[Bug]: Push notifications fail – server unknown by push server after secret change

[FSDirk]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Expected behavior:
Push notifications (Talk, Notifications) should be delivered successfully.

Actual behavior:
All devices are deleted immediately with message:
Deleting device because it is unknown by the push server
Push notification sent, but 1 failed

Steps to reproduce

Steps to reproduce:

1. Regenerated secret in config.php (old value lost)
2. Cleared appdata/*/identityproof and appdata/*/notifications/push*
3. Verified connectivity to https://push-notifications.nextcloud.com (HTTP 404 on / as expected)
4. Users re-logged in on iOS/Android apps
5. Ran occ notification:test-push

Expected behavior

Expected behavior:
Push notifications (Talk, Notifications) should be delivered successfully.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Nginx

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Instance information:
Instance ID:
Nextcloud version: 31.0.9.1
PHP version: 8.x
Deployment: self-hosted (single node)
Apps: all up to date
Push proxy: reachable, responds with 404 on / (normal)

What we already tried:

• Removed all identity proof and push registration data (appdata//identityproof, appdata//notifications/push*)
• Verified overwrite.cli.url -> correct public HTTPS URL
• Verified trusted_domains, overwriteprotocol, and proxy headers
• Switched to cron background jobs
• Reinstalled and re-logged in mobile clients

Problem summary:
After regenerating the instance secret, the server lost its trust relationship with the global Nextcloud Push Proxy.
All new device registrations are rejected as:
"unknown by the push server"

Request:
Please reset our Push Proxy registration / trust for this instance so that new device registrations can be accepted again.

[nickvergessen]

Cleared appdata/*/identityproof and appdata/*/notifications/push*

Not sure where you got that from, but you corrupted your system. You should not delete things inside the appdata directory. Okay I missed that it all started with lossing the secret from config.php but then It's even worse.

My best idea would be:

1. Remove all app tokens/passwords of affected users (using the interface, don't fiddle with the database directly!)
2. Run occ files:scan-app-data identityproof
3. Remove the accounts on all mobile apps
4. Change the password of all users
5. Login with all users in the web interface
6. Re-setup the accounts in the mobile apps
   If that does not work, create new accounts and transfer the ownership of files and calendars from the old users to the new ones (they must NOT have the same user id, but they can have the same display name)