Cannot login to opencloud behind external reverse proxy. Authentication issues?

[despens]

Hello all,

I have successfully installed opencloud with the docker compose technique, but am not using traefik to expose it to the open web; instead I'm exposing it to my organization's VPN using tailscale services, a reverse proxy that I have been using for other projects without fail.

This is similar to the case described under behind external proxy in the opencloud admin docs, just the outside proxy's certificates are not available. For this reason I did set INSECURE=true in the .env file already.

All endpoinds (opencloud, collabora, and wopiserver) respond to https requests as expected, but the initial login with the admin password is not working. After submitting the login form I see the following messages on the browser console:

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'unsafe-inline' https://keycloak.opencloud.test/” (Missing 'unsafe-eval')

I am wondering why keycloak is involved here, as keycloak is not part of the recommended minimal setup in the .env.example file, see https://github.com/opencloud-eu/opencloud-compose/blob/main/.env.example#L22. I was under the impression that libegraph idm was used in absence of Keycloak. Am I misunderstanding this and keycloak (or another identity service) is mandatory?

I'm using these compose files:

COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.>

The next two error appearing are

AxioError 1

{
  "message": "Request failed with status code 401",
  "name": "AxiosError",
  "stack": "ws@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:1080\nq@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5701\nEventHandlerNonNull*Oa</<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5771\nOa<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5099\nrs@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:5:513\npromise callback*_request@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:1316\nrequest@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:5:1977\ns/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:1926\ncs/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:1:329\ninternalRequestWithData@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:6:48435\npost@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:6:47882\nfetchRoles@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:44600\nfetchUserInfo@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:44057\nasync*updateContext/this.updateAccessTokenPromise<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43739\nupdateContext@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43848\ninitializeContext@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:53140\nasync*gF/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:66979\nHe/</</l<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14192\no@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:13928\nHe/</<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14185\nHe/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14000\nrunWithContext@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:16743\nF@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20231\nXl/se/</<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23274\npromise callback*Xl/se/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23264\nse@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23248\nXl/V/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20525\npromise callback*V@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20451\nL@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19827\np@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19193\n\nasync*s/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:1926\ncs/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:1:329\ninternalRequestWithData@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:6:48435\npost@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:6:47882\nfetchRoles@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:44600\nfetchUserInfo@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:44057\nasync*updateContext/this.updateAccessTokenPromise<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43739\nupdateContext@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43848\ninitializeContext@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:53140\nasync*gF/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:66979\nHe/</</l<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14192\no@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:13928\nHe/</<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14185\nHe/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:14000\nrunWithContext@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:16743\nF@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20231\nXl/se/</<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23274\npromise callback*Xl/se/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23264\nse@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:23248\nXl/V/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20525\npromise callback*V@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20451\nL@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19827\np@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19193\nk@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19219\nbF/r/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:67872\nsignInCallback@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:54191\nasync*setup/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:59263\nwn/</<@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:7484\nio@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:1385\nUr@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:1458\nru/t.__weh@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:7365\nda@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:2966\nIb@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:3275\npromise callback*Ob@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:2464\nRh@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:13:2433\noo/a.scheduler@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:32227\nZT/u.scheduler<@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:16646\ntrigger@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:2162\nAh@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:2577\nnotify@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:5184\ntrigger@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:5078\nset value@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:9:13645\nB@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:21298\nXl/L/<@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:20022\npromise callback*L@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19883\np@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:19193\ninstall@https://drive.<mydomain>/js/chunks/SpaceInfo-C13re01H.mjs:11:22930\nuse@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:14:16133\nTO@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:135644\nasync*init/window.runtimeLoaded@https://drive.<mydomain>/web-oidc-callback?code=oShlDO3jjBRXbWfXc6JO3H87c57fPPeJ&scope=openid%20profile%20email&session_state=b64a3872787b6402a62289606d4d505ff75b46120cba62270cff512b9963a811.z5AV3uhNxV2Du7lmekZ9U3XLZdS2kV62FCpXu1hOFVA&state=b2f4f9740e6e4bc1821c639e2f08ec90:174:21\n@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:137591\n",
  "config": {
    "transitional": {
      "silentJSONParsing": true,
      "forcedJSONParsing": true,
      "clarifyTimeoutError": false
    },
    "adapter": [
      "xhr",
      "http",
      "fetch"
    ],
    "transformRequest": [
      null
    ],
    "transformResponse": [
      null
    ],
    "timeout": 0,
    "xsrfCookieName": "XSRF-TOKEN",
    "xsrfHeaderName": "X-XSRF-TOKEN",
    "maxContentLength": -1,
    "maxBodyLength": -1,
    "env": {},
    "headers": {
      "Accept": "application/json, text/plain, */*",
      "Content-Type": "application/json",
      "Initiator-ID": "bba0bb57-75fb-4345-9e22-32cf6ccfcd6c",
      "X-Requested-With": "XMLHttpRequest",
      "Accept-Language": "en",
      "X-Request-ID": "e4364f59-e840-4209-92c2-c562426b5235",
      "Authorization": "Bearer <token>"
    },
    "baseURL": "https://drive.<mydomain>/",
    "cancelToken": {
      "promise": {},
      "_listeners": []
    },
    "method": "post",
    "url": "/api/v0/settings/roles-list",
    "data": "{}",
    "allowAbsoluteUrls": true
  },
  "code": "ERR_BAD_REQUEST",
  "status": 401
}

