Nextcloud: notify_push advertises ws://127.0.0.1/push to clients, so desktop clients reject it #8272

Steps to reproduce

• Install and configure the Nextcloud module with a public hostname (e.g. cloud.example.org) over HTTPS
• Connect the Nextcloud desktop client (tested with 35.0.0 on macOS) to the instance
• Look at the client log (nextcloud.log)

Expected behavior

The notify_push capability gives clients the public endpoint, e.g. wss://cloud.example.org/push/ws, and the desktop client receives file change notifications in real time.

Actual behavior

The capability gives clients the in-pod address, and the desktop client refuses it:

[ warning nextcloud.sync.account account.cpp:363 ]: Reject insecure push notifications websocket endpoint QUrl("ws://127.0.0.1/push/ws") for account QUrl("https://cloud.example.org")

The client then falls back to polling, so push notifications never work for any client. A remote client could not reach 127.0.0.1 anyway, even if it accepted ws://.

The cause is imageroot/actions/configure-module/90apps_management:

occ -n notify_push:setup http://127.0.0.1/push

notify_push stores this URL as base_endpoint and uses it for two different things:

1. Its self-test, where Nextcloud talks to the push server inside the pod. The internal URL is fine for this.
2. The websocket endpoint it advertises to clients in its capabilities. Here it has to be the public https://<host>/push URL.

Because the action runs on every configure-module, setting the value by hand (occ notify_push:setup https://<host>/push or occ config:app:set notify_push base_endpoint ...) is overwritten on the next configure or update.

#8017 concluded that the "unencrypted http" self-test warning could be ignored because everything runs inside the pod. That holds for the self-test but not for the endpoint sent to clients.

The public side already works. Traefik routes the module's host to its nginx, and nginx proxies location ^~ /push/ to notify_push on 127.0.0.1:7867. On a 1.7.8 instance, a WebSocket upgrade request to https://<host>/push/ws gets 101 Switching Protocols. Only the URL advertised to clients is wrong.

Possible fix: run notify_push:setup with the module's configured public host (https://<host>/push) in place of http://127.0.0.1/push, so clients are given wss://<host>/push/ws.

Components

Nextcloud 1.7.8 (Nextcloud 33.0.10), Nextcloud desktop client 35.0.0 (macOS)

See also

• ns8-nextcloud: notify_push never configured after module setup #8017
• https://github.com/nextcloud/notify_push#configuration