From 68134e62ce54c47a44f2b84ee201f8f22fda4025 Mon Sep 17 00:00:00 2001 From: GitHub Workflow Date: Wed, 6 Dec 2023 14:37:59 +0000 Subject: [PATCH] Repo-sync --- Containers/apache/nextcloud.conf | 3 + Containers/borgbackup/Dockerfile | 2 +- Containers/clamav/Dockerfile | 2 +- Containers/docker-socket-proxy/Dockerfile | 2 +- Containers/domaincheck/Dockerfile | 2 +- Containers/imaginary/Dockerfile | 6 +- Containers/mastercontainer/Dockerfile | 2 +- .../mastercontainer/mastercontainer.conf | 6 ++ Containers/nextcloud/Dockerfile | 2 +- Containers/nextcloud/cron.sh | 15 +++- Containers/nextcloud/entrypoint.sh | 4 +- Containers/nextcloud/run-exec-commands.sh | 6 +- Containers/notify-push/Dockerfile | 2 +- Containers/notify-push/start.sh | 5 ++ Containers/talk/Dockerfile | 6 +- Containers/watchtower/Dockerfile | 2 +- community-containers/caddy/readme.md | 3 +- community-containers/stalwart/readme.md | 17 +++++ community-containers/stalwart/stalwart.json | 64 +++++++++++++++++ nextcloud-aio-helm-chart/Chart.yaml | 2 +- .../nextcloud-aio-apache-deployment.yaml | 2 +- .../nextcloud-aio-clamav-deployment.yaml | 2 +- .../nextcloud-aio-collabora-deployment.yaml | 6 +- .../nextcloud-aio-database-deployment.yaml | 2 +- ...xtcloud-aio-fulltextsearch-deployment.yaml | 2 +- .../nextcloud-aio-imaginary-deployment.yaml | 2 +- .../nextcloud-aio-nextcloud-deployment.yaml | 14 +++- .../nextcloud-aio-notify-push-deployment.yaml | 2 +- .../nextcloud-aio-onlyoffice-deployment.yaml | 2 +- .../nextcloud-aio-redis-deployment.yaml | 2 +- .../nextcloud-aio-talk-deployment.yaml | 2 +- ...xtcloud-aio-talk-recording-deployment.yaml | 2 +- nextcloud-aio-helm-chart/update-helm.sh | 22 +++++- php/composer.lock | 48 ++++++------- php/containers.json | 1 + php/psalm-baseline.xml | 2 +- php/src/Controller/DockerController.php | 2 +- php/templates/containers.twig | 4 +- readme.md | 11 +-- reverse-proxy.md | 71 ++++++++++++------- 40 files changed, 258 insertions(+), 96 deletions(-) create mode 100644 community-containers/stalwart/readme.md create mode 100644 community-containers/stalwart/stalwart.json diff --git a/Containers/apache/nextcloud.conf b/Containers/apache/nextcloud.conf index c7f986f3..8f179328 100644 --- a/Containers/apache/nextcloud.conf +++ b/Containers/apache/nextcloud.conf @@ -49,4 +49,7 @@ Listen 8000 # See https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxytimeout ProxyTimeout ${APACHE_MAX_TIME} + + # See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable + TraceEnable Off diff --git a/Containers/borgbackup/Dockerfile b/Containers/borgbackup/Dockerfile index f6e6853c..7e467e67 100644 --- a/Containers/borgbackup/Dockerfile +++ b/Containers/borgbackup/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.18.4 +FROM alpine:3.18.5 RUN set -ex; \ \ diff --git a/Containers/clamav/Dockerfile b/Containers/clamav/Dockerfile index 162046e9..32ac6000 100644 --- a/Containers/clamav/Dockerfile +++ b/Containers/clamav/Dockerfile @@ -1,5 +1,5 @@ # Probably from this file: https://github.com/Cisco-Talos/clamav-docker/blob/main/clamav/1.1/alpine/Dockerfile -FROM clamav/clamav:1.2.1-16 +FROM clamav/clamav:1.2.1-20 COPY clamav.conf /tmp/clamav.conf diff --git a/Containers/docker-socket-proxy/Dockerfile b/Containers/docker-socket-proxy/Dockerfile index f86b9718..3831d548 100644 --- a/Containers/docker-socket-proxy/Dockerfile +++ b/Containers/docker-socket-proxy/Dockerfile @@ -1,4 +1,4 @@ -FROM haproxy:2.8.4-alpine3.18 +FROM haproxy:2.9.0-alpine3.18 # hadolint ignore=DL3002 USER root diff --git a/Containers/domaincheck/Dockerfile b/Containers/domaincheck/Dockerfile index 7019215f..f494f545 100644 --- a/Containers/domaincheck/Dockerfile +++ b/Containers/domaincheck/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.18.4 +FROM alpine:3.18.5 RUN set -ex; \ apk add --no-cache bash lighttpd netcat-openbsd; \ adduser -S www-data -G www-data; \ diff --git a/Containers/imaginary/Dockerfile b/Containers/imaginary/Dockerfile index f63e88df..2da7768a 100644 --- a/Containers/imaginary/Dockerfile +++ b/Containers/imaginary/Dockerfile @@ -1,6 +1,6 @@ -FROM golang:1.21.4-alpine3.18 as go +FROM golang:1.21.5-alpine3.18 as go -ENV IMAGINARY_HASH 7efb66c243056e5b3b65215e101be7915983e364 +ENV IMAGINARY_HASH 6cd9edd1d3fb151eb773c14552886e4fc8e50138 RUN set -ex; \ apk add --no-cache \ @@ -12,7 +12,7 @@ RUN set -ex; \ build-base; \ go install github.com/h2non/imaginary@"$IMAGINARY_HASH"; -FROM alpine:3.18.4 +FROM alpine:3.18.5 RUN set -ex; \ apk add --no-cache \ tzdata \ diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile index 92b7f1a8..e8bf6d78 100644 --- a/Containers/mastercontainer/Dockerfile +++ b/Containers/mastercontainer/Dockerfile @@ -5,7 +5,7 @@ FROM docker:24.0.7-cli as docker FROM caddy:2.7.5-alpine as caddy # From https://github.com/docker-library/php/blob/master/8.2/alpine3.18/fpm/Dockerfile -FROM php:8.2.12-fpm-alpine3.18 +FROM php:8.2.13-fpm-alpine3.18 EXPOSE 80 EXPOSE 8080 diff --git a/Containers/mastercontainer/mastercontainer.conf b/Containers/mastercontainer/mastercontainer.conf index 701cb420..d1f4ed64 100644 --- a/Containers/mastercontainer/mastercontainer.conf +++ b/Containers/mastercontainer/mastercontainer.conf @@ -49,8 +49,14 @@ Listen 8080 SSLCertificateFile /etc/apache2/certs/ssl.crt SSLEngine on SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off # Increase timeout in case e.g. the initial download takes a long time Timeout 7200 ProxyTimeout 7200 + +# See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable +TraceEnable Off diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile index 21334726..058c303e 100644 --- a/Containers/nextcloud/Dockerfile +++ b/Containers/nextcloud/Dockerfile @@ -1,4 +1,4 @@ -FROM php:8.1.25-fpm-alpine3.18 +FROM php:8.1.26-fpm-alpine3.18 ENV PHP_MEMORY_LIMIT 512M ENV PHP_UPLOAD_LIMIT 10G diff --git a/Containers/nextcloud/cron.sh b/Containers/nextcloud/cron.sh index 0fe5f589..87f6bf7a 100644 --- a/Containers/nextcloud/cron.sh +++ b/Containers/nextcloud/cron.sh @@ -1,7 +1,20 @@ #!