nginx proxy_pass with nextcloud 27 docker -您的Web服务器未正确设置以解析“/ocm-provider/”

vsmadaxz  于 2023-10-17  发布在  Nginx
关注(0)|答案(1)|浏览(766)

我已经通过Docker运行NextCloud很长时间了。我不知道有多久了，但至少有三年了。
nextcloud是通过docker compose运行的，我使用nginx代理nextcloud docker http流量到互联网。nginx也为其他服务提供了许多其他子域，所以使用其他东西来转发80/443流量将是太多的工作。
多年来，每隔一段时间，我就会在nextcloud安全和设置警告页面上看到一个警告，通常很容易通过谷歌搜索来纠正。
这个最新的警告并不明显，如何纠正，在文档中闲逛后，我意识到我的nginx配置中的代码腐烂是相当腐烂的，并决定我不妨更新我的nginx配置为nextcloud推荐的内容。
NextCloud警告：
您的Web服务器未正确设置以解析“/ocm-provider/"。这很可能与未更新以直接传递此文件夹的Web服务器配置有关。请将您的配置与Apache的“.htaccess”中提供的重写规则或Nginx文档中提供的重写规则进行比较。在Nginx上，这些通常是以“location ~”开头的行，需要更新。
Nextcloud提到，只有Apache是官方支持的，他们的文档是用于在裸机上运行Nextcloud的，而不是通过Docker。https://docs.nextcloud.com/server/27/admin_manual/installation/nginx.html最重要的是，我没有使用Office NextCloud Docker镜像，我不记得为什么，但我相信我使用Docker镜像是有原因的。
我更新了我的nginx配置，并注解掉了任何破坏东西的代码块。最后，我能够让我的配置与他们的示例配置非常相似，而不会进一步破坏。
下面是我的docker-compose.yml

version: '2'

networks:
  default:
    driver: bridge

services:
  nextcloud:
    image: ghcr.io/hoellen/nextcloud
    restart: unless-stopped
    depends_on:
      - nextcloud-db
      - redis
    environment:
      - UID=1000
      - GID=1000
      - UPLOAD_MAX_SIZE=10G
      - APC_SHM_SIZE=128M
      - OPCACHE_MEM_SIZE=128
      - CRON_PERIOD=15m
      - TZ=America/Vancouver
      - DOMAIN=cloud.redacted.xyz
      - DB_TYPE=mysql
      - DB_NAME=nextcloud
      - DB_USER=nextcloud
      - DB_PASSWORD=redacted1234
      - DB_HOST=nextcloud-db
    volumes:
      - ./volumes/nextcloud/data:/data
      - ./volumes/nextcloud/config:/nextcloud/config
      - ./volumes/nextcloud/apps:/nextcloud/apps2
      - ./volumes/nextcloud/themes:/nextcloud/themes
    ports:
      - 8888:8888

  nextcloud-db:
    image: mariadb:10.6
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-read-only-compressed=OFF
    volumes:
      - ./volumes/nextcloud/db:/var/lib/mysql
      - ./volumes/nextcloud/my.cnf:/etc/mysql/my.cnf
    environment:
      - MYSQL_ROOT_PASSWORD=redacted5678
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=redacted1234
      - TZ=America/Vancouver

  redis:
    image: redis:alpine
    restart: unless-stopped
    container_name: redis
    volumes:
      - ./volumes/nextcloud/redis:/data
    environment:
      - TZ=America/Vancouver

这是我的nginx nextcloud.conf

upstream php-handler {
    server 127.0.0.1:9000;
}

map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}

server {
    listen 192.168.1.10:80;
    server_name cloud.redacted.xyz;

    server_tokens off;

    return 301 https://$server_name$request_uri;
}

server {
    listen 192.168.1.10:443 ssl http2; # managed by Certbot
    server_name cloud.redacted.xyz;

    ssl_certificate     /etc/letsencrypt/live/cloud.redacted.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/cloud.redacted.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    server_tokens off;

    client_max_body_size 512M;
    client_body_timeout 300s;
    fastcgi_buffers 64 4K;

    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    client_body_buffer_size 512k;

    add_header Referrer-Policy                   "no-referrer"       always;
    add_header X-Content-Type-Options            "nosniff"           always;
    add_header X-Download-Options                "noopen"            always;
    add_header X-Frame-Options                   "SAMEORIGIN"        always;
    add_header X-Permitted-Cross-Domain-Policies "none"              always;
    add_header X-Robots-Tag                      "noindex, nofollow" always;
    add_header X-XSS-Protection                  "1; mode=block"     always;

    fastcgi_hide_header X-Powered-By;

    include mime.types;
    types {
        text/javascript js mjs;
    }

    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ^~ /.well-known {
        # The rules in this block are an adaptation of the rules
        # in `.htaccess` that concern `/.well-known`.

