How to redirect to Nextcloud Docker container?

[AlexCreamer]

Bear with me. I'm new to Caddy. New to Tailscale. New to Nextcloud.

I'm trying to access my Nextcloud via Caddy which is accessed via Tailscale. All three are in Docker containers. I tried following the following example but am still struggling: nextcloud/all-in-one#575

When I try to access my site via http, port 80, and no path, I get brought to a welcome page for Caddy saying "Caddy works! Congratulations! Your web server is working."

And my Caddy/Tailscale container is able to communicate with my Nextcloud container when I sh into the container and try to ping. But the redirect isn't working when trying to access it via my browser doesn't work. I tried using /web_app, /web_app2, as shown in my Caddy file below, on both http and https and neither gives me results. I'm not able to connect with either of those.

This is my HTTP port 80 display if I don't add a path:

Caddyfile

{
        tailscale {
                auth_key tskey-auth-H54H54H5-GRGH453G45
                hostname nextcloud-aio-mastercontainer:11000

                web_app {
                        auth_key tskey-auth-H54H54H5-GRGH453G45
                        hostname nextcloud-aio-mastercontainer:11000
                }
                web_app2 {
                        auth_key tskey-auth-H54H54H5-GRGH453G45
                        hostname nextcloud-aio-mastercontainer:11000
                }
        }
}
:80 {
        bind tailscale/web_app
}

:443 {
        bind tailscale/web_app2
}

caddy-tailscale container

services:
  caddy:
      environment:
        TS_AUTH_KEY:  tskey-auth-H54H54H5-GRGH453G45
        APACHE_PORT: 11000
      volumes:
        - ./Caddyfile:/etc/caddy/Caddyfile
      build:
          dockerfile_inline: |
            FROM docker.io/caddy:2.9-builder AS builder
            RUN xcaddy build \
              --with github.com/tailscale/caddy-tailscale
            FROM docker.io/caddy:2.9
            COPY --from=builder /usr/bin/caddy /usr/bin/caddy
      ports:
        - 80:80
        - 443:443
      networks:
        - nextcloud-aio

volumes:
  caddy_certs:
  caddy_data:
  caddy_config:
  tailscale:
  tailscale_sock:

networks:
  home_default:
    external: true
  nextcloud-aio:
    name: nextcloud-aio
    external: true

Nextcloud container

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:beta
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
      - ./abc:/mnt/ncdata2
    #network_mode: bridge # add to the same network as docker run would do
    networks:
      - nextcloud-aio
    ports:
      #- 80:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      #- 0.0.0.0:443:443
      #- 0.0.0.0:80:80
      - 0.0.0.0:8080:8080
      # - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    environment: # Is needed when using any of the options below
      # AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section

       APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       #APACHE_IP_BINDING: 127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

...
...

[nerdlich]

I don't quite understand your Caddyfile. I would start with the most basic version and take it from there once that works. Something like this:

{
    tailscale {
        auth_key *******************
    }
}

nextcloud.<tailnet_domain> {
    reverse_proxy http://nextcloud-aio-apache:11000
}

[AlexCreamer]

When I use your config using my hostname instead of "nextcloud", I get the same Caddy welcome page.

{
    tailscale {
        auth_key ******
    }
}

myhostname.tail123abc.ts.net {
    reverse_proxy http://nextcloud-aio-apache:11000
}

When I try the following the same config as yours, I get a server not found error in my browser:

{
    tailscale {
        auth_key ******
    }
}

nextcloud.tail123abc.ts.net {
    reverse_proxy http://nextcloud-aio-apache:11000
}

[AlexCreamer]

Actually correction. It looks like its the tailscale that was installed on my host that was showing the welcome to Caddy page. When I bring it down, I'm not able to connect to it anymore.

[AlexCreamer]

I'm not even sure Tailscale is running at all in this container. I'm not sure how to check. Caddy is running but I don't see Tailscale anywhere.

[nerdlich]

If I understand correctly, myhostname is the name of the physical host which is also running tailscale? In that case you can't use the same hostname for tailscale inside this caddy. It needs to be a different node on your tailnet. If "nextcloud" didn't register, something is wrong there. Check the logs of your caddy to see where the tailscale plugin fails (docker logs caddy). Also check the tailscale admin console to see what your tailscale nodes are doing.

[AlexCreamer]

I don't see any mentions of Tailscale in the logs. Maybe that's why its failing? Perhaps it didn't build the right image?

