Update admin webserver config recommendations for well known handlers #5825

ChristophWurst · 2020-12-16T09:38:20Z

Basically well known has to go to Nextcloud, except for the hard-coded DAV routes.

I tested with nginx, both nextcloud hosted in the root as well as as sub directory. Ideally we'd have nginx answer to ./well-known directly without the index.php prefix but I'm not able to change our default config for this. My previous hand-crafted nginx config allowed this.

@daita please review and test

Requires Add well known handlers API server#24702

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

ChristophWurst · 2020-12-16T12:25:26Z

On a side note this recommended nginx config really has some issues. I've reverted to my own version now. It's not idea, but works a lot better for development purposes (I don't care much about security headers there).

juliusknorr · 2020-12-16T13:15:49Z

admin_manual/installation/nginx.rst

-          rewrite ^/\.well-known/host-meta        /public.php?service=host-meta       last;
-          rewrite ^/\.well-known/webfinger        /public.php?service=webfinger       last;
-          rewrite ^/\.well-known/nodeinfo         /public.php?service=nodeinfo        last;
-
          location = /.well-known/carddav     { return 301 /remote.php/dav/; }


Would be good to at some point then also migrate the *dav related well known endpoints

Absolutely. @rullzer and I brainstormed about using the new API and having a simple handler in the dav app. Then installations that are hosted in the document root don't ever need to fiddle with the rewrites/redirects.

ArtificialOwl · 2020-12-16T19:37:09Z

This need confirmation, as I might be wrong, but I don't think the current API can handle host-meta

https://tools.ietf.org/html/rfc6415#section-3.1 : The host-meta document root MUST be an "XRD" element.

ChristophWurst · 2020-12-17T06:59:31Z

This need confirmation, as I might be wrong, but I don't think the current API can handle host-meta

https://tools.ietf.org/html/rfc6415#section-3.1 : The host-meta document root MUST be an "XRD" element.

This is doable today with the GenericResponse. See nextcloud/server#24702 (comment).

MichaIng · 2021-02-15T18:45:52Z

Is it a great idea to redirect really all .well-known requests, including ACME and whatnot? If I'm not mistaken this breaks Let's Encrypt certificate renewal when the webroot authentication method is used.

MichaIng · 2021-02-15T19:21:00Z

admin_manual/installation/nginx.rst

          location = /.well-known/carddav     { return 301 /remote.php/dav/; }
          location = /.well-known/caldav      { return 301 /remote.php/dav/; }
+          # Anything else is dynamically handled by Nextcloud
+          location ^~ /.well-known            { return 301 /index.php$uri; }


I think $request_uri must be used here as $uri is the normalised/decided URI with query string and anchor removed, which is not what is wanted here?

@daita could that explain why you sometimes didn't see query parameters?!

ChristophWurst · 2021-02-16T07:20:09Z

Is it a great idea to redirect really all .well-known requests, including ACME and whatnot? If I'm not mistaken this breaks Let's Encrypt certificate renewal when the webroot authentication method is used.

My stack of thoughts ran into an overflow and I forgot our considerations but I seem to remember that we thought about this ACME challenge. Do you have a setup where you could test this?

MichaIng · 2021-02-16T11:12:35Z

Do you have a setup where you could test this?

One with Nextcloud in /nextcloud sub directory and Apache2 at least. The issue should be the same when /.well-known/acme-challenge is redirected to /nextcloud/index.php/.well-known/acme-challenge and the question where the ACME client writes and the server reads files from. I'll run a quick test:

Redirect permanent /.well-known /nextcloud/index.php/.well-known

[Tue Feb 16 11:53:13 CET 2021] domain.org:Verify error:Invalid response from https://micha.gnoedi.org/nextcloud/login [123.456.789.123]:
total 4
[Tue Feb 16 11:53:13 CET 2021] Please add '--debug' or '--log' to check more details.
[Tue Feb 16 11:53:13 CET 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
[Tue Feb 16 11:53:14 CET 2021] Error renew domain.org_ecc.

This is with acme.sh webroot authentication. The client writes to /.well-known/acme-challenge/<token> but the authentication server is redirected to /nextcloud/..., hence finally the login page.

.htaccess excludes it explicitly:

RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]

But it looks dangerous to go with the approach to redirect all .well-known requests and only exclude some, which are known to be not handled correctly by Nextcloud. I don't know how much services use this path (if a list can be maintained reasonably), but, while it makes the configs more complicated, to me it looks much safer to redirect only the service requests explicitly that are known to be handled correctly by Nextcloud. Especially with Nextcloud in a sub directory one cannot even assume that it is wanted that Nextcloud handles all of them, but probably other software is used to handle some of them. So for an example Nginx configuration, it would probably be more helpful to show how to redirect actually used services that shall be handled by Nextcloud explicitly instead of showing how to exclude those which shall not be handled by Nextcloud, isn't it?

