Update Nextcloud AIO configuration for IP binding and add middleware for secure headers

nextcloud-docker-compose.yaml

@@ -22,7 +22,7 @@ services:
     environment: # Is needed when using any of the options below
       AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
       APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+      APACHE_IP_BINDING: 127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       APACHE_ADDITIONAL_NETWORK: traefik-proxy # (Optional) Connect the apache container to an additional docker network. Needed when behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) running in a different docker network on same server. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
       COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature

traefik/dynamic/services.yml

@@ -43,14 +43,16 @@ http:
     # Nextcloud Main
     nextcloud:
       rule: "Host(`nextcloud.workstation`)"
-      entryPoints:
+      entrypoints:
         - websecure
       service: nextcloud
+      middlewares:
+        - nextcloud-chain
       tls: {}
 
     # Dockmon
     dockmon:
-      rule: "Host(`workstation`)"
+      rule: "Host(`dcokmon.workstation`)"
       entryPoints:
         - websecure
       service: dockmon
@@ -94,7 +96,7 @@ http:
           - url: "http://adguardhome:3000"
 
     # Nextcloud AIO Interface
-    nextcloud-aio:
+    nextcloud:
       loadBalancer:
         servers:
           - url: "https://nextcloud-aio-mastercontainer:8080"
@@ -103,7 +105,7 @@ http:
     nextcloud:
       loadBalancer:
         servers:
-          - url: "https://nextcloud-aio-mastercontainer:8443"
+          - url: "http://localhost:11000"
 
     # Dockmon
     dockmon:
@@ -145,4 +147,16 @@ http:
         stsIncludeSubdomains: true
         stsPreload: true
         stsSeconds: 31536000
-        customFrameOptionsValue: "SAMEORIGIN"
+        customFrameOptionsValue: "SAMEORIGIN"
+
+    # nextcloud-secure-headers:
+    #   headers:
+    #     hostsProxyHeaders:
+    #       - "X-Forwarded-Host"
+    #     referrerPolicy: "same-origin"
+
+    nextcloud-chain:
+      chain:
+        middlewares:
+          - redirect-https
+          # - nextcloud-secure-headers