Nexcloud behind HAproxy on pfsense - config question

Help!
1

I apologize for my ignorance on the topic. I am just learning and am stuck for a few hours now on this problem. I have several “servers” setup and working on HAproxy, however I can not get Nextcloud to work properly. It always says: plain http request was sent to https (400)

It always says this no matter if I try https or http. I can look in the nextcloud nginx logs and it shows my request.

Upon further digging I found that this likely needs added into haproxy, but I’m not sure how to go about doing that on pfsense:

acl url_discovery path /.well-known/caldav /.well-known/carddav
http-request redirect location /remote.php/dav/ code 301 if url_discovery

found at this link in nextcloud’s documentation: Reverse proxy — Nextcloud latest Administration Manual latest documentation

Any insight or suggestions would be amazing.

A few lines from the nginx access log for nextcloud:
192.168.5.230 - - [08/Jul/2021:01:17:07 -0700] “GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36”
192.168.5.230 - - [08/Jul/2021:01:18:07 -0700] “GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36”
192.168.5.230 - - [08/Jul/2021:01:19:07 -0700] “GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36”
192.168.5.230 - - [08/Jul/2021:01:20:07 -0700] “GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36”

2

I just resolved the problem. You have to make sure you Encrypt(SSL) the connection TO the backend. In pfsense there is an option in the UI for this. I was then able to connect.

3

Note that nextcloud also requires the caldav/carddav redirects.

some more details on the configuration here: /.well-known/caldav and carddav with haproxy - #3 by abyss02 - ℹ️ Support - Nextcloud community

works well with those changes, i.e.:

acl caldav-endpoint path_beg /.well-known/caldav                                                   
http-request set-path /remote.php/dav if caldav-endpoint

acl carddav-endpoint path_beg /.well-known/carddav      
http-request set-path /remote.php/dav if carddav-endpoint