/bin/bash set -eu +wait_for_cron() { + set -x + while [ -n "$(pgrep -f /var/www/html/cron.php)" ]; do + echo "Waiting for cron to stop..." + sleep 5 + done + echo "Cronjob successfully exited." + set +x +} + +trap wait_for_cron SIGINT SIGTERM + while true; do php -f /var/www/html/cron.php & - sleep 5m + sleep 5m & + wait $! done diff --git a/Containers/nextcloud/entrypoint.sh b/Containers/nextcloud/entrypoint.sh index 18dc9b48..eb95aef2 100644 --- a/Containers/nextcloud/entrypoint.sh +++ b/Containers/nextcloud/entrypoint.sh @@ -478,6 +478,7 @@ php /var/www/html/occ config:system:set updatedirectory --value="/nc-updater" # Apply network settings echo "Applying network settings..." +php /var/www/html/occ config:system:set allow_local_remote_servers --type=bool --value=true php /var/www/html/occ config:system:set davstorage.request_timeout --value="$PHP_MAX_TIME" --type=int php /var/www/html/occ config:system:set trusted_domains 1 --value="$NC_DOMAIN" php /var/www/html/occ config:system:set overwrite.cli.url --value="https://$NC_DOMAIN/" @@ -531,8 +532,6 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then php /var/www/html/occ app:update richdocuments fi php /var/www/html/occ config:app:set richdocuments wopi_url --value="https://$NC_DOMAIN/" - # Fix https://github.com/nextcloud/all-in-one/issues/188: - php /var/www/html/occ config:system:set allow_local_remote_servers --type=bool --value=true # Make collabora more save COLLABORA_IPv4_ADDRESS="$(dig "$NC_DOMAIN" A +short +search | grep '^[0-9.]\+$' | sort | head -n1)" COLLABORA_IPv6_ADDRESS="$(dig "$NC_DOMAIN" AAAA +short +search | grep '^[0-9a-f:]\+$' | sort | head -n1)" @@ -596,7 +595,6 @@ if [ "$ONLYOFFICE_ENABLED" = 'yes' ]; then php /var/www/html/occ config:app:set onlyoffice jwt_secret --value="$ONLYOFFICE_SECRET" php /var/www/html/occ config:system:set onlyoffice jwt_header --value="AuthorizationJwt" php /var/www/html/occ config:app:set onlyoffice DocumentServerUrl --value="https://$NC_DOMAIN/onlyoffice" - php /var/www/html/occ config:system:set allow_local_remote_servers --type=bool --value=true else if [ "$REMOVE_DISABLED_APPS" = yes ] && [ -d "/var/www/html/custom_apps/onlyoffice" ] && [ -n "$ONLYOFFICE_SECRET" ] && [ "$(php /var/www/html/occ config:system:get onlyoffice jwt_secret)" = "$ONLYOFFICE_SECRET" ]; then php /var/www/html/occ app:remove onlyoffice diff --git a/Containers/nextcloud/run-exec-commands.sh b/Containers/nextcloud/run-exec-commands.sh index a2a6c84a..ab3abab7 100644 --- a/Containers/nextcloud/run-exec-commands.sh +++ b/Containers/nextcloud/run-exec-commands.sh @@ -1,9 +1,7 @@ #!/bin/bash -while ! nc -z "$NC_DOMAIN" 443; do - sleep 5 -done -sleep 10 +# Wait 15s for domain to be reachable +sleep 15 if [ -n "$NEXTCLOUD_EXEC_COMMANDS" ]; then echo "#!/bin/bash" > /tmp/nextcloud-exec-commands diff --git a/Containers/notify-push/Dockerfile b/Containers/notify-push/Dockerfile index a07211f2..602db937 100644 --- a/Containers/notify-push/Dockerfile +++ b/Containers/notify-push/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.18.4 +FROM alpine:3.18.5 COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh diff --git a/Containers/notify-push/start.sh b/Containers/notify-push/start.sh index d730c7fd..e9f558c9 100644 --- a/Containers/notify-push/start.sh +++ b/Containers/notify-push/start.sh @@ -42,6 +42,11 @@ if ! [ -f /nextcloud/custom_apps/notify_push/bin/"$CPU_ARCH"/notify_push ]; then exit 1 fi +# Add a timeout of 15s to hopefully get rid of the first error that is logged if apache is not there yet +sleep 15 + +echo "notify-push was started" + # Set sensitive values as env export DATABASE_URL="postgres://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST/$POSTGRES_DB" export REDIS_URL="redis://:$REDIS_HOST_PASSWORD@$REDIS_HOST" diff --git a/Containers/talk/Dockerfile b/Containers/talk/Dockerfile index f9a61460..fac18448 100644 --- a/Containers/talk/Dockerfile +++ b/Containers/talk/Dockerfile @@ -1,7 +1,7 @@ -FROM nats:2.10.5-scratch as nats +FROM nats:2.10.6-scratch as nats FROM eturnal/eturnal:1.12.0 AS eturnal FROM strukturag/nextcloud-spreed-signaling:1.2.1 as signaling -FROM alpine:3.18.4 as janus +FROM alpine:3.18.5 as janus ARG JANUS_VERSION=v0.14.0 WORKDIR /src @@ -33,7 +33,7 @@ RUN set -ex; \ make configs; \ rename -v ".jcfg.sample" ".jcfg" /usr/local/etc/janus/*.jcfg.sample -FROM alpine:3.18.4 +FROM alpine:3.18.5 ENV ETURNAL_ETC_DIR="/conf" COPY --from=janus --chmod=777 --chown=1000:1000 /usr/local /usr/local COPY --from=eturnal --chmod=777 --chown=1000:1000 /opt/eturnal /opt/eturnal diff --git a/Containers/watchtower/Dockerfile b/Containers/watchtower/Dockerfile index b9b87625..d63b5a53 100644 --- a/Containers/watchtower/Dockerfile +++ b/Containers/watchtower/Dockerfile @@ -1,7 +1,7 @@ # From https://github.com/containrrr/watchtower/blob/main/dockerfiles/Dockerfile.self-contained FROM containrrr/watchtower:1.7.1 as watchtower -FROM alpine:3.18.4 +FROM alpine:3.18.5 RUN apk add --no-cache bash COPY --from=watchtower /watchtower /watchtower diff --git a/community-containers/caddy/readme.md b/community-containers/caddy/readme.md index b1767210..c26b39a5 100644 --- a/community-containers/caddy/readme.md +++ b/community-containers/caddy/readme.md @@ -1,10 +1,11 @@ ## Caddy with geoblocking -This container bundles caddy and auto-configures it for you. It also covers https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden by listening on `bw.$NC_DOMAIN`, if installed. +This container bundles caddy and auto-configures it for you. It also covers https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden by listening on `bw.