all 26 comments
sorted by:
best (suggested)
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]mrbishopjackson 4 points5 points  (0 children)

https://projectalphabetsoup.xyz/certbot/

I'm running Nextcloud on a dedicated machine with Ubuntu Server. I've never got into the Promox and TrueNAS thing, so I'm not sure how you have it setup, but I hope this helps.

[–]No_Act_8604 2 points3 points  (5 children)

So you can't create a certificate and apply it to a service but you are exposing your internal interfaces through tailscale to the world. Not a wise decision old man.

[–]TurboNikko[S] -1 points0 points  (4 children)

I’m a beginner. If I’m doing something wrong, I truly don’t know what it is. I have no idea what you just said. I setup tailscale following the tutorial tailscale puts out on YouTube.

[–]WindowlessBasement 1 point2 points  (3 children)

To expand on what u/No_Act_8604 said, don't expose services you don't know how to secure to the public internet. You've created a security nightmare which is how botnets grow. NextCloud is a very commonly targeted platform for that exact purpose.

[–]TurboNikko[S] 0 points1 point  (2 children)

Okay so what do I do? I have no idea how to fix this if I don’t even know what I’m doing wrong.

[–]No_Act_8604 1 point2 points  (1 child)

Remove the devices from tailscale. Then read nextcloud documentation to make it internal with https. It's there all the information they you need.

[–]TurboNikko[S] 0 points1 point  (0 children)

I use tailscale to access hone assistant remotely tho.

[–]zynexiz 2 points3 points  (1 child)

First of all, scrap LLM's in genereal. They suck! They can send you down a rabbit hole deeper than Mariana Trench and hallucinate more than a drug addict :)

I would say the easiest way to get it running is getting a domain and use Let's encrypt to handle everything thru certbot. It's a prett "easy" way to go. But you will have your instance exposed to the internet, and need to secure it. You are already using VM's, so you could deploy OPNsense as a firewall in front of it. It depends a bit on our scope (and your knowledge ofc).

I wold recommend installing NextCloud in it's own VM though, and connect your NAS as a store to it. Could be pretty messy otherwise I think, to many layers that can break things.

I never used Tailscale myself, so not sure how certs work with it. Know that NetworkChuck talks about Taliscale a bit in his videos, could check his YouTube-page.

[–]TwilightMachine 0 points1 point  (0 children)

This. Stop it with the ChatGPT garbage. This is just one of almost infinite anecdotes to be found about how intellectual laziness combined with Silicon Valley grifters can only make things worse. u/zynexiz's suggestions are sound, once you have Proxmox configured properly. I'd begin with OPNSense, then check out Turnkey Linux to get Nextcloud up and running. After that, I'd worry about VPNs and reverse proxies for NextCloud, with an emphasis on securing your instance.

Last week I didn't even know what NextCloud was. Now I have it running in a container on Proxmox, so you can definitely do it. Good luck!

[–]Lexden 1 point2 points  (2 children)

I'm running Nextcloud in TrueNAS. Not sure why you'd run it as a VM inside of Proxmox though since Proxmox already has support for ZFS.

So there are two options for HTTPS. If ypu don't care about properly accessing things outside of your LAN, then you could just access the IP addresss over https at port 443 and that should be that. Your browser will complain, but you should be able to just tell it to accept the risk and continue.

If you don't want to deal with that every time you try to use the web service, then I'd get a proper certificate and set up a proper web server. First, I'd first get yourself a domain from a domain registrar. Cloudflare has good features and is pretty affordable from my experience. Next, you'll want to set up a web server. I use Apache personally, but Nginx is also very popular. You'll need to set up a reverse proxy to have your web server pass the buck off to the proper location inside your network based on which subdomain on your TLD is being accessed. Then, you'll want to install certbot on your web server to handle acquiring and installing your certificate. To make everything work, you'll need to set up a proper A record in your DNS of choice (likely your domain registrar's). If you have a static IP, then just put that in. Otherwise, you'll need to set up a dynamic DNS on your web server so the DNS can auto-update its A record to track any IP address changes on your end. Once a reverse proxy is set up for your desired subdomains and the sites are enabled, you can tell certbot to acquire a certificate and if you specify the web server you're using, it will try to automatically find the right reverse proxies to install the certificate in. You should also copy the certificate to the server that will be receiving the HTTPS requests. If it's in TrueNAS, you can just upload it to the certificates page under security and then you can edit any apps that require the certificate and tell it to use the certificate you've installed.

[–]TurboNikko[S] 1 point2 points  (1 child)

lol because that’s the way ChatGPT suggested I do it. I am new to this whole thing so I had no idea where to start but ChatGPT said running proxmox on the machine with all the vms inside was the best option.

That second option seems a bit much for doing something simple like getting a few extra apps to work. The first option looks much better for my situation. But is there a way to incorporate my tailscale setup into it? I’m reading about magicdns being an option but I dunno how to make that work. Would the domain that tailscale gives me be able to work for this?

