Reverse proxy communication through a Docker network

[nicolasblandamour]

I was wondering it would be possible in the future to use a Docker network for communication between the reverse proxy and the Apache container when the reverse proxy is hosted in a Docker container. This would allow to not expose any port on the host as the communication between the reverse proxy (running in Docker) and the Apache container (running in Docker too) would be done using a standard bridge Docker network.

I am not an expert with the Docker API, but I guess it should be technically possible to specify an external Docker network when the Apache container is created (such a network could be defined using an extra APACHE_EXTERNAL_DOCKER_NETWORK environment variable in the master container configuration). This network would be used only by the Apache container and all AIO containers would share the already existing network for inner AIO communication.

I think it would a nice feature for security purposes. When the reverse proxy is being run in Docker, we currently have two options according to reverse proxy documentation:

1. Use --add-host=host.docker.internal:host-gateway to allow to reach the host from the container to finally reach the exposed Apache container
2. Use host network mode for the reverse proxy

I successfully used the first solution, but it requires to have APACHE_IP_BINDING set to 0.0.0.0. Therefore, it exposes the Apache container to all interfaces in HTTP. If a firewall is not properly set to refuse external connections to APACHE_PORT, this leads to a security issue. Keeping the communication within a Docker network would fix this and remove the need to add the host.docker.internal:host-gateway to the reverse proxy container. This would also allow to not expose any port (requested in #4238)

[szaimen]

Hi, this is already possible by adding the reverse proxy container to the nextcloud-aio network, setting --env APACHE_PORT=11000 targeting http://nextcloud-aio-apache:$APACHE_PORT and skipping the domain validation with --env SKIP_DOMAIN_VALIDATION=true. It is not documented because obviously the domain validation will not work in that case.