Need help with AIO reverse proxy and premade certs. "Domain does not point to this server or the reverse proxy is not configured correctly", "connection reset by peer", "aborting with incomplete response"

[FreSchNDE]

Hey there!

I need help getting my Nextcloud AIO setup running with an reverse proxy and prefabricated SSL/TSL certificates.

I'm currently trying to set up NC AIO on my Ubuntu machine running docker engine. I have a domain pointing to my device (using DNS Exit, link) with ports 80 TCP/UDP, 443 TCP/UDP, 3478 TCP/UDP and 8443 TCP open.

My current machine is staging for a "production" (university) environment, where I'll need to use the provided SSL/TSL certificates and where the instance won't be natively reachable from the outside. In order to use the certificates for my domain, I set up a reverse proxy Caddy container and instructed it to use the certificates for my "testing" domain, which I've downloaded from the DNS Exit SSL feature.

The AIO Interface is reachable without problems, however I can't create new instances. The UI returns:
Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')
These are the relevant log entries:

nextcloud-aio-mastercontainer | NOTICE: PHP message: The response of the connection attempt to "https://mydomain.com:443" was:
nextcloud-aio-mastercontainer | NOTICE: PHP message: Expected was: c596cbaaae6122f487bf35ac059792251a7e45527bd6e9fc
nextcloud-aio-mastercontainer | NOTICE: PHP message: The error message was: SSL certificate problem: unable to get local issuer certificate

My compose file looks like this:

services:
  nextcloud:
    image: nextcloud/all-in-one:latest
    restart: unless-stopped
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 8080:8080
    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=127.0.0.1
      - NEXTCLOUD_DATADIR=${PWD}/app/nextcloud/data
      - NEXTCLOUD_TRUSTED_CACERTS_DIR=${PWD}/certs/issuer
    depends_on:
      - caddy

  caddy:
    image: caddy:alpine
    restart: unless-stopped
    container_name: caddy
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./certs:/certs
      - ./app/caddy/config:/config
      - ./app/caddy/data:/data
      - ./app/caddy/sites:/srv
    network_mode: host

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer 

And my Caddyfile like this:

https://**mydomain.com**:443 {
	tls /certs/cert.pem /certs/key.pem
	header Strict-Transport-Security max-age=31536000
	reverse_proxy localhost:11000
}

https://**mydomain.com**:8443 {
	reverse_proxy https://localhost:8080 {
		transport http {
			tls_insecure_skip_verify
		}
	}
}

./certs contains the SSL .cer and .key files, which I've renamed to .pem
./certs/issuer contains the SSL intermediate CA file (ca.cer)
ca cert.zip

When I now add: - SKIP_DOMAIN_VALIDATION=true, I can create an instance and access it. My browser seems to natively trust the CA, I don't need to add an exemption when opening https://**mydomain.com**:443. At startup, Caddy generates these logs:

caddy                          | {"level":"info","ts":1688919146.2423682,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
caddy                          | {"level":"info","ts":1688919146.2434661,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
caddy                          | {"level":"info","ts":1688919146.2436128,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00037d500"}
caddy                          | {"level":"info","ts":1688919146.24409,"logger":"http","msg":"skipping automatic certificate management because one or more matching certificates are already loaded","domain":"mydomain.com","server_name":"srv1"}
caddy                          | {"level":"info","ts":1688919146.2440958,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv1"}
caddy                          | {"level":"info","ts":1688919146.244102,"logger":"http","msg":"skipping automatic certificate management because one or more matching certificates are already loaded","domain":"mydomain.com","server_name":"srv0"}
caddy                          | {"level":"info","ts":1688919146.2441034,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
caddy                          | {"level":"info","ts":1688919146.244309,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/data/caddy"}
caddy                          | {"level":"info","ts":1688919146.2443137,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
caddy                          | {"level":"info","ts":1688919146.2443495,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Receive-Buffer-Size for details."}
caddy                          | {"level":"info","ts":1688919146.2443914,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
caddy                          | {"level":"info","ts":1688919146.244411,"logger":"http","msg":"enabling HTTP/3 listener","addr":":8443"}
caddy                          | {"level":"info","ts":1688919146.2444432,"logger":"tls","msg":"finished cleaning storage units"}
caddy                          | {"level":"info","ts":1688919146.244447,"logger":"http.log","msg":"server running","name":"srv1","protocols":["h1","h2","h3"]}
caddy                          | {"level":"info","ts":1688919146.2444694,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
caddy                          | {"level":"info","ts":1688919146.244697,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
caddy                          | {"level":"info","ts":1688919146.2447062,"msg":"serving initial configuration"}

