OpenCloud behind Caddy Reverse Proxy: Login not possible

[daaho]

I installed OpenCloud with the documentation from OpenCloud Compose behind an existing Caddy Reverse Proxy.

Trying to log on, I get the following error message:

In the error log I can see that OpenCloud tries to connect to port 443, but the service is running on port 9200

How can I correct this behavior ?

Error log from Docker container opencloud-test

opencloud-test | {"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://opencloud-test.meineadresse.de/.well-known/openid-configuration\": dial tcp 127.0.0.1:443: connect: connection refused","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","client.address":"109.40.176.212","network.peer.address":"","network.peer.port":"","time":"2025-06-11T11:22:57Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}

Configuration files

.env

COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml OC_DOMAIN=opencloud-test.meineadresse.de OC_CONFIG_DIR=opencloud-test-config OC_DATA_DIR=opencloud-test-data

docker-compose.yml

services: opencloud-test: container_name: opencloud-test hostname: opencloud-test image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest} # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog # release notes: https://docs.opencloud.eu/opencloud_release_notes.html networks: backend-test: extra_hosts: # how to avoid hardcoding traefik container IP here? - opencloud-test.meineadresse.de:127.0.0.1

Caddyfile

opencloud-test.meineadresse.de {
        reverse_proxy opencloud-test:9200
}

[micbar]

Get "https://opencloud-test.meineadresse.de/.well-known/openid-configuration\"

This is important because it uses the public oidc endpoint in the same way like from the public network. This is needed by the openid spec, because a user is always identified by the sub@issuer pattern. Issuer is the public OpenIDConnect Provider which always needs to be https and have a valid certificate.

so please make sure that the openCloud container can resolve its own public domain.

[daaho]

The access to https://opencloud-test.meineadresse.de/.well-known/openid-configuration is working now.

I added a rule to iptables, to allow access from the containers to the host.

Check for the Network ID of the network for OpenCloud (In my case backend-test)

docker network list
NETWORK ID     NAME           DRIVER    SCOPE
afbfd3ffe90b   backend        bridge    local
201c804e007d   backend-test   bridge    local
86328f7f5391   bridge         bridge    local
ed66c0cdc8b7   host           host      local
a27fe44ec0a5   none           null      local
452236264ec0   proxy          bridge    local

Find the bridge name for Network ID 201c804e007d

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gw.contabo.com  0.0.0.0         UG    0      0        0 eth0
123.123.123.0    0.0.0.0         255.255.240.0   U     0      0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-452236264ec0
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-afbfd3ffe90b
172.20.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-201c804e007d

Add the rule to iptables:
iptables -A INPUT -i br-201c804e007d -j ACCEPT