[Bug]: Error: This app cannot be enabled because it makes the server unstable

[oitconz]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Every app I try to enable via the web gui say, "Error: This app cannot be enabled because it makes the server unstable" or App with ID has invalid signature

Steps to reproduce

1. Log in as Admin user
2. Click Apps
3. Select enable from next to an app
4. Error occurs.

Expected behavior

app to install

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

This is a docker compose install: 

## Server configuration detail
**Operating system:** Linux 5.15.0-130-generic #140-Ubuntu SMP Wed Dec 18 17:59:53 UTC 2024 x86_64
**Webserver:** nginx/1.27.4 (fpm-fcgi)
**Database:** mysql 11.7.2
**PHP version:** 8.3.17
Modules loaded: Core, date, libxml, openssl, pcre, sqlite3, zlib, ctype, curl, dom, fileinfo, filter, hash, iconv, json, mbstring, SPL, session, PDO, pdo_sqlite, standard, posix, random, readline, Reflection, Phar, SimpleXML, tokenizer, xml, xmlreader, xmlwriter, mysqlnd, cgi-fcgi, apcu, bcmath, exif, ftp, gd, gmp, igbinary, imagick, intl, ldap, memcached, pcntl, pdo_mysql, pdo_pgsql, redis, sodium, sysvsem, zip, Zend OPcache
**Nextcloud version:** 31.0.0 - 31.0.0.18
**Updated from an older Nextcloud/ownCloud or fresh install:** 
**Where did you install Nextcloud from:** unknown
<details><summary>Signing status</summary>
[]
</details>

List of activated Apps

<details><summary>List of activated apps</summary>


Enabled:
 - activity: 4.0.0
 - app_api: 5.0.2
 - bruteforcesettings: 4.0.0
 - circles: 31.0.0-dev.0
 - comments: 1.21.0
 - contactsinteraction: 1.12.0
 - dashboard: 7.11.0
 - federation: 1.21.0
 - files_downloadlimit: 4.0.0
 - files_pdfviewer: 4.0.0
 - files_reminders: 1.4.0
 - files_sharing: 1.23.1
 - files_trashbin: 1.21.0
 - files_versions: 1.24.0
 - firstrunwizard: 4.0.0
 - logreader: 4.0.0
 - nextcloud_announcements: 3.0.0
 - notifications: 4.0.0
 - password_policy: 3.0.0
 - photos: 4.0.0-dev.1
 - privacy: 3.0.0
 - recommendations: 4.0.0
 - related_resources: 2.0.0
 - serverinfo: 3.0.0
 - sharebymail: 1.21.0
 - support: 3.0.0
 - survey_client: 3.0.0
 - systemtags: 1.21.1
 - text: 5.0.0
 - updatenotification: 1.21.0
 - user_status: 1.11.0
 - webhook_listeners: 1.2.0
Disabled:
 - admin_audit
 - calendar: 5.1.2
 - encryption
 - files_external
 - richdocuments: 8.6.2
 - suspicious_login
 - twofactor_nextcloud_notification
 - twofactor_totp
 - user_ldap
 - weather_status: 1.11.0


</details>
<details><summary>Configuration (config/config.php)</summary>


{
    "memcache.local": "\\OC\\Memcache\\APCu",
    "apps_paths": [
        {
            "path": "\/var\/www\/html\/apps",
            "url": "\/apps",
            "writable": false
        },
        {
            "path": "\/var\/www\/html\/custom_apps",
            "url": "\/custom_apps",
            "writable": true
        }
    ],
    "memcache.distributed": "\\OC\\Memcache\\Redis",
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "password": "***REMOVED SENSITIVE VALUE***",
        "port": 6379
    },
    "overwriteprotocol": "https",
    "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "465",
    "mail_smtpsecure": "tls",
    "mail_smtpauth": true,
    "mail_smtpauthtype": "LOGIN",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "upgrade.disable-web": true,
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "nextcloud.outsourcedit.co.nz"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "31.0.0.18",
    "overwrite.cli.url": "https:\/\/nextcloud.outsourcedit.co.nz",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "mail_sendmailmode": "smtp",
    "default_phone_region": "NZ"
}

</details>

**Cron Configuration:** 

Mode: cron
Last: 2025-03-05T02:15:03+00:00 (13 seconds ago)


**External storages:** files_external is disabled

**Encryption:** no

**User-backends:** 
 * OC\User\Database


**Subscription:** 
 * No valid subscription key set


**Browser:** Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0

## Setup checks

<details><summary>network</summary>

 * JavaScript modules support: Your webserver does not serve `.mjs` files using the JavaScript MIME type. This will break some apps by preventing browsers from executing the JavaScript files. You should configure your webserver to serve `.mjs` files with either the `text/javascript` or `application/javascript` MIME type.
 * .well-known URLs: Your web server is not properly set up to resolve `.well-known` URLs, failed on:
   `/.well-known/caldav`

</details>

<details><summary>system</summary>

 * Errors in the log: 5 errors in the logs since February 26, 2025, 3:15:17 PM
 * Maintenance window start: Server has no maintenance window start time configured. This means resource intensive daily background jobs will also be executed during your main usage time. We recommend to set it to a time of low usage, so users are less impacted by the load caused from these heavy tasks.
 * Mimetype migrations available: One or more mimetype migrations are available. Occasionally new mimetypes are added to better handle certain file types. Migrating the mimetypes take a long time on larger instances so this is not done automatically during upgrades. Use the command `occ maintenance:repair --include-expensive` to perform the migrations.