AxiosError 2

{
  "message": "Request failed with status code 401",
  "name": "AxiosError",
  "stack": "ws@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:1080\nq@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5701\nEventHandlerNonNull*Oa</<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5771\nOa<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:3:5099\nrs@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:5:513\npromise callback*_request@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:1316\nrequest@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:5:1977\ncs/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:1:329\nV/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:6481\nRt/getOwnUser/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:68016\npi/getOwnUser/<@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:68272\npromise callback*getOwnUser@https://drive.<mydomain>/js/chunks/resources-Bx5BQCdP.mjs:6:68263\ngetMe@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:6:10981\nfetchUserInfo@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:44044\nasync*updateContext/this.updateAccessTokenPromise<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43739\nupdateContext@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:43848\ninitializeContext/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:52101\nraise@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:25577\nload@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:72606\nasync*_buildUser@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:82008\nasync*_signinEnd@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:81617\nasync*_signinEnd@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:45183\n_signin@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:81046\nasync*signinSilent@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:78494\nasync*initializeContext/<@https://drive.<mydomain>/js/index.html-BPKFcxtw.mjs:37:51689\nraise@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:25577\nta/this._callback@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:26391\nsetInterval handler*init@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:26788\nload@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:28471\nload@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:72572\n_buildUser@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:82008\nasync*_signinEnd@https://drive.<mydomain>/js/chunks/PortalTarget.vue_vue_type_script_lang-yDq2u1lj.mjs:83:81617\n",
  "config": {
    "transitional": {
      "silentJSONParsing": true,
      "forcedJSONParsing": true,
      "clarifyTimeoutError": false
    },
    "adapter": [
      "xhr",
      "http",
      "fetch"
    ],
    "transformRequest": [
      null
    ],
    "transformResponse": [
      null
    ],
    "timeout": 0,
    "xsrfCookieName": "XSRF-TOKEN",
    "xsrfHeaderName": "X-XSRF-TOKEN",
    "maxContentLength": -1,
    "maxBodyLength": -1,
    "env": {},
    "headers": {
      "Accept": "application/json, text/plain, */*",
      "Initiator-ID": "77a1f71e-268e-49a4-9541-577013c85116",
      "X-Requested-With": "XMLHttpRequest",
      "Accept-Language": "en",
      "X-Request-ID": "dddf6bc9-ed58-4f89-9178-acefef81356c",
      "Authorization": "Bearer <token>"
    },
    "method": "get",
    "url": "https://drive.<mydomain>/graph/v1.0/me?%24expand=memberOf",
    "allowAbsoluteUrls": true
  },
  "code": "ERR_BAD_REQUEST",
  "status": 401
}

It looks like a POST request to /api/v0/settings/roles-list and a GET request to https://drive.<mydomain>/graph/v1.0/me?%24expand=memberOf failed with HTTP Error 401 (unauthorized).

The opencloud docker container's log for the login request:

