Hello everyone, I use nextcloud and in the summary information the following inscription appears:
The reverse proxy header configuration is incorrect
I think this is an error regarding HTTP “X-Forwarded-For” . I’ve tried different configurations by reading a little on the forums, but nothing to do.
Has anyone solved it?
Yes, check this post:
Thanks mark , but the problem is that the reverse proxy is on the pfsense with the valid certificate of the nextcloud server ( ns8) , so I should probably intervene on the config.php with the strings that are read around about this topic . As you can see from the image I had to activate haproxy u pfsense as ns8 in addition to not having the possibility of internal aliases related to hostnames e.g. sn8.internal.lan = myweb.fqdn , myhost2.fqdn , etc. In fact, in the ns8 line I have to define the aliases of ns8 and manage them from there. However, beyond this the nexcloud certificate is on the pfsense but also active in lan for nextcloud.
I don’t use haproxy but isn’t it just adding the pfsense IP to the environment variable TRUSTED_PROXIES on the NS8 Nextcloud node? I don’t understand the issue regarding the aliases…
I imagined, because it is difficult to explain, but I try … For example, my neth7 server, has a private address 192.168.3.83/24 . The current hostname sound is that of neth7.internal.lan . So far everything is normal. In order to make it public with an LE certificate I proceeded as follows 
Enabling dnat from the pfsense 443 and 80 firewall from wan > pfsense and redirect to neth7.internal.lan .
3 . The name or rather the alias is fundamental for the LE request as LE goes the verification of the hostnam and the external ip .
4 . Enabling dnsoveride on pfsense of the hostname neth7.internal.lan in mynethserver.fqn .
5 . In doing so in lan I access mynethserver.fqdn with a valid certificate and both from the wan the access is always on the same machine.
In Ns8 the aliases are therefore not there to activate on ns8 the 4 servers glpi , roundcube , nextcloud , wordpress , I had to install haproxy on pfsense , activate the 4 names duckdns and request for each dynamic address a certificate that obtained , remained in the belly in the pfsense . So it happens that from the wan if I call wordpress.duckdns (it’s an example) , haproxy responds with the frontend and its acl , hijacked on the ns8 server which responds responds with its declared virtualhost for each app server.
I know that what I wrote may be confusing, but that’s how it is!
This configuration was mandatory because I have a dynamic ip with nat and the servers are only in lan
I don’t really see why this is necessary…
My clients access internally and externally with the same FQDN - and get a correct LE cert.
→ It works !!!
No matter if using a dynamic IP or a static IP for the clients acces to the server, always on premise.
PM me if you need help with this.
My 2 cents
Andy
Hi Andy, does your WAN configuration have an ip pool or just one of the nat type and behind a router?
Hi @france
All with more than one IP (a pool) have static Ips.
But I can also handle those easily… 
Otherwise, NAT behind Firewall (OPNsense), for both static and dynamic IP(s).
My 2 cents
Andy
I meant from the wan header of the wan network.
Internally, I always use my own internal IP network.
NAT is a must, yes.
But if I ever have to change provider, it’s only a few rules on the firewall, no need to touch any server…
The internal aliases in NS7 and NS8 are configured in /etc/hosts.
Isn’t it just adding the alias names like:
192.168.0.1 ns8.domain.tld ns8.alias1 ns8.alias2
were actually done from Cockpit, no real manual file editing needed…
(But yes, only for NS7 iteslf, not for other hosts…)
I know, just a small reminder of what’s still needed in NS8…
Yes mark , but I believe that … in host this is declared.
# ================= DO NOT MODIFY THIS FILE =================
#
# Manual changes will be lost when this file is regenerated.
#
# Please read the developer's guide, which is available
# at NethServer official site: https://www.nethserver.org
#
In addition, in the hosts file at least in my ns7 I also find the definition of the hosts booked in DHCP
192.168.3.178 w11pro.internal2.lan
192.168.3.156 w7pro-PC.internal2.lan
192.168.3.183 win10minis.internal2.lan
Sorry, I think you misunderstood me. I just wanted to tell you that you can edit the /etc/hosts in NS8 and add aliases as you like.
Ok, I had already seen and tried some time ago. I don’t remember why, after modifying the host file, I didn’t get what I wanted.
I fixed the problem of the nexrcloud error for ns8 related to the wrong configuration of the reverse proxy ( in my case haproxy ) . The change I made is to add the fqdn name of the reverse proxy .
'trusted_proxies' =>
array (
0 => '192.168.3.0/24',
1 => '192.168.1.2',
2 => '127.0.0.1',
3 => 'localhost',
4 => '::1',
5 => 'myproxyha.domain.fqdn',
),
This configuration worked in my NS8 computing context.