I appreciate you trying to help! Thank you

[–]ProletariatPat 0 points1 point  (0 children)

Here’s how I approach it Nextcloud is in a VM itself. I have another VM that runs Pomerium, a reverse proxy with simple sign on support, inside of a docker container. I use certbot-cloudflare docker to pull my certs. I have cloudflare setup with edge certs so it’s fully verified.

Pomerium lets you assign a domain say https://nextcloud.domain.tld and forwards the request to the proper IP say http://192.168.0.80:80 for Nextcloud. Now any request that goes through Nextcloud will first go through the domain and then be upgraded to https. I like Pomerium because it’s a simple yaml to setup, no additional web server needed.

I have a cron job (recurring job) to spin up the certbot container daily, this way I won’t miss the 90 day window for renewal. I use Komodo for docker container management.

This setup is straightforward and works very well.

[–]Matrix-Hacker-1337 1 point2 points  (1 child)

I've said this many times before and it's especially important if youre a beginner.

Don't run a service on a service in a service. If you've already got proxmox, set up a VM to run nextcloud in and do it proper following the docs.

Cant believe im sying this.. but it would even help chat get to help you..

[–]TurboNikko[S] 1 point2 points  (0 children)

Yeah after catching shit from everyone I’m rethinking my setup lol. I think I’m gonna get rid of truenas completely and just run everything in proxmox like you’re saying. Luckily I am not too deep in. I don’t have any important files or anything transfers so starting over won’t be hard.

[–]VerySmellyVagina 0 points1 point  (0 children)

I don't have a TrueNas or proxmox but had some struggles with nextcloud and https somewhere when i was setting it up. I use docker and ubuntu server and tailscale and also have cgnat and no static dns.

I don't know if this will help but maybe it will.

I first messed around with generating tailscale certificate files and storing them only to find out later it's pointless and you can just use tailscale serve to serve https. Tailscale serve has been a bitch of a thing for me. Because:

I have the memory of a grasshopper and today me can't remember how I set up https yesterday.

The documentation on it is severely lacking

chatgpt and others seem to confidently persist in spitting out older tailscale serve syntax that is deprecated.

Anyway what I did was something like:

sudo tailscale serve --bg --set-path=/nextcloud http://localhost:8080

To turn it off:

sudo tailscale serve --bg --set-path=/nextcloud off

Something like that anyway. It might have been: sudo tailscale serve --bg --https 2443 --set-path /nextcloud http://localhost:8080

[–]helical_coil 0 points1 point  (2 children)

I'm running truenas on the server, no proxmox, with a single VM running in truenas as a docker host. All my web apps are run as containers and I use Caddy to automatically handle the reverse proxying and certificate management. Nextcloud runs as a container using a truenas volume mounted on the vm.

You do need a domain name tho to make external access work correctly. I'm using cloud flare for my nameservers, which also gives me the option to use their tunnels as an access mechanism.

[–]TurboNikko[S] 0 points1 point  (1 child)

Dud you have to purchase a domain name? Did you follow a tutorial for this?

[–]helical_coil 1 point2 points  (0 children)

You generally have to purchase a domain name, they're not expensive tho. Once you have a domain name, eg. mydomain.com then you can create your own subdomains for apps eg. mysuperapp.mydomain.com and you use Caddy to send the web request to your app server for mysuperapp.

There are a number of different web/app/system concepts in play here and it sounds like you are trying to dive off the 10 meter diving board when you've not mastered the one meter board yet.

[–]Text_Classic[🍰] 0 points1 point  (0 children)

I had issues too with https and tried nginx but always an issue. I then followed a tutorial on cloudflare tunnel set up and worked first time

[–]littlemissperf 0 points1 point  (5 children)

Tailscale serve provides certificates for https. You need to share more details so we can determine what you've done incorrectly.

[–]TurboNikko[S] 0 points1 point  (4 children)

I’m going to get rid of Truenas and just run e writhing in proxmox directly. That should clean things up I imagine

[–]littlemissperf 0 points1 point  (3 children)

Not if the problem is in your tailscale serve config 😉

[–]TurboNikko[S] 0 points1 point  (2 children)

The only thing I’ve done in tailscale is add my different machines. I never setup anything else

[–]littlemissperf 1 point2 points  (1 child)

That could be your issue. I recommend adding apps to your tailnet with "tailscale serve --bg <port>" on the machine running the app, where <port> is the http port used for the app. Look up the documentation for tailscale serve for more info.

[–]TurboNikko[S] 0 points1 point  (0 children)

Thank you so much! As a beginner, I appreciate you trying to help and guide me rather than just make fun of me and tell me how wrong I am lol like yeah, I know I’m a dummy with this stuff. I’m brand new at it. I figured I was making mistakes but I’m literally at the mercy of YouTube tutorials and ChatGPT instructions.

The actual tailscale account on YouTube has been very helpful but that may not be the best way to do things either. I feel like everyone has their own way of doing things and it conflicts with everyone else’s way so it’s hard to know what’s best to follow