To start, I am very new to all this so probably just have some misunderstandings of how things work. Like a lot of people, I used SpaceInvader One's tutorial on getting my unraid server setup to run nextcloud behind SWAG with my connections routing through cloudflare.

 

Everything works great through that path internally and externally, however my issue is when I am on my LAN and try to upload files to my nextcloud, I am limited to the speeds through cloudflare/my ISP - windows performance monitor is showing 8Mbits/s send, unraid shows peaks of 60Mbits/s receive on the NIC. I tested the LAN speeds from my desktop to my server using IPerf and am getting my expected 900+ Mbits/s speeds (yes, Mbits/s not MB/s)

 

Here's a breakdown of my setup:

 

Unraid 6.10.3

Linuxserver's SWAG docker

Linuxserver's Nextcloud docker

Linuxserver's MariaDB docker

selfhoster's Cloudflare-DDNS docker

Spant's Pihole Docker

 

I have port 443 access turned off on my unraid server and connect to it locally only over port 80 (http).

My SWAG uses unraidIP:1443 and unraidIP:180

My nextcloud uses unraidIP:444

mariaDB uses unraidIP:3306

Pihole is on a static IP in the same subnet as unraidIP, let's call it PiholeIP.

 

I have my own domain from google domains linked to cloudflare. Cloudflare has a 'A' record for my public IP (which is updated using the Cloudflare-DDNS docker I believe) and then I have a CNAME pointing to that and I am able to successfully connect to my nextcloud using that xyz.domain.com. Both the A record and CNAME record are proxied on cloudflare (it was the only way I could get it to work when initially setting it up). SSL/TLS is set to Full (Strict) and I enabled HSTS. When I connect to xyz.domain.com the certificate is being provided by cloudflare (so not LetsEncrypt).

 

My router forwards port 443 to SWAG at unraidIP:1443. I do not port forward port 80. SWAG is routed through cloudflare (through the config files I believe?). SWAG is then connected to my nextcloud. I have nextcloud and swag on a custom docker network ('proxynet') so they can talk to each other without having to dig deeper into config files. I did change SWAG to use 'Modern configuration' (e.g. TLSv1.3) instead of 'intermediate configuration' in the ssl.conf as I don't need older browser support.

 

This is where my knowledge gets fuzzy and I'm kinda just throwing mud at a wall at this point...I think I have to setup a 'split-brain DNS'...

 

I tried changing my nextcloud to unraidIP:443 and then using Pihole (which is setup and working nicely right now) to create a DNS record that directs me to unraidIP, however when I do this I get "“Privacy error: Your connection is not private” (NET::ERR_CERT_AUTHORITY_INVALID)"

 

If I try going to unraidIP:443 locally, my router forwards that request to SWAG (port 1443) which then overwrites(?) that request to xyz.domain.com and sends me back through cloudflare. So I have not tried setting nextcloud back to port 444 and using port 443 for SWAG as I believe I would get the same result anyway?

 

Which leads me to believe this is all a problem with cloudflare certificates or SWAG. 

 

I don't know if it's possible to get the certificate from cloudflare and install it somewhere so that local access is allowed (since my SSL/TLS is set to Full [Strict] ) or if there's something in the SWAG config that I can edit so that it sends requests through cloudflare only if it is a request from outside the network? My router is a basic D-link one so I don't have much in the way of firewall rules (that I can find) I seem to only be able to allow or deny WAN to LAN / LAN to WAN requests there.

 

Plz send help.

Heya!

 

Did you ever figure this out?

12 hours ago, bucketphobia said:

Heya!

 

Did you ever figure this out?

No news is good news.... Usually

@bucketphobia

 

Super late response. Sorry I never come on here.

I did actually figure it out eventually, however I can't recall off the top of my head exactly how.

Pretty sure it was one of two things (or both):

 

 

1. Changed my SWAG instance to run on port 443 instead of port 1443 - something funky was going on there, I think it was something to do with Pihole not working with DNS records to a different port.

 

2. Added my unraid server IP address to the resolver.conf file in /mnt/user/appdata/swag/nginx (Although I think this was actually from me trying to get hostnames on Pihole...fairly certain it was solution 1)

Edited July 14, 20232 yr by HurracaineIke
Changed bullet points slightly to point to what I believe is the correct solution more clearly

Thinking about it more and I definitely think point 1 was the solution.

When you make the request to go to your domain it will be https (port 443) and pretty sure pihole takes that right away before it can get to your router (which would forward to port 1443). So then the request is going to your server at port 443 (instead of 1443) and thus you cannot connect to nextcloud directly.

 

I couldn't find a way in pihole configs to forward 443 requests to 1443 with DNS records so setting swag to 443 fixed the issue if I recall correctly.

Hey @HurracaineIke,

 

No worries at all, same!

 

Yeah, that was the solution I settled on as well sometime after making the post. I moved unraid to IP 1443, SWAG to 443 and pihole redirected mydomain.com to [unraid local IP]

 

Works like a charm.

 

Appreciated for the response

It's good that you found a solution that worked for you.