nextcloud/all-in-one · error · InvalidSettingConfigurationException

The domain is not reachable on Port 443 from within this con

Error message

The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.

What it means

In ConfigurationManager::setDomain() (when validation is not skipped): the mastercontainer must be able to open a TCP connection to the domain on port 443 within 10 seconds (@fsockopen). Failure throws this exception → HTTP 422. DNS resolution already succeeded (earlier checks passed), so this is purely a connectivity failure: port 443 not forwarded or firewalled, nothing listening on 443, or NAT loopback (hairpinning) not working so the container cannot reach its own public IP from inside the LAN.

Source

Thrown at php/src/Data/ConfigurationManager.php:659

            }

            // Get the apache port
            $port = $this->apachePort;

            if (!filter_var($dnsRecordIP, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                if ($port === '443') {
                    throw new InvalidSettingConfigurationException("It seems like the ip-address of the domain is set to an internal or reserved ip-address. This is not supported by the domain validation. (It was found to be set to '" . $dnsRecordIP . "'). Please set it to a public ip-address so that the domain validation can work or skip the domain validation!");
                } else {
                    error_log("Info: It seems like the ip-address of " . $domain . " is set to an internal or reserved ip-address. (It was found to be set to '" . $dnsRecordIP . "')");
                }
            }

            // Check if port 443 is open
            $connection = @fsockopen($domain, 443, $errno, $errstr, 10);
            if ($connection) {
                fclose($connection);
            } else {
                throw new InvalidSettingConfigurationException("The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.");
            }

            // Get Instance ID
            $instanceID = $this->getAndGenerateSecret('INSTANCE_ID');

            // set protocol
            if ($port !== '443') {
                $protocol = 'https://';
            } else {
                $protocol = 'http://';
            }

            // Check if response is correct
            $testUrl = $protocol . $domain . ':443';
            $errorMessage = '';
            $guzzleClient = new Client(['connect_timeout' => 10, 'timeout' => 10, 'http_errors' => false]);
            try {
                $guzzleResponse = $guzzleClient->get($testUrl);

View on GitHub (pinned to 6b788eec5e)

Solutions

Forward 443/tcp on the router/firewall to the host and confirm the AIO apache container is running and listening
Test reachability from the host and from inside the container: 'curl -sv telnet://cloud.example.com:443' or 'nc -vz cloud.example.com 443'
If 443 works from outside but not from inside your LAN, NAT loopback is broken — set up split-brain DNS and configure the Docker daemon.json to use the local DNS server, as the message suggests
As a workaround for unreachable-from-inside networks, use the 'skip domain validation' option

Example fix

# before
router: no 443/tcp forwarding to the host
# after
router: forward 443/tcp -> <host-lan-ip>:443

Defensive patterns

Strategy: try-catch

Validate before calling

// Probe reachability exactly like the mastercontainer will
$probe = @fsockopen($domain, 443, $errno, $errstr, 10);
if ($probe === false) {
    $errors[] = "Port 443 unreachable ($errstr) — fix forwarding/NAT loopback first";
} else {
    fclose($probe);
}

Type guard

function isInvalidSettingConfigurationException(\Throwable $e): bool {
    return $e instanceof \AIO\Data\InvalidSettingConfigurationException;
}

Try / catch

use AIO\Data\InvalidSettingConfigurationException;

try {
    $configurationManager->setDomain($domain, $skipDomainValidation);
} catch (InvalidSettingConfigurationException $e) {
    // connectivity failure inside the container — guide the user to
    // port forwarding / hairpinning docs or the skip option
    $formErrors[] = $e->getMessage();
}

Prevention

Forward 443/tcp on the router/firewall before starting domain validation
Verify hairpinning by connecting to the public domain:443 from inside the LAN
If hairpinning is impossible, deploy split-brain DNS + Docker daemon.json DNS or skip validation

When it happens

Trigger: Router/firewall has no 443/tcp forwarding to the host; the AIO apache container is stopped so nothing listens on 443; NAT loopback broken — connecting from inside the LAN to the own public IP is blocked by the router; outbound traffic on 443 blocked from the Docker network.

Common situations: First-time setup before port forwarding was configured; ISP routers without hairpinning support; cloud servers whose security group still blocks 443.

Related errors

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/aa1ec193edc5a78b. Report an issue: GitHub.