title: Installing nextcloud (helm) on linode k8s (v1.19) cluster with nginx-ingress tls/ssl encryption (let's encrypt) dosen't work as expected
body: <p>I tried to install nextcloud on a Linode k8s managed cluster with helm. The installation process was no problem. Everything worked fine. My nextcloud instance is tls encrypted, but when I try to log in, nothing happens. In the console of the browser I only get the information:</p>
  <pre><code>Refused to send form data to 'http://cloud.my-domain.io/' because it violates the following Content Security Policy directive: &quot;form-action 'self'&quot;.
  </code></pre>
  <p>I figured out, that this has probably to do with the fact that nextcloud has a problem with the reverse proxy of my k8s Nginx ingress. I tried out to solve the problem by adding 'overwriteprotocol' =&gt; 'https' to my config.php. Then the error message disappears, but I didn't get forward to the account page, I still see only the login page.</p>
  <p>I also tried out to use the Nginx ingress of the nextcloud helm chart itself. But that doesn't work at all. When I try to access nextcloud within the browser I only get the information, that the instance is unsafe. No login page, no nextcloud page at all. Just the blank browser page.</p>
  <p>In the end, I tried to use nextcloud without any tls, and that works quite fine. But of course, that's not what I want. I wanna have a secure connection to nextcloud.</p>
  <p>I have no ideas what else I can do. What I'm doing wrong? I really hope that someone can help me to solve the problem. Thank's for your help!</p>
  <p>That's my helm values.yaml:</p>
  <pre><code>## Official nextcloud image version
  ## ref: https://hub.docker.com/r/library/nextcloud/tags/
  ##
  image:
    repository: nextcloud
    tag: 19.0.3-apache
    pullPolicy: IfNotPresent
    # pullSecrets:
    #   - myRegistrKeySecretName
  
  nameOverride: &quot;&quot;
  fullnameOverride: &quot;&quot;
  
  # Number of replicas to be deployed
  replicaCount: 1
  
  ## Allowing use of ingress controllers
  ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
  ##
  ingress:
    enabled: false
    # metadata:
      # annotations:
      #   kubernetes.io/ingress.class: nginx
      #   nginx.ingress.kubernetes.io/rewrite-target: /
      #   nginx.ingress.kubernetes.io/proxy-body-size: 4G
      #   kubernetes.io/tls-acme: &quot;true&quot;
      #   certmanager.k8s.io/cluster-issuer: letsencrypt-prod
      #   nginx.ingress.kubernetes.io/server-snippet: |-
      #     server_tokens off;
      #     proxy_hide_header X-Powered-By;
  
      #     rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
      #     rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
      #     rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
      #     location = /.well-known/carddav {
      #       return 301 $scheme://$host/remote.php/dav;
      #     }
      #     location = /.well-known/caldav {
      #       return 301 $scheme://$host/remote.php/dav;
      #     }
      #     location = /robots.txt {
      #       allow all;
      #       log_not_found off;
      #       access_log off;
      #     }
      #     location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
      #       deny all;
      #     }
      #     location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
      #       deny all;
      #     }
      #   tls:
      #     - secretName: wa-stack-nextcloud-tls
      #       hosts:
      #         - cloud.my-domain.io
      # labels: {}
  
  # Allow configuration of lifecycle hooks
  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
  lifecycle: {}
    # postStartCommand: []
    # preStopCommand: []
  
  nextcloud:
    host: cloud.my-domain.io
    # username: admin
    # password: changeme
    # Use an existing secret
    existingSecret:
      enabled: true
      secretName: nextcloud-secret
      # for initiator
      usernameKey: username
      passwordKey: password
      # secretName: nameofsecret
      # usernameKey: username
      # passwordKey: password
      # smtpUsernameKey: smtp_username
      # smtpPasswordKey: smtp_password
    update: 0
    datadir: /var/www/html/data
    tableprefix: wa
    persistence:
      subPath:
    mail:
      enabled: false
      fromAddress: user
      domain: domain.com
      smtp:
        host: domain.com
        secure: ssl
        port: 465
        authtype: LOGIN
        name: user
        password: pass
    # PHP Configuration files
    # Will be injected in /usr/local/etc/php/conf.d for apache image and in /usr/local/etc/php-fpm.d when nginx.enabled: true
    phpConfigs: {}
    # Default config files
    # IMPORTANT: Will be used only if you put extra configs, otherwise default will come from nextcloud itself
    # Default confgurations can be found here: https://github.com/nextcloud/docker/tree/master/16.0/apache/config
    defaultConfigs:
      # To protect /var/www/html/config
      .htaccess: true
      # Redis default configuration
      redis.config.php: true
      # Apache configuration for rewrite urls
      apache-pretty-urls.config.php: true
      # Define APCu as local cache
      apcu.config.php: true
      # Apps directory configs
      apps.config.php: true
      # Used for auto configure database
      autoconfig.php: true
      # SMTP default configuration
      smtp.config.php: true
    # Extra config files created in /var/www/html/config/
    # ref: https://docs.nextcloud.com/server/15/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
    configs: {}
  
