mirror of
https://github.com/nextcloud/all-in-one.git
synced 2026-05-21 02:40:09 +00:00
docs: mention deSEC feature in readme, reverse-proxy, local-instance and QA docs
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/987af94f-dbff-4efd-968c-f6993c7c4dc8 Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
committed by
GitHub
GitHub
parent
03e3b90ced
commit
6b362f2f5d
@@ -3,15 +3,26 @@ It is possible due to several reasons that you do not want or cannot open Nextcl
|
||||
|
||||
### Content
|
||||
- [1. Tailscale](#1-tailscale)
|
||||
- [2. The normal way](#2-the-normal-way)
|
||||
- [3. Use the ACME DNS-challenge](#3-use-the-acme-dns-challenge)
|
||||
- [4. Use Cloudflare](#4-use-cloudflare)
|
||||
- [5. Buy a certificate and use that](#5-buy-a-certificate-and-use-that)
|
||||
- [2. deSEC free domain](#2-desec-free-domain)
|
||||
- [3. The normal way](#3-the-normal-way)
|
||||
- [4. Use the ACME DNS-challenge](#4-use-the-acme-dns-challenge)
|
||||
- [5. Use Cloudflare](#5-use-cloudflare)
|
||||
- [6. Buy a certificate and use that](#6-buy-a-certificate-and-use-that)
|
||||
|
||||
## 1. Tailscale
|
||||
This is the recommended way. For a reverse proxy example guide for Tailscale, see this guide by [@Perseus333](https://github.com/Perseus333): https://github.com/nextcloud/all-in-one/discussions/6817
|
||||
|
||||
## 2. The normal way
|
||||
## 2. deSEC free domain
|
||||
[deSEC](https://desec.io) offers free dynamic-DNS subdomains under `dedyn.io`. AIO can register an account and a subdomain for you automatically — directly from the domain-entry page of the AIO interface. After registration:
|
||||
- The [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container is enabled automatically as a reverse proxy and handles TLS via Let's Encrypt.
|
||||
- The [dnsmasq](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) community container is enabled automatically so that LAN clients resolve your Nextcloud domain to the server's local IP address — no separate Pi-hole or local DNS server required.
|
||||
- The mastercontainer keeps the DNS record up to date automatically when your public IP changes.
|
||||
|
||||
**How to set it up:** Open the AIO interface, expand the **"Don't have a domain? Get a free one from deSEC"** section, enter your email and an optional subdomain slug, and click **Register free domain via deSEC**. See the full documentation at [How to get a free domain via deSEC](https://github.com/nextcloud/all-in-one#how-to-get-a-free-domain-via-desec).
|
||||
|
||||
After registration, follow the [dnsmasq documentation](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) to point your router's DHCP DNS server to the AIO host so that all LAN devices resolve the domain locally.
|
||||
|
||||
## 3. The normal way
|
||||
The normal way is the following:
|
||||
1. Set up your domain correctly to point to your home network
|
||||
1. Set up a reverse proxy by following the [reverse proxy documentation](./reverse-proxy.md) but only open port 80 (which is needed for the ACME challenge to work - however no real traffic will use this port).
|
||||
@@ -21,12 +32,12 @@ The normal way is the following:
|
||||
|
||||
**Hint:** You may have a look at [this video](https://youtu.be/zk-y2wVkY4c) for a more complete but possibly outdated example.
|
||||
|
||||
## 3. Use the ACME DNS-challenge
|
||||
## 4. Use the ACME DNS-challenge
|
||||
You can alternatively use the ACME DNS-challenge to get a valid certificate for Nextcloud. Here is described how to set it up using an external caddy reverse proxy: https://github.com/nextcloud/all-in-one#how-to-get-nextcloud-running-using-the-acme-dns-challenge
|
||||
|
||||
## 4. Use Cloudflare
|
||||
## 5. Use Cloudflare
|
||||
If you do not have any control over the network, you may think about using Cloudflare Tunnel to get a valid certificate for your Nextcloud. However it will be opened to the public internet then. See https://github.com/nextcloud/all-in-one#how-to-run-nextcloud-behind-a-cloudflare-tunnel how to set this up.
|
||||
|
||||
## 5. Buy a certificate and use that
|
||||
## 6. Buy a certificate and use that
|
||||
If none of the above ways work for you, you may simply buy a certificate from an issuer for your domain. You then download the certificate onto your server, configure AIO in [reverse proxy mode](./reverse-proxy.md) and use the certificate for your domain in your reverse proxy config.
