[Bug]: Real clients IPs behind cloudflare issues --> forbidden access to public shares about server

[kesselb]

I see several apps in app_install_overwrite. That means those apps are enabled even if they are not declared as compatible with Nextcloud 29. You may want to go over the list and see if the apps are really compatible. There is a log message about files_accesscontrol. Is there maybe a rule configured to block access for a given file?

[l3ochan]

I know the log line is about file access controls but with the same link and without making any modifications to access controls of the file when I remove the config to get the read clients IPs, it starts to show the files and there's no error in the logs. This is caused by the server getting IPs moved around in the header. I don't understand why it's doing this.

[joshtrichards]

    RemoteIPHeader CF_CONNECTING_IP
    RemoteIPTrustedProxy 127.0.0.1 ::1

  'forwarded_for_headers' =>
  array (
    0 => 'HTTP_CF_CONNECTING_IP',
  ),

So you're trying to use Apache's header overrides and Nextcloud's trusted_proxies support simultaneously? Is that really what you want? Those would seem to be in conflict (or at least redundant).

[kesselb]

I know the log line is about file access controls but with the same link and without making any modifications to access controls of the file when I remove the config to get the read clients IPs, it starts to show the files and there's no error in the logs.

Did you configure a file_accesscontrol rule using remote address? ¹

If Nextcloud was seeing the internal IP address before and now the right one, then you may have to update existing rules.

Those would seem to be in conflict (or at least redundant).

I think that depends. If mod_remoteip rewrites the REMOTE_ADDR header, then it's not possible anymore to use the trusted proxies feature because it's already handled before.

Footnotes

1. https://github.com/nextcloud/server/blob/master/apps/workflowengine/lib/Check/RequestRemoteAddress.php ↩

[l3ochan]

Did you configure a file_accesscontrol rule using remote address?

I did not, I don't use workflows

So you're trying to use Apache's header overrides and Nextcloud's trusted_proxies support simultaneously? Is that really what you want? Those would seem to be in conflict (or at least redundant).

I think that depends. If mod_remoteip rewrites the REMOTE_ADDR header, then it's not possible anymore to use the trusted proxies feature because it's already handled before.

So before doing anything in nextcloud's config file I tried with apache only and had the same issue but regardless of if you have both, only apache or nextcloud's config, the result is exactly the same.

UPDATE, I just tried it out and its partially working but I'm still getting errors in the logs, here is one

{"reqId":"Zk5R9mejtkTAmSoG5zq0jAAAAAA","level":3,"time":"2024-05-22T20:13:42+00:00","remoteAddr":"*RECACTED*","user":"Leo","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/files/Leo/Cours","message":"Optional parameter $userId declared before required parameter $path is implicitly treated as a required parameter at /var/www/next.cloud.com/apps/deck/lib/Service/ConfigService.php#234","userAgent":"Mozilla/5.0 (Windows) mirall/3.13.0stable-Win64 (build 20240423) (Nextcloud, windows-10.0.22631 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"29.0.0.19","data":{"app":"PHP"},"id":"664e51fb7db20"}

so I only have the CF headers thingy in my nextcloud's config and its showing the right ips as expected and shares started working again ! But I'm still having logs entries like the one above and to my knowledge it doesn't make any sense...

[kesselb]

The last message will be fixed by an upcoming deck ap p update.