Merge pull request #286 from nextcloud/enh/noid/reverse-proxy-docs

add reverse proxy docs

Author: szaimen

readme.md

@@ -66,28 +66,28 @@ Included are:
     </details>
 
 4. After the initial startup, you should be able to open the Nextcloud AIO Interface now on port 8080 of this server.<br>
-E.g. https://internal.ip.of.this.server:8080<br>
+E.g. `https://internal.ip.of.this.server:8080`<br>
 If your server has port 80 and 8443 open and you point a domain to your server, you can get a valid certificate automatially by opening the Nextcloud AIO Interface via:<br>
-https://your-domain-that-points-to-this-server.tld:8443
+`https://your-domain-that-points-to-this-server.tld:8443`
+5. Please do not forget to open port `3478/TCP` and `3478/UDP` for the Talk container!
 
 ## FAQ
 ### How does it work?
 Nextcloud AIO is inspired by projects like Portainer that allow to manage the docker daemon by talking to the docker socket directly. This concept allows to install only one container with a single command that does the heavy lifting of creating and managing all containers that are needed in order to provide a Nextcloud installation with most features included. It also makes updating a breeze and is not bound to the host system (and its slow updates) anymore as everything is in containers. Additionally, it is very easy to handle from a user perspective because a simple interface for managing your Nextcloud AIO installation is provided.
 
 ### Are reverse proxies supported?
-Reverse proxies are currently because of the above mentioned architecture not supported.<br>
-You might investigate yourself though how it could made work behind reverse proxies. If you open a PR with that we might consider it then :)
+Yes. Please refer to the following documentation on this: [reverse-proxy.md](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md)
 
 ### Which ports are mandatory to be open?
 Only those (if you acces the Mastercontainer Interface internally via port 8080):
-- `443/TCP` for the Nextcloud container
+- `443/TCP` for the Apache container
 - `3478/TCP` and `3478/UDP` for the Talk container
 
 ### Explanation of used ports:
 - `8080/TCP`: Mastercontainer Interface with self-signed certificate (works always, also if only access via IP-address is possible, e.g. `https://internal.ip.address:8080/`)
 - `80/TCP`: redirects to Nextcloud (is used for getting the certificate via ACME http-challenge for the Mastercontainer)
 - `8443/TCP`: Mastercontainer Interface with valid certificate (only works if port 80 and 8443 are open and you point a domain to your server. It generates a valid certificate then automatically and access via e.g. `https://public.domain.com:8443/` is possible.)
-- `443/TCP`: will be used by the Nextcloud container later on and needs to be open
+- `443/TCP`: will be used by the Apache container later on and needs to be open
 - `3478/TCP` and `3478/UDP`: will be used by the Turnserver inside the Talk container and needs to be open
 
 ### How to run `occ` commands?

reverse-proxy.md

@@ -0,0 +1,68 @@
+## Reverse Proxy Config
+
+Basically, you need to specify the port that the apache container shall use and modify the startup command a bit.
+
+All examples below will use port `11000` as example apache port. Also it is supposed that the reverse proxy runs on the same server like AIO, hence `localhost` is used and not an internal ip-address to point to the AIO instance. Modify both to your needings.
+
+### Caddy reverse proxy config example
+
+Add this to your Caddyfile:
+
+```
+https://<your-nc-domain>:443 {
+    header Strict-Transport-Security max-age=31536000;
+    reverse_proxy localhost:11000
+}
+```
+
+Of course you need to modify `<your-nc-domain>` to the domain on which you want to run Nextcloud.
+
+### Startup command
+
+```
+# For x64 CPUs:
+sudo docker run -it \
+--name nextcloud-aio-mastercontainer \
+--restart always \
+-p 8080:8080 \
+-e APACHE_PORT=11000 \
+--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+--volume /var/run/docker.sock:/var/run/docker.sock:ro \
+nextcloud/all-in-one:latest
+```
+
+<details>
+
+<summary>Command for arm64 CPUs like the Raspberry Pi 4</summary>
+
+```
+# For arm64 CPUs:
+sudo docker run -it \
+--name nextcloud-aio-mastercontainer \
+--restart always \
+-p 8080:8080 \
+-e APACHE_PORT=11000 \
+--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+--volume /var/run/docker.sock:/var/run/docker.sock:ro \
+nextcloud/all-in-one:latest-arm64
+```
+
+</details>
+
+After doing so, you should be able to access the AIO Interface via `https://internal.ip.of.this.server:8080`. Enter your domain that you've entered in the reverse proxy config and you should be done. Please do not forget to open port `3478/TCP` and `3478/UDP` for the Talk container!
+
+### Optional
+
+If you want to also access your AIO interface publicly with a valid certificate, you can add e.g. the following config to your Caddyfile:
+
+```
+https://<your-nc-domain>:8443 {
+    reverse_proxy https://localhost:8080 {
+        transport http {
+            tls_insecure_skip_verify
+        }
+    }
+}
+```
+
+Of course you also need to modify `<your-nc-domain>` to the domain that you want to use. Afterwards should the AIO interface be accessible via `https://<your-nc-domain>:8443`.