# How to Configure HAProxy for Docker-based Nextcloud AIO

## Purpose

Configure **HAProxy on pfSense** to terminate SSL and securely reverse-proxy public HTTPS traffic to an internal **Docker Nextcloud AIO server** behind your firewall.

---

## 1. HAProxy Package Installation on pfSense

On pfSense, go to:

- **System → Package Manager → Available Packages**
- Search for **HAProxy** and install `haproxy` (not haproxy-devel unless needed).

---

## 2. Create SSL Certificate (or Import)

In pfSense:

- **System → Certificate Manager → Certificates**
- Import or create an SSL certificate for your domain (example: `nextcloud.mydomain.com`).

---

## 3. HAProxy Settings

Go to **Services → HAProxy** and configure:

### Global Settings

- Enable HAProxy
- Set the SSL/TLS cipher suite to "Intermediate" (recommended for compatibility and security)

### Frontend (Public Side)

```
Name: frontend-https Bind address: WAN Address (or "any") Port: 443 Type: SSL Offloading (HTTPS) SSL Certificate: [Select imported Let's Encrypt or custom cert] 
```

### Actions:

- **Condition:** Match on `Host Header` = `nextcloud.mydomain.com`
- **Action:** Use Backend: `backend-nextcloud`

### Optional:

- Add another frontend to redirect port 80 to 443 if you want forced HTTPS

---

## 4. HAProxy Backend (Internal Docker Host)

```
Name: backend-nextcloud Mode: HTTP (or HTTPS if you terminate SSL at the container) Server list: Name: nextcloud-docker Address: 192.168.100.19 Port: 11000 Health Check Method: HTTP-OPTIONS 
```

### Important Backend Options:

- **Check "Use HTTP/1.1"**
- **Forward host headers (preserve client IP)**
- **Add header X-Forwarded-Proto: https**

---

## 5. Nextcloud Trusted Proxy Configuration

On the Nextcloud server, we modified the trusted proxies:

```
sudo docker exec -it nextcloud-aio-nextcloud bash cd /var/www/html/config nano config.php 
```

Add or verify these lines inside `config.php`:

```
'trusted_proxies' => ['192.168.100.1'], 'overwritehost' => 'nextcloud.mydomain.com', 'overwriteprotocol' => 'https', 'overwrite.cli.url' => 'https://nextcloud.mydomain.com', 
```

> *Note: Replace `192.168.100.1` with your pfSense LAN IP if different.*

---

## 6. Restart Docker Nextcloud Container

```
docker restart nextcloud-aio-nextcloud 
```

---

## ✅ Summary

- pfSense HAProxy listens on WAN 443 (HTTPS)
- SSL terminated at pfSense, traffic forwarded to Docker Nextcloud Apache 11000
- Client IP preserved using X-Forwarded-For headers
- Nextcloud properly recognizes reverse proxy and HTTPS URL

---

## 🛠️ Additional Notes

- HAProxy + pfSense reduces public attack surface on your Docker server
- Remember to update SSL certificates if using Let's Encrypt (can be automated)
- Use Health Checks to monitor Nextcloud availability
- Backup your pfSense HAProxy config after working setup