[Bug] 1Panel fails when adding Nextcloud All in One Reverse Proxy Configuration

[c0fe]

Contact Information

No response

1Panel Version

1.10.32-lts

Problem Description

I am wanting to run Nextcloud All in One which provides the instructions on how to set this up behind an existing reverse proxy here:

https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

Part of the instructions provide a configuration for the reverse proxy but when I use this and attempt to save it in the configuration panel I get this error:

Service internal error: stderr: 2025/09/14 14:07:27 [emerg] 599#599: SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: [emerg] SSL_CTX_set1_curves_list("x25519:x448:secp521r1:secp384r1:secp256r1") failed nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test failed

Steps to Reproduce

This is my compose.yml file:

# ignored options for 'all-in-one'
# --sig-proxy=false
# named volume 'nextcloud_aio_mastercontainer' is marked as "external" (used by service 'all-in-one'), so either remove "external" from volume definition or it needs to be created using: docker volume create nextcloud_aio_mastercontainer
name: c0fe_cloud
services:
    all-in-one:
        init: true
        container_name: nextcloud-aio-mastercontainer
        restart: always
        ports:
            - 8080:8080
        environment:
            - APACHE_PORT=11000
            - APACHE_IP_BINDING=0.0.0.0
            - APACHE_ADDITIONAL_NETWORK=
            - SKIP_DOMAIN_VALIDATION=true
            - NEXTCLOUD_DATADIR=/media/cloud_drive/c0fe_cloud
        volumes:
            - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
            - /var/run/docker.sock:/var/run/docker.sock:ro
        image: ghcr.io/nextcloud-releases/all-in-one:latest
volumes:
    nextcloud_aio_mastercontainer:
        external: true
        name: nextcloud_aio_mastercontainer

And this is my configuration file for the reverse proxy:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;            # comment to disable IPv6

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      # for nginx versions below v1.25.1
    listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6

    # listen 443 ssl;      # for nginx v1.25.1+
    # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6
    # http2 on;            # uncomment to enable HTTP/2 - supported on nginx v1.25.1+

    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
    # listen [::]:443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_gso on;                              # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_bpf on;                              # improves  HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+

    proxy_buffering off;
    proxy_request_buffering off;

    access_log /www/sites/nextcloud.exampledomain.com/log/access.log main;
    error_log /www/sites/nextcloud.exampledomain.com/log/error.log;

    client_max_body_size 0;
    client_body_buffer_size 512k;
    # http3_stream_buffer_size 512k; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    proxy_read_timeout 86400s;

    server_name nextcloud.exampledomain.com;

    location / {
        proxy_pass http://127.0.0.1:11000$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Early-Data $ssl_early_data;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    # If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine, 
    # the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain. 
    # In this case the subdomain should already be secured without additional actions
    ssl_certificate /www/sites/nextcloud.exampledomain.com/ssl/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /www/sites/nextcloud.exampledomain.com/ssl/privkey.pem; # managed by certbot on host machine

    ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam

    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}