Nginx reverse proxy, slow webdav performance on nextcloud

Thanks,

Well I no longer have the database errors, but not much has changed, I recently made some tweaks to my Nginx config, as I noticed I get a 502 error which is a gateway time out issue. But this only seems to happen on first login on the web interface.

Ok, that’s good and bad. Good, that you solved those issues - Bad, that it didn’t solve yours. But that kinda was to be expected.

Did you try with a different user yet?

502… hm… Since you are using a Reverse Proxy thus having one (extrenal) IP for all requests and WebDAV might open multiple streams, maybe your issue is as simple as the brute force protection kicking in. Try disabling it
in config.php:
'auth.bruteforce.protection.enabled' => false,

Also add to config.php:

  'forwarded_for_headers' =>
  array (
    0 => 'HTTP_X_FORWARDED',
    1 => 'HTTP_FORWARDED_FOR',
  ),

and add to Apache virtualhost:

  ProxyVia On
  ProxyPreserveHost On
  RequestHeader set X-Forwarded-Proto 'https' env=HTTPS

(If using HTTPS)

Credit

Since I know the source, credit where credit is due: the above snippets are from a bookmark of mine from this thread

I found those changes online to, unfortunately when I tried them I did not make any difference.

It was a good call to try another user, but it was the same unfortunately.

Ok, at least we were able to narrow it down:

  • Different user, same issue -> Not the known issue from some releases ago
  • DB errors cleared -> Nothing to do with that
  • Anti Brute force -> Checked and not the issue (did you restart & clear/check the DB after the change?)

Issues that might still be it:

  • RP3+ simply not fast enough to handle reverse proxy and NC on the same board. Maybe check htop while accessing?
  • Config errors regarding reverse proxy: Might need to post (a somewhat redacted) config anyway.
  • Issue with how android does WebDAV -> Have you tried the performance with the same Reverse Proxy Setup using a differnt client via WLAN (in the order of: different app -> different mobile OS if available -> different Infrastructure e.g. Laptop)
  • Random Issue: Love those. With a vengeance.

So when I am accessing WebDav on my smartphone, I’m mainly using an audio player to access it , it’s called Neutron but when it scans for audio files on the WebDav server, the server does slow down significantly I notice this when accessing SSH and typing in simple commands like sudo nano.

So this would seem to suggest to me “that your most likely right” it just can’t handle the reverse proxy. As well as the other systems that are in place.

Should I just ditch Nginx? Only reason why I am using it, is for extra security. Would it be better if I just use vlan for Nextcloud and pi.hole and add a custom domain name?

Edit: Question

To quote Mythbusters: “There’s your problem” :wink:

Seeing that you have 3 tools which might require significant resources (in terms of Raspi Performance) installed on one board, yes, I’d suggest splitting them. Even think about getting one for each (Then again, not everyone is like me with at least 10 of those things lying around at any given time)

Why exactly reverse proxy? Are you accessing it from outside? How do you handle that access? Port Forwarding? 1:1 NAT?

If it’s only for HTTPS, just use a Let’s Encrypt Cert. There are tons of guides for implementing it and even do auto-renewal with NC. I can also assist, if you have questions.

If it’s as to limit attack vectors, do you have a firewall set up? If so, using reverse proxy might be redundant (in some cases) and might be better done on the FW itself.

The VLAN stuff as to put them to a different network is also a good idea. If you have hardware that supports that and optionally know your way around Split DNS and stuff like that.

I am accessing this from the outside, but only via a VPN like wiregard or openvpn, via a port forward.

Then your only connection is the VPN anyways. So (if correctly done) no need to worry

Yer, just a question of replacing the IP and port number with an actual domain name.

Why do you need a domain, if you only connect through VPN?

Oh, also, if you don’t mind, mark one of the answers (can be yours too) as solution if possible. That way others see that there is nothing to “solve” regarding your original post.

Well, mainly because I prefer to type a name in rather than an ip and port number for each system.

I see. Well since you are connecting via VPN anyhow, this should be easily done locally. Added bonus of not being known and available to the outside :wink:

1 Like