Nextcloud login TTFB very high (~30 sec) after a few hours via SSL + NGINX

[razem-io]

Hello,

I am very sorry to post such an issue, as I fear it is a problem with my setup but I am trying to fix this since 3 months now and I am left out of ideas.

I have the following problem:

• TTFB after one day is at ~30 sec. It slowly raises from ~650 ms after a docker service restart. Restarting or removing/creating the containers won't fix it only a docker service restart.
• TTFB won't get higher or lower. It just takes ~30 sec to login no matter what, even if the server is under some load.
• If I access nextcloud via the exposed container port 80 (without nginx proxy) TTFB resides at about ~400ms.
• The TTFB is only high when I try to login. Everything else is < ~1 sec.
• other applications like rocket.chat, kanboard, openldap, discourse work flawlessly with ssl enabled, nginx reverse proxy and openldap

My Setup:

• Ubuntu LTS 14.04
• Docker version 1.12.5, build 7392c3b
• user login via openldap
• tested with NGINX 1.5.9, NGINX 1.10.3 and docker jwilder/nginx-proxy
• tested with docker wonderfall/nextcloud:11.0 and docker nextcloud:11.0
• tested with acpu cache and redis cache
• using system cron
• lets encrypt ssl
• 8 GB RAM
• quad amd 2.4 GHZ

What I tried so far:

• moving everything to an SSD (volumes + /var/lib/docker)
• exchangend acpu with redis
• tried nextcloud 10 and 11 (with 11 it gets even worse because of removed asset pipelining I guess)
• tried various nginx versions
• tried to enable http2 but I can't get it to work with nginx reverse proxy
• switched from wonderfall/nextcloud to this image
• tried to disable ssl but which makes it faster but still results in TTFB > ~30sec
• checked iotop (all good and normal)
• checked htop (all good and normal)

Thanks for any help!

[pierreozoux]

You issue is the brute force protection I guess, Try reinitate it.

…

On 01-02-2017 11:26, Julian Liebl wrote: Hello, I am very sorry to post such an issue, as I fear it is a problem with my setup but I am trying to fix this since 3 months now and I am left out of ideas. *I have the following problem:* * TTFB after one day is at ~30 sec. It slowly raises from ~650 ms after a docker service restart. *Restarting or removing/creating the containers won't fix it only a docker service restart.* * TTFB won't get higher or lower. It just takes ~30 sec to login no matter what, even if the server is under some load. * If I access nextcloud via the exposed container port 80 (without nginx proxy) TTFB resides at about ~400ms. * The TTFB is only high when I try to login. Everything else is < ~1 sec. * *other applications like rocket.chat, kanboard, openldap, discourse work flawlessly with ssl enabled, nginx reverse proxy and openldap* *My Setup:* * Ubuntu LTS 14.04 * Docker version 1.12.5, build 7392c3b * user login via openldap * tested with NGINX 1.5.9, NGINX 1.10.3 and docker jwilder/nginx-proxy * tested with docker wonderfall/nextcloud:11.0 and docker nextcloud:11.0 * tested with acpu cache and redis cache * using system cron * lets encrypt ssl * 8 GB RAM * quad amd 2.4 GHZ *What I tried so far:* * moving everything to an SSD (volumes + /var/lib/docker) * exchangend acpu with redis * tried nextcloud 10 and 11 (with 11 it gets even worse because of removed asset pipelining I guess) * tried various nginx versions * tried to enable http2 but I can't get it to work with nginx reverse proxy * switched from wonderfall/nextcloud to this image * tried to disable ssl but which makes it faster but still results in TTFB > ~30sec * checked iotop (all good and normal) * checked htop (all good and normal) Thanks for any help! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#31>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABxvHQ5xa1ub5IR7d1kSyMVuPt9eNQpRks5rYGvmgaJpZM4LzwV9>.

-- I use PGP to protect our privacy, if you want to know more, you can follow this https://emailselfdefense.fsf.org/en/ If you have further questions, please do not hesitate to ask. You can verify my public key here: https://keybase.io/pierreozoux

[razem-io]

Oh my! I never thought it might be the brute force protection. Thank you! I set the following in my config and restarted the server: 'auth.bruteforce.protection.enabled' => false but the issue is still there.

I guess the issue will resolve in 12 hours? I will report back if this is the case.

[razem-io]

I deleted the brute force entries manually. It works! Thank you a 1000 times!

[banto6]

Hello, I also have the same problem as you. Can you tell me a little bit about the solution @razem-io

[razem-io]

@buyi998 As described above set the following option in the nextcloud config file:

'auth.bruteforce.protection.enabled' => false

The entries which trigger the bruteforce protection are in the databse (in my case mariadb). I deleted the false login entries manually and everything works. Those entries will also be ignored after sometime (12 h). So you can either just wait or delete them manually.

[banto6]

@razem-io Although the problem still exists after the amendment, but thank you for your answer, thank you