nextclould – ssl specifics

/ household, SprUng, KEEPERS, CODING / 7 minutes of reading
Key Configurations for Nextcloud with SSL

Yes, Nextcloud does require some specific server configurations, especially for SSL, to ensure it runs securely and optimally. There are a few key configurations that are often recommended when setting up Nextcloud with SSL on a server like NGINX or Apache.

Key Configurations for Nextcloud with SSL

1. Strong SSL Configuration (SSL Settings)

Make sure your SSL configuration follows strong security practices, including modern SSL protocols, strong ciphers, and other best practices.

Here's an example of a strong SSL configuration for NGINX:


server {
    listen 443 ssl http2;
    server_name nextcloud.example.com;

    ssl_certificate /etc/letsencrypt/live/nextcloud.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nextcloud.example.com/privkey.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload; always";

    # Nextcloud specific settings
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

2. WebDAV Configuration

Nextcloud uses WebDAV for file syncing, which requires proper configuration in the NGINX or Apache server block to avoid issues. Ensure the following lines are in your server block to support WebDAV:


location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
}

# Make sure that WebDAV methods work properly
location = /.well-known/carddav {
    return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
    return 301 $scheme://$host/remote.php/dav;
}

This ensures that your server redirects WebDAV requests to the proper Nextcloud endpoints.

3. Security Headers for Nextcloud

You need some additional security headers to ensure that the installation is secure. Here’s an example of headers to include:


add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload; always";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;

4. Data Directory Permissions

Ensure that the Nextcloud data directory and all its files have proper permissions set. You typically want to set permissions so that only the Nextcloud user can access the data:


chown -R www-data:www-data /var/www/nextcloud/
chmod -R 750 /var/www/nextcloud/

This ensures that the Nextcloud files and directories are not publicly accessible but can be accessed by the web server.

5. Trusted Domains Configuration

You need to configure the trusted domains in Nextcloud's configuration file (config.php). This is important when using SSL so that Nextcloud recognizes your SSL domain as trusted:


'trusted_domains' => 
array (
  0 => 'nextcloud.example.com',
),

You can add multiple trusted domains if necessary.

6. Cron Job Setup for Background Tasks

Ensure Nextcloud’s background jobs are configured. You can add a cron job for Nextcloud using the following command:


crontab -u www-data -e

Add this line:


*/5  *  *  *  * php -f /var/www/nextcloud/cron.php

This makes sure background tasks are executed every 5 minutes.

7. Database Optimization

Optimize your database by enabling the utf8mb4 character set. Add this to your Nextcloud configuration if it is not already done:


'mysql.utf8mb4' => true,

Summary

To successfully configure Nextcloud with SSL, ensure you:

  1. Set up strong SSL protocols and ciphers.
  2. Configure WebDAV redirections for file syncing.
  3. Add the appropriate security headers.
  4. Set correct permissions on the Nextcloud data directory.
  5. Add your domain to the trusted domains array in config.php.
  6. Configure cron jobs for background tasks.
  7. Ensure your database is optimized for performance.

Once these configurations are set, Nextcloud should be secure and ready to handle traffic over SSL.

If you need help with any specific part of the configuration, feel free to ask!

Running Nextcloud on an Asustor NAS does indeed introduce some unique configuration challenges due to the limited customization options and sometimes non-standard directory structures on NAS devices. However, there are still ways to ensure proper SSL and security settings while working within the NAS environment.

Key Considerations for Nextcloud on Asustor NAS:

  1. Web Server Configuration: Asustor NAS typically uses Apache or NGINX to serve web applications, but the ability to customize configurations may be restricted depending on the NAS model and setup.
  2. SSL Configuration: You may need to adjust SSL settings via the NAS’s interface or configuration files. If you’re using Let’s Encrypt for SSL, some NAS devices have built-in support for certificate renewal and management, but if not, you may need to manually set up these certificates.
  3. Nextcloud Data Directory Permissions: NAS devices often manage permissions in a more restricted way. Make sure the www-data or equivalent user has the correct ownership and permissions for the Nextcloud data directory.
  4. Trusted Domains: This should still be configured within the Nextcloud config.php file, which you may need to access via SSH or through the file management interface on the NAS.
  5. Security Headers and WebDAV: These headers or configurations may be trickier to add depending on the level of access you have to the web server configuration. If you don’t have full access to the Apache/NGINX configuration, you might need to add them via .htaccess (for Apache) or work with what’s available through the NAS’s web server settings.

