Hey @lochnar187
Congrats on getting that running Nextcloud + Collabora in Docker is a satisfying stack to see working together.
Yes, this is totally doable and simpler than most guides make it look. The core idea is: generate a self-signed cert, then put a reverse proxy (Nginx is the easiest) in front of your containers to terminate SSL. Here’s a walkthrough for a local/LAN setup.
Step 1: Generate the self-signed cert
From your Docker host, create a cert that covers your local hostname or IP:
mkdir -p ~/certs
openssl req -x509 -nodes -days 365 \
-newkey rsa:2048 \
-keyout ~/certs/selfsigned.key \
-out ~/certs/selfsigned.crt \
-subj "/CN=nextcloud.local" \
-addext "subjectAltName=DNS:nextcloud.local,IP:192.168.1.100"
Replace 192.168.1.100 with your actual host IP. The subjectAltName is important — modern browsers reject certs without it. If you access it by IP only, you still want it listed there.
Step 2: Add an Nginx reverse proxy container
In your docker-compose.yml, add something like this alongside your existing Nextcloud and Collabora services:
nginx-proxy:
image: nginx:alpine
ports:
- "443:443"
volumes:
- ~/certs:/etc/nginx/certs:ro
- ./nginx.conf:/etc/nginx/nginx.conf:ro
depends_on:
- nextcloud
- collabora
Step 3: Create the Nginx config
Create nginx.conf next to your compose file:
events {}
http {
upstream nextcloud {
server nextcloud:80; # matches your container name
}
upstream collabora {
server collabora:9980; # default Collabora port
}
server {
listen 443 ssl;
server_name nextcloud.local;
ssl_certificate /etc/nginx/certs/selfsigned.crt;
ssl_certificate_key /etc/nginx/certs/selfsigned.key;
client_max_body_size 10G;
location / {
proxy_pass http://nextcloud;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
server {
listen 9980 ssl;
server_name nextcloud.local;
ssl_certificate /etc/nginx/certs/selfsigned.crt;
ssl_certificate_key /etc/nginx/certs/selfsigned.key;
location / {
proxy_pass http://collabora;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
}
The WebSocket headers (Upgrade/Connection) on the Collabora block are essential — Collabora uses WebSockets for the live document editing.
Step 4: Tell Nextcloud it’s behind HTTPS
In your Nextcloud config.php (or via environment variables), make sure these are set:
'overwriteprotocol' => 'https',
'trusted_domains' => ['nextcloud.local', '192.168.1.100'],
'trusted_proxies' => ['nginx-proxy'],
Step 5: Deal with the browser warning
Since it’s self-signed, browsers will complain. You have two options: just click through the warning each time, or (the nicer path) import selfsigned.crt into your OS/browser trust store. On Linux that’s typically copying it to /usr/local/share/ca-certificates/ and running update-ca-certificates. On macOS, add it to Keychain and mark it trusted. On Windows, import it into Trusted Root Certification Authorities.
Optional but handy: add 192.168.1.100 nextcloud.local to /etc/hosts on any machine that needs to reach it, so you can use the hostname instead of the IP.
The key thing that makes this simpler than the enterprise guides is: no Let’s Encrypt, no domain registrar, no ACME challenges. Just OpenSSL, one Nginx config, and a cert you trust manually. Let me know if you hit any snags getting it wired up.
Let me know if this still confussion with SSL setup
Thanks
Darshan