[AlexCreamer]

My container isn't showing up at all in the Tailscale admin console. I tried both the docker-compose approach and the following as described here https://github.com/tailscale/caddy-tailscale?tab=readme-ov-file#docker:

docker run -it -rm \
  -e TS_AUTHKEY="tskey-auth-XXX" \
  -v ./custom.caddyfile:/etc/caddy/Caddyfile -v ./config:config \
  ghcr.io/tailscale/caddy-tailscale

Except I had errors with -rm and ./config:config where I had to remove -rm and change the config part to: ./config:/config. The rm was giving me the error: unknown shorthand flag: 'r' in -rm and the config part was giving me the error invalid mount config for type "bind": invalid mount path: 'config' mount path must be absolute. Changing them to the following allowed the container to run, but I still don't see it in the Tailscale Admin Console:

docker run -it \
  -e TS_AUTHKEY="tskey-auth-XXX" \
  -v ./Caddyfile:/etc/caddy/Caddyfile -v ./config:/config \
  ghcr.io/tailscale/caddy-tailscale

[AlexCreamer]

I keep getting these same similar logs like this with my configs. I even tried running the container with some extra params:

sudo docker run --cap-add=NET_ADMIN --rm -it -e TS_EXTRA_ARGS="--advertise-tags=tag:nextcloud" -e TS_AUTHKEY="tskey-api-fakeery-fakeferg" -v ./Caddyfile:/etc/caddy/Caddyfile -v ./config:/config --device=/dev/net/tun:/dev/net/tun ghcr.io/tailscale/caddy-tailscale:main

2025/06/15 13:40:42.842 INFO    using config from file  {"file": "/etc/caddy/Caddyfile"}
2025/06/15 13:40:42.843 INFO    adapted config to JSON  {"adapter": "caddyfile"}
2025/06/15 13:40:42.843 INFO    admin   admin endpoint started  {"address": "localhost:2019", "enforce_origin": false, "origins": ["//127.0.0.1:2019", "//localhost:2019", "//[::1]:2019"]}
2025/06/15 13:40:42.843 INFO    http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS       {"server_name": "srv0", "https_port": 443}
2025/06/15 13:40:42.843 INFO    http.auto_https enabling automatic HTTP->HTTPS redirects        {"server_name": "srv0"}
2025/06/15 13:40:42.844 INFO    tls.cache.maintenance   started background certificate maintenance      {"cache": "0xc000678f00"}
2025/06/15 13:40:42.844 WARN    http    HTTP/2 skipped because it requires TLS  {"network": "tcp", "addr": ":80"}
2025/06/15 13:40:42.844 WARN    http    HTTP/3 skipped because it requires TLS  {"network": "tcp", "addr": ":80"}
2025/06/15 13:40:42.844 INFO    http.log        server running  {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2025/06/15 13:40:42.844 INFO    http    enabling HTTP/3 listener        {"addr": ":443"}
2025/06/15 13:40:42.844 INFO    http.log        server running  {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2025/06/15 13:40:42.844 INFO    autosaved config (load with --resume flag)      {"file": "/config/caddy/autosave.json"}
2025/06/15 13:40:42.844 INFO    serving initial configuration
2025/06/15 13:40:42.845 INFO    tls     cleaning storage unit   {"storage": "FileStorage:/data/caddy"}
2025/06/15 13:40:42.846 INFO    tls     finished cleaning storage units

[nerdlich]

So sorry, the tailscale bind is missing in the Caddyfile I provided above.

{
    tailscale {
        auth_key *******************
    }
}

nextcloud.<tailnet_domain> {
    bind tailscale/nextcloud
    reverse_proxy http://nextcloud-aio-apache:11000
}

[AlexCreamer]

It works now. Thanks!

[AlexCreamer]

I'm not sure what I brought, but I'm not able to connect to from Caddy-Tailscale to my Nextcloud container anymore. But Caddy-Tailscale is able to connect to my Immich container.

My Caddy-Tailscale log has the following error:

logger":"tls.handshake","msg":"external certificate manager","remote_ip":"100.123.123.123","remote_port":"51234","sni":"nextcloud.mytail1234.ts.net","cert_manager":"caddytls.Tailscale","cert_manager_idx":0,"error":"Get \"http://local-tailscaled.sock/localapi/v0/cert/nextcloud.mytail1234.ts.net?type=pair\": Get \"http://local-tailscaled.sock/localapi/v0/cert/nextcloud.mytail1234.ts.net?type=pair\": context deadline exceeded"}

And my nextcloud-aio-nextcloud container logs has the error:

Failed to fetch discovery endpoint from https://nextcloud.tail1234.ts.net
cURL error 28: Resolving timed out after 5001 milliseconds (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://nextcloud.tail1234.ts.net/hosting/discovery

With no errors showing in my nextcloud-aio-apache container logs