AIO behind caddy still rewrite to 443 port instead of the port I use

[lianqi1998]

Steps to reproduce

1. My ISP block 80, 443 port
2. Add caddy reverse proxy config with ACME DNS-challenge and open 20000 to replace 443. Caddy can get cert and run well.
3. Use AIO behind caddy with --env SKIP_DOMAIN_VALIDATION=true
4. Open https://my.domain:20000 Nextcloud will rewrite to https://my.domain/login
5. I can enter Nextcloud panel after I add port manually. And after login the matter disappeared.
6. After I modified "domain": "my.domain:20000" in configuration.json as folder nextcloud_aio_mastercontainer/_data/data/ It seems fixed (I'm not sure, I changed a lot)

Expected behavior

After acess Nextcloud with specific port I think AIO should not rewrite adress to 443

Actual behavior

With right reverse proxy config, Nextcloud still rewrite adress as default (443).
After login the matter disappeared, so I guess it's a bug

Host OS

debian 11

Nextcloud AIO version

AIO v7.2.1

Current channel

latest channel

Other valuable info

By the way, I wonder to know if I modified "domain": "my.domain:20000" in configuration.json with port information directly, it will produce other problem?
Thank You for Your Patience.

[Zoey2936]

https://github.com/nextcloud/all-in-one#are-other-ports-than-the-default-443-for-nextcloud-supported - also the :2000 could cause problems

[lianqi1998]

If port 443 and/or 80 is blocked for you, you may use the ACME DNS-challenge or a Cloudflare Tunnel

I think perhaps AIO support other port, by get cert by ACME DNS-challenge?

https://github.com/nextcloud/all-in-one#are-other-ports-than-the-default-443-for-nextcloud-supported - also the :2000 could cause problems↳

So that means AIO can only run on 443 ?
If AIO only support 443, maybe emphasize the consideration that even if use the ACME DNS-challenge or a Cloudflare Tunnel, AIO still don't work on the environment as port 443 and/or 80 is blocked is better

But what confuses me is AIO will work after login. It seems like it is a bug happens on login.
And could I know why abandon other port support, it looks as if once solve the problem while login, AIO will run other port behind reverse proxy.

[uchiit]

Well...

After some investigation of decrypted traffic in Wireshark it looks like that when your browser gives empty GET request (without path to any file) NextCloud will respond to your browser with an HTTP2 status code 302 redirect message (even if you are already authenticated and have coockies).

But if you will try to send GET request with particular path (/apps/dashboard/) and if you already authenticated, in such case NextCloud will give you a status code 200 which will not make a redirect for you and home screen eventually will be provided to you. But at the same moment your browser will try to open additional sessions to port 443 to receive some other additional stuff which is required on this main page.

Here is some screenshots.

First: HTTP2 with 302 Status Code response from server on empty GET request from outside network browser on port 45135 (outside port of NextCloud on edge router)

Second: Browser view after 302 redirection Status code. Initial request was on port 45135 (my.domain.name:45135) without URI but as we can see after redirection there is no any port in URL (defaults to 443).

Third: HTTP2 response from server on GET request with /apps/dashboard/ path

Fourth: Browser view after 200 OK Status code. Due to there was no redirection, port number is preserved and we can see the home page.

In both cases TCP port 45135 was used but behavior varies.

[uchiit]

Suggestion for developers:

To make outside port change possible and flexible from inside/outside access perspective there is a possibility to point a domain variable in NextCloud code to authority header field in clients GET request like on a screenshot below. In such case it will be possible to avoid port 443 when it is unable to be used.

Thank you!

BR