    # For example, to use S3 as primary storage
    # ref: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3
    #
    #  configs:
    #    s3.config.php: |-
    #      &lt;?php
    #      $CONFIG = array (
    #        'objectstore' =&gt; array(
    #          'class' =&gt; '\\OC\\Files\\ObjectStore\\S3',
    #          'arguments' =&gt; array(
    #            'bucket'     =&gt; 'my-bucket',
    #            'autocreate' =&gt; true,
    #            'key'        =&gt; 'xxx',
    #            'secret'     =&gt; 'xxx',
    #            'region'     =&gt; 'us-east-1',
    #            'use_ssl'    =&gt; true
    #          )
    #        )
    #      );
  
    ## Strategy used to replace old pods
    ## IMPORTANT: use with care, it is suggested to leave as that for upgrade purposes
    ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
    strategy:
      type: Recreate
      # type: RollingUpdate
      # rollingUpdate:
      #   maxSurge: 1
      #   maxUnavailable: 0
  
    ##
    ## Extra environment variables
    extraEnv:
    #  - name: SOME_SECRET_ENV
    #    valueFrom:
    #      secretKeyRef:
    #        name: nextcloud
    #        key: secret_key
  
    # Extra mounts for the pods. Example shown is for connecting a legacy NFS volume
    # to NextCloud pods in Kubernetes. This can then be configured in External Storage
    extraVolumes:
    #  - name: nfs
    #    nfs:
    #      server: &quot;10.0.0.1&quot;
    #      path: &quot;/nextcloud_data&quot;
    #      readOnly: false
    extraVolumeMounts:
    #  - name: nfs
    #    mountPath: &quot;/legacy_data&quot;
  
  nginx:
    ## You need to set an fpm version of the image for nextcloud if you want to use nginx!
    enabled: false
    image:
      repository: nginx
      tag: alpine
      pullPolicy: IfNotPresent
  
    config:
      # This generates the default nginx config as per the nextcloud documentation
      default: true
      # custom: |-
      #     worker_processes  1;..
  
    resources: {}
  
  internalDatabase:
    enabled: false
    name: nextcloud
  
  ##
  ## External database configuration
  ##
  externalDatabase:
    enabled: true
  
    ## Supported database engines: mysql or postgresql
    type: mysql
  
    ## Database host
    host: maria-db-mariadb-primary
  
    ## Database user
    # user: wa-cloud
  
    # Database password
    # password:
  
    ## Database name
    database: wa-cloud
  
    ## Use a existing secret
    existingSecret:
      enabled: true
      secretName: mariadb-secret
      usernameKey: db-username
      passwordKey: mariadb-password
  
  ##
  ## MariaDB chart configuration
  ##
  mariadb:
    ## Whether to deploy a mariadb server to satisfy the applications database requirements. To use an external database set this to false and configure the externalDatabase parameters
    enabled: false
  
    db:
      name: nextcloud
      user: nextcloud
      password: changeme
  
    replication:
      enabled: false
  
    ## Enable persistence using Persistent Volume Claims
    ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
    ##
    master:
      persistence:
        enabled: false
        # storageClass: &quot;&quot;
        accessMode: ReadWriteOnce
        size: 8Gi
  
  postgresql:
    enabled: false
    global:
      postgresql:
        postgresqlUsername: nextcloud
        postgresqlPassword: changeme
        postgresqlDatabase: nextcloud
    persistence:
      enabled: false
      # storageClass: &quot;&quot;
  
  redis:
    enabled: true
    usePassword: false
    password: ''
  
