Closed julianfairfax closed 11 months ago
This also happens on a clean install of Raspberry Pi OS with the latest version of NextcloudPi installed through the curl install script.
This doesn't seem to be an actual issue.
What does seem to be the case, is that Tailscale now requires you use a different command to serve (and funnel) a site with a self-signed HTTPS certificate: sudo tailscale serve https / https+insecure://localhost:443
.
Serving the site with the normal command sudo tailscale serve https / https://localhost:443
doesn't appear to work.
Once you serve the site, you can then generate a proper HTTPS certificate. It appears that, without this certificate, only connections to port 443 will work over Tailscale. Other ports, such as 4443, will complain that they're using a self-signed certificate.
But they were before the serving as well, so I'm not sure what's going on here. Additionally, even after generating the certificate, you still cannot serve the site using the normal command.
When SSHing into my Pi 4 running NextcloudPi (a clean install with the latest version of NextcloudPi, latest version of Nextcloud, and all packages being up-to-date), I cannot access Nextcloud over https://localhost or https://127.0.0.1. Only https://0.0.0.0. I have tested this with curl, which comes back with no output for the first two.
This is an issue because I would like to use Tailscale Funnel to be able to access my Nextcloud instance from outside my network, and this tool doesn't support https://0.0.0.0. When using https://localhost as the site to make accessible, visiting it in a browser shows nothing.
System information
NextcloudPi diagnostics
``` NextcloudPi version v1.52.4 NextcloudPi image NextCloudPi_RaspberryPi_v1.52.2.img OS Debian GNU/Linux 11. 6.1.21-v8+ (aarch64) automount no USB devices none datadir /opt/ncdata/data data in SD yes data filesystem ext2/ext3 data disk usage 3.0G/29G rootfs usage 3.0G/29G swapfile /var/swap dbdir /var/lib/mysql Nextcloud check ok Nextcloud version 27.0.1.2 HTTPD service up PHP service up MariaDB service up Redis service up HPB service up Postfix service up Internet check ok Public IPv4 ***REMOVED SENSITIVE VALUE*** Public IPv6 ***REMOVED SENSITIVE VALUE*** Port 80 closed Port 443 closed IP ***REMOVED SENSITIVE VALUE*** Gateway ***REMOVED SENSITIVE VALUE*** Interface wlan0 Certificates ***REMOVED SENSITIVE VALUE*** NAT loopback no Uptime 2min ```Nextcloud configuration
``` { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": { "0": "localhost", "7": "nextcloudpi", "5": "nextcloudpi.local", "8": "nextcloudpi.lan", "3": "nextcloudpi", "11": "2a04:ee41:85:4073:fef1:de10:b2b1:8909", "1": "10.0.0.30", "14": "nextcloudpi" }, "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "27.0.1.2", "overwrite.cli.url": "https:\/\/nextcloudpi\/", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "memcache.local": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 0, "timeout": 0, "password": "***REMOVED SENSITIVE VALUE***" }, "tempdirectory": "\/opt\/ncdata\/data\/tmp", "mail_smtpmode": "sendmail", "mail_smtpauthtype": "LOGIN", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "preview_max_x": "2048", "preview_max_y": "2048", "jpeg_quality": "60", "overwriteprotocol": "https", "maintenance": false, "logfile": "\/opt\/ncdata\/data\/nextcloud.log", "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "loglevel": 2 } } ```HTTPd logs
``` [Wed Aug 09 14:38:12.171075 2023] [authz_host:error] [pid 37352:tid 547620557184] [remote 10.0.0.5:51454] AH01753: access check of 'localhost' to /img/red-circle.svg failed, reason: unable to get the remote host name, referer: https://10.0.0.30:4443/css/ncp.css [Wed Aug 09 14:38:27.864620 2023] [authz_host:error] [pid 37352:tid 547612164480] [remote 10.0.0.5:51454] AH01753: access check of 'localhost' to /ncp-launcher.php failed, reason: unable to get the remote host name [Wed Aug 09 14:38:33.134983 2023] [authz_host:error] [pid 37352:tid 547603771776] [remote 10.0.0.5:51454] AH01753: access check of 'localhost' to /ncp-launcher.php failed, reason: unable to get the remote host name [Wed Aug 09 14:45:26.724379 2023] [authz_host:error] [pid 37352:tid 547595379072] [remote 10.0.0.5:51454] AH01753: access check of 'localhost' to /ncp-launcher.php failed, reason: unable to get the remote host name [Wed Aug 09 14:45:29.108919 2023] [mpm_event:notice] [pid 784:tid 547764929600] AH00492: caught SIGWINCH, shutting down gracefully [Wed Aug 09 14:45:29.133049 2023] [proxy_fcgi:error] [pid 37352:tid 547696091520] [remote 10.0.0.5:51454] AH01067: Failed to read FastCGI header [Wed Aug 09 14:45:29.133154 2023] [proxy_fcgi:error] [pid 37352:tid 547696091520] (104)Connection reset by peer: [remote 10.0.0.5:51454] AH01075: Error dispatching request to :4443: [Wed Aug 09 14:45:32.481446 2023] [core:warn] [pid 784:tid 547764929600] AH00045: child process 37352 still did