How to Configure HAProxy for Docker-based Nextcloud AIO

Purpose 
 Configure HAProxy on pfSense to terminate SSL and securely reverse-proxy public HTTPS traffic to an internal Docker Nextcloud AIO server behind your firewall. 
 
 1. HAProxy Package Installation on pfSense 
 On pfSense, go to: 
 
 System → Package Manager → Available Packages 
 Search for HAProxy and install haproxy (not haproxy-devel unless needed). 
 
 
 2. Create SSL Certificate (or Import) 
 In pfSense: 
 
 System → Certificate Manager → Certificates 
 Import or create an SSL certificate for your domain (example: nextcloud.mydomain.com ). 
 
 
 3. HAProxy Settings 
 Go to Services → HAProxy and configure: 
 Global Settings 
 
 Enable HAProxy 
 Set the SSL/TLS cipher suite to "Intermediate" (recommended for compatibility and security) 
 
 Frontend (Public Side) 
 Name: frontend-https Bind address: WAN Address (or "any") Port: 443 Type: SSL Offloading (HTTPS) SSL Certificate: [Select imported Let's Encrypt or custom cert] 
 Actions: 
 
 Condition: Match on Host Header = nextcloud.mydomain.com 
 Action: Use Backend: backend-nextcloud 
 
 Optional: 
 
 Add another frontend to redirect port 80 to 443 if you want forced HTTPS 
 
 
 4. HAProxy Backend (Internal Docker Host) 
 Name: backend-nextcloud Mode: HTTP (or HTTPS if you terminate SSL at the container) Server list: Name: nextcloud-docker Address: 192.168.100.19 Port: 11000 Health Check Method: HTTP-OPTIONS 
 Important Backend Options: 
 
 Check "Use HTTP/1.1" 
 Forward host headers (preserve client IP) 
 Add header X-Forwarded-Proto: https 
 
 
 5. Nextcloud Trusted Proxy Configuration 
 On the Nextcloud server, we modified the trusted proxies: 
 sudo docker exec -it nextcloud-aio-nextcloud bash cd /var/www/html/config nano config.php 
 Add or verify these lines inside config.php : 
 'trusted_proxies' => ['192.168.100.1'], 'overwritehost' => 'nextcloud.mydomain.com', 'overwriteprotocol' => 'https', 'overwrite.cli.url' => 'https://nextcloud.mydomain.com', 
 
 Note: Replace 192.168.100.1 with your pfSense LAN IP if different. 
 
 
 6. Restart Docker Nextcloud Container 
 docker restart nextcloud-aio-nextcloud 
 
 ✅ Summary 
 
 pfSense HAProxy listens on WAN 443 (HTTPS) 
 SSL terminated at pfSense, traffic forwarded to Docker Nextcloud Apache 11000 
 Client IP preserved using X-Forwarded-For headers 
 Nextcloud properly recognizes reverse proxy and HTTPS URL 
 
 
 🛠️ Additional Notes 
 
 HAProxy + pfSense reduces public attack surface on your Docker server 
 Remember to update SSL certificates if using Let's Encrypt (can be automated) 
 Use Health Checks to monitor Nextcloud availability 
 Backup your pfSense HAProxy config after working setup