$NC_DOMAIN`, if installed. It also covers https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart by listening on `mail.$NC_DOMAIN`, if installed. ### Notes - This container is incompatible with the [npmplus](https://github.com/nextcloud/all-in-one/tree/main/community-containers/npmplus) community container. So make sure that you do not enable both at the same time! - Make sure that no other service is using port 443 on your host as otherwise the containers will fail to start. You can check this with `sudo netstat -tulpn | grep 443` before installing AIO. - If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden, make sure that you point `bw.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for vaultwarden. +- If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart, make sure that you point `mail.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for stalwart. - After the container was started the first time, you should see a new `nextcloud-aio-caddy` folder and inside there an `allowed-countries.txt` file when you open the files app with the default `admin` user. In there you can adjust the allowed country codes for caddy by adding them to the first line, e.g. `IT FR` would allow access from italy and france. Private ip-ranges are always allowed. Additionally, in order to activate this config, you need to get an account at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data and download the `GeoLite2-Country.mmdb` and upload it with this exact name into the `nextcloud-aio-caddy` folder. Afterwards restart all containers from the AIO interface and your new config should be active! - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack diff --git a/community-containers/stalwart/readme.md b/community-containers/stalwart/readme.md new file mode 100644 index 00000000..034d8fb1 --- /dev/null +++ b/community-containers/stalwart/readme.md @@ -0,0 +1,17 @@ +## Stalwart mail server +This container bundles stalwart mail server and auto-configures it for you. + +### Notes +- This is only intended to run on a VPS with static ip-address. +- Check with `sudo netstat -tulpn` that no other service is using port 25, 143, 465, 578, 993 nor 4190 yet as otherwise the container will fail to start. +- You need to configure a reverse proxy in order to run this container since stalwart needs a dedicated (sub)domain! For that, you might have a look at https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy. +- Currently, only `mail.$NC_DOMAIN` is supported as subdomain! So if Nextcloud is using `your-domain.com`, vaultwarden will use `mail.your-domain.com`. +- The data of Stalwart will be automatically included in AIOs backup solution! +- After adding and starting the container, you need to run `sudo docker exec -it nextcloud-aio-stalwart configure.sh` and follow https://stalw.art/docs/install/docker/#choose-where-to-store-your-data (1. choose `Local disk`, 2. choose `No, create a new directory for me`, 3. type in your `$NC_DOMAIN` as `domain name` and `mail.$NC_DOMAIN` as `server hostname`. 4. add `DKIM, SPF and DMARC` as advised, 5. Take note of the administrator credentials, 6. skip https://stalw.art/docs/install/docker/#add-your-tls-certificate as this is done automatically for you, 7. Review the configuration file, 8. run `sudo docker restart nextcloud-aio-stalwart` in order restart the container and enable the config). +- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack + +### Repository +https://github.com/marcoambrosini/aio-stalwart + +### Maintainer +https://github.com/marcoambrosini diff --git a/community-containers/stalwart/stalwart.json b/community-containers/stalwart/stalwart.json new file mode 100644 index 00000000..9da8e12e --- /dev/null +++ b/community-containers/stalwart/stalwart.json @@ -0,0 +1,64 @@ +{ + "aio_services_v1": [ + { + "container_name": "nextcloud-aio-stalwart", + "display_name": "Stalwart", + "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart", + "image": "marcoambrosini/aio-stalwart", + "image_tag": "v1", + "internal_port": "587", + "restart": "unless-stopped", + "ports": [ + { + "ip_binding": "", + "port_number": "25", + "protocol": "tcp" + }, + { + "ip_binding": "", + "port_number": "143", + "protocol": "tcp" + }, + { + "ip_binding": "", + "port_number": "465", + "protocol": "tcp" + }, + { + "ip_binding": "", + "port_number": "587", + "protocol": "tcp" + }, + { + "ip_binding": "", + "port_number": "993", + "protocol": "tcp" + }, + { + "ip_binding": "", + "port_number": "4190", + "protocol": "tcp" + } + ], + "environment": [ + "TZ=%TIMEZONE%", + "NC_DOMAIN=%NC_DOMAIN" + ], + "volumes": [ + { + "source": "nextcloud_aio_stalwart", + "destination": "/opt/stalwart-mail", + "writeable": true + }, + { + "source": "nextcloud_aio_caddy", + "destination": "/caddy", + "writeable": false + } + ], + "backup_volumes": [ + "nextcloud_aio_stalwart" + ] + } + ] +} diff --git a/nextcloud-aio-helm-chart/Chart.yaml b/nextcloud-aio-helm-chart/Chart.yaml index 37669b75..ab8327d9 100755 --- a/nextcloud-aio-helm-chart/Chart.yaml +++ b/nextcloud-aio-helm-chart/Chart.yaml @@ -1,6 +1,6 @@ name: nextcloud-aio-helm-chart description: A generated Helm Chart for Nextcloud AIO from Skippbox Kompose -version: 7.7.1-dev3 +version: 7.7.1 apiVersion: v2 keywords: - latest diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml index f605bf93..95206aba 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml @@ -57,7 +57,7 @@ spec: value: nextcloud-aio-talk - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-apache:20231123_084113-latest + image: nextcloud/aio-apache:20231130_081302-latest name: nextcloud-aio-apache ports: - containerPort: {{ .Values.APACHE_PORT }} diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml index 310a7e9d..52cfb07c 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml @@ -50,7 +50,7 @@ spec: value: "90" - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-clamav:20231123_084113-latest + image: nextcloud/aio-clamav:20231130_081302-latest name: nextcloud-aio-clamav ports: - containerPort: 3310 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml index 0ec6e6f6..68cc29e6 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml @@ -37,9 +37,13 @@ spec: value: --o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:home_mode.enable=true {{ .Values.COLLABORA_SECCOMP_POLICY }} --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json - name: server_name value: "{{ .Values.NC_DOMAIN }}" - image: nextcloud/aio-collabora:20231123_084113-latest + image: nextcloud/aio-collabora:20231130_081302-latest name: nextcloud-aio-collabora ports: - containerPort: 9980 protocol: TCP + securityContext: + capabilities: + add: + - MKNOD {{- end }} diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml index 44e86abf..44c92d1e 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml @@ -61,7 +61,7 @@ spec: value: nextcloud - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-postgresql:20231123_084113-latest + image: nextcloud/aio-postgresql:20231130_081302-latest name: nextcloud-aio-database ports: - containerPort: 5432 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml index 78d2156a..29bbf1d1 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml @@ -55,7 +55,7 @@ spec: value: basic - name: xpack.security.enabled value: "false" - image: nextcloud/aio-fulltextsearch:20231123_084113-latest + image: nextcloud/aio-fulltextsearch:20231130_081302-latest name: nextcloud-aio-fulltextsearch ports: - containerPort: 9200 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml index 2e47e831..d28cd599 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml @@ -27,7 +27,7 @@ spec: - env: - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-imaginary:20231123_084113-latest + image: nextcloud/aio-imaginary:20231130_081302-latest name: nextcloud-aio-imaginary ports: - containerPort: 9000 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml index 8353c7f0..44a81740 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml @@ -23,6 +23,17 @@ spec: io.kompose.service: nextcloud-aio-nextcloud spec: initContainers: + - name: delete lost+found + image: alpine + command: + - rm + - "-rf" + - /nextcloud-aio-nextcloud/lost+found + volumeMounts: + - name: nextcloud-aio-nextcloud-trusted-cacerts + mountPath: /nextcloud-aio-nextcloud-trusted-cacerts + - name: nextcloud-aio-nextcloud + mountPath: /nextcloud-aio-nextcloud - name: init-volumes image: alpine command: @@ -145,8 +156,7 @@ spec: value: "{{ .Values.TIMEZONE }}" - name: UPDATE_NEXTCLOUD_APPS value: "{{ .Values.UPDATE_NEXTCLOUD_APPS }}" - image: nextcloud/aio-nextcloud:develop - imagePullPolicy: Always + image: nextcloud/aio-nextcloud:20231130_081302-latest name: nextcloud-aio-nextcloud ports: - containerPort: 9000 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml index 0bb87c54..0975b3e5 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml @@ -50,7 +50,7 @@ spec: value: nextcloud-aio-redis - name: REDIS_HOST_PASSWORD value: "{{ .Values.REDIS_PASSWORD }}" - image: nextcloud/aio-notify-push:20231123_084113-latest + image: nextcloud/aio-notify-push:20231130_081302-latest name: nextcloud-aio-notify-push ports: - containerPort: 7867 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml index 866cdae2..fecea8cc 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml @@ -43,7 +43,7 @@ spec: value: "{{ .Values.ONLYOFFICE_SECRET }}" - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-onlyoffice:20231123_084113-latest + image: nextcloud/aio-onlyoffice:20231130_081302-latest name: nextcloud-aio-onlyoffice ports: - containerPort: 80 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml index 86db5044..7913eeb7 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml @@ -38,7 +38,7 @@ spec: value: "{{ .Values.REDIS_PASSWORD }}" - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-redis:20231123_084113-latest + image: nextcloud/aio-redis:20231130_081302-latest name: nextcloud-aio-redis ports: - containerPort: 6379 diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml index 90bb0d72..b5c4bf49 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml @@ -37,7 +37,7 @@ spec: value: "{{ .Values.TURN_SECRET }}" - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-talk:20231123_084113-latest + image: nextcloud/aio-talk:20231130_081302-latest name: nextcloud-aio-talk ports: - containerPort: {{ .Values.TALK_PORT }} diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml index 3cda8532..33a5e284 100755 --- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml +++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml @@ -33,7 +33,7 @@ spec: value: "{{ .Values.RECORDING_SECRET }}" - name: TZ value: "{{ .Values.TIMEZONE }}" - image: nextcloud/aio-talk-recording:20231123_084113-latest + image: nextcloud/aio-talk-recording:20231130_081302-latest name: nextcloud-aio-talk-recording ports: - containerPort: 1234 diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index a105d1dd..e16883b2 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -98,6 +98,22 @@ cat << EOL > /tmp/initcontainers.clamav - "-R" volumeMountsInitContainer: EOL +cat << EOL > /tmp/initcontainers.nextcloud + initContainers: + - name: delete lost+found + image: alpine + command: + - rm + - "-rf" + - /nextcloud-aio-nextcloud/lost+found + volumeMountsInitRmLostFound: + - name: init-volumes + image: alpine + command: + - chmod + - "777" + volumeMountsInitContainer: +EOL # shellcheck disable=SC1083 DEPLOYMENTS="$(find ./ -name '*deployment.yaml')" mapfile -t DEPLOYMENTS <<< "$DEPLOYMENTS" @@ -107,6 +123,8 @@ for variable in "${DEPLOYMENTS[@]}"; do sed -i "/^ spec:/r /tmp/initcontainers.database" "$variable" elif echo "$variable" | grep -q clamav; then sed -i "/^ spec:/r /tmp/initcontainers.clamav" "$variable" + elif echo "$variable" | grep -q "nextcloud-deployment.yaml"; then + sed -i "/^ spec:/r /tmp/initcontainers.nextcloud" "$variable" else sed -i "/^ spec:/r /tmp/initcontainers" "$variable" fi @@ -117,6 +135,7 @@ for variable in "${DEPLOYMENTS[@]}"; do if [ "$volumeName" != "nextcloud-aio-nextcloud-data" ]; then sed -i "/^.