[Podman-Docker] Can't pass `trusted_proxy` test during notify_push:setup

[urbenlegend]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. I am attempting to setup notify_push with the community Docker. I am using the following docker-compose

2. I've added the https://nextcloud.example.com/push/ location into my Nginx Proxy Manager instance which is in the same proxied podman network as my other Nextcloud containers.

3. When I attempt to run occ notify_push:setup https://nextcloud.example.com/push, it fails the trusted_proxy check

✓ redis is configured
✓ push server is receiving redis messages
✓ push server can load mount info from database
✓ push server can connect to the Nextcloud server
🗴 push server is not a trusted proxy by Nextcloud or another proxy in the chain.
  Nextcloud resolved the following client address for the test request: "10.89.2.7" instead of the expected "1.2.3.4" test value.
  The following trusted proxies are currently configured: 
  The following x-forwarded-for header was received by Nextcloud: "1.2.3.4"
    from the following remote: 10.89.2.7

  10.89.2.7 is not trusted as a reverse proxy by Nextcloud
  See https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html#defining-trusted-proxies for how to add trusted proxies.

  If you're having issues getting the trusted proxy setup working, you can try bypassing any existing reverse proxy
  in your setup by setting the `NEXTCLOUD_URL` environment variable to point directly to the internal Nextcloud webserver url
  (You will still need the ip address of the push server added as trusted proxy)

10.89.2.7 is the internal IP address of the container running notify_push. I don't know why that needs to be added as a trusted proxy since it isn't my actual reverse proxy. Even if I wanted to add it, that IP is dynamically allocated by the container runtime and will change, making my docker-compose hard to use.

I've followed numerous guides and most say that between containers I just need to use the internal hostname defined by the compose file and it should work

Expected behaviour

I should be able to enable notify_push

Actual behaviour

notify_push fails setup with push server is not a trusted proxy

Server configuration

I am using the community Docker.

Nextcloud version: 32

List of activated apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.0.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.2
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notifications: 5.0.0-dev.0
  - notify_push: 1.2.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocuments: 9.0.0
  - richdocumentscode: 25.4.504
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - spreed: 22.0.0
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0
  - text: 6.0.0-dev.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - whiteboard: 1.2.1
  - workflowengine: 2.14.0
Disabled:
  - encryption: 2.20.0 (installed 2.19.0)
  - files_external: 1.24.0
  - tasks: 0.16.1 (installed 0.16.1)
  - user_ldap: 1.23.0

Nextcloud configuration

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.example.com",
            "nextcloud"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.0.13",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": true,
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 3,
        "default_phone_region": "US",
        "theme": "",
        "app_install_overwrite": [
            "bruteforcesettings",
            "richdocumentscode",
            "tasks"
        ],
        "maintenance": false,
        "loglevel": 2,
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/nextcloud.example.com"
    }
}

Browser

Browser name: Chrome

Browser version: 140

Operating system: Arch Linux

[ancow]

I've added the following to my Nextcloud container's environment:

  nextcloud:
    environment:
      TRUSTED_PROXIES: "127.0.0.1 172.25.0.0/16"

That adds the entire 172.25.*.* range as trusted proxies. It's a bit permissive, so feel free to restrict it to your network(s) as appropriate.