But after I start the instance setup through the AIO interface, I get errors:

caddy                          | {"level":"error","ts":1688919187.6066227,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:11000: connect: connection refused","request":{"remote_ip":"31.17.72.161","remote_port":"39630","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Sun, 09 Jul 2023 16:13:07"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"mydomain.com"}},"duration":0.000197395,"status":502,"err_id":"rijpzujh7","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1688919247.7582278,"logger":"http.log.error","msg":"read tcp 127.0.0.1:55948->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"45852","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Sun, 09 Jul 2023 16:14:07"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"mydomain.com"}},"duration":0.001094415,"status":502,"err_id":"g0f2pwmpw","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1688919271.6634758,"logger":"http.log.error","msg":"read tcp 127.0.0.1:40772->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"59504","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"Accept-Encoding":["gzip"],"User-Agent":["Nextcloud Server Crawler"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.000820279,"status":502,"err_id":"92in5qbkp","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1688919271.9960184,"logger":"http.log.error","msg":"read tcp 127.0.0.1:40776->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"59510","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"Accept-Encoding":["gzip"],"User-Agent":["Nextcloud Server Crawler"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.000701417,"status":502,"err_id":"dmqyxeaae","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1688919272.3412735,"logger":"http.log.error","msg":"read tcp 127.0.0.1:40784->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"59526","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.000824416,"status":502,"err_id":"g2zn5hpdn","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}

The nextcloud-aio-nextcloud container also generates errors:

User required to trust additional CA certificates, running 'update-ca-certificates.'
WARNING: ca-cert-ca.cer.pem does not contain exactly one certificate or CRL: skipping
+ '[' -f /dev-dri-group-was-added ']'
++ find /dev -maxdepth 1 -mindepth 1 -name dri
+ '[' -n '' ']'
+ set +x

and:

Activating collabora config...
Failed to activate any config changes
cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://mydomain.com/hosting/discovery

Even though it semms to be possible to use Nextcloud on a surface level despite these errors, collabora unfortunately does not work.

The nextcloud-aio-collabora container prints this:

Ready to accept connections on port 9980.

wsd-00001-00023 2023-07-09 18:13:07.614320 +0200 [ remotefontconfig_poll ] ERR  Remote config server has response status code: Bad Gateway| wsd/COOLWSD.cpp:1173
wsd-00001-00023 2023-07-09 18:14:07.765900 +0200 [ remotefontconfig_poll ] ERR  Remote config server has response status code: Bad Gateway| wsd/COOLWSD.cpp:1173

The nextcloud-aio-apache logs look normal:

Waiting for Nextcloud to start...
[Sun Jul 09 18:14:36.743273 2023] [mpm_event:notice] [pid 74:tid 139849853553480] AH00489: Apache/2.4.57 (Unix) configured -- resuming normal operations
[Sun Jul 09 18:14:36.743305 2023] [core:notice] [pid 74:tid 139849853553480] AH00094: Command line: '/usr/local/apache2/bin/httpd -D FOREGROUND'
{"level":"info","ts":1688919276.7482188,"msg":"using provided configuration","config_file":"/Caddyfile","config_adapter":""}

Can you help me to configure my setup correctly so that I can omit - SKIP_DOMAIN_VALIDATION=true and get Collabora to work?

[Zoey2936]

are you sure that you need: NEXTCLOUD_TRUSTED_CACERTS_DIR=${PWD}/certs/issuer?

[FreSchNDE]

Thank you for your quick answer! I've reset everything according to the readme and removed NEXTCLOUD_TRUSTED_CACERTS_DIR (But kept SKIP_DOMAIN_VALIDATION=true) but sadly still get these logs at (AIO related) container initialization:

caddy                          | {"level":"error","ts":1689085435.3061635,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:11000: connect: connection refused","request":{"remote_ip":"31.17.72.161","remote_port":"38766","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Tue, 11 Jul 2023 14:23:55"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"mydomain.com"}},"duration":0.0002592,"status":502,"err_id":"u6a70ac4w","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1689085495.5953674,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:11000: connect: connection refused","request":{"remote_ip":"31.17.72.161","remote_port":"60394","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"],"Date":["Tue, 11 Jul 2023 14:24:55"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"mydomain.com"}},"duration":0.00025973,"status":502,"err_id":"qxj967s4u","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1689085555.7410378,"logger":"http.log.error","msg":"read tcp 127.0.0.1:34194->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"48708","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Tue, 11 Jul 2023 14:25:55"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"mydomain.com"}},"duration":0.000586437,"status":502,"err_id":"ax2n32yen","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1689085556.3691223,"logger":"http.log.error","msg":"read tcp 127.0.0.1:34202->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"42970","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.000654558,"status":502,"err_id":"0qfkdzzaq","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1689085556.6958697,"logger":"http.log.error","msg":"read tcp 127.0.0.1:34208->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"42978","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.001066309,"status":502,"err_id":"bmu0msvfc","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                          | {"level":"error","ts":1689085557.0148594,"logger":"http.log.error","msg":"read tcp 127.0.0.1:34212->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"31.17.72.161","remote_port":"42982","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"mydomain.com"}},"duration":0.000966876,"status":502,"err_id":"m8uarhx4k","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}

This also didn't fix Collabora, which prints the same errors as mentioned above at container startup.

I've taken a look at #1358 and enabled Disable certificate verification (insecure) in the Collabora settings (https://mydoamin.com/settings/admin/richdocuments ), which made it work instantly (But didn't affect the caddy / Nextcloud Server Crawler errors). However, I'm not sure if this is secure for "production" use. The logs I have shared lead me to believe that the issues I'm having are caused by my certificates. I would be happy to share further logs in order to find out what's wrong with my certificates / setup if I could be told where to look.