*volumeMountsInitContainer:/i\ \ \ \ \ \ \ \ \ \ \ \ - /$volumeName" "$variable" sed -i "/volumeMountsInitContainer:/a\ \ \ \ \ \ \ \ \ \ \ \ - name: $volumeName\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ mountPath: /$volumeName" "$variable" + sed -i "/volumeMountsInitRmLostFound:/a\ \ \ \ \ \ \ \ \ \ \ \ - name: $volumeName\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ mountPath: /$volumeName" "$variable" # Workaround for the database volume if [ "$volumeName" = nextcloud-aio-database ]; then sed -i "/mountPath: \/var\/lib\/postgresql\/data/a\ \ \ \ \ \ \ \ \ \ \ \ \ \ subPath: data" "$variable" @@ -126,7 +145,8 @@ for variable in "${DEPLOYMENTS[@]}"; do fi done - sed -i "s|volumeMountsInitContainer|volumeMounts|" "$variable" + sed -i "s|volumeMountsInitContainer:|volumeMounts:|" "$variable" + sed -i "s|volumeMountsInitRmLostFound:|volumeMounts:|" "$variable" if grep -q claimName "$variable"; then claimNames="$(grep claimName "$variable")" mapfile -t claimNames <<< "$claimNames" diff --git a/php/composer.lock b/php/composer.lock index 4cebda77..ad792be0 100644 --- a/php/composer.lock +++ b/php/composer.lock @@ -8,16 +8,16 @@ "packages": [ { "name": "guzzlehttp/guzzle", - "version": "7.8.0", + "version": "7.8.1", "source": { "type": "git", "url": "https://github.com/guzzle/guzzle.git", - "reference": "1110f66a6530a40fe7aea0378fe608ee2b2248f9" + "reference": "41042bc7ab002487b876a0683fc8dce04ddce104" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/guzzle/zipball/1110f66a6530a40fe7aea0378fe608ee2b2248f9", - "reference": "1110f66a6530a40fe7aea0378fe608ee2b2248f9", + "url": "https://api.github.com/repos/guzzle/guzzle/zipball/41042bc7ab002487b876a0683fc8dce04ddce104", + "reference": "41042bc7ab002487b876a0683fc8dce04ddce104", "shasum": "" }, "require": { @@ -32,11 +32,11 @@ "psr/http-client-implementation": "1.0" }, "require-dev": { - "bamarni/composer-bin-plugin": "^1.8.1", + "bamarni/composer-bin-plugin": "^1.8.2", "ext-curl": "*", "php-http/client-integration-tests": "dev-master#2c025848417c1135031fdf9c728ee53d0a7ceaee as 3.0.999", "php-http/message-factory": "^1.1", - "phpunit/phpunit": "^8.5.29 || ^9.5.23", + "phpunit/phpunit": "^8.5.36 || ^9.6.15", "psr/log": "^1.1 || ^2.0 || ^3.0" }, "suggest": { @@ -114,7 +114,7 @@ ], "support": { "issues": "https://github.com/guzzle/guzzle/issues", - "source": "https://github.com/guzzle/guzzle/tree/7.8.0" + "source": "https://github.com/guzzle/guzzle/tree/7.8.1" }, "funding": [ { @@ -130,28 +130,28 @@ "type": "tidelift" } ], - "time": "2023-08-27T10:20:53+00:00" + "time": "2023-12-03T20:35:24+00:00" }, { "name": "guzzlehttp/promises", - "version": "2.0.1", + "version": "2.0.2", "source": { "type": "git", "url": "https://github.com/guzzle/promises.git", - "reference": "111166291a0f8130081195ac4556a5587d7f1b5d" + "reference": "bbff78d96034045e58e13dedd6ad91b5d1253223" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/promises/zipball/111166291a0f8130081195ac4556a5587d7f1b5d", - "reference": "111166291a0f8130081195ac4556a5587d7f1b5d", + "url": "https://api.github.com/repos/guzzle/promises/zipball/bbff78d96034045e58e13dedd6ad91b5d1253223", + "reference": "bbff78d96034045e58e13dedd6ad91b5d1253223", "shasum": "" }, "require": { "php": "^7.2.5 || ^8.0" }, "require-dev": { - "bamarni/composer-bin-plugin": "^1.8.1", - "phpunit/phpunit": "^8.5.29 || ^9.5.23" + "bamarni/composer-bin-plugin": "^1.8.2", + "phpunit/phpunit": "^8.5.36 || ^9.6.15" }, "type": "library", "extra": { @@ -197,7 +197,7 @@ ], "support": { "issues": "https://github.com/guzzle/promises/issues", - "source": "https://github.com/guzzle/promises/tree/2.0.1" + "source": "https://github.com/guzzle/promises/tree/2.0.2" }, "funding": [ { @@ -213,20 +213,20 @@ "type": "tidelift" } ], - "time": "2023-08-03T15:11:55+00:00" + "time": "2023-12-03T20:19:20+00:00" }, { "name": "guzzlehttp/psr7", - "version": "2.6.1", + "version": "2.6.2", "source": { "type": "git", "url": "https://github.com/guzzle/psr7.git", - "reference": "be45764272e8873c72dbe3d2edcfdfcc3bc9f727" + "reference": "45b30f99ac27b5ca93cb4831afe16285f57b8221" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/psr7/zipball/be45764272e8873c72dbe3d2edcfdfcc3bc9f727", - "reference": "be45764272e8873c72dbe3d2edcfdfcc3bc9f727", + "url": "https://api.github.com/repos/guzzle/psr7/zipball/45b30f99ac27b5ca93cb4831afe16285f57b8221", + "reference": "45b30f99ac27b5ca93cb4831afe16285f57b8221", "shasum": "" }, "require": { @@ -240,9 +240,9 @@ "psr/http-message-implementation": "1.0" }, "require-dev": { - "bamarni/composer-bin-plugin": "^1.8.1", + "bamarni/composer-bin-plugin": "^1.8.2", "http-interop/http-factory-tests": "^0.9", - "phpunit/phpunit": "^8.5.29 || ^9.5.23" + "phpunit/phpunit": "^8.5.36 || ^9.6.15" }, "suggest": { "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses" @@ -313,7 +313,7 @@ ], "support": { "issues": "https://github.com/guzzle/psr7/issues", - "source": "https://github.com/guzzle/psr7/tree/2.6.1" + "source": "https://github.com/guzzle/psr7/tree/2.6.2" }, "funding": [ { @@ -329,7 +329,7 @@ "type": "tidelift" } ], - "time": "2023-08-27T10:13:57+00:00" + "time": "2023-12-03T20:05:35+00:00" }, { "name": "http-interop/http-factory-guzzle", diff --git a/php/containers.json b/php/containers.json index 977a97b0..b62c4236 100644 --- a/php/containers.json +++ b/php/containers.json @@ -215,6 +215,7 @@ "APACHE_IP_BINDING=%APACHE_IP_BINDING%", "THIS_IS_AIO=true" ], + "stop_grace_period": 