|
||||
|
||||
|
||||
20
readme.md
20
readme.md
@@ -61,6 +61,7 @@ Included are:
|
||||
- [Mail server can be added](https://github.com/nextcloud/all-in-one#mail-server)
|
||||
- Nextcloud can be [accessed locally via the domain](https://github.com/nextcloud/all-in-one#how-can-i-access-nextcloud-locally)
|
||||
- Can [be installed locally](https://github.com/nextcloud/all-in-one/blob/main/local-instance.md) (if you don't want or cannot make the instance publicly reachable)
|
||||
- Free [deSEC](https://desec.io) dynamic-DNS domain (`*.dedyn.io`) can be registered directly from the AIO interface — no external domain needed
|
||||
- [IPv6-ready](https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md)
|
||||
- Can be used with [Docker rootless](https://github.com/nextcloud/all-in-one/blob/main/docker-rootless.md) (good for additional security)
|
||||
- Runs on all platforms Docker supports (e.g. also on Windows and Macos)
|
||||
@@ -248,6 +249,9 @@ https://your-domain-that-points-to-this-server.tld:8443
|
||||
|
||||
5. If you enable Nextcloud Talk, open port `3478/TCP` and `3478/UDP` in your firewall/router for the Talk (TURN) container.
|
||||
|
||||
> [!TIP]
|
||||
> Don't have a domain yet? AIO can register a free dynamic-DNS subdomain under `dedyn.io` for you via [deSEC](https://desec.io) — no external setup needed. Look for the **"Don't have a domain? Get a free one from deSEC"** section on the AIO interface when you are asked to enter your domain. AIO will automatically register the domain, keep the DNS record up to date, and enable the [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container as a reverse proxy as well as the [dnsmasq](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) container for local DNS resolution.
|
||||
|
||||
# FAQ
|
||||
- [TOC](#faq)
|
||||
- [Where can I find additional documentation?](#where-can-i-find-additional-documentation)
|
||||
@@ -261,6 +265,7 @@ https://your-domain-that-points-to-this-server.tld:8443
|
||||
- [Notes on Cloudflare (proxy/tunnel)](#notes-on-cloudflare-proxytunnel)
|
||||
- [How to run Nextcloud behind a Cloudflare Tunnel?](#how-to-run-nextcloud-behind-a-cloudflare-tunnel)
|
||||
- [How to run Nextcloud via Tailscale?](#how-to-run-nextcloud-via-tailscale)
|
||||
- [How to get a free domain via deSEC?](#how-to-get-a-free-domain-via-desec)
|
||||
- [How to get Nextcloud running using the ACME DNS-challenge?](#how-to-get-nextcloud-running-using-the-acme-dns-challenge)
|
||||
- [How to run Nextcloud locally? No domain wanted, or wanting intranet access within your LAN.](#how-to-run-nextcloud-locally-no-domain-wanted-or-wanting-intranet-access-within-your-lan)
|
||||
- [Can I use an ip-address for Nextcloud instead of a domain?](#can-i-use-an-ip-address-for-nextcloud-instead-of-a-domain)
|
||||
@@ -410,6 +415,19 @@ Although it does not seems like it is the case but from AIO perspective a Cloudf
|
||||
### How to run Nextcloud via Tailscale?
|
||||
For a reverse proxy example guide for Tailscale, see this guide by [@Perseus333](https://github.com/Perseus333): https://github.com/nextcloud/all-in-one/discussions/6817
|
||||
|
||||
### How to get a free domain via deSEC?
|
||||
[deSEC](https://desec.io) offers free dynamic-DNS subdomains under `dedyn.io`. AIO integrates the registration process directly:
|
||||
|
||||
1. Open the AIO interface and expand the **"Don't have a domain? Get a free one from deSEC"** section on the domain-entry page.
|
||||
2. Enter your email address and, optionally, a desired subdomain slug (the part before `.dedyn.io`). Leave the slug blank for a random one.
|
||||
3. Click **Register free domain via deSEC**. AIO will create a deSEC account, register the subdomain and store the credentials in its configuration.
|
||||
|
||||
After successful registration:
|
||||
- AIO sets the registered `*.dedyn.io` domain as the Nextcloud domain automatically.
|
||||
- The [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container is enabled as a reverse proxy.
|
||||
- The [dnsmasq](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) community container is enabled so that LAN devices can resolve the domain to the server's local IP. Follow the [dnsmasq documentation](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) for the required router change.
|
||||
- The mastercontainer keeps the DNS record up to date automatically when your public IP changes.
|
||||
|
||||
### How to get Nextcloud running using the ACME DNS-challenge?
|
||||
You can install AIO behind an external reverse proxy where is also documented how to get it running using the ACME DNS-challenge for getting a valid certificate for AIO. See the [reverse proxy documentation](./reverse-proxy.md). (Meant is the `Caddy with ACME DNS-challenge` section). Also see https://github.com/dani-garcia/vaultwarden/wiki/Running-a-private-vaultwarden-instance-with-Let%27s-Encrypt-certs#getting-a-custom-caddy-build for additional docs on this topic.
