Force https using owncloud/server:10.0.3

[s-geissler]

I am running owncloud/server:latest and am looking for a way to force https (i.e. redirect all port 80 requests to 443).

Is there a way without building a custom image on top of owncloud/server that configures the redirect via apache?

[tboerger]

There is no option for that yet, most people are anyway running it behind a reverse proxy that handles the SSL termination and SSL enforcement.

[ghost]

i use reverse proxy and it does the job

[s-geissler]

Could you help me out here? Below are the two docker-compose files I am using to start the nginx-proxy as well as owncloud. I am obviously missing something as I only get 503 when connecting on port 80 and nothing at all on port 443.

version: '3'

services:
  owncloud:
    image: owncloud/server:${VERSION}
    restart: always
#  ports:
#      - ${HTTPS_PORT}:443
#      - ${HTTP_PORT}:80
    depends_on:
      - db
      - redis
    environment:
      - OWNCLOUD_DOMAIN=${DOMAIN}
      - OWNCLOUD_DB_TYPE=mysql
      - OWNCLOUD_DB_NAME=owncloud
      - OWNCLOUD_DB_USERNAME=owncloud
      - OWNCLOUD_DB_PASSWORD=owncloud
      - OWNCLOUD_DB_HOST=db
      - OWNCLOUD_ADMIN_USERNAME=${ADMIN_USERNAME}
      - OWNCLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - OWNCLOUD_UTF8MB4_ENABLED=true
      - OWNCLOUD_REDIS_ENABLED=true
      - OWNCLOUD_REDIS_HOST=redis
      - VIRTUAL_PROTO=https
      - VIRTUAL_PORT=443
      - VIRTUAL_HOST=owncloud.domain.de
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/status.php"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - ./data:/mnt/data

  db:
    image: webhippie/mariadb:latest
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=owncloud
      - MARIADB_USERNAME=owncloud
      - MARIADB_PASSWORD=owncloud
      - MARIADB_DATABASE=owncloud
      - MARIADB_MAX_ALLOWED_PACKET=128M
      - MARIADB_INNODB_LOG_FILE_SIZE=64M
      - MARIADB_INNODB_LARGE_PREFIX=ON
      - MARIADB_INNODB_FILE_FORMAT=Barracuda
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - ./mysql:/var/lib/mysql

  redis:
    image: webhippie/redis:latest
    restart: always
    environment:
      - REDIS_MAXCONN=10000
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - ./redis:/var/lib/redis

version: '2'

services:
  nginx-proxy:
    image: jwilder/nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro

[ghost]

You must put the certificates in jwilder/nginx-proxy and in ownlcoud

owncloud:

docker run -d --name owncloud --restart=always --link mariadb:db --link redis:redis -e OWNCLOUD_DOMAIN=localhost -e VIRTUAL_HOST=cloud -e VIRTUAL_PROTO=https -e VIRTUAL_PORT=443 -e OWNCLOUD_DB_TYPE=mysql -e OWNCLOUD_DB_NAME=owncloud -e OWNCLOUD_DB_USERNAME=owncloud -e OWNCLOUD_DB_PASSWORD=owncloud -e OWNCLOUD_DB_HOST=db -e OWNCLOUD_ADMIN_USERNAME=admin -e OWNCLOUD_ADMIN_PASSWORD=admin -e OWNCLOUD_REDIS_ENABLED=true -e OWNCLOUD_REDIS_HOST=redis -v /cloud/data:/mnt/data:z -v /home/administrator/certs:/mnt/data/certs owncloud/server:10.0.2 && docker logs owncloud -f

Don´t forget of VIRTUAL_PROTO=https and VIRTUAL_PORT=443

jwilder/nginx-proxy:

docker run --name reverse_proxy -d -p 80:80 -p 443:443 --restart=always -v /home/administrator/certs:/etc/nginx/certs -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy && docker logs reverse_proxy -f

Also, don´t forget to change client_max_body_size in nginx.conf

Hope it helps

[tboerger]

I can't really say something to this nginx-proxy, I personally and we at ownCloud are usually using https://traefik.io/ as a reverse proxy. But sounds like sfmarques gave some hints.

[ghost]

It looks very interesting, I'll definitely take a look....

[s-geissler]

Thanks everyone - got it working. Also thank you for the traefik.io mention. Didn't know that before.

[tboerger]

We won't enforce HTTPS within this image for now, so I'm closing this issue.