600, "restart": "unless-stopped", "devices": [ "/dev/dri" diff --git a/php/psalm-baseline.xml b/php/psalm-baseline.xml index ecbd3ec6..285e2b1b 100644 --- a/php/psalm-baseline.xml +++ b/php/psalm-baseline.xml @@ -1,2 +1,2 @@ - + diff --git a/php/src/Controller/DockerController.php b/php/src/Controller/DockerController.php index 51dd42a6..bb57ec91 100644 --- a/php/src/Controller/DockerController.php +++ b/php/src/Controller/DockerController.php @@ -164,7 +164,7 @@ public function StartContainer(Request $request, Response $response, array $args } if (isset($request->getParsedBody()['install_latest_major'])) { - $installLatestMajor = 27; + $installLatestMajor = 28; } else { $installLatestMajor = ""; } diff --git a/php/templates/containers.twig b/php/templates/containers.twig index d1e7827d..7fc6c8d0 100644 --- a/php/templates/containers.twig +++ b/php/templates/containers.twig @@ -16,7 +16,7 @@
-

Nextcloud AIO v7.7.1

+

Nextcloud AIO v7.8.0

{# Add 2nd tab warning #} @@ -28,7 +28,7 @@ {% set isBackupOrRestoreRunning = false %} {% set isApacheStarting = false %} {# Setting newMajorVersion to '' will hide corresponding options/elements, can be set to an integer like 26 in order to show corresponding elements. If set, also increase installLatestMajor in https://github.com/nextcloud/all-in-one/blob/main/php/src/Controller/DockerController.php #} - {% set newMajorVersion = '' %} + {% set newMajorVersion = 28 %} {% if is_backup_container_running == true %} {% if borg_backup_mode == 'backup' or borg_backup_mode == 'restore' %} diff --git a/readme.md b/readme.md index c5bfe890..554d3b81 100644 --- a/readme.md +++ b/readme.md @@ -16,7 +16,7 @@ Included are: - Simple web interface included that enables easy installation and maintenance - [Easy updates included](https://github.com/nextcloud/all-in-one#how-to-update-the-containers) - Update and backup notifications included -- Daily backups can get enabled from the AIO interface which also allows to update all containers, Nextcloud and its apps afterwards automatically +- Daily backups can be enabled from the AIO interface which also allows updating all containers, Nextcloud and its apps afterwards automatically - Instance restore from backup archive via the AIO interface included (you only need the archive and the password in order to restore the whole instance on a new AIO instance) - APCu as local cache - Redis as distributed cache and for file locking @@ -258,9 +258,9 @@ No and they will not be. Please use a dedicated domain for Nextcloud and set it No and it will not be added. Please use a dedicated domain for Nextcloud and set it up correctly by following the [reverse proxy documentation](./reverse-proxy.md). ### How can I access Nextcloud locally? -Please note that local access is not possible if you should be running AIO behind Cloudflare Tunnel since TLS proxying is in that case offloaded to Cloudflares infrastructure. You can fix this by setting up your own reverse proxy that handles TLS proxying locally and will make the steps below work. +Please note that local access is not possible if you are running AIO behind Cloudflare Tunnel since TLS proxying is in that case offloaded to Cloudflares infrastructure. You can fix this by setting up your own reverse proxy that handles TLS proxying locally and will make the steps below work. -Please make sure that if you should be running AIO behind a reverse proxy, that the reverse proxy is configured to use port 443 on the server that runs it. Otherwise the steps below will not work. +Please make sure that if you are running AIO behind a reverse proxy, that the reverse proxy is configured to use port 443 on the server that runs it. Otherwise the steps below will not work. Now that this is out of the way, the recommended way how to access Nextcloud locally, is to set up a local dns-server like a pi-hole and set up a custom dns-record for that domain that points to the internal ip-adddress of your server that runs Nextcloud AIO. Below are some guides: - https://www.howtogeek.com/devops/how-to-run-your-own-dns-server-on-your-local-network/ @@ -371,6 +371,9 @@ Be aware that this solution does not back up files and folders that are mounted --- +#### What is getting backed up by AIO's backup solution? +Backed up will get all important data of your Nextcloud AIO instance like the database, your files and configuration files of the mastercontainer and else. Files and folders that are mounted into Nextcloud using the external storage app are not getting backed up. There is currently no way to exclude the data directory because it would require hacks like running files:scan and would make the backup solution much more unreliable (since the database and your files/folders need to stay in sync). If you still don't want your datadirectory to be backed up, see https://github.com/nextcloud/all-in-one#how-to-enable-automatic-updates-without-creating-a-backup-beforehand for options (there is a hint what needs to be backed up in which order). + #### How to adjust borgs retention policy? The built-in borg-based backup solution has by default a retention policy of `--keep-within=7d --keep-weekly=4 --keep-monthly=6`. See https://borgbackup.readthedocs.io/en/stable/usage/prune.html for what these values mean. You can adjust the retention policy by providing `--env BORG_RETENTION_POLICY="--keep-within=7d --keep-weekly=4 --keep-monthly=6"` to the docker run command of the mastercontainer (but before the last line `nextcloud/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used) and customize the value to your fitting. ⚠️ Please make sure that this value is valid, otherwise backup pruning will bug out! @@ -665,7 +668,7 @@ The [facerecognition app](https://apps.nextcloud.com/apps/facerecognition) requi ### How to enable hardware-transcoding for