CyberMind-FR 7e8c9767ba fix(nextcloud): remove Authelia auth_request gate so mobile clients work (closes #394) ... The official Nextcloud mobile client (Android/iOS) uses HTTP Basic with an app-password and does NOT carry browser SSO cookies. With the auth_request gate on `location /` in the NC public vhost, every /remote.php/webdav/* and /ocs/* call returned 401 → redirect to sso.gk2.secubox.in/, which the mobile client can't render → auth lockout loop. The phone then triggered NC's own bruteforce throttle. Comment out (don't delete) the 4 SSO-related lines in `location /`: - auth_request /__sbx_auth_verify; - error_page 401 = @sbx_auth_login; - auth_request_set $sbx_user ... - auth_request_set $sbx_groups ... plus the two proxy_set_header X-Forwarded-User/Groups inside the proxy block. The @sbx_auth_login + /__sbx_auth_verify blocks below are kept for revert symmetry — uncomment the four lines + the X-Forwarded-User/ Groups to restore SSO. NC handles its own web login + 2FA + (newly disabled at runtime) bruteforce protection. Verified on gk2 after the live fix: curl -A 'Nextcloud-android' https://nc/status.php → 200 OK curl -A 'Nextcloud-android' https://nc/remote.php/webdav/ → 401 (correct — NC's own Basic auth challenge) Trade-off (flagged in #394 issue): drops SSO for desktop browser users too. They go to NC's own login page. To preserve SSO on desktop while opening mobile-only paths (/remote.php/*, /ocs/*, /public.php/*) is more complex and deferred to a follow-up. Bumped secubox-nextcloud 1.3.4 → 1.3.5.		2026-05-27 16:15:05 +02:00
..
nextcloud-vhost.conf	fix(nextcloud): remove Authelia auth_request gate so mobile clients work (closes #394)	2026-05-27 16:15:05 +02:00
nextcloud.conf	fix(secubox-nextcloud): v1.3.1 — split SecuBox config module from public app vhost (closes #282) (#283)	2026-05-21 07:34:48 +02:00