Forcing Docker Nextcloud install to use Letsencrypt cert?

  • OMV: version 4.1.23-1


    First of all I'm a complete noob when it comes to Docker. I have done a fresh install of OMV and on my previous install I had installed Nextcloud and Letsencrypt natively but now I wanted to try it the Docker way. I have both Letsencrypt and Nextcloud installed (followed the TDL youtube videos) in Docker and they both work but I have no idea how to force the Nextcloud install to use the Letsencrypt certificate?


    Right now Nextcloud is using a self-signed certificate, which prevents me from opening Nextcloud due to HSTS. This is the error I get when I try to go to the Nextcloud site "Firefox does not trust this site because it uses a certificate that is not valid for [mydomain]:444.
    Error code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT".

  • This is the most up to date guide regarding nextcloud and letsencrypt on omv: https://forum.openmediavault.o…g-OMV-and-docker-compose/ (but it requires a reinstall of nextcloud and letsencrypt)


    This official guide by Linuxserver is also great: https://blog.linuxserver.io/20…rypt-nginx-starter-guide/

    Thanks for the reply, I deleted all the Docker containers created by following TDL's videos and recreated them by following the instructions in that first link. However it did not work, the certificate is still self-signed and therefore I can't access Nextcloud due to HSTS.


    Letsencrypt does work as I did receive the "Congratulations! Your certificate and chain have been saved at" -message but something is apparently broken with the proxy? I'm using no-ip.org as my DDNS. Here is the contents of my /srv/dev-disk-by-label-disk/appdata/nextcloud/config/www/nextcloud/config/config.php:



  • Have you enabled the proxy configuration for nextcloud in letsencrypt? First two steps of "Configuration of proxy".



    • cd /srv/dev-disk-by-label-disk1/appdata/letsencrypt/nginx/proxy-confs /srv/dev-disk-by-label-disk1 has to be adjusted
    • cp nextcloud.subfolder.conf.sample nextcloud.subfolder.conf this will copy the sample configuration file for nextcloud and removes the .sample so that the file will become active

    And restarted the container after modifications?

  • @macom: Yes I did those steps as well, this is what my /srv/dev-disk-by-label-disk/appdata/letsencrypt/nginx/proxy-confs/nextcloud.subfolder.conf looks like:




  • Yes I have restarted both the letsencrypt and nextcloud containers. And here is the nextcloud docker log, it has some errors:


  • please change your router forward from external 443 to internal 444 and delete the other rule with 444

    Thanks a lot for the help, that was the problem! I fixed the port forwards and I can now access the Nextcloud setup page. I had to also activate Pure NAT for NAT reflection in my pfSense advanced settings in order to access the site from within the LAN.


    One more question; what should I set as the "Database host" in the Nextcloud setup page? I have tried localhost:3306 but I just get this error message when trying to finish the setup:


    Error while trying to create admin user: Failed to connect to the database: An exception occurred in driver: SQLSTATE[HY000] [2002] No such file or directory


    If i try 127.0.0.1:3306 I get this error message:


    Error while trying to create admin user: Failed to connect to the database: An exception occurred in driver: SQLSTATE[HY000] [2002] Connection refused

  • please change your router forward from external 443 to internal 444 and delete the other rule with 444

    Thanks a lot for the help, that was the problem! I fixed the port forwards and I can now access the Nextcloud setup page. I had to also activate Pure NAT for NAT reflection in my pfSense advanced settings in order to access the site from within the LAN.


    One more question; what should I set as the "Database host" in the Nextcloud setup page? I have tried localhost:3306 but I just get this error message when trying to finish the setup:


    • Error while trying to create admin user: Failed to connect to the database: An exception occurred in driver: SQLSTATE[HY000] [2002] No such file or directory


    If i try 127.0.0.1:3306 I get this error message:


    • Error while trying to create admin user: Failed to connect to the database: An exception occurred in driver: SQLSTATE[HY000] [2002] Connection refused
  • what should I set as the "Database host" in the Nextcloud setup page?

    If you used the docker-compose file: nextclouddb


    from the guide:
    select MySQL/MariaDB

    • Database user --> "root"
    • Database password --> password which has been specified in the docker-compose file with MYSQL_ROOT_PASSWORD
    • Database name --> "nextcloud"
    • localhost host --> "nextclouddb"
  • I have same problem - Nextcloud don't use letsencrypt certificate, but reason is - router. It's can't NAT'ing ports to other value, just 443-443 etc.
    Qwestion is can I use additional software to solve this problem, or should I buy a new router?

    The rescue of one animal will not change the world, but the world will certainly changed for this animal.

  • I'm sorry for misunderstanding. Let's make it clear.
    I want to be able to connect to my Nextcloud from Internet. OMV-GUI available only from innerspace.


    -----------------case1------------------------
    NAT rules on router 443-443, 80-80.


    Docker network rules for:


    letsencrypt 443-443, 80-80


    nextcloud 444-443, 8080-80


    VERIFICATION = http
    ------------------------------------------------


    Letsencrypt can verifying, but NC on 444 port and don't answer from outerspace.


    -----------------case2------------------------
    NAT rules on router 443-443, 80-80.


    Docker network rules for:


    letsencrypt 443-443, 90-80


    nextcloud 444-443, 8080-80


    VERIFICATION = dns
    ------------------------------------------------


    443 port still belongs to LE =(


    Maybe virtual host is the answer (nextcloud.domain.ru)? But it will be redirects on 444 port that wil be closed. Yes, I can open it on my router, but I don't want more holes outside. Paranoia detected =)


    I have own IP&domain. CNAME record is required for this.

    The rescue of one animal will not change the world, but the world will certainly changed for this animal.

  • You where right, Morlan.
    Thanx alot for help.


    If you don't mind, one more question.
    Can I use letsencrypt reverse proxy for many containers? I've activate one config - nextcloud.subfolder.conf. What if I do it with other conf's?

    The rescue of one animal will not change the world, but the world will certainly changed for this animal.

  • Yes. You can connect other containers. You have to activate the other .conf files. If you are using subdomains you have to include them in your ssl Certificate by adding them to the SUBDOMAINS variable (comma-Separated without spaces) and rebuild the container.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!