Nextcloud? ⚠️⚠️⚠️ Warning: this only works if the `/dev/dri` device is present on the host! If it does not exists on your host, don't proceed as otherwise the Nextcloud container will fail to start! If you are unsure about this, better do not proceed with the instructions below. -The [memories app](https://apps.nextcloud.com/apps/memories) allows to enable hardware transcoding for videos. In order to use that, you need to add `--env NEXTCLOUD_ENABLE_DRI_DEVICE=true` to the docker run command of the mastercontainer (but before the last line `nextcloud/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used) which will mount the `/dev/dri` device into the container. Additionally, you need to add required packets to the Nextcloud container by using [this feature](https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container) and adding the required Alpine packages that are documented [here](https://memories.gallery/hw-transcoding/#va-api). +The [memories app](https://apps.nextcloud.com/apps/memories) allows to enable hardware transcoding for videos. In order to use that, you need to add `--env NEXTCLOUD_ENABLE_DRI_DEVICE=true` to the docker run command of the mastercontainer (but before the last line `nextcloud/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used) which will mount the `/dev/dri` device into the container. There is now a community container which allows to easily add the transcoding container of Memories to AIO: https://github.com/nextcloud/all-in-one/tree/main/community-containers/memories ### How to keep disabled apps? In certain situations you might want to keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed in Nextcloud. You can do so by adding `--env NEXTCLOUD_KEEP_DISABLED_APPS=true` to the docker run command of the mastercontainer (but before the last line `nextcloud/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used). ⚠️⚠️⚠️ **Warning** doing this might cause unintended problems in Nextcloud if an app that requires an external dependency is still installed but the external dependency not for example. diff --git a/reverse-proxy.md b/reverse-proxy.md index 0fc53374..330c28ea 100644 --- a/reverse-proxy.md +++ b/reverse-proxy.md @@ -7,30 +7,49 @@ A [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) is basically a we In order to run Nextcloud behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else), you need to specify the port that AIO's Apache container shall use, add a specific config to your web server or reverse proxy and modify the startup command a bit. All examples below will use port `11000` as example `APACHE_PORT` which will be exposed on the host to receive unencrypted HTTP traffic from the reverse proxy. **Advice:** If you need https between Nextcloud and the reverse proxy because it is running on a different server in the same network, simply add another reverse proxy to the chain that runs on the same server like AIO and takes care of https proxying (most likely via self-signed cert). Another option is to create a VPN between the server that runs AIO and the server that runs the reverse proxy which takes care of encrypting the connection. **Attention:** The process to run Nextcloud behind a reverse proxy consists of at least steps 1, 2 and 4: -1. **Configure the reverse proxy! See [point 1](#1-add-this-to-your-reverse-proxy-config)** +1. **Configure the reverse proxy! See [point 1](#1-configure-the-reverse-proxy)** 1. **Use this startup command! See [point 2](#2-use-this-startup-command)** 1. Optional: If the reverse proxy is installed on the same host and in the host network, you should limit the apache container to only listen on localhost. See [point 3](#3-limit-the-access-to-the-apache-container) 1. **Open the AIO interface. See [point 4](#4-open-the-aio-interface)** 1. Optional: Get a valid certificate for the AIO interface! See [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface) 1. Optional: How to debug things? See [point 6](#6-how-to-debug-things) -## 1. Add this to your reverse proxy config - **Please note:** Since the Apache container gets created by the mastercontainer, there is **NO** way to provide custom docker labels or custom environmental variables for the Apache container. So please do not attempt to do this because you will fail! Only the documented way will work! -### Adaptation of the respective sample configuration -Of course you need to modify `` to the domain on which you want to run Nextcloud. Also make sure to adjust the port `11000` to match the chosen `APACHE_PORT`. Additionally, you might need to adjust `localhost` or `127.0.0.1` based on your setup. See below. - -**Running the Reverse Proxy on the same server, not in a container**
-For this setup, the default sample configurations with `localhost:$APACHE_PORT` should work. +## 1. Configure the reverse proxy + +### Adapting the sample web server configurations below +1. Replace `` with the domain on which you want to run Nextcloud. +1. Adjust the port `11000` to match your chosen `APACHE_PORT`. +1. Adjust `localhost` or `127.0.0.1` to point to the Nextcloud server IP or domain depending on where the reverse proxy is running. See the following options. + +
+ + On the same server without a container + + For this setup, the default sample configurations with `localhost:$APACHE_PORT` should work. + +
+ +
-**Running the Reverse Proxy in a Docker container on the same server**
-For this setup, you can use as target `host.docker.internal:$APACHE_PORT` instead of `localhost:$APACHE_PORT`. **⚠️ Important:** In order to make this work on Docker for Linux, you need to add `--add-host=host.docker.internal:host-gateway` to the docker run command of your reverse proxy container or `extra_hosts: ["host.docker.internal:host-gateway"]` in docker compose (it works on Docker Desktop by default).