|
||||
|
||||
@@ -446,6 +464,8 @@ Now that this is out of the way, the recommended way how to access Nextcloud loc
|
||||
- https://dockerlabs.collabnix.com/intermediate/networking/Configuring_DNS.html
|
||||
Apart from that there is now a community container that can be added to the AIO stack: https://github.com/nextcloud/all-in-one/tree/main/community-containers/pi-hole
|
||||
|
||||
If you registered your domain via the built-in [deSEC integration](#how-to-get-a-free-domain-via-desec), the [dnsmasq](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) community container is automatically enabled and resolves your Nextcloud domain to the server's local IP for LAN clients. You only need to point your router's DHCP DNS server to the AIO host — see the [dnsmasq documentation](https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq) for details.
|
||||
|
||||
### How to overwrite the local DNS resolution for some domains or add extra hosts to the containers?
|
||||
|
||||
For some use cases, you might need to overwrite the local DNS resolution of some domains inside the containers. On Linux, you can do so either by using a local DNS server as described in the section above and add a local DNS entry into the dns server and make your containers use that DNS server.
|
||||
|
||||
@@ -104,7 +104,7 @@ To make your Nextcloud AIO instance accessible from the public Internet (not jus
|
||||
## Configuration and Deployment
|
||||
|
||||
> [!NOTE]
|
||||
> These instructions assume you already have a domain name pointing to your server's public IP address. If you don't have a domain yet, see the recommendations below.
|
||||
> These instructions assume you already have a domain name pointing to your server's public IP address. If you don't have a domain yet, AIO can register a free dynamic-DNS subdomain under `dedyn.io` for you via the built-in [deSEC integration](https://github.com/nextcloud/all-in-one#how-to-get-a-free-domain-via-desec) — no external setup needed. Alternatively, see the recommendations below.
|
||||
|
||||
### Quick overview
|
||||
|
||||
@@ -117,7 +117,7 @@ To run Nextcloud AIO behind an external reverse proxy or secure tunneling/proxyi
|
||||
The sections below provide detailed instructions for each step.
|
||||
|
||||
> [!TIP]
|
||||
> If you don't have a domain yet, we recommend using [an approach using Tailscale](https://github.com/nextcloud/all-in-one/discussions/6817). If you don't have an external reverse proxy yet, we recommend [Caddy](https://github.com/nextcloud/all-in-one/discussions/575).
|
||||
> If you don't have a domain yet, AIO can register a free `*.dedyn.io` subdomain for you via [deSEC](https://desec.io) directly from the AIO interface — see [How to get a free domain via deSEC](https://github.com/nextcloud/all-in-one#how-to-get-a-free-domain-via-desec). Alternatively, we recommend using [an approach using Tailscale](https://github.com/nextcloud/all-in-one/discussions/6817). If you don't have an external reverse proxy yet, we recommend [Caddy](https://github.com/nextcloud/all-in-one/discussions/575).
|
||||
|
||||
### Step-by-Step Instructions
|
||||
|
||||
|
||||
@@ -9,6 +9,13 @@ For the below to work, it is important that you have a domain that you point ont
|
||||
- [ ] Entering `10.0.0.1` should report that ip-addresses are not supported
|
||||
- [ ] Entering `nextcloud.com` should report that the domain does not point to this server
|
||||
- [ ] Entering the domain that does point to your server e.g. `yourdomain.com` should finally redirect you to the next screen (if you did not configure your domain yet or did not open port 443, it should report that to you)
|
||||
- [ ] Below the domain input box there should be a collapsed `<details>` element labelled **"Don't have a domain? Get a free one from deSEC"**
|
||||
- [ ] Expanding it should show a form with fields for email address and an optional subdomain slug, plus a **Register free domain via deSEC** submit button
|
||||
- [ ] Submitting with an empty email should show an error asking for a valid email address
|
||||
- [ ] Submitting with an invalid slug (e.g. `-bad-`) should show a validation error about the allowed slug format
|
||||
- [ ] Submitting with a valid email and no slug should register a random `*.dedyn.io` domain, set it as the Nextcloud domain and redirect to the next screen
|
||||
- [ ] After successful registration, the `caddy` and `dnsmasq` community containers should be listed as enabled in the Community Containers section
|
||||
- [ ] After successful registration, there should be a **deSEC account credentials** section in the AIO interface that shows the registered email and allows revealing the password
|
||||
- [ ] Now you should see a button `Start containers` and an explanation which points out that clicking on the button will start the containers and that this can take a long time.
|
||||
- [ ] Below that you should see a section `Optional addons` which shows a checkbox list with addons that can be enabled or disabled.
|
||||
- [ ] Collabora, Imaginary, Talk and Whiteboard should be enabled, the rest disabled
|
||||
|
||||
Reference in New Issue
Block a user