[Bug] 1Panel fails when adding Nextcloud All in One Reverse Proxy Configuration

[c0fe]

Contact Information

No response

1Panel Version

1.10.32-lts

Problem Description

I am wanting to run Nextcloud All in One which provides the instructions on how to set this up behind an existing reverse proxy here:

https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

Part of the instructions provide a configuration for the reverse proxy but when I use this and attempt to save it in the configuration panel I get this error:

Service internal error: stderr: 2025/09/14 14:07:27 [emerg] 599#599: SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: [emerg] SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed

Steps to Reproduce

This is my compose.yml file:

# ignored options for 'all-in-one'
# --sig-proxy=false
# named volume 'nextcloud_aio_mastercontainer' is marked as "external" (used by service 'all-in-one'), so either remove "external" from volume definition or it needs to be created using: docker volume create nextcloud_aio_mastercontainer
name: c0fe_cloud
services:
    all-in-one:
        init: true
        container_name: nextcloud-aio-mastercontainer
        restart: always
        ports:
            - 8080:8080
        environment:
            - APACHE_PORT=11000
            - APACHE_IP_BINDING=0.0.0.0
            - APACHE_ADDITIONAL_NETWORK=
            - SKIP_DOMAIN_VALIDATION=true
            - NEXTCLOUD_DATADIR=/media/cloud_drive/c0fe_cloud
        volumes:
            - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
            - /var/run/docker.sock:/var/run/docker.sock:ro
        image: ghcr.io/nextcloud-releases/all-in-one:latest
volumes:
    nextcloud_aio_mastercontainer:
        external: true
        name: nextcloud_aio_mastercontainer

And this is my configuration file for the reverse proxy:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      # for nginx versions below v1.25.1
    listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6

    # listen 443 ssl;      # for nginx v1.25.1+
    # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6
    # http2 on;            # uncomment to enable HTTP/2 - supported on nginx v1.25.1+

    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
    # listen [::]:443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_gso on;                              # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_bpf on;                              # improves  HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+

    proxy_buffering off;
    proxy_request_buffering off;

    access_log /www/sites/nextcloud.exampledomain.com/log/access.log main;
    error_log /www/sites/nextcloud.exampledomain.com/log/error.log;

    client_max_body_size 0;
    client_body_buffer_size 512k;
    # http3_stream_buffer_size 512k; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    proxy_read_timeout 86400s;

    server_name nextcloud.exampledomain.com;

    location / {
        proxy_pass http://127.0.0.1:11000$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Early-Data $ssl_early_data;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine, 
    # the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain. 
    # In this case the subdomain should already be secured without additional actions
    ssl_certificate /www/sites/nextcloud.exampledomain.com/ssl/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /www/sites/nextcloud.exampledomain.com/ssl/privkey.pem; # managed by certbot on host machine

    ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam

    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}

[c0fe]

@wanghe-fit2cloud why was this converted into a discussion? it is a bug, not a discussion.

[zhengkunwang223]

/usr/local/openresty/nginx/conf/nginx.conf test failed

This error means that there is a configuration error in your Nginx configuration file. You need to check the settings in your OpenResty main configuration file.

[c0fe]

@zhengkunwang223 then this is a bug because the main openresty configuration files were not touched at all, so these are what the installer put out.

[zhengkunwang223]

It seems there's an issue with your configuration file – for example,

ssl_dhparam /etc/dhparam;

By default, this file does not exist in the container.
@c0fe

[c0fe]

@zhengkunwang223 I disabled that but the error:

Service internal error: stderr: 2025/09/17 09:03:38 [emerg] 149#149: SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: [emerg] SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed
So you can't introduce full security certificate with 1Panel?

[c0fe]

@zhengkunwang223 looks like openresty doesn't support

`ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;`

[c0fe]

The error log:

2025/09/17 11:17:32 [error] 783#783: *7221 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4002/", host: "nextcloud.mydomain.com"
2025/09/17 11:17:32 [error] 783#783: *7223 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4002/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"

[c0fe]

If I enter the server's IP address along with the port for 8080 (opened different port on host) it will open Nextcloud but will be a self signed certificate which then is rejected by 1Panel/OpenResty.

