Initial Opencloud setup behind existing Apache rever proxy

[apastuszak]

I am trying to setup Opencloud on a Raspberry Pi 5 in my house and use my existing Apache reverse proxy running on another server to access it. I installed docker on the Raspberry Pi and used the following docker compose file:

services:
  opencloud:
    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest}
    # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
    # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
    user: ${OC_CONTAINER_UID_GID:-1000:1000}
    networks:
      opencloud-net:
    entrypoint:
      - /bin/sh
    # run opencloud init to initialize a configuration file with random secrets
    # it will fail on subsequent runs, because the config file already exists
    # therefore we ignore the error and then start the opencloud server
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      # enable services that are not started automatically
      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
      # do not use SSL between the reverse proxy and OpenCloud
      PROXY_TLS: "false"
      # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
      OC_INSECURE: "${INSECURE:-false}"
      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
      # demo users
      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
      # admin password
      IDM_ADMIN_PASSWORD: "${INITIAL_ADMIN_PASSWORD}"
      # email server (if configured)
      NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
      NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
      NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud Notifications <notifications@cloud.opencloud.test>}"
      NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
      NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
      NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE:-false}"
      NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
      NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
      FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
      FRONTEND_CHECK_FOR_UPDATES: "${CHECK_FOR_UPDATES:-true}"
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      # enable to allow using the banned passwords list
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      # control the password enforcement and policy for public shares
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}"
      OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}"
      OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
      OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
      PROXY_HTTP_ADDR: "0.0.0.0:9200"
    volumes:
      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
      - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
      - ${OC_APPS_DIR:-./config/opencloud/apps}:/var/lib/opencloud/web/assets/apps
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: unless-stopped
    ports:
      - "0.0.0.0:9200:9200"

volumes:
  opencloud-config:
  opencloud-data:

networks:
  opencloud-net:

My .env file has this in it:

INSECURE=false
COMPOSE_FILE=compose.yml
OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
INITIAL_ADMIN_PASSWORD=*********
LOG_LEVEL=warn
LOG_PRETTY=true
OC_CONFIG_DIR=/home/andy/opencloud-compose/config
OC_DATA_DIR=/home/andy/opencloud-compose/data

I set up a domain name on my DNS server, set up the following config on my apache server (domain name changed to protect the innocent.)

<VirtualHost *:443>
  ServerName opencloud.myhome.net
  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/myhome.net/cert.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/myhome.net/privkey.pem
  SSLCertificateChainFile /etc/letsencrypt/live/myhome.net/fullchain.pem

  SSLProxyEngine On
  ProxyPreserveHost On
  ProxyRequests off
  ProxyPass / http://172.25.100.17:9200/
  ProxyPassReverse / http://172.25.100.17:9200/
</VirtualHost>

When I try to go to https://opencloud.myhome.net, Firefox gives me the following message:

[fschade]

@apastuszak thanks for your question, unfortunately apache is not part of our deployments, maybe @artanis42 can help, he created a tutorial which uses apache too. You can find it here: https://github.com/orgs/opencloud-eu/discussions/2058

[artanis42]

Hi @apastuszak,

when I compare the virtual host settings, I see a difference in the ProxyPass and ProxyPassReverse directives: I am using HTTPS, while you use HTTP. I am not sure, if OpenCloud offers insecure HTTP connections at all.
Additionally, have you checked, if your Raspi itself and the Docker instance are reachable from the server running Apache? E.g. are all required ports exposed? Is the OpenCloud instance reachable directly?

My setup runs with OC_INSECURE=false and some custom settings regarding logging. Everything else runs with default settings.

Are there any clues in the Apache logs?

Best regards

[apastuszak]

I'm sorry I didn't up this. I figured it out. It was a DNS issue (isn't it always?). I have Opencloud up and running now. Just patiently waiting for File Provider for MacOS support.