docker log

{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001457","traceid":"002abe18799fcb2267ae7db8c5bca44c","remote-addr":"<ipv6>:5712","method":"GET","status":302,"path":"/signin/v1/identifier/_/authorize","duration":29.409651,"bytes":0,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001459","traceid":"e948b59987fce7388aa16b0bac7a0b73","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/oidc-callback.html","duration":0.668173,"bytes":384,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001461","traceid":"79deb89d96576bda28e4de1999a6e9cf","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/web-oidc-callback","duration":1.217225,"bytes":3335,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"f9e51da5-7232-4b83-aa23-8083bd0f43e5","traceid":"f84fb20ff70572f22a2b6a303a5a4e3f","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/config.json","duration":0.357444,"bytes":332,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001463","traceid":"bc486e7732f4c05f5097ad2c6c06c049","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/favicon.ico","duration":0.639134,"bytes":3335,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"3e618b62-d2e5-4ef9-9feb-d960c0d02540","traceid":"1dc69edfe1b7a3e64ba8747cb18c923f","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/themes/opencloud/theme.json","duration":0.762077,"bytes":4416,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"frontend","host.name":"c9ce4829984f","pkg":"rhttp","traceid":"d1cef7717bce335f9f35b71deb62dff1","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/reva/v2@v2.39.1/internal/http/interceptors/auth/auth.go:195","message":"skipping auth check for: /app/list"}
{"level":"warn","service":"frontend","host.name":"c9ce4829984f","pkg":"rhttp","traceid":"d1cef7717bce335f9f35b71deb62dff1","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/reva/v2@v2.39.1/internal/http/interceptors/auth/auth.go:248","message":"core access token not set"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"66a22750-0d85-49b0-9dd2-acedfcaf7352","traceid":"4d0f231527c7f9fa6e9c4804fdb9a320","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/app/list","duration":1.012024,"bytes":17,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001465","traceid":"832e3d579077340b298b8bad62ebf949","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/.well-known/openid-configuration","duration":0.272309,"bytes":1837,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c9ce4829984f/zmdIDLbuCb-001467","traceid":"c8c0dc65a186c96ccb101cf1c252b900","remote-addr":"<ipv6>:5712","method":"POST","status":200,"path":"/konnect/v1/token","duration":9.92994,"bytes":2461,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://drive.<mydomain>/.well-known/openid-configuration\": dial tcp: lookup drive.<mydomain> on 127.0.0.11:53: no such host","authenticator":"oidc","path":"/ocs/v1.php/cloud/capabilities","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0","client.address":"<ipv6>:5712","network.peer.address":"","network.peer.port":"","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
{"level":"info","service":"frontend","host.name":"c9ce4829984f","pkg":"rhttp","traceid":"339b5185c4c9a35815c2559965800643","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/reva/v2@v2.39.1/internal/http/interceptors/auth/auth.go:195","message":"skipping auth check for: /ocs/v1.php/cloud/capabilities"}
{"level":"warn","service":"frontend","host.name":"c9ce4829984f","pkg":"rhttp","traceid":"339b5185c4c9a35815c2559965800643","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/reva/v2@v2.39.1/internal/http/interceptors/auth/auth.go:248","message":"core access token not set"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"979b6447-236a-4604-943f-3b2b54c7d0c1","traceid":"a2af341376a9f6cec9e32b8e8618b183","remote-addr":"<ipv6>:5712","method":"GET","status":200,"path":"/ocs/v1.php/cloud/capabilities","duration":3.308558,"bytes":3281,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://drive.<mydomain>/.well-known/openid-configuration\": dial tcp: lookup drive.<mydomain> on 127.0.0.11:53: no such host","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0","client.address":"<ipv6>:5712","network.peer.address":"","network.peer.port":"","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"d2467d94-3f78-48ea-ac8b-7838b0c59bd9","traceid":"2c43455e867153203dd50ce9540f5b5f","remote-addr":"<ipv6>:5712","method":"POST","status":401,"path":"/api/v0/settings/roles-list","duration":2.127012,"bytes":0,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://drive.<mydomain>/.well-known/openid-configuration\": dial tcp: lookup drive.<mydomain> on 127.0.0.11:53: no such host","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0","client.address":"<ipv6>:5712","network.peer.address":"","network.peer.port":"","time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"2e69d457-6bb7-4d2b-aead-07d0d071e2ad","traceid":"31ab4afd889dd12d751a716ec4720b4c","remote-addr":"<ipv6>:5712","method":"GET","status":401,"path":"/graph/v1.0/me","duration":2.389554,"bytes":0,"time":"2025-11-01T07:00:39Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://drive.<mydomain>/.well-known/openid-configuration\": dial tcp: lookup drive.<mydomain> on 127.0.0.11:53: no such host","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0","client.address":"<ipv6>:5712","network.peer.address":"","network.peer.port":"","time":"2025-11-01T07:00:53Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
{"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"c058c5f1-1fda-4cfc-beaa-92323b5a939c","traceid":"ae8b0d26a2702d2e9ef0fdc4cecaea5f","remote-addr":"<ipv6>:5712","method":"GET","status":401,"path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","duration":2.817524,"bytes":0,"time":"2025-11-01T07:00:53Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}

I'd be grateful for any hint about what might be wrong in my setup. Would love to switch my organization to a more reliable self-hosted file storage service than the one we're using right now.

[micbar]

The used components are defined in COMPOSE_FILE=

How did you set that?

