Do all up steam containers require port 80 and 443?

[prairietree]

I am using docker-compose to set up Collabora and NextCloud with nginxproxy/nginx-proxy:alpine and nginxproxy/acme-companion. I had NextCloud working before and it still works. But Collabora does not work over https.

I can access access Collabora with http://office.[domain].com:9980/hosting/discovery.

However, it will not work with https. If I go to https://office.[domain].com:9980/hosting/discovery I get an error that says:

Secure Connection Failed

An error occurred during a connection to office.[domain].com:9980. SSL received a record that exceeded the maximum permissible length.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

Please contact the website owners to inform them of this problem.

This is my docker-compose.yml

version: '3'

services:
  [...]
  app:
    image: nextcloud:apache
    restart: always
    volumes:
      [...]
    environment:
      - VIRTUAL_HOST=nextcloud.[domain].com
      - LETSENCRYPT_HOST=nextcloud.[domain].com
      - [email protected]
      - MYSQL_HOST=db
      - REDIS_HOST=redis
      - NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.[domain].com [domain].com
      - NEXTCLOUD_DATA_DIR=/srv/nextcloud/data
      - TRUSTED_PROXIES=nextcloud-proxy-1
      - NEXTCLOUD_HOSTNAME=nextcloud.[domain].com
      - OVERWRITEPROTOCOL=https
      - OVERWRITEHOST=nextcloud.[domain].com
    hostname: nextcloud.[domain].com
    env_file:
      [...]
    depends_on:
      [...]
    networks:
      - proxy-tier
      - default

  collabora:
    image: collabora/code:latest
    cap_add:
      - MKNOD
    environment:
      - aliasgroup1=https://nextcloud.[domain].com:443
      - username=[...]
      - password=[...]
      - VIRTUAL_HOST=office.[domain].com
      - LETSENCRYPT_HOST=office.[domain].com
      - VIRTUAL_PORT=9980
      - [email protected]
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
    ports:
      - 9980:9980
    restart: always
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
    networks:
      - proxy-tier
      - default

  proxy:
    build: ./proxy
    restart: always
    ports:
      - 80:80
      - 443:443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - certs:/etc/nginx/certs:ro
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro
    container_name: nextcloud-proxy-1
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: nginxproxy/acme-companion
    restart: always
    volumes:
      - certs:/etc/nginx/certs
      - acme:/etc/acme.sh
      - vhost.d:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy

volumes:
  [...]

networks:
  proxy-tier:

[buchdag]

Hi.

The whole idea of a SNI based reverse proxy like nginx-proxy is that you access all services through http(s)://some.domain.tld on the normal 80 or 443 ports, yes.

Doing http(s)://office.[domain].com:9980/hosting/discovery in your case entirely bypass the proxy, you're accessing the container directly through its published (ie available to the outside) 9980 port.

Try doing http(s)://office.[domain].com/hosting/discovery instead.