ChristophWurst · 2021-02-22T07:16:51Z

But it looks dangerous to go with the approach to redirect all .well-known requests and only exclude some, which are known to be not handled correctly by Nextcloud

If there is anything else that is never handled by Nextcloud then we can add it to this hard coded exclude pattern. But the idea was to let Nextcloud apps handle as much as they like dynamically. So from the PoV of Nextcloud we don't actually know what well known handlers are available as they are provided via apps.

MichaIng · 2021-02-22T20:19:42Z

So from the PoV of Nextcloud we don't actually know what well known handlers are available as they are provided via apps.

Fair point as well. Practically I guess it doesn't make much difference whether one needs to add an extra include or an extra exclude.

However, ACME definitely needs to be excluded and likely pki-validation (whatever it is), to match the .htaccess.

ChristophWurst · 2021-02-23T07:39:24Z

True. Would you mind sending the change as PR?

MichaIng · 2021-02-23T11:39:43Z

Done: #6221

Please note that I didn't use the current nginx config from the administration manual as this would've broken ACME challenges[1]. Also added a fix for Microsoft clients. [1] nextcloud/documentation#5825 (comment)

Please note that I didn't use the current nginx config from the administration manual as this would've broken ACME challenges[1]. Also added a fix for Microsoft clients. [1] nextcloud/documentation#5825 (comment) (cherry picked from commit 7977214)

Update admin webserver config recommendations for well known handlers

c9918d4

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

ChristophWurst added bug 3. to review manual: admin labels Dec 16, 2020

ChristophWurst added this to the Nextcloud 21 milestone Dec 16, 2020

ChristophWurst requested review from rullzer, ArtificialOwl and juliusknorr December 16, 2020 09:38

ChristophWurst self-assigned this Dec 16, 2020

ChristophWurst mentioned this pull request Dec 16, 2020

Add well known handlers API nextcloud/server#24702

Merged

3 tasks

juliusknorr reviewed Dec 16, 2020

View reviewed changes

ChristophWurst requested a review from juliusknorr December 18, 2020 12:34

juliusknorr approved these changes Dec 21, 2020

View reviewed changes

juliusknorr merged commit 4f454bf into master Dec 21, 2020

juliusknorr deleted the fix/admin-webserver-well-known-handling branch December 21, 2020 06:41

ChristophWurst mentioned this pull request Jan 1, 2021

NC 21 Beta 3 and 4 | Systemconfig has errors because of "webfinger" and "nodeinfo" nextcloud/server#24877

Closed

MichaIng reviewed Feb 15, 2021

View reviewed changes

MichaIng mentioned this pull request Feb 23, 2021

Fix Nginx .well-known redirects #6221

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update admin webserver config recommendations for well known handlers #5825

Update admin webserver config recommendations for well known handlers #5825

ChristophWurst commented Dec 16, 2020 •

edited

Loading

ChristophWurst commented Dec 16, 2020

juliusknorr Dec 16, 2020

ChristophWurst Dec 16, 2020

ArtificialOwl commented Dec 16, 2020

ChristophWurst commented Dec 17, 2020

MichaIng commented Feb 15, 2021

MichaIng Feb 15, 2021

ChristophWurst Feb 16, 2021

ChristophWurst commented Feb 16, 2021

MichaIng commented Feb 16, 2021

ChristophWurst commented Feb 22, 2021

MichaIng commented Feb 22, 2021

ChristophWurst commented Feb 23, 2021

MichaIng commented Feb 23, 2021

Update admin webserver config recommendations for well known handlers #5825

Update admin webserver config recommendations for well known handlers #5825

Conversation

ChristophWurst commented Dec 16, 2020 • edited Loading

ChristophWurst commented Dec 16, 2020

juliusknorr Dec 16, 2020

Choose a reason for hiding this comment

ChristophWurst Dec 16, 2020

Choose a reason for hiding this comment

ArtificialOwl commented Dec 16, 2020

ChristophWurst commented Dec 17, 2020

MichaIng commented Feb 15, 2021

MichaIng Feb 15, 2021

Choose a reason for hiding this comment

ChristophWurst Feb 16, 2021

Choose a reason for hiding this comment

ChristophWurst commented Feb 16, 2021

MichaIng commented Feb 16, 2021

ChristophWurst commented Feb 22, 2021

MichaIng commented Feb 22, 2021

ChristophWurst commented Feb 23, 2021

MichaIng commented Feb 23, 2021

ChristophWurst commented Dec 16, 2020 •

edited

Loading