[despens]

The COMPOSE_FILE variable is set in the .env file.

[RobertFischer4Merck]

Hi,

same issue for similar setup here. Using nginx as reverse proxy configured as suggested at https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy (yet only for OpenCloud with self-signed certificate, since only internal file sharing is needed) and the variables set at .env :

INSECURE=true
COMPOSE_FILE=docker-compose.yml:external-proxy/opencloud.yml
OC_DOMAIN=share.intern

I cannot login, and the button 'Log in again' redirects to 'Not logged in'.

The docker log notes: opencloud-1 | {"level":"error","service":"proxy","error":"failed to verify access token: Get "https://share.intern/.well-known/openid-configuration\": dial tcp: lookup share.intern on 127.0.0.11:53: no such host","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (X11; Linux x86_64)

At the browser I also get the "POST https://share.intern/api/v0/settings/roles-list 401 (Unauthorized)" followed by
message: 'Request failed with status code 401', name: 'AxiosError', code: 'ERR_BAD_REQUEST',...
and then "GET https://share.intern/graph/v1.0/me?%24expand=memberOf 401 (Unauthorized)" followed by the same 'AxiosError'.

Is it possible that the authentication process tries to find something on the host server that actually should be inside the container (share.intern on 127.0.0.11:53)?

Help is appreciated, please let me know if I can provide more details.

[iamdangry]

For me, the solution was setting an alias on my NGINX container. The OpenCloud container wasn't resolving the domain set in OC_DOMAIN and if I tried to run curl <OC_DOMAIN> from within the OpenCloud container, it would timeout. After setting an alias, all came good.

[micbar]

Yes. The alias is important.

[RobertFischer4Merck]

Could you please share where to set what alias?

[iamdangry]

I set an alias on the reverse proxy container itself. For example:

services:
  nginx:
    image: nginx:latest
    restart: unless-stopped
    ports:
      - 8080:80
    networks:
      frontend:
        aliases:
          - <opencloud domain>
networks:
  frontend:
    external: true

[RobertFischer4Merck]

Thanks for the fast reply. To my understanding, the alias should behave exactly as the server_name in the configuration below - or am I missing some container specifics here? The error still persists.

[RobertFischer4Merck]

Thanks for the fast reply! Indeed, I get "Could not resolve host: share.intern" for both curl share.intern and curl https://share.intern. I'm using nginx installed via APT, i.e. not in a container. Sorry, where and how should I set which alias?

# Open Cloud fileserver
server {

    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    server_name  share.intern;
    access_log off;
    error_log /var/log/nginx/shareIntern.error.log;

    location / {
        proxy_pass http://127.0.0.1:9200;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    ssl_certificate     cert/shareIntern.pem;
    ssl_certificate_key cert/shareIntern.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:1m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;
    add_header Strict-Transport-Security "max-age=63072000" always;
}

[RobertFischer4Merck]

Adding 127.0.0.1 share.intern to etc/hosts seems to have changed something, but I still get the error "Failed to load resource: the server responded with a status of 401 ()" for both api/v0/settings/roles-list:1 and
index.html-BCJ7E1CT.mjs:37 E. I thus guess that's not the alias you meant?

[RobertFischer4Merck]

One more info, if helpful: When deleting browser data and going back to login page (not yet entered anything), the console says: Kopano Identifier build version: 0.0.0-no-proper-build. After entering admin/pwd the errors above appear, incl. the 'AxiosError'

[despens]

Thanks all for pointing out this might be DNS related.

In the docker-compose.yml I added

services:
  opencloud:
    extra_hosts:
      - "drive.<mydomain>:127.0.0.1"

...and could verify that indeed the docker error message has changed to contain that IP address:

opencloud-1      | {"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://drive.<mydomain>/.well-known/openid-configuration\": dial tcp 127.0.0.1:443: connect: connection refused","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","client.address":"fd7a:115c:a1e0::9c01:a46c","network.peer.address":"","network.peer.port":"","time":"2025-11-14T11:25:42Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}

This looks like OpenCloud assumes consistent DNS inside and outside of the docker network and the container. When using a VPN that's not necessarily the case, and IP addresses might even not be existing inside a container that the host has access to.

The docker host is part of the VPN with its own VPN-specific DNS, the docker container has its own DNS with doesn't know about the VPN... and probably shouldn't have to know. It makes little sense for a tool inside a container to talk to itself or its dockerized components using a service's public DNS name. It should use the names internal to the docker network.

Am I right assuming that OpenCloud uses the configured OC_DOMAIN environment variable for internal API calls? If that's the case I would need to add every containerized component I'd like to use to the VPN.