Your web server is not properly set up to resolve "/.well-known/caldav" or "/.well-known/carddav"

Describe your Issue

After installing the helm chart, I see warnings like this on /settings/admin/overview:

• Your web server is not properly set up to resolve "/.well-known/caldav". Further information can be found in the documentation ↗.
• Your web server is not properly set up to resolve "/.well-known/carddav". Further information can be found in the documentation ↗.

Logs and Errors

In my browser console, I see the following errors:

Refused to connect to 'http://[redacted]/remote.php/dav/' because it violates the following Content Security Policy directive: "connect-src 'self'".
Refused to connect to 'http://[redacted]/remote.php/dav/' because it violates the following Content Security Policy directive: "connect-src 'self'".
GET https://[redacted]/.well-known/nodeinfo 404 (Not Found)
GET https://[redacted]/data/.ocdata?t=1713053623792 404 (Not Found)
GET https://[redacted]/.well-known/webfinger 404 (Not Found)

Describe your Environment

• Kubernetes distribution: k3s

• Helm Version (or App that manages helm): Pulumi 3.108.1

• Helm Chart Version: 4.6.6

• values.yaml:

- cronjob:
    enabled: true
  externalDatabase:
    database: '[redacted]'
    enabled: true
    host: '[redacted]'
    password: '[redacted]'
    type: postgresql
    user: '[redacted]'
  ingress:
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.middlewares: default-strict-https@kubernetescrd
    enabled: true
    tls:
    - hosts:
      - '[redacted]'
      secretName: nextcloud-tls
  internalDatabase:
    enabled: false
  metrics:
    token: '[redacted]'
  nextcloud:
    configs:
      custom.config.php: "<?php\n$CONFIG = array (\n  // Traefik is the entrypoint\
        \ into our cluster. Trust its\n  // X-Forwarded-* headers.\n  'trusted_proxies'\
        \ => array(\n    0 => '127.0.0.1',\n    1 => '10.0.0.0/8',\n  ),\n  'forwarded_for_headers'\
        \ => array('HTTP_X_FORWARDED_FOR'),\n  // https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#default-phone-region\n\
        \  'default_phone_region' => 'US',\n  'maintenance_window_start' => 11,  //\
        \ 11am UTC = 3 or 4 am Pacific\n);\n"
    host: '[redacted]'
    password: '[redacted]'
    username: '[redacted]'
  persistence:
    enabled: true
    nextcloudData:
      enabled: true
      storageClass: manual
    storageClass: manual
  phpClientHttpsFix:
    enabled: true
  redis:
    auth:
      password: '[redacted]'
    enabled: true

Additional context, if any

The issue here is that my ingress (traefik) terminates https, and then initiates a http connection to my nextcloud service. This results in apache/nginx giving me redirects back to a http url, which my webbrowser refuses to follow thanks to the Content Security Policy (see above logs from my browser console). For example note how this https request gets a redirect to a http url:

$ curl -is https://[redacted]/.well-known/carddav | grep -i '^location:'
location: http://[redacted]/remote.php/dav/

This happens to me with both the apache and nginx flavors. Ideally, nextcloud could be configured to trust the X-Forwarded-Proto header. For example, in nginx, the fix would be to change this redirect to use the $http_x_forwarded_proto variable:

        location = /.well-known/carddav     { return 301 $http_x_forwarded_proto://$host/remote.php/dav/; }

Start with charts/nextcloud/templates/nginx-config.yaml around line 89 and inspect the equivalent Apache flavor configuration. Reproduce the redirect with the curl command from the issue through the Traefik ingress, then verify both /.well-known/caldav and /.well-known/carddav resolve to the DAV endpoint without redirecting to an internal HTTP URL.