Alpine Nextcloud Hub: .htaccess file is not working - potential security issue

[The-May]

Please verify that you have read and understood the guidelines.

yes

A clear and concise description of the issue.

Hi,

I recently stumbled upon the LXC creaton of Alpine Nextcloud Hub. I Installed it with bash -c "$(wget -qO - https://github.com/tteck/Proxmox/raw/main/ct/alpine-nextcloud.sh)" and updated it with the manual LXC Updater bash -c "$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/misc/update-lxcs.sh)" (in case it is relevant)

I stumbled upon this errormessage which left me puzzled:

Your data directory and files are probably accessible from the internet. The .htaccess file is not working. It is strongly recommended that you configure your web server so that the data directory is no longer accessible, or move the data directory outside the web server document root.

Since I am not the biggest linux-expert I did some research, looked up if someone already opened up an issue (no result) and did some checks on my own with the "curl" command since I understand basic usage codes from it.

alpine-nextcloud:/etc/nextcloud# curl -Ik https://localhost/data/
HTTP/2 200 
server: nginx
date: Wed, 14 Aug 2024 11:13:36 GMT
content-type: text/html
content-length: 156
last-modified: Thu, 18 Jul 2024 13:38:18 GMT
etag: "66991aca-9c"
accept-ranges: bytes

alpine-nextcloud:/etc/nextcloud# curl -Ik https://192.168.1.145/data/
HTTP/2 200 
server: nginx
date: Wed, 14 Aug 2024 11:23:22 GMT
content-type: text/html
content-length: 156
last-modified: Thu, 18 Jul 2024 13:38:18 GMT
etag: "66991aca-9c"
accept-ranges: bytes

this looks like the server does not deny the request. I was expecting an errorcode that clearly denies my request. According to this, it shows that the Error/Warning is true and a security issue is persistent to it.

What settings are you currently utilizing?

Default Settings

Which Linux distribution are you employing?

Alpine

If relevant, including screenshots or a code block can be helpful in clarifying the issue.

Please provide detailed steps to reproduce the issue.

1. Create LXC like mentioned before on pve host
2. Open up https://ip.adress.of.nextcloud/, get redirected to initial setup, set username and pass
3. Login to Nextcloud with username/pass
4. go to https://ip.adress.of.nextcloud/index.php/settings/admin/overview
5. See Errormessage

[tteck]

Is your nextcloud instance available via the internet?

[tteck]

🧐 As this issue is unrelated to the script, it is considered closed.

[The-May]

Is your nextcloud instance available via the internet?

accessed via lan. Never hat the plan to use it with reverse proxy or anything else.