nextcloud / nextcloud/nextcloud-talk-recording

Firefox 145 hangs on driver.get when public DNS zone serves HTTPS RR with alpn=h3 (Cloudflare-managed domains behind reverse proxy)

Open Beginner friendly
#92 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug
Dominant language
Python
Stars
34
Forks
16
Avg merge
5d 5h
Merged PRs (30d)
4

Description

Description
The recording bot hangs indefinitely on driver.get() (manifesting as a 120s urllib3.exceptions.ReadTimeoutError and "Recording stopping before starting") on deployments where:
1. The Nextcloud public DNS zone is hosted on a provider that auto-publishes DNS HTTPS resource records (RFC 9460) advertising alpn=h3 — Cloudflare does this automatically for managed hosts.
2. The recording bot resolves the Nextcloud host to an internal reverse proxy (e.g. nginx / Nginx Proxy Manager) that only listens on TCP/443.

Firefox 145 honours the HTTPS RR (fetched via DoH for type-65 records, even when TRR/DoH for A records is disabled), combines the internal A-record IP with alpn=h3 from the HTTPS RR, and opens an HTTP/3 (QUIC over UDP/443) session. Since the reverse proxy does not listen on UDP/443, the QUIC packets are silently dropped, and Firefox keeps retrying QUIC with backoff without ever falling back to HTTP/2 within Selenium's read timeout.

Steps to reproduce
1. Run a Nextcloud instance whose public DNS zone is managed by Cloudflare (HTTPS RR with alpn=h3 is published automatically).
2. Place the Nextcloud host behind a reverse proxy that terminates TLS on TCP/443 only (no HTTP/3 / UDP/443).
3. Configure the recording bot so it resolves the Nextcloud host to the internal reverse-proxy IP.
4. Start a recording from a Talk call.

Expected behavior
The bot navigates to /index.php/call//recording, joins the call and starts recording.

Actual behavior
driver.get() never returns. After 120s the recording fails with "Recording stopping before starting":

urllib3.exceptions.ReadTimeoutError: HTTPConnectionPool(host='localhost', port=XXXXX): Read timed out. (read timeout=120)

MOZ_LOG=nsHttp:5,nsHostResolver:5 confirms the cause:

TRR Decode: ... HTTPS RR ... alpn=h3 ... (from Cloudflare-managed zone)
Http3Session::Init origin=<NC host>, alpn=h3, peerAddr=<internal proxy IP>
Http3Session::SetupTimer ... (repeated, no fallback to HTTP/2)

Suggested fix
The bot only ever navigates to a fixed internal URL
(/index.php/call//recording); HTTP/3 brings no benefit here and introduces this regression class on any Cloudflare-managed deployment behind a TCP-only reverse proxy. Disabling HTTP/3 and HTTPS-RR upgrade in Participant.startFirefox() resolves it completely:

options.set_preference('network.http.http3.enable', False)
options.set_preference('network.dns.upgrade_with_https_rr', False)
options.set_preference('network.dns.use_https_rr_as_altsvc', False)
options.set_preference('network.dns.echconfig.enabled', False)

Alternatively, expose this as a [recording] disable_http3 = true config knob.
I have verified that these four preferences fully resolve the hang, with no other changes, on Firefox 145 / Talk Server 22 / Nextcloud 32. BiDi and everything else work normally once HTTP/3 is out of the path.

Environment
• Nextcloud Talk Recording: 0.2.1
• Talk Server: 22.x
• Nextcloud: 32.x
• Firefox: 145 (Alpine package)
• Reverse proxy: Nginx Proxy Manager (TCP/443 only)
• Public DNS: Cloudflare (HTTPS RR auto-published)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at Participant.startFirefox() and inspect how Firefox options are configured for the recording bot. Reproduce the driver.get() hang with Firefox 145, a Cloudflare-managed DNS zone, and a TCP-only reverse proxy, then verify that recording reaches the call URL and starts without the 120-second timeout.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.