[c0fe]

This is the config I use:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      # for nginx versions below v1.25.1
    listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6

    # listen 443 ssl;      # for nginx v1.25.1+
    # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6
    # http2 on;            # uncomment to enable HTTP/2 - supported on nginx v1.25.1+

    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
    # listen [::]:443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_gso on;                              # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_bpf on;                              # improves  HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+

    proxy_buffering off;
    proxy_request_buffering off;

    client_max_body_size 0;
    client_body_buffer_size 512k;
    # http3_stream_buffer_size 512k; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    proxy_read_timeout 86400s;

    server_name nextcloud.mydomain.com;

    location / {
        proxy_pass http://172.17.0.2:4001$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Early-Data $ssl_early_data;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine, 
    # the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain. 
    # In this case the subdomain should already be secured without additional actions
    ssl_certificate /www/sites/nextcloud.mydomain.com/ssl/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /www/sites/nextcloud.mydomain.com/ssl/privkey.pem; # managed by certbot on host machine

    #ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam

    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
#    ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}

[c0fe]

I am using 1Panel to manage Docker containers which utilizes Openresty 1.21.4.3-3-3-focal for the reverse proxy server.

I have used the following compose.yml

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest # This is the container image used. You can switch to ghcr.io/nextcloud-releases/all-in-one:beta if you want to help testing new releases. See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel
    init: true # This setting makes sure that signals from main process inside the container are correctly forwarded to children. See https://docs.docker.com/reference/compose-file/services/#init
    restart: always # This makes sure that the container starts always together with the host OS. See https://docs.docker.com/reference/compose-file/services/#restart
    container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
      - /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
    network_mode: bridge # This adds the container to the same network as docker run would do. Comment this line and uncomment the line below and the networks section at the end of the file if you want to define a custom MTU size for the docker network
    #networks: ["nextcloud-aio"]
    ports:
      - 4002:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      - 4001:8080 # This is the AIO interface, served via https and self-signed certificate. See https://github.com/nextcloud/all-in-one#explanation-of-used-ports
      - 4443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
    # security_opt: ["label:disable"] # Is needed when using SELinux. See https://github.com/nextcloud/all-in-one#are-there-known-problems-when-selinux-is-enabled
    environment: # Is needed when using any of the options below
      # AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
      APACHE_PORT: 11001 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      APACHE_IP_BINDING: 127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      APACHE_ADDITIONAL_NETWORK: bridge # (Optional) Connect the apache container to an additional docker network. Needed when behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) running in a different docker network on same server. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
      SKIP_DOMAIN_VALIDATION: true # This should only be set to true if things are correctly configured. See https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-skip-the-domain-validation

volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work

# # Adjust the MTU size of the docker network. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-mtu-size-of-the-docker-network
#networks:
#  nextcloud-aio:
#    name: nextcloud-aio
#    driver_opts:
#      com.docker.network.driver.mtu: 1440

1Panel generates a config on its own which is here:

server {
    listen 80 ; 
    listen 443 ssl http2 ; 
    server_name nextcloud.mydomain.com; 
    index index.php index.html index.htm default.php default.htm default.html; 
    proxy_set_header Host $host; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
    proxy_set_header X-Forwarded-Host $server_name; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_http_version 1.1; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    access_log /www/sites/nextcloud.mydomain.com/log/access.log main; 
    error_log /www/sites/nextcloud.mydomain.com/log/error.log; 
    location ^~ /.well-known/acme-challenge {
        allow all; 
        root /usr/share/nginx/html; 
    }
    include /www/sites/nextcloud.mydomain.com/proxy/*.conf; 
    if ($scheme = http) {
        return 301 https://$host$request_uri; 
    }
    ssl_certificate /www/sites/nextcloud.mydomain.com/ssl/fullchain.pem; 
    ssl_certificate_key /www/sites/nextcloud.mydomain.com/ssl/privkey.pem; 
    ssl_protocols TLSv1.3 TLSv1.2; 
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256; 
    ssl_prefer_server_ciphers on; 
    ssl_session_cache shared:SSL:10m; 
    ssl_session_timeout 10m; 
    error_page 497 https://$host$request_uri; 
    proxy_set_header X-Forwarded-Proto https; 
    add_header Strict-Transport-Security "max-age=31536000"; 
}

Unfortunately this just resulted in constantly ERROR 502 BAD GATEWAY error. The logs here:

