nextcloud/all-in-one:latest-arm64' when used with an arm64 CPU
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation
    ports:
      - 8080:8080
    environment: # Is needed when using any of the options below
      - APACHE_PORT=11000 # Is needed when running behind a reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

[kbdcrazy]

An additional piece of information.

Here is the result from obtaining a shell within the Nextcloud AIO container and running curl against the site:
(111.111.111.111 is the public IP address (replaced fake IP) the domain name resolves to from inside the container)

[userx@blue ~]$ docker exec -it nextcloud-aio-mastercontainer /bin/bash
root@6edf96fad94c:/var/www/docker-aio# curl -v https://my.nextcloud-domain.org/login
*   Trying 111.111.111.111:443...
* Connected to my.nextcloud-domain.org (111.111.111.111) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=my.nextcloud-domain.org
*  start date: Jul 10 10:31:51 2022 GMT
*  expire date: Oct  8 10:31:50 2022 GMT
*  subjectAltName: host "my.nextcloud-domain.org" matched cert's "my.nextcloud-domain.org"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55dd03f525c0)
> GET /login HTTP/2
> Host: my.nextcloud-domain.org
> user-agent: curl/7.74.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 200
< cache-control: no-store, no-cache, must-revalidate
< content-type: text/html; charset=UTF-8
< date: Wed, 13 Jul 2022 00:57:12 GMT
< expires: Thu, 19 Nov 1981 08:52:00 GMT
< pragma: no-cache
< server: Caddy
< server: Caddy
< server: Apache/2.4.53 (Debian)
< set-cookie: PHPSESSID=ac3e5ebbfea5ac5be96a4812f507164e; path=/
< vary: Accept-Encoding
< x-powered-by: PHP/8.0.20
<
<html>
    <head>
        <title>AIO</title>
        <link rel="stylesheet" href="/style.css" media="all" />
        <link rel="icon" href="/img/favicon.png">
        <script type="text/javascript" src="forms.js"></script>
        <script type="text/javascript" src="options-form-submit.js"></script>
    </head>

    <body>
                <div class="login-wrapper">
        <div class="login">
            <img src="/img/logo-blue.svg" style="margin-left: auto;margin-right: auto;display: block;">
            <h1>Nextcloud AIO Login</h1>
                            <p>Log in using your Nextcloud AIO password:</p>
                <form method="POST" action="/api/auth/login">
                    <input type="text" autocomplete="off" name="password" placeholder="Password" />
                    <input type="hidden" name="csrf_name" value="csrf62ce1868dd5ba">
                    <input type="hidden" name="csrf_value" value="6ae20ed9dbb2dc1dea131c7b3e344529">
                    <input type="submit" class="button" value="Login" />
                </form>
                    </div>
    </div>
    </body>
</html>
* Connection #0 to host my.nextcloud-domain.org left intact

root@6edf96fad94c:/var/www/docker-aio# echo $?
0

To me it looks like the reversed proxy setup is ok.

I get the same result from an external host not connected to any of the described networks.

[kbdcrazy]

Setting the env variable SKIP_DOMAIN_VALIDATION=true allows me to get past it.

It then fails to start the Apache containers.

I might start a different thread about that,
but I did find some posts about it and need to compare the output to my setup.