  ## Cronjob to execute Nextcloud background tasks
  ## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
  ##
  cronjob:
    enabled: true
    # Nexcloud image is used as default but only curl is needed
    image: {}
      # repository: nextcloud
      # tag: 16.0.3-apache
      # pullPolicy: IfNotPresent
      # pullSecrets:
      #   - myRegistrKeySecretName
    # Every 5 minutes
    # Note: Setting this to any any other value than 5 minutes might
    #  cause issues with how nextcloud background jobs are executed
    schedule: &quot;*/5 * * * *&quot;
    annotations: {}
    # Set curl's insecure option if you use e.g. self-signed certificates
    curlInsecure: false
    failedJobsHistoryLimit: 2
    successfulJobsHistoryLimit: 2
    # If not set, nextcloud deployment one will be set
    # resources:
      # We usually recommend not to specify default resources and to leave this as a conscious
      # choice for the user. This also increases chances charts run on environments with little
      # resources, such as Minikube. If you do want to specify resources, uncomment the following
      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
      # limits:
      #  cpu: 100m
      #  memory: 128Mi
      # requests:
      #  cpu: 100m
      #  memory: 128Mi
  
    # If not set, nextcloud deployment one will be set
    # nodeSelector: {}
  
    # If not set, nextcloud deployment one will be set
    # tolerations: []
  
    # If not set, nextcloud deployment one will be set
    # affinity: {}
  
  service:
    type: ClusterIP
    port: 8080
    loadBalancerIP: nil
    nodePort: nil
  
  ## Enable persistence using Persistent Volume Claims
  ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
  ##
  persistence:
    # Nextcloud Data (/var/www/html)
    enabled: true
    annotations: {}
    ## nextcloud data Persistent Volume Storage Class
    ## If defined, storageClassName: &lt;storageClass&gt;
    ## If set to &quot;-&quot;, storageClassName: &quot;&quot;, which disables dynamic provisioning
    ## If undefined (the default) or set to null, no storageClassName spec is
    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
    ##   GKE, AWS &amp; OpenStack)
    ##
    storageClass: &quot;linode-block-storage&quot;
  
    ## A manually managed Persistent Volume and Claim
    ## Requires persistence.enabled: true
    ## If defined, PVC must be created manually before volume will be bound
    # existingClaim:
  
    accessMode: ReadWriteOnce
    size: 20Gi
  
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
    # requests:
    #  cpu: 100m
    #  memory: 128Mi
  
  ## Liveness and readiness probe values
  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
  ##
  livenessProbe:
    enabled: true
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
    successThreshold: 1
  readinessProbe:
    enabled: true
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
    successThreshold: 1
  startupProbe:
    enabled: false
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 30
    successThreshold: 1
  
  
  ## Enable pod autoscaling using HorizontalPodAutoscaler
  ## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
  ##
  hpa:
    enabled: false
    cputhreshold: 60
    minPods: 1
    maxPods: 10
  
  nodeSelector: {}
  
  tolerations: []
  
  affinity: {}
  
  
  ## Prometheus Exporter / Metrics
  ##
  metrics:
    enabled: false
  
    replicaCount: 1
    # The metrics exporter needs to know how you serve Nextcloud either http or https
    https: true
    timeout: 5s
  
    image:
      repository: xperimental/nextcloud-exporter
      tag: v0.3.0
      pullPolicy: IfNotPresent
  
    ## Metrics exporter resource requests and limits
    ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
    ##
    # resources: {}
  
    ## Metrics exporter pod Annotation and Labels
    # podAnnotations: {}
  
    # podLabels: {}
  
    service:
      type: ClusterIP
      ## Use serviceLoadBalancerIP to request a specific static IP,
      ## otherwise leave blank
      # loadBalancerIP:
      annotations:
        prometheus.io/scrape: &quot;true&quot;
        prometheus.io/port: &quot;9205&quot;
      labels: {}
  </code></pre>
  <p>And that's my ingress rule:</p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.ingress.kubernetes.io/proxy-body-size: 4G
      kubernetes.io/tls-acme: &quot;true&quot;
      cert-manager.io/cluster-issuer: letsencrypt-prod
      nginx.ingress.kubernetes.io/server-snippet: |-
          server_tokens off;
          proxy_hide_header X-Powered-By;
  
          rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
          rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
          rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
          location = /.well-known/carddav {
            return 301 $scheme://$host/remote.php/dav;
          }
          location = /.well-known/caldav {
            return 301 $scheme://$host/remote.php/dav;
          }
          location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
          }
          location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
            deny all;
          }
          location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
            deny all;
          }
    name: wa-stack-cloud-ingress-nginx
    namespace: business
  spec:
    tls:
    - hosts:
        - cloud.my-domain.io
      secretName: wa-cloud-tls
    rules:
      - host: cloud.my-domain.io
        http:
          paths:
            - path: /
              pathType: Prefix
              backend:
                service:
                  name: nextcloud
                  port:
                    number: 8080
  </code></pre>