CLOUD BACKUP & PHOTO LIBRARIES
HTTPS must work for the address your clients actually use. A certificate on the proxy alone does not fix incorrect forwarded headers or a Nextcloud instance generating HTTP links.
Quick answer
Choose the public or private hostname, obtain a valid certificate for it and configure the supported proxy settings. Test login, WebDAV and desktop synchronization through that same address.
Steps to follow
-
Before you start
Keep the original data available while following this procedure. Record the application version, account, source path and destination you are actually using. If an error is involved, save its exact wording. Use a small, non-sensitive sample first so that an unexpected result is easy to inspect without disturbing your working library.
-
Set up the right scope
Confirm DNS resolves to the intended endpoint and the certificate matches the hostname. Decide whether TLS terminates at Nextcloud’s web server, AIO’s documented setup or an existing reverse proxy.
-
Apply the relevant settings
Use the proxy configuration for your deployment. Add only the actual proxy addresses to trusted_proxies and preserve the documented forwarded headers. Set overwrite protocol or host only when the deployment requires it.
-
Complete the first run
Test a normal login, file upload, download and client connection using the final HTTPS URL. Examine Nextcloud’s overview for warnings and check links sent to another user.
Decisions and checks
The limitation that matters
trusted_domains is an allowed-host list, not a certificate installation. Do not add every client network to trusted_proxies or ignore certificate errors to make a test pass. Restrict the separate administration endpoint.
How to verify the result
Verify the certificate chain and renewal arrangement, then test from a second network where relevant. After proxy changes, check large uploads and WebDAV as well as the home page.
Keep the result reliable
After the first successful check, repeat the process with an ordinary working session or scheduled run. Record the date and the recovery location. Revisit the setup after changing devices, accounts, storage paths or software versions; yesterday’s successful job does not prove that a new configuration is covered.
Compare the options
| Situation / component | Purpose / action | What to check |
|---|---|---|
| Input | Preserve an unchanged sample | Know which account and location contain the original |
| Operation | Follow the procedure for your installed version | Review errors and skipped items, not only the completion message |
| Result | Open the resulting file or test the documented recovery route | Confirm that the content, version and access rights are correct |
Frequently asked questions
Can I remove the original immediately?
Keep it until you have verified the intended result and have an independent recovery copy where the data matters. A visible file name, a green icon or a completed task alone does not show that every needed item is recoverable.
What information helps if this fails?
Record the version, exact error, affected file type, available space and whether the same small sample works elsewhere. Share sanitized details through the official support route; passwords, recovery keys and private documents are not needed for an initial diagnosis.
Official documentation
This guide combines current official documentation with practical recovery checks. It does not claim hands-on testing of your installation. Menu labels and supported procedures can vary by release; follow the documentation for your installed version.