        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        # Let Nextcloud's API for `/.well-known` URIs handle all other
        # requests by passing them to the front-end controller.
        return 301 /index.php$request_uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

#    location ~ \.php(?:$|/) {
        # Required for legacy support
#        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

#        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
#        set $path_info $fastcgi_path_info;

#        try_files $fastcgi_script_name =404;

#        include fastcgi_params;
#        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#        fastcgi_param PATH_INFO $path_info;
#        fastcgi_param HTTPS on;

#        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
#        fastcgi_param front_controller_active true;     # Enable pretty urls
#        fastcgi_pass php-handler;

#        fastcgi_intercept_errors on;
#        fastcgi_request_buffering off;

#        fastcgi_max_temp_file_size 0;
#    }

    location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463, $asset_immutable";
        access_log off;     # Optional: Don't log access to assets

        location ~ \.wasm$ {
            default_type application/wasm;
        }
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri;
        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
        access_log off;     # Optional: Don't log access to assets
    }

    # Rule borrowed from `.htaccess`
#    location /remote {
#        return 301 /remote.php$request_uri;
#    }

    location / {
#        try_files $uri $uri/ /index.php$request_uri;
        proxy_pass        http://127.0.0.1:8888;

        proxy_hide_header X-XSS-Protection;
        add_header X-XSS-Protection "1; mode=block" always;
    }
}

如果我取消注解location ~ \.php(?:$|/) {和右花括号或部分

location /remote {
        return 301 /remote.php$request_uri;
    }

然后我在nextcloud中收到以下警告
您的Web服务器尚未正确设置为允许文件同步，因为WebDAV接口似乎已损坏。您的Web服务器未正确设置以解析“/ocm-provider/"。这很可能与未更新以直接传递此文件夹的Web服务器配置有关。请将您的配置与Apache的“.htaccess”中提供的重写规则或Nginx文档中提供的重写规则进行比较。在Nginx上，这些通常是以“location ~”开头的行，需要更新。您的Web服务器未正确设置以解析“/.well-known/webfinger”。有关详细信息，请参阅文档。您的Web服务器未正确设置，无法解析“/.well-known/nodeinfo”。有关详细信息，请参阅文档。您的Web服务器未正确设置为解析“/.well-known/caldav”。有关详细信息，请参阅文档。您的Web服务器未正确设置以解析“/.well-known/carddav”。有关详细信息，请参阅文档。
如果我只在location / {中取消注解try_files $uri $uri/ /index.php$request_uri;，那么我会得到500内部服务器错误
任何帮助将非常感谢。
谢谢你花时间帮我准备运球，丹

编辑经过一些播放，我已经纠正了我的大部分代码，它非常接近nextcloud最初建议的代码。我仍然收到关于ocm-provider的警告，但我在hoellen/nextcloud github页面https://github.com/hoellen/docker-nextcloud/issues/47上看到了一个打开的工单。

下面是我目前在nginx配置中使用的内容

upstream php-handler {
    server 127.0.0.1:8888;
    server unix:/var/run/php/php-fpm.sock;
}

map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}

server {
    listen 192.168.1.10:80;
    server_name cloud.redacted.xyz;

    server_tokens off;

    return 301 https://$server_name$request_uri;
}

server {
    listen 192.168.1.10:443 ssl http2; # managed by Certbot
    server_name cloud.redacted.xyz;

    ssl_certificate     /etc/letsencrypt/live/cloud.redacted.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/cloud.redacted.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    server_tokens off;

    client_max_body_size 512M;
    client_body_timeout 300s;
    fastcgi_buffers 64 4K;

    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    client_body_buffer_size 512k;

    add_header Referrer-Policy                   "no-referrer"       always;
    add_header X-Content-Type-Options            "nosniff"           always;
    add_header X-Download-Options                "noopen"            always;
    add_header X-Frame-Options                   "SAMEORIGIN"        always;
    add_header X-Permitted-Cross-Domain-Policies "none"              always;
    add_header X-Robots-Tag                      "noindex, nofollow" always;
    add_header X-XSS-Protection                  "1; mode=block"     always;

    fastcgi_hide_header X-Powered-By;

    include mime.types;
    types {
        text/javascript js mjs;
    }

    index index.php index.html /index.php$request_uri;

    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ^~ /.well-known {
        # The rules in this block are an adaptation of the rules
        # in `.htaccess` that concern `/.well-known`.

        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        # Let Nextcloud's API for `/.well-known` URIs handle all other
        # requests by passing them to the front-end controller.
        return 301 /index.php$request_uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

    location ~ \.php(?:$|/) {
        # Required for legacy support
        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404 @proxy;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;

        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
        fastcgi_param front_controller_active true;     # Enable pretty urls
        fastcgi_pass php-handler;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;

        fastcgi_max_temp_file_size 0;
    }

    location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
        try_files $uri /index.php$request_uri @proxy;
        add_header Cache-Control "public, max-age=15778463, $asset_immutable";
        access_log off;     # Optional: Don't log access to assets

        location ~ \.wasm$ {
            default_type application/wasm;
        }
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri @proxy;
        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
        access_log off;     # Optional: Don't log access to assets
    }

    # Rule borrowed from `.htaccess`
    location /remote {
        return 301 /remote.php$request_uri;
    }

    location / {
        try_files $uri $uri/ /index.php$request_uri @proxy;
    }

    location @proxy {
        proxy_pass        http://php-handler;

        proxy_hide_header X-XSS-Protection;
        add_header X-XSS-Protection "1; mode=block" always;
    }
}
nginx

1条答案

按热度按时间
qnzebej0

qnzebej01#

我已经设法在我的图像中解决了这个问题，看看this Nginx配置。
对我来说，这两个条款是至关重要的：

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
            include /etc/nginx/fastcgi_params;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param modHeadersAvailable true;
            fastcgi_param front_controller_active true;
            fastcgi_pass unix:/php/run/php-fpm.sock;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
            fastcgi_read_timeout 1200;
        }

        location ~ ^\/(?:updater|ocs-provider)(?:$|\/) {
            try_files $uri/ =404;
            index index.php;
        }

在这两个子句中，必须将oc[ms] regex fragment更改为ocs。

赞(0）分享  回复(0）举报  2023-10-17
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备2022004421号-2 NULL123 https://www.null123.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com