Since this seems to be a certificate issue, and I'll be using different certificates for the university deployment, I’m going to try out the provided certs on site and will report back with my findings.

[FreSchNDE]

Hey,
so I've got the "production" environment up and running with the SSL certs from my university. I don't get the SSL certificate problem(s) from the AIO container anymore and have set SKIP_DOMAIN_VALIDATION=false.

I can now initialize instances that seem to be working correctly (Collabora etc. included), however I still get traffic errors from caddy:

E.g., these directly after instance initialization:
(connection reset by peer / Nextcloud Server Crawler)

caddy                      	| {"level":"error","ts":1689375942.33316,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:11000: connect: connection refused","request":{"remote_ip":"172.19.0.3","remote_port":"44292","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Fri, 14 Jul 2023 23:05:42"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"myunidomain.com"}},"duration":0.000564978,"status":502,"err_id":"qz71dtvus","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376002.4772165,"logger":"http.log.error","msg":"dial tcp 127.0.0.1:11000: connect: connection refused","request":{"remote_ip":"172.19.0.3","remote_port":"38708","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Fri, 14 Jul 2023 23:06:42"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"myunidomain.com"}},"duration":0.000778718,"status":502,"err_id":"9jkud4bh2","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376062.6084843,"logger":"http.log.error","msg":"read tcp 127.0.0.1:53950->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.3","remote_port":"37578","proto":"HTTP/1.1","method":"GET","host":"mydomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Fri, 14 Jul 2023 23:07:42"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"myunidomain.com"}},"duration":0.001229651,"status":502,"err_id":"ta6ynu3wt","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376122.7326834,"logger":"http.log.error","msg":"read tcp 127.0.0.1:58620->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.3","remote_port":"58756","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Fri, 14 Jul 2023 23:08:42"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"myunidomain.com"}},"duration":0.000923336,"status":502,"err_id":"xtgsdnyf5","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376182.856582,"logger":"http.log.error","msg":"read tcp 127.0.0.1:54872->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.3","remote_port":"52510","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/apps/richdocuments/settings/fonts.json","headers":{"Date":["Fri, 14 Jul 2023 23:09:42"],"User-Agent":["COOLWSD HTTP Agent 23.05.0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"myunidomain.com"}},"duration":0.001385587,"status":502,"err_id":"x1g9f2yg1","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376190.7416875,"logger":"http.log.error","msg":"read tcp 127.0.0.1:43212->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.8","remote_port":"56022","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"myunidomain.com"}},"duration":0.0009039,"status":502,"err_id":"s4ndwdemd","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376191.6959188,"logger":"http.log.error","msg":"read tcp 127.0.0.1:43222->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.8","remote_port":"56028","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"myunidomain.com"}},"duration":0.00075584,"status":502,"err_id":"wk5pj1aip","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376192.5092697,"logger":"http.log.error","msg":"read tcp 127.0.0.1:43234->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.8","remote_port":"56036","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/standalone-signaling/api/v1/welcome","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"myunidomain.com"}},"duration":0.000978676,"status":502,"err_id":"0dvu0cmus","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376195.3050122,"logger":"http.log.error","msg":"read tcp 127.0.0.1:50708->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.9","remote_port":"38634","proto":"HTTP/2.0","method":"GET","host":"myunidomain.com","uri":"/index.php/apps/notify_push/test/version","headers":{"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"myunidomain.com"}},"duration":0.000913252,"status":502,"err_id":"1vhuydm6d","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}
caddy                      	| {"level":"error","ts":1689376195.9931335,"logger":"http.log.error","msg":"read tcp 127.0.0.1:50718->127.0.0.1:11000: read: connection reset by peer","request":{"remote_ip":"172.19.0.8","remote_port":"49074","proto":"HTTP/1.1","method":"GET","host":"myunidomain.com","uri":"/hosting/capabilities","headers":{"User-Agent":["Nextcloud Server Crawler"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"myunidomain.com"}},"duration":0.001113592,"status":502,"err_id":"tx4wetytj","err_trace":"reverseproxy.statusError (reverseproxy.go:1299)"}

Or these when accessing the domain with a logged in browser:
(aborting with incomplete response)

caddy                          | {"level":"error","ts":1689986983.947444,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 60 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.9603212,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 80 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.960466,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 88 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.971578,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 92 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.9718778,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 104 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.975417,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 112 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.976229,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 120 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.976314,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 116 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.9764483,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 128 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.9765704,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 124 canceled by remote with error code 268"}
caddy                          | {"level":"error","ts":1689986983.9798586,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","error":"stream 132 canceled by remote with error code 268"}

My Caddyfile hasn't changed (besides the domain).

It doesn't seem to affect usability in any way, but doesn't seem right to me either. Is this a known Issue? How can I further investigate the relevant traffic?

[szaimen]

I fear I cannot reproduce your issue so it is most likely something you need to fix in your networking infrastructure.

For further help on this you could open an issue at https://help.nextcloud.com

[FreSchNDE]

Thanks, I'll take a look 👍