{"record":{"id":"984a419082115b3a","repo":"nextcloud/all-in-one","slug":"domain-does-not-point-to-this-server-or-the-revers-984a41","errorCode":null,"errorMessage":"Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer') If you should be using Cloudflare, make sure to disable the Cloudflare Proxy feature as it might block the domain validation. Same for any other firewall or service that blocks unencrypted access on port 443.","messagePattern":"Domain does not point to this server or the reverse proxy is not configured correctly\\. See the mastercontainer logs for more details\\. \\('sudo docker logs -f nextcloud-aio-mastercontainer'\\) If you should be using Cloudflare, make sure to disable the Cloudflare Proxy feature as it might block the domain validation\\. Same for any other firewall or service that blocks unencrypted access on port 443\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"error","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":695,"sourceCode":"                $guzzleResponse = $guzzleClient->get($testUrl);\n                # Get rid of trailing \\n\n                $response = str_replace(\"\\n\", \"\", (string)$guzzleResponse->getBody());\n            } catch (TransferException $e) {\n                $response = '';\n                $errorMessage = 'The error message was: ' . $e->getMessage();\n            }\n\n            if ($response !== $instanceID) {\n                error_log('The response of the connection attempt to \"' . $testUrl . '\" was: ' . $response);\n                error_log('Expected was: ' . $instanceID);\n                error_log($errorMessage);\n                $notice = \"Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. ('sudo docker logs -f nextcloud-aio-mastercontainer')\";\n                if ($port === '443') {\n                    $notice .= \" If you should be using Cloudflare, make sure to disable the Cloudflare Proxy feature as it might block the domain validation. Same for any other firewall or service that blocks unencrypted access on port 443.\";\n                } else {\n                    error_log('Please follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#how-to-debug in order to debug things!');\n                }\n                throw new InvalidSettingConfigurationException($notice);\n            }\n        }\n\n        $this->startTransaction();\n        // Write domain\n        // Don't set the domain via the attribute, or we create a loop.\n        $this->set('domain', $domain);\n        // Reset the borg restore password when setting the domain\n        $this->borgRestorePassword = '';\n        $this->commitTransaction();\n    }\n\n    public function getBaseDN() : string {\n        $domain = $this->domain;\n        if ($domain === \"\") {\n            return \"\";\n        }\n        return 'dc=' . implode(',dc=', explode('.', $domain));","sourceCodeStart":677,"sourceCodeEnd":713,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L677-L713","documentation":"Same final INSTANCE_ID comparison in ConfigurationManager::setDomain() as the base notice, but this variant carries the Cloudflare suffix and occurs on default installs (APACHE_PORT = 443), where the validation request is deliberately plain http:// on port 443. Any proxy that intercepts or blocks unencrypted HTTP on 443 — most commonly the Cloudflare proxy (orange cloud), which answers TLS only — returns something other than the INSTANCE_ID and triggers the throw (HTTP 422). The mastercontainer log contains the actual response body and the expected value.","triggerScenarios":"Cloudflare proxy enabled for the A record: Cloudflare terminates TLS on 443 so the plain-HTTP validation request fails or returns a Cloudflare error page; TLS-terminating firewalls or middleboxes rejecting plaintext HTTP on 443; the domain pointing at a different web server that only speaks HTTPS.","commonSituations":"Domains managed via Cloudflare with default proxied records; corporate TLS-inspection appliances; other CDNs sitting in front of the origin server.","solutions":["In Cloudflare, switch the DNS record to 'DNS only' (grey cloud) so the plain-HTTP validation request on 443 reaches your server directly","Verify the A record points at this server's public IP and 443/tcp is forwarded to the AIO apache container","Disable any other firewall, CDN or middlebox that blocks unencrypted HTTP on port 443","If it still fails, check 'sudo docker logs -f nextcloud-aio-mastercontainer' for the actual vs expected response body"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Reproduce the check for a default (port 443) install: plain HTTP on 443\n$testUrl = 'http://' . $domain . ':443';\n$client = new \\GuzzleHttp\\Client(['http_errors' => false, 'connect_timeout' => 10, 'timeout' => 10]);\n$response = trim((string) $client->get($testUrl)->getBody());\nif ($response !== $instanceId) {\n    $errors[] = 'Something intercepts plain HTTP on 443 (e.g. Cloudflare proxy) — disable it first';\n}","typeGuard":"function isInvalidSettingConfigurationException(\\Throwable $e): bool {\n    return $e instanceof \\AIO\\Data\\InvalidSettingConfigurationException;\n}","tryCatchPattern":"use AIO\\Data\\InvalidSettingConfigurationException;\n\ntry {\n    $configurationManager->setDomain($domain, $skipDomainValidation);\n} catch (InvalidSettingConfigurationException $e) {\n    // message names Cloudflare proxy as the top suspect; check mastercontainer\n    // logs for the actual response, then have the user grey-cloud the record\n    $formErrors[] = $e->getMessage();\n}","preventionTips":["Keep the AIO DNS record 'DNS only' (grey cloud) in Cloudflare during domain validation","Do not put TLS-terminating middlewares in front of port 443 for the AIO domain","Confirm the A record targets this server's public IP before submitting the domain"],"tags":["php","nextcloud-aio","reverse-proxy","cloudflare","domain-validation","port-443"],"backgroundTag":"reverse-proxy-misconfiguration","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}