How to Approach Configuration on Asustor NAS:

  1. Check for a Web Management Interface:

    • Some NAS devices allow you to manage the web server and SSL through a GUI. Look for SSL settings or a reverse proxy option to configure proper HTTPS handling.

  2. Access Configuration Files:

    • Use SSH to access the file system if GUI options are limited. You can typically modify the necessary configuration files for Nextcloud or the web server (like httpd.conf for Apache or nginx.conf for NGINX).

  3. Let’s Encrypt via NAS:

    • Asustor NAS may have built-in support for Let’s Encrypt certificates via the App Central or Control Panel. Make sure SSL certificates are applied to the Nextcloud domain properly.

  4. .htaccess for Apache:

    • If Apache is in use, you can try to add security headers and redirects via .htaccess in the Nextcloud directory. This will allow you to adjust settings without full access to httpd.conf.

  5. Use Custom Port Forwarding:

    • Ensure proper port forwarding for both HTTP (80) and HTTPS (443) through your router, directing traffic to the NAS’s internal IP for Nextcloud.

If You Need Specific Help:

If you can share the exact configuration interface or file system structure of the Asustor NAS, I can help with more detailed instructions on where to find or modify these files. Each NAS can vary slightly in how it handles server management.

More

    • certificates from Let’s Encrypt or another provider.

  2. Configure Nextcloud for Trusted Proxies: You need to let Nextcloud know it's behind a reverse proxy and to trust the proxy. Edit the config.php file in Nextcloud's installation directory:

    
'trusted_proxies' => 
array (
    0 => '192.168.1.100',  // IP of the reverse proxy server
),
'overwritehost' => 'nextcloud.example.com',
'overwriteprotocol' => 'https',
'overwritewebroot' => '/',
'overwritecondaddr' => '^192\.168\.1\.100$',
    • trusted_proxies: Add the IP address of the reverse proxy server (e.g., 192.168.1.100).
    • overwritehost: Set this to the domain that points to your Nextcloud instance (e.g., nextcloud.example.com).
    • overwriteprotocol: Set this to https to make sure Nextcloud knows it's being accessed securely.
    • overwritecondaddr: Specify the IP address of the reverse proxy server.

  3. Port Forwarding and Firewall Rules: Ensure that port forwarding is correctly set up in your router:

    • Forward external traffic on port 443 (HTTPS) to your reverse proxy server (e.g., 192.168.1.100).
    • Make sure that the reverse proxy can communicate with the NAS (port 8080 or whatever port Nextcloud is running on internally).

  4. Test the Setup: Once everything is configured:

    • Visit your Nextcloud instance via the reverse proxy URL (e.g., https://nextcloud.example.com).
    • Ensure that it loads with a valid SSL certificate and that everything works as expected.

  5. Additional NGINX Configuration for WebDAV: Since Nextcloud uses WebDAV for file syncing, ensure you handle .well-known redirects properly:

    
location = /.well-known/carddav {
    return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
    return 301 $scheme://$host/remote.php/dav;
}

  6. Harden SSL Configuration: You can further harden your SSL configuration by enforcing strong ciphers, disabling older protocols (like TLS 1.0 and 1.1), and enabling HTTP/2:

    
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

Benefits of Using a Reverse Proxy:

  • Simplified SSL Management: SSL certificates are handled by the reverse proxy server, meaning you don’t need to manage them on the NAS itself.
  • Improved Security: The reverse proxy can handle security-related headers and enforce HTTPS.
  • Centralized Access: You can route multiple services (e.g., Nextcloud, other web apps) through the same proxy.

Next Steps:

  • Ensure that SSL is properly configured on the reverse proxy.
  • Verify that port forwarding and firewall rules allow traffic between the reverse proxy and your NAS.
  • Keep Nextcloud and your reverse proxy server updated for security.
Scroll to Top