not exit, sending a SIGTERM [Wed Aug 09 14:45:34.483640 2023] [core:warn] [pid 784:tid 547764929600] AH00045: child process 37352 still did not exit, sending a SIGTERM [Wed Aug 09 14:45:36.485951 2023] [core:warn] [pid 784:tid 547764929600] AH00045: child process 37352 still did not exit, sending a SIGTERM [Wed Aug 09 14:45:38.488219 2023] [core:error] [pid 784:tid 547764929600] AH00046: child process 37352 still did not exit, sending a SIGKILL [Wed Aug 09 14:45:46.759485 2023] [ssl:warn] [pid 585:tid 547757397056] AH01909: localhost:4443:0 server certificate does NOT include an ID which matches the server name [Wed Aug 09 14:45:46.781631 2023] [ssl:error] [pid 585:tid 547757397056] AH02217: ssl_stapling_init_cert: can't retrieve issuer certificate! [subject: CN=fv-az83-474 / issuer: CN=fv-az83-474 / serial: 138C9125F0C613A164DD420FEB2DF95A6552B53F / notbefore: Jul 19 12:36:44 2023 GMT / notafter: Jul 16 12:36:44 2033 GMT] [Wed Aug 09 14:45:46.781714 2023] [ssl:error] [pid 585:tid 547757397056] AH02604: Unable to configure certificate localhost:4443:0 for stapling [Wed Aug 09 14:45:46.848984 2023] [ssl:warn] [pid 890:tid 547757397056] AH01909: localhost:4443:0 server certificate does NOT include an ID which matches the server name [Wed Aug 09 14:45:46.849142 2023] [ssl:error] [pid 890:tid 547757397056] AH02217: ssl_stapling_init_cert: can't retrieve issuer certificate! [subject: CN=fv-az83-474 / issuer: CN=fv-az83-474 / serial: 138C9125F0C613A164DD420FEB2DF95A6552B53F / notbefore: Jul 19 12:36:44 2023 GMT / notafter: Jul 16 12:36:44 2033 GMT] [Wed Aug 09 14:45:46.849158 2023] [ssl:error] [pid 890:tid 547757397056] AH02604: Unable to configure certificate localhost:4443:0 for stapling [Wed Aug 09 14:45:46.853790 2023] [mpm_event:notice] [pid 890:tid 547757397056] AH00489: Apache/2.4.56 (Debian) OpenSSL/1.1.1n configured -- resuming normal operations [Wed Aug 09 14:45:46.853912 2023] [core:notice] [pid 890:tid 547757397056] AH00094: Command line: '/usr/sbin/apache2' [Wed Aug 09 14:46:13.639988 2023] [authz_host:error] [pid 892:tid 547730985344] [remote 10.0.0.5:45824] AH01753: access check of 'localhost' to /ncp-output.php failed, reason: unable to get the remote host name ```Database logs
``` tail: cannot open '/var/log/mysql/*.log' for reading: No such file or directory ```Nextcloud logs
``` {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Add background job to cleanup login flow v2 tokens","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Remove potentially over exposing share links","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairInfoEvent: Repair info: No need to remove link shares.","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Clear access cache of projects","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Reset generated avatar flag","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Keep legacy encryption enabled","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Check encryption key format","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Remove old dashboard app config data","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Add job to cleanup the bruteforce entries","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Queue a one-time job to check for user uploaded certificates","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Repair DAV shares","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Add background job to set the lookup server share state for users","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Add token cleanup job","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Clean up abandoned apps","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"OC\\Repair\\Events\\RepairStepEvent: Repair step: Add possibly missing system config","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:50+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"\\OC\\Updater::startCheckCodeIntegrity: Starting code integrity check...","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:58+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"\\OC\\Updater::finishedCheckCodeIntegrity: Finished code integrity check","userAgent":"--","version":"26.0.3.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:58+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"\\OC\\Updater::updateEnd: Update successful","userAgent":"--","version":"27.0.1.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:58+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"\\OC\\Updater::maintenanceDisabled: Turned off maintenance mode","userAgent":"--","version":"27.0.1.2","data":{"app":"updater"}} {"reqId":"Qa1GjCUpbiTHlOopbjKt","level":1,"time":"2023-08-09T13:33:58+00:00","remoteAddr":"","user":"--","app":"updater","method":"","url":"--","message":"\\OC\\Updater::resetLogLevel: Reset log level to Warning(2)","userAgent":"--","version":"27.0.1.2","data":{"app":"updater"}} ```