2025/09/17 18:30:48 [error] 1233#1233: *16298 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.214.55, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4002/", host: "nextcloud.mydomain.com"
2025/09/17 18:30:48 [error] 1233#1233: *16300 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4002/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:33:07 [error] 1323#1323: *16366 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:11001/", host: "nextcloud.mydomain.com"
2025/09/17 18:33:07 [error] 1323#1323: *16368 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:11001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:33:35 [error] 1413#1413: *16434 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:11001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:33:35 [error] 1413#1413: *16436 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:11001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:34:00 [error] 1503#1503: *16512 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4002/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:34:00 [error] 1503#1503: *16514 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4002/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:34:13 [error] 1593#1593: *16586 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:34:13 [error] 1593#1593: *16588 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:34:23 [error] 1683#1683: *16654 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:34:23 [error] 1683#1683: *16656 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:34:38 [error] 1773#1773: *16722 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:34:38 [error] 1773#1773: *16724 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:34:39 [error] 1773#1773: *16722 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:36:57 [error] 1862#1862: *16791 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:36:57 [error] 1862#1862: *16794 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:37:08 [error] 1952#1952: *16897 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:37:08 [error] 1952#1952: *16900 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:37:18 [error] 2042#2042: *16980 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.43, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:37:18 [error] 2042#2042: *16982 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:37:43 [error] 2132#2132: *17048 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:37:43 [error] 2132#2132: *17050 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 18:37:44 [error] 2132#2132: *17048 connect() failed (111: Connection refused) while connecting to upstream, client: 172.70.126.42, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 18:37:44 [error] 2132#2132: *17050 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"

I then used this configuration to make adjustments:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}


server {
    listen 80;
    listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      # for nginx versions below v1.25.1
    listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6

    # listen 443 ssl;      # for nginx v1.25.1+
    # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6
    # http2 on;            # uncomment to enable HTTP/2 - supported on nginx v1.25.1+

    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
    # listen [::]:443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_gso on;                              # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_bpf on;                              # improves  HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+

    proxy_buffering off;
    proxy_request_buffering off;

    client_max_body_size 0;
    client_body_buffer_size 512k;
    # http3_stream_buffer_size 512k; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    proxy_read_timeout 86400s;

    server_name nextcloud.mydomain.com;

    location / {
        proxy_pass http://172.17.0.2:4001$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Early-Data $ssl_early_data;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine, 
    # the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain. 
    # In this case the subdomain should already be secured without additional actions
    ssl_certificate /www/sites/nextcloud.mydomain.com/ssl/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /www/sites/nextcloud.mydomain.com/ssl/privkey.pem; # managed by certbot on host machine

    #ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam

    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
#    ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}

Unfortunately this doesn’t solve the issue and here are the error logs:

2025/09/17 19:09:10 [error] 2795#2795: *17667 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.107, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:11001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:09:10 [error] 2795#2795: *17669 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:11001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:10:36 [error] 2840#2840: *17703 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.106, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:10:36 [error] 2840#2840: *17705 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:10:43 [error] 2885#2885: *17739 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.107, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4002/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:10:43 [error] 2885#2885: *17741 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4002/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:10:52 [error] 2930#2930: *17777 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.107, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "http://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:10:52 [error] 2930#2930: *17779 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "http://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:13:25 [error] 2975#2975: *17813 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.107, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4443/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:13:25 [error] 2975#2975: *17815 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4443/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:13:38 [error] 3020#3020: *17849 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.106, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4001/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:13:38 [error] 3020#3020: *17851 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.131, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4001/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"
2025/09/17 19:13:48 [error] 3065#3065: *17885 connect() failed (111: Connection refused) while connecting to upstream, client: 172.69.17.107, server: nextcloud.mydomain.com, request: "GET / HTTP/2.0", upstream: "https://172.17.0.2:4002/", host: "nextcloud.mydomain.com", referrer: "https://192.168.7.140:4001/"
2025/09/17 19:13:48 [error] 3065#3065: *17887 connect() failed (111: Connection refused) while connecting to upstream, client: 172.71.255.132, server: nextcloud.mydomain.com, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.17.0.2:4002/favicon.ico", host: "nextcloud.mydomain.com", referrer: "https://nextcloud.mydomain.com/"

I am not sure what else I can do or why this is happening. The container can be accessed if I put in the IP of my server and point it to the 4001 port. But I am not sure how to further adjust the config to make this work.

[zhengkunwang223]

Set the website with an IP as the domain name as the default website.