</details>

<details><summary>security</summary>

 * Forwarded for headers: Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation.
 * HTTP headers: Some headers are not set correctly on your instance
   - The `X-Robots-Tag` HTTP header is not set to `noindex,nofollow`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
   

</details>

<details><summary>database</summary>

 * Database version: MariaDB version "11.7.2-MariaDB-ubu2404" detected. MariaDB >=10.6 and <=11.4 is suggested for best performance, stability and functionality with this version of Nextcloud.

</details>

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

cat nextcloud.log 
{"reqId":"tdcjKsiqWqRZgkzcapyN","level":3,"time":"2025-03-05T02:24:30+00:00","remoteAddr":"172.18.0.10","user":"itsupport","app":"settings","method":"POST","url":"/settings/apps/enable","message":"could not enable apps","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0","version":"31.0.0.18","exception":{"Exception":"Exception","Message":"App with id contacts has invalid signature","Code":0,"Trace":[{"file":"/var/www/html/apps/settings/lib/Controller/AppSettingsController.php","line":526,"function":"downloadApp","class":"OC\\Installer","type":"->","args":["contacts"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":200,"function":"enableApps","class":"OCA\\Settings\\Controller\\AppSettingsController","type":"->","args":[["contacts"],[]]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":114,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Settings\\Controller\\AppSettingsController"},"enableApps"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Settings\\Controller\\AppSettingsController"},"enableApps"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":307,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Settings\\Controller\\AppSettingsController","enableApps",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"_route":"settings.appsettings.enableapps"}]},{"file":"/var/www/html/lib/base.php","line":1018,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/settings/apps/enable"]},{"file":"/var/www/html/index.php","line":24,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/lib/private/Installer.php","Line":338,"message":"could not enable apps","exception":{},"CustomMessage":"could not enable apps"}}

Additional info

No response

[susnux]

Might be unrelated but your server seems to be misconfigured, make sure that the server itself (e.g. the docker container) can connect to itself (e.g. switch into the docker container and try curl -I URL where URL is the cli.overwrite.url from your config.php - this must work.)

If that works then the mjs error points to a misconfiguration of your webserver - it seems you use NGinx instead of Apache (for Apache the htaccess is updated automatically).
For Nginx make sure that your configuration is similar to the one from the docs (especially the static file handling for e.g. mjs files: https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html )

[susnux]

⏫ you should still check this as there are setup check errors with your config.

Nevertheless the app installation problem is a duplicate of nextcloud/contacts#4372

[oitconz]

While my issue may be related to that issue #4372 it is different.
I'm getting : Error : The app cannot be enabled because it makes the server unstable.

I'm getting it for all apps.

To answer your question above : My cli.overwrite is connectable. it resolves to a ping and when using the curl -I is resolved ( but says closed)

HTTP/1.1 308 Permanent Redirect
Connection: close
Location: https://nextcloud.<redacted.domain>/
Server: Caddy
Date: Fri, 07 Mar 2025 04:57:53 GMT

/var/www/html/config # ping  nextcloud.<redacted domain>
PING nextcloud.<redacted domain> (210.XXX.XXX.XXX): 56 data bytes
64 bytes from 210.xxx.xxx.xxx: seq=0 ttl=63 time=0.620 ms

I had a previously successful nextcloud running using the exact same docker-compose file. I got notified the server is out of date (version 28?) and so started the update process after reading the docker update will handle the versions updates etc. Boy was I wrong. (BTW - for some reason a year ago nextcloud docker seemed to be installing old versions)

I blew away my DB folder and data folder, reloaded it from last nights backup but the issue was the deeper. The docker image was obviously ahead of the data. I didn't have a viable docker image / cache backup.

So blew away the data / db folder, just left the nginx and docker-compose and .env file in place and updated docker for a new install.

The new install causes this issue.

I can log into nextcloud. from external IP so it goes from internet to router, to caddy to docker and is working correctly. This would indicate to me my caddy-net, my docker network, my name resolutions etc are all correct. Nothing changed there. The docker-compose didn't change. The .env file didnt change. I didnt edit the ngingx config file ( I assume docker created that).

I then rebuilt my users manually, and then uploaded their files again, manually to avoid other issues.

Thoughts?

[kaffeeringe]

Same here: I updated DrawIO and Whiteboard, but I can't activate them due to this error.

[kaffeeringe]

I just observed, that this function seems to call https://cloud.example.com/apps/files and http://cloud.example.com/apps/files - both fail. NS_ERROR_DOM_BAD_URL and NS_ERROR_UNEXPECTED

When I paste that URL into the browser, I get redirected to https://cloud.example.com/apps/files/files - Also, when I click on the "Files"-Icon in the top bar, I get redirected to https://cloud.example.com/apps/files/files.

[Hakbarth]

I also face this issue but and I'm getting it for all apps. I have the newest Docker Version of Nextcloud installed. Usually the whole container crashes after I try to install & enable an App.