I tried it with another problem of yours: https://www.reddit.com/r/homelab/comments/qbmj1w/issue_with_nextcloud_via_docker_and_nginx_reverse/

Not only did it give the solution, it was much clearer than the comment solution you received on Reddit.

The issue you're experiencing with the Nextcloud desktop client is related to how Nextcloud generates URLs when it's behind a reverse proxy like Nginx, especially when SSL termination is involved. Even though everything works fine in the browser and on Android devices, the desktop client performs stricter checks and detects that the polling URL is not using HTTPS, which raises a security concern.

Root Cause:

When Nextcloud is behind a reverse proxy that handles SSL encryption, it needs to be aware of this setup to generate correct URLs using HTTPS. If not configured properly, Nextcloud may generate HTTP URLs internally, leading to the error you're seeing in the desktop client.

Solution:

You need to update your config.php to inform Nextcloud about the proxy and the SSL termination. Specifically, you should:

1. Define Trusted Proxies: Include the IP address of your reverse proxy (Nginx) in the trusted_proxies array. Since Nginx is running on the host machine, you should use the Docker network's gateway IP or the host's LAN IP.

2. Set Overwrite Protocol: Use the 'overwriteprotocol' => 'https' directive to tell Nextcloud to use HTTPS for generating URLs.

3. Set Overwrite CLI URL: Update 'overwrite.cli.url' to reflect the external URL clients use to access Nextcloud.

Updated config.php:

<?php
$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'instanceid' => 'redacted',
  'passwordsalt' => 'redacted',
  'secret' => 'redacted',
  'trusted_domains' => 
  array (
    0 => '192.168.1.*',
    1 => 'nextcloud.domain.com',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '22.1.1.2',
  'trusted_proxies' => ['192.168.1.7', '127.0.0.1'], // Add your proxy IPs here
  'overwritehost' => 'nextcloud.domain.com', // Optional but recommended
  'overwritewebroot' => '', // Leave empty unless you have a specific webroot
  'overwrite.cli.url' => 'https://nextcloud.domain.com', // Use HTTPS and your domain
  'overwriteprotocol' => 'https', // Force HTTPS
  'dbname' => 'nextcloud',
  'dbhost' => 'redacted',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'redacted',
  'dbpassword' => 'redacted',
  'installed' => true,
  'twofactor_enforced' => 'true',
  'twofactor_enforced_groups' => 
  array (
  ),
  'twofactor_enforced_excluded_groups' => 
  array (
  ),
);

Explanation of Changes:

• 'trusted_proxies': Added both 192.168.1.7 (your host's LAN IP) and 127.0.0.1 to ensure Nextcloud trusts requests forwarded by Nginx.

• 'overwriteprotocol': Set to 'https' to force Nextcloud to generate URLs with HTTPS.

• 'overwrite.cli.url': Changed to 'https://nextcloud.domain.com' to reflect the external URL with HTTPS.

• 'overwritehost': Optionally set to your domain to ensure consistency in generated URLs.

Additional Steps:

• Restart Services: After making these changes, restart your Nextcloud container and Nginx to ensure the new configuration is loaded.

• Verify Nginx Configuration: Ensure that Nginx is correctly set up to proxy requests to Nextcloud and that it's passing necessary headers like X-Forwarded-For and X-Forwarded-Proto.

Example Nginx Configuration Snippet:

server {
    listen 80;
    server_name nextcloud.domain.com;
    return 301 https://$host$request_uri; # Redirect to HTTPS
}

server {
    listen 443 ssl;
    server_name nextcloud.domain.com;

    # SSL configuration...

    location / {
        proxy_pass http://127.0.0.1:91; # Port mapping to your Nextcloud container
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Why This Works:

By informing Nextcloud about the proxy and enforcing HTTPS in its internal URL generation, you align the internal URLs with the external ones accessed by clients. This prevents the desktop client from detecting mismatches between the login URL and the polling URL, resolving the security warning.

Note on Updates:

Your Nextcloud version (22.1.1) is quite outdated. Consider updating to a newer version to benefit from security patches and improvements. Always back up your data before performing an upgrade.

Conclusion:

Implementing these configuration changes should resolve the error you're encountering with the Nextcloud desktop client. The key is ensuring that Nextcloud is fully aware of the reverse proxy setup and handles URL generation accordingly.

So what was the solution for your problem?