From 448d4ba76d6d0b86b8708a560bc8e0941a22941f Mon Sep 17 00:00:00 2001
From: Mauricio Siu <siumauricio@icloud.com>
Date: Wed, 8 Jul 2026 01:54:04 -0600
Subject: [PATCH] fix: oCIS crash-loop and https-only redirect behind Dokploy
 proxy

The container was restart-looping because the built-in IdP fatals with
"invalid iss value, URL must start with https://" when OCIS_URL uses
plain http, which caused the sustained 502.

- Set owncloud_url to https://${main_domain} so the IdP issuer is valid
  and ocis server stays up.
- oCIS 8.x unconditionally answers 308 -> https:// whenever it receives
  X-Forwarded-Proto: http (services/proxy https_redirect middleware), so
  the domain check then died on a redirect loop into a non-existent 443
  router. Add a small nginx gateway in front of oCIS that forwards
  requests with X-Forwarded-Proto: https (what a TLS-terminating proxy
  sends) and point the Dokploy domain at gateway:8080.
- Update the README notes accordingly.

Verified on a live Dokploy instance: deploy done, GET / returns
HTTP 200 with title "ownCloud".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../docker-compose.yml                        | 10 +++++
 .../owncloud-infinite-scale/template.toml     | 39 ++++++++++++++++---
 2 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/blueprints/owncloud-infinite-scale/docker-compose.yml b/blueprints/owncloud-infinite-scale/docker-compose.yml
index 5dadf076..30a1a4ee 100644
--- a/blueprints/owncloud-infinite-scale/docker-compose.yml
+++ b/blueprints/owncloud-infinite-scale/docker-compose.yml
@@ -1,6 +1,16 @@
 version: "3.8"
 
 services:
+  gateway:
+    image: nginx:1.27-alpine
+    restart: unless-stopped
+    depends_on:
+      - owncloud-infinite-scale
+    expose:
+      - "8080"
+    volumes:
+      - ../files/etc/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro
+
   owncloud-infinite-scale:
     image: owncloud/ocis:8.0.3
     restart: unless-stopped
diff --git a/blueprints/owncloud-infinite-scale/template.toml b/blueprints/owncloud-infinite-scale/template.toml
index 2096950c..12c77e37 100644
--- a/blueprints/owncloud-infinite-scale/template.toml
+++ b/blueprints/owncloud-infinite-scale/template.toml
@@ -1,15 +1,44 @@
 [variables]
 main_domain = "${domain}"
-owncloud_url = "http://${main_domain}"
+owncloud_url = "https://${main_domain}"
 admin_password = "${password:32}"
 log_level = "info"
 
 [[config.domains]]
-serviceName = "owncloud-infinite-scale"
-port = 9200
+serviceName = "gateway"
+port = 8080
 host = "${main_domain}"
 path = "/"
 
+[[config.mounts]]
+filePath = "/etc/nginx/conf.d/default.conf"
+content = """
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  "" close;
+}
+
+server {
+  listen 8080;
+  client_max_body_size 0;
+  proxy_request_buffering off;
+
+  location / {
+    proxy_pass http://owncloud-infinite-scale:9200;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+  }
+}
+"""
+
 [[config.mounts]]
 filePath = "README.md"
 content = """# ownCloud Infinite Scale
@@ -18,11 +47,11 @@ This template deploys ownCloud Infinite Scale (oCIS), a modern file sync and sha
 
 ## Access
 
-- URL: `http://${main_domain}`
+- URL: `https://${main_domain}`
 - Admin user: `admin`
 - Admin password: the generated `admin_password` value
 
-The `owncloud_url` value is written into the initial oCIS configuration. Set it to `https://${main_domain}` before the first deployment if your Dokploy domain enforces TLS. Change it before the first deployment if your public URL is different, because `ocis init` does not rewrite an existing `ocis.yaml` file.
+The `owncloud_url` value must use `https://` because oCIS only supports HTTPS public URLs (its built-in identity provider rejects plain HTTP issuers). A bundled nginx gateway sits in front of oCIS and forwards requests with `X-Forwarded-Proto: https`, which keeps oCIS from redirecting every request when it runs behind the Dokploy proxy. Enable HTTPS on the Dokploy domain so the public URL matches `OCIS_URL`.
 
 ## Storage