secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-30 00:19:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(nextcloud): remove Authelia auth_request gate so mobile clients work (closes #394)

Browse Source 
The official Nextcloud mobile client (Android/iOS) uses HTTP Basic with
an app-password and does NOT carry browser SSO cookies. With the
auth_request gate on `location /` in the NC public vhost, every
/remote.php/webdav/* and /ocs/* call returned 401 → redirect to
sso.gk2.secubox.in/, which the mobile client can't render → auth
lockout loop. The phone then triggered NC's own bruteforce throttle.

Comment out (don't delete) the 4 SSO-related lines in `location /`:
  - auth_request /__sbx_auth_verify;
  - error_page 401 = @sbx_auth_login;
  - auth_request_set $sbx_user ...
  - auth_request_set $sbx_groups ...
plus the two proxy_set_header X-Forwarded-User/Groups inside the
proxy block.

The @sbx_auth_login + /__sbx_auth_verify blocks below are kept for
revert symmetry — uncomment the four lines + the X-Forwarded-User/
Groups to restore SSO. NC handles its own web login + 2FA + (newly
disabled at runtime) bruteforce protection.

Verified on gk2 after the live fix:
  curl -A 'Nextcloud-android' https://nc/status.php → 200 OK
  curl -A 'Nextcloud-android' https://nc/remote.php/webdav/ → 401
    (correct — NC's own Basic auth challenge)

Trade-off (flagged in #394 issue): drops SSO for desktop browser
users too. They go to NC's own login page. To preserve SSO on
desktop while opening mobile-only paths (/remote.php/*, /ocs/*,
/public.php/*) is more complex and deferred to a follow-up.

Bumped secubox-nextcloud 1.3.4 → 1.3.5.
This commit is contained in:
CyberMind-FR 2026-05-27 16:15:05 +02:00
parent d20aacf8cf
commit 7e8c9767ba
2 changed files with 38 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
packages/secubox-nextcloud/debian/changelog
View File

@ -1,3 +1,21 @@
secubox-nextcloud (1.3.5-1~bookworm1) bookworm; urgency=medium
* nginx/nextcloud-vhost.conf: remove Authelia auth_request gate
from the public NC vhost (closes #394). The official Nextcloud
mobile client (Android/iOS) uses HTTP Basic with an app-password
and does NOT carry browser SSO cookies — the SSO gate caused an
auth lockout loop on every smartphone sync attempt.
* NC handles its own web auth (login page + 2FA) and its own
bruteforce protection. Comment-out preserves the original
auth_request + auth_request_set + error_page 401 lines for
easy revert (see in-file comment block for the desktop-vs-mobile
trade-off).
* Companion runtime fix applied to gk2 + NC bruteforce table
truncated; operator re-enables auth.bruteforce.protection
after confirming mobile reconnect.
-- Gerald KERMA <devel@cybermind.fr> Wed, 27 May 2026 21:00:00 +0000
secubox-nextcloud (1.3.4-1~bookworm1) bookworm; urgency=low
* Rewrite Description to identify this as the self-hosted Nextcloud

30
packages/secubox-nextcloud/nginx/nextcloud-vhost.conf
View File

@ -41,15 +41,25 @@ server {
alias /usr/share/secubox/www/shared/;
}
# Nextcloud Apache proxied to the LXC at root. Gated by Authelia SSO
# via secubox-authelia's /verify socket. 401 → 302 to /auth/ on the
# canonical hub vhost (admin.gk2.secubox.in).
# Nextcloud Apache proxied to the LXC at root. NC handles its own
# auth (web login, app-passwords for mobile, OAuth) — no SSO gate.
#
# Authelia auth_request was removed in #394 because the official
# Nextcloud mobile client (Android/iOS) uses HTTP Basic with an
# app-password and does NOT carry browser SSO cookies. With the
# auth_request gate every /remote.php/webdav/* and /ocs/* call
# returned 401 → redirected to sso.gk2.secubox.in/, which the
# mobile client can't render → auth lockout loop.
#
# The unused @sbx_auth_login + /__sbx_auth_verify blocks below are
# kept for revert symmetry — uncomment the four lines below + the
# ones in those blocks if you want SSO back. See #394 commit body
# for the desktop-vs-mobile trade-off note.
location / {
auth_request /__sbx_auth_verify;
error_page 401 = @sbx_auth_login;
auth_request_set $sbx_user $upstream_http_remote_user;
auth_request_set $sbx_groups $upstream_http_remote_groups;
# auth_request /__sbx_auth_verify; # disabled in #394 (mobile NC client)
# error_page 401 = @sbx_auth_login; # disabled in #394
# auth_request_set $sbx_user $upstream_http_remote_user; # disabled in #394
# auth_request_set $sbx_groups $upstream_http_remote_groups; # disabled in #394
proxy_pass http://10.100.0.21:80/;
proxy_http_version 1.1;
@ -58,8 +68,8 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-User $sbx_user;
proxy_set_header X-Forwarded-Groups $sbx_groups;
# proxy_set_header X-Forwarded-User $sbx_user; # disabled in #394 (auth_request gone)
# proxy_set_header X-Forwarded-Groups $sbx_groups; # disabled in #394
proxy_read_timeout 300s;
client_max_body_size 0; # large Nextcloud uploads
proxy_request_buffering off;