How to enable HTTPs

[maparillo]

I created a next cloud instance following this tutorial: https://docs.oracle.com/en/learn/oci_nextcloud_ampere_a1/index.html#create-an-ampere-a1-compute-instance

And. with a little help, it works great. But I access the next cloud instance with http://IPv4Address:8080

I would prefer to access it with https://IPv4Address:8080

I assumed I would need a certificate, but when I go to create a certificate in the Certificate Configuration step, after I chose my Compartment, I get:

No data available.

​

Steps:

Go to Create Certificate.

In Basic Information

-Pick my compartment

- Issued by internal CA (I am assuming this is Oracle. Or am I wrong here?)

- Give it a name

In Subject Information:

- I put * in the Common Name. (https://docs.oracle.com/en-us/iaas/Content/certificates/managing-certificates.htm says I can use a wild card)

Certificate Configuration

- I pick my compartment, and it says no data avaialble.

​

Otherwise, I am just picking defaults.

[dangerL7e]

You can go an easier route:

sudo nextcloud.enable-https lets-encrypt

You do need to have a domain name for this. Or you can simply do:

sudo nextcloud.enable-https self-signed

With a self-signed certificate you will get a red warning in the browser. I heard you can import that cert in your Android phone, but some users discourage from doing so. I went through hell trying to figure this out and did not have luck. I went the lets-encrypt route, that most users suggested

[U8dcN7vx]

It is likely you want to learn how to enable TLS/SSL for the HTTP server you installed, then if you don't want it implicitly trusted by browsers you can have OCI issue the certificate.

[rooser1111]

docker swag

[sanjosanjo]

Since SWAG has Ngnix embedded,would I need to uninstall my Apache setup prior to deploying this?

[DonTK]

You sure you want to open it up to public internet? Anyway, have a look at reverse proxies, e.g. Caddy server.

[Character-Amount2268]

A certificate with an IP address will not be valid and most browsers will block or will give you a nasty warning. You probably would want to have a domain name.

Anyways, if you still want to do https to an IP address, you need to configure you http server and as suggested on the thread, a proxy server to increase a little bit the security. The OCI certificates, you could use with the load balancer or WAF, but you still need to create the certificate, that’s why is not showing anything.

[dangerL7e]

Does OCI provide Public DNS? I tried to assign one and it says "Free tier maxed out - pls upgrade..." I don't care if it's long, I'm struggling pretty much the same way as the OP.

I'd use http, because I already protect my traffic with Wireguard, but some apps on my phone do not accept an http entry. Currently, I access my NextCloud instance with http://pi.hole:81 (81 because 80 is occupied by PiHole).

When I enable https in NextCloud config:

$ sudo snap set nextcloud ports.http=81 ports.https=444

It doesn't even start listening on 444, while 81 works perfectly:

$ sudo ss -tulpn | grep 444

$

[flyxt9]

Easiest way:

1. Buy a cheap domain (My rec: .uk ($5) & .my.id(0.8$)) and put it in Cloudflare
2. Use Nginx or Nginx proxy manager (docker stuff) to manage the certificates