-Another option and actually the recommended way in this case is to use `--network host` option (or `network_mode: host` for docker-compose) as setting for the reverse proxy container to connect it to the host network. If you are using a firewall on the server, you need to open ports 80 and 443 for the reverse proxy manually. By doing so, the default sample configurations that point at `localhost:$APACHE_PORT` should work without having to modify them. + On the same server in a Docker container + + For this setup, you can use as target `host.docker.internal:$APACHE_PORT` instead of `localhost:$APACHE_PORT`. **⚠️ Important:** In order to make this work on Docker for Linux, you need to add `--add-host=host.docker.internal:host-gateway` to the docker run command of your reverse proxy container or `extra_hosts: ["host.docker.internal:host-gateway"]` in docker compose (it works on Docker Desktop by default). + + Another option and actually the recommended way in this case is to use `--network host` option (or `network_mode: host` for docker-compose) as setting for the reverse proxy container to connect it to the host network. If you are using a firewall on the server, you need to open ports 80 and 443 for the reverse proxy manually. By doing so, the default sample configurations that point at `localhost:$APACHE_PORT` should work without having to modify them. + +
+ +
+ + On a different server (in container or not) + + Use the private ip-address of the host that shall be running AIO. So e.g. `private.ip.address.of.aio.server:$APACHE_PORT` instead of `localhost:$APACHE_PORT`. + + If you are not sure how to retrieve that, you can run: `ip a | grep "scope global" | head -1 | awk '{print $2}' | sed 's|/.*||'` on the server that shall be running AIO (the commands only work on Linux). -**Running the Reverse Proxy on a different server (no matter if in container or not)**
-For this setup, you need to use as target the private ip-address of the host that shall be running AIO. So e.g. `private.ip.address.of.aio.server:$APACHE_PORT` instead of `localhost:$APACHE_PORT`.
-If you are not sure how to retrieve that, you can run: `ip a | grep "scope global" | head -1 | awk '{print $2}' | sed 's|/.*||'` on the server that shall be running AIO (the commands only work on Linux). +
### Apache @@ -97,7 +116,7 @@ Add this as a new Apache site config: ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. To make the config work you can run the following command: `sudo a2enmod rewrite proxy proxy_http proxy_wstunnel ssl headers http2` @@ -119,7 +138,7 @@ https://:443 { ``` The Caddyfile is a text file called `Caddyfile` (no extension) which – if you should be running Caddy inside a container – should usually be created in the same location as your `compose.yaml` file prior to starting the container. -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. **Advice:** You may have a look at [this](https://github.com/nextcloud/all-in-one/discussions/575#discussion-4055615) for a more complete example. @@ -143,7 +162,7 @@ You can get AIO running using the ACME DNS-challenge. Here is how to do it. } } ``` - ⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. + ⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. You also need to adjust `` and `` to match your case. @@ -172,7 +191,7 @@ For a reverse proxy example guide for Citrix ADC VPX / Citrix Netscaler, see thi Although it does not seem like it is the case but from AIO perspective a Cloudflare Tunnel works like a reverse proxy. Please see the [caveats](https://github.com/nextcloud/all-in-one#notes-on-cloudflare-proxytunnel) before proceeding. Here is then how to make it work: 1. Install the Cloudflare Tunnel on the same machine where AIO will be running on and point the Tunnel with the domain that you want to use for AIO to `http://localhost:11000`.
-⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. 1. Now continue with [point 2](#2-use-this-startup-command) but additionally, add `--env SKIP_DOMAIN_VALIDATION=true` to the docker run command which will disable the domain validation (because it is known that the domain validation will not work behind a Cloudflare Tunnel). So you need to ensure yourself that you've configured everything correctly. **Advice:** Make sure to [disable Cloudflares Rocket Loader feature](https://help.nextcloud.com/t/login-page-not-working-solved/149417/8) as otherwise Nextcloud's login prompt will not be shown. @@ -272,7 +291,7 @@ backend Nextcloud server Nextcloud localhost:11000 ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. @@ -362,7 +381,7 @@ server { ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. **Advice:** You may have a look at [this](https://github.com/nextcloud/all-in-one/discussions/588#discussioncomment-2811152) for a more complete example. @@ -393,7 +412,7 @@ proxy_read_timeout 86400s; client_max_body_size 0; ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. Also change `@` to a mail address of yours. @@ -497,7 +516,7 @@ httpServer.on('upgrade', (req, socket, head) => { }); ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. @@ -515,7 +534,7 @@ See these screenshots for a working config: ![image](https://user-images.githubusercontent.com/70434961/213193789-fa936edc-e307-4e6a-9a53-ae26d1bf2f42.jpg) -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. @@ -596,7 +615,7 @@ The examples below define the dynamic configuration in YAML files. If you rather --- -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. **Hint**: see https://www.youtube.com/watch?v=VLPSRrLMDmA for a video on configuring Traefik. @@ -689,7 +708,7 @@ https://:8443 { } } ``` -⚠️ **Please note:** Look into [this](#adaptation-of-the-respective-sample-configuration) to adapt the above example configuration. +⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration. Afterwards should the AIO interface be accessible via `https://ip.address.of.the.host:8443`. You can alternatively change the domain to a different subdomain by using `https://:443` instead of `https://:8443` in the Caddyfile and use that to access the AIO interface. @@ -699,7 +718,7 @@ If something does not work, follow the steps below: 1. Make sure that you used the docker run command that is described in this reverse proxy documentation. **Hint:** make sure that you have set the `APACHE_PORT` via e.g. `--env APACHE_PORT=11000` during the docker run command! 1. Make sure to set the `APACHE_IP_BINDING` variable correctly. If in doubt, set it to `--env APACHE_IP_BINDING=0.0.0.0` 1. Make sure that all ports to which your reverse proxy is pointing match the chosen `APACHE_PORT`. -1. Make sure to follow [this](#adaptation-of-the-respective-sample-configuration) to adapt the example configurations to your specific setup +1. Make sure to follow [this](#adapting-the-sample-web-server-configurations-below) to adapt the example configurations to your specific setup 1. Make sure that the mastercontainer is able to spawn other containers. You can do so by checking that the mastercontainer indeed has access to the Docker socket which might not be positioned in one of the suggested directories like `/var/run/docker.sock` but in a different directory, based on your OS and the way how you installed Docker. The mastercontainer logs should help figuring this out. You can have a look at them by running `sudo docker logs nextcloud-aio-mastercontainer` after the container is started the first time. 1. Check if after the mastercontainer was started, the reverse proxy if running inside a container, can reach the provided apache port. You can test this by running `nc -z localhost 11000; echo $?` from inside the reverse proxy container. If the output is `0`, everything works. Alternatively you can of course use instead of `localhost` the ip-address of the host here for the test. 1. Make sure that you are not behind CGNAT. If that is the case, you will not be able to open ports properly. In that case you might use a Cloudflare Tunnel.