Migrating AIO from Caddy to no proxy - apache not listening on 443?

[DavidRawling]

I originally deployed AIO with Caddy enabled and it's mostly working OK - apart from things like Collabora, where the NC interface tells me the Collabora server isn't available:

It appears that with the "server behind a reverse proxy" configuration I've broken something. I'm running behind Caddy with the following Compose file:

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    network_mode: bridge
    ports:
      # - 1080:80
      - 8080:8080
      # - 8443:8443
    environment:
      AIO_DISABLE_BACKUP_SECTION: true
      # AIO_COMMUNITY_CONTAINERS:
      APACHE_PORT: 11000
      APACHE_IP_BINDING: 127.0.0.1
      APACHE_ADDITIONAL_NETWORK: frontend_net
      # BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6
      # COLLABORA_SECCOMP_DISABLED: false
      # FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M"
      NEXTCLOUD_DATADIR: /ncdata
      NEXTCLOUD_MOUNT: /ncdata/
      NEXTCLOUD_UPLOAD_LIMIT: 64G
      NEXTCLOUD_MAX_TIME: 3600
      NEXTCLOUD_MEMORY_LIMIT: 12288M
      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts
      NEXTCLOUD_STARTUP_APPS: deck -twofactor_totp -tasks -calendar -contacts -notes
      # NEXTCLOUD_ADDITIONAL_APKS: imagemagick
      # NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick
      # NEXTCLOUD_ENABLE_DRI_DEVICE: true
      # NEXTCLOUD_ENABLE_NVIDIA_GPU: true
      # NEXTCLOUD_KEEP_DISABLED_APPS: false
      SKIP_DOMAIN_VALIDATION: true
      # TALK_PORT: 3478
      # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock
    # security_opt: ["label:disable"] # Is needed when using SELinux

  caddy:
    image: caddy:alpine
    restart: always
    container_name: caddy
    volumes:
      # - caddy_certs:/certs
      - caddy_config:/config
      - caddy_data:/data
      - caddy_caddyfile:/etc/caddy
      # - caddy_sites:/srv
    network_mode: "host"
    cap_add:
      - NET_ADMIN

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer
    driver_opts:
      type: none
      device: /docker/ncaio
      o: bind
  caddy_caddyfile:
    driver_opts:
      type: none
      device: /docker/caddy/caddyfile
      o: bind
  caddy_config:
    driver_opts:
      type: none
      device: /docker/caddy/config
      o: bind
  caddy_data:
    driver_opts:
      type: none
      device: /docker/caddy/data
      o: bind

I've put the appropriate Caddyfile in /docker/caddy/caddyfile/Caddyfile and it works for NC itself:

{
        log default {
                output stdout
                format json
                level DEBUG
                include http.log.access admin.api
        }
}
nc.domain.tld {
        reverse_proxy localhost:11000
}

When I switch to "non-Caddy" mode - remove the Caddy container from compose, remove the configuration lines for Apache port and bind address, uncomment the additional ports lines, then compose down and compose up - there are no containers listening on :443 on any network:

root@s1-nc-01:/docker/nextcloud# docker ps
CONTAINER ID   IMAGE                                                  COMMAND                  CREATED         STATUS                   PORTS                                                                                                                                         NAMES
389ea3bef4c8   ghcr.io/nextcloud-releases/aio-apache:latest           "/start.sh /usr/bin/…"   3 minutes ago   Up 3 minutes (healthy)   80/tcp, 127.0.0.1:11000->11000/tcp                                                                                                            nextcloud-aio-apache
d9a530989760   ghcr.io/nextcloud-releases/aio-whiteboard:latest       "/start.sh"              3 minutes ago   Up 3 minutes (healthy)   3002/tcp                                                                                                                                      nextcloud-aio-whiteboard
8794d9e79440   ghcr.io/nextcloud-releases/aio-notify-push:latest      "/start.sh"              3 minutes ago   Up 3 minutes (healthy)                                                                                                                                                 nextcloud-aio-notify-push
7ba2c9de00b0   ghcr.io/nextcloud-releases/aio-nextcloud:latest        "/start.sh /usr/bin/…"   3 minutes ago   Up 3 minutes (healthy)   9000/tcp                                                                                                                                      nextcloud-aio-nextcloud
18fb9d361cf6   ghcr.io/nextcloud-releases/aio-imaginary:latest        "/start.sh"              4 minutes ago   Up 4 minutes (healthy)                                                                                                                                                 nextcloud-aio-imaginary
5d25ddc5a102   ghcr.io/nextcloud-releases/aio-fulltextsearch:latest   "/bin/tini -- /usr/l…"   5 minutes ago   Up 5 minutes (healthy)   9200/tcp, 9300/tcp                                                                                                                            nextcloud-aio-fulltextsearch
093c34910240   ghcr.io/nextcloud-releases/aio-clamav:latest           "/start.sh /usr/bin/…"   5 minutes ago   Up 5 minutes (healthy)                                                                                                                                                 nextcloud-aio-clamav
96fbdb7ded7c   ghcr.io/nextcloud-releases/aio-redis:latest            "/start.sh"              6 minutes ago   Up 6 minutes (healthy)   6379/tcp                                                                                                                                      nextcloud-aio-redis
e1b922c5b3b9   ghcr.io/nextcloud-releases/aio-postgresql:latest       "/start.sh"              6 minutes ago   Up 6 minutes (healthy)   5432/tcp                                                                                                                                      nextcloud-aio-database
d0d764779de4   ghcr.io/nextcloud-releases/aio-collabora:latest        "/start-collabora-on…"   6 minutes ago   Up 6 minutes (healthy)   9980/tcp                                                                                                                                      nextcloud-aio-collabora
dae080bcbfc0   nextcloud/all-in-one:latest                            "/start.sh"              8 minutes ago   Up 8 minutes (healthy)   0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:8443->8443/tcp, [::]:8443->8443/tcp, 9000/tcp, 0.0.0.0:1080->80/tcp, [::]:1080->80/tcp   nextcloud-aio-mastercontainer

What did I break here? I see TCP port 9000 on the aio-mastercontainer is listening but not part of a PORTS definition - is that the HTTPS port and I am supposed to add one to the config?

      - 443:9000

[DavidRawling]

Wait, when I searched closed questions as well (I didn't realise there was a filter) I find this similar item #5798.

This suggests that something is maintaining state, and I just need to reset apache port and IP. Would be good to explain that in the docs if that's the case.

And this did let Apache listen on :443 (with SSL) - the Collabora problem was me not understanding it needs to be an internal URL not the external URL. At least it tries to work now.