Skip to content

Commit 41b0648

Browse files
jessebotjessebot
authored
Merge branch 'master' into add-missing-s3-variables
2 parents 0f899fe + dd663d6 commit 41b0648

File tree

86 files changed

+365
-319
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+365
-319
lines changed

‎.config/reverse-proxy.config.php

+5
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,8 @@
2828
if ($trustedProxies) {
2929
$CONFIG['trusted_proxies'] = array_filter(array_map('trim', explode(' ', $trustedProxies)));
3030
}
31+
32+
$forwardedForHeaders = getenv('FORWARDED_FOR_HEADERS');
33+
if ($forwardedForHeaders) {
34+
$CONFIG['forwarded_for_headers'] = array_filter(array_map('trim', explode(' ', $forwardedForHeaders)));
35+
}

‎.config/s3.config.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414
'port' => getenv('OBJECTSTORE_S3_PORT') ?: '',
1515
'storageClass' => getenv('OBJECTSTORE_S3_STORAGE_CLASS') ?: '',
1616
'objectPrefix' => getenv("OBJECTSTORE_S3_OBJECT_PREFIX") ? getenv("OBJECTSTORE_S3_OBJECT_PREFIX") : "urn:oid:",
17-
'autocreate' => (strtolower($autocreate) === 'false' || $autocreate == false) ? false : true,
18-
'use_ssl' => (strtolower($use_ssl) === 'false' || $use_ssl == false) ? false : true,
17+
'autocreate' => strtolower($autocreate) !== 'false',
18+
'use_ssl' => strtolower($use_ssl) !== 'false',
1919
// required for some non Amazon S3 implementations
2020
'use_path_style' => $use_path == true && strtolower($use_path) !== 'false',
2121
// required for older protocol versions

‎.examples/README.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,9 @@ The following Dockerfile commands are also necessary for a sucessfull cron insta
6666

6767
## docker-compose
6868
In `docker-compose` additional services are bundled to create a complete nextcloud installation. The examples are designed to run out-of-the-box.
69-
Before running the examples you have to modify the `db.env` and `docker-compose.yml` file and fill in your custom information.
69+
Before running the examples you have to modify the `db.env` and `compose.yaml` file and fill in your custom information.
7070

71-
The docker-compose examples make heavily use of derived Dockerfiles to add configuration files into the containers. This way they should also work on remote docker systems as _Docker for Windows_. When running docker-compose on the same host as the docker daemon, another possibility would be to simply mount the files in the volumes section in the `docker-compose.yml` file.
71+
The docker compose examples make heavily use of derived Dockerfiles to add configuration files into the containers. This way they should also work on remote docker systems as _Docker for Windows_. When running docker compose on the same host as the docker daemon, another possibility would be to simply mount the files in the volumes section in the `compose.yaml` file.
7272

7373

7474
### insecure
@@ -78,10 +78,10 @@ For this use one of the [with-nginx-proxy](#with-nginx-proxy) examples.
7878

7979
To use this example complete the following steps:
8080

81-
1. if you use mariadb or mysql choose a root password for the database in `docker-compose.yml` behind `MYSQL_ROOT_PASSWORD=`
81+
1. if you use mariadb or mysql choose a root password for the database in `compose.yaml` behind `MYSQL_ROOT_PASSWORD=`
8282
2. choose a password for the database user nextcloud in `db.env` behind `MYSQL_PASSWORD=` (for mariadb/mysql) or `POSTGRES_PASSWORD=` (for postgres)
83-
3. run `docker-compose build --pull` to pull the most recent base images and build the custom dockerfiles
84-
4. start nextcloud with `docker-compose up -d`
83+
3. run `docker compose build --pull` to pull the most recent base images and build the custom dockerfiles
84+
4. start nextcloud with `docker compose up -d`
8585

8686

8787
If you want to update your installation to a newer version of nextcloud, repeat the steps 3 and 4.
@@ -97,13 +97,13 @@ This combination of the [nginxproxy/nginx-proxy](https://github.com/nginx-proxy/
9797

9898
To use this example complete the following steps:
9999

100-
1. open `docker-compose.yml`
100+
1. open `compose.yaml`
101101
1. insert your nextcloud domain behind `VIRTUAL_HOST=`and `LETSENCRYPT_HOST=`
102102
2. enter a valid email behind `LETSENCRYPT_EMAIL=`
103103
3. if you use mariadb or mysql choose a root password for the database behind `MYSQL_ROOT_PASSWORD=`
104104
2. choose a password for the database user nextcloud in `db.env` behind `MYSQL_PASSWORD=` (for mariadb/mysql) or `POSTGRES_PASSWORD=` (for postgres)
105-
3. run `docker-compose build --pull` to pull the most recent base images and build the custom dockerfiles
106-
4. start nextcloud with `docker-compose up -d`
105+
3. run `docker compose build --pull` to pull the most recent base images and build the custom dockerfiles
106+
4. start nextcloud with `docker compose up -d`
107107

108108

109109
If you want to update your installation to a newer version of nextcloud, repeat the steps 3 and 4.

‎.examples/docker-compose/insecure/mariadb/apache/docker-compose.yml ‎.examples/docker-compose/insecure/mariadb/apache/compose.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
1-
version: '3'
2-
31
services:
42
db:
5-
image: mariadb:10.6
3+
image: mariadb:10.11
64
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
75
restart: always
86
volumes:
@@ -25,6 +23,7 @@ services:
2523
- 127.0.0.1:8080:80
2624
volumes:
2725
- nextcloud:/var/www/html:z
26+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
2827
environment:
2928
- MYSQL_HOST=db
3029
- REDIS_HOST=redis
@@ -39,6 +38,7 @@ services:
3938
restart: always
4039
volumes:
4140
- nextcloud:/var/www/html:z
41+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
4242
entrypoint: /cron.sh
4343
depends_on:
4444
- db

‎.examples/docker-compose/insecure/mariadb/fpm/docker-compose.yml ‎.examples/docker-compose/insecure/mariadb/fpm/compose.yaml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
1-
version: '3'
2-
31
services:
42
db:
5-
image: mariadb:10.6
3+
image: mariadb:10.11
64
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
75
restart: always
86
volumes:
@@ -23,6 +21,7 @@ services:
2321
restart: always
2422
volumes:
2523
- nextcloud:/var/www/html:z
24+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
2625
environment:
2726
- MYSQL_HOST=db
2827
- REDIS_HOST=redis
@@ -39,6 +38,7 @@ services:
3938
- 127.0.0.1:8080:80
4039
volumes:
4140
- nextcloud:/var/www/html:z,ro
41+
# NOTE: The `volumes` included here should match those of the `app` container (unless you know what you're doing)
4242
depends_on:
4343
- app
4444

@@ -47,6 +47,7 @@ services:
4747
restart: always
4848
volumes:
4949
- nextcloud:/var/www/html:z
50+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
5051
entrypoint: /cron.sh
5152
depends_on:
5253
- db

‎.examples/docker-compose/insecure/mariadb/fpm/web/nginx.conf

+14-18
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ events {
1212
http {
1313
include mime.types;
1414
default_type application/octet-stream;
15+
types {
16+
text/javascript mjs;
17+
application/wasm wasm;
18+
}
1519

1620
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
1721
'$status $body_bytes_sent "$http_referer" '
@@ -30,7 +34,7 @@ http {
3034
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
3135
map $arg_v $asset_immutable {
3236
"" "";
33-
default "immutable";
37+
default ", immutable";
3438
}
3539

3640
#gzip on;
@@ -140,7 +144,7 @@ http {
140144
# to the URI, resulting in a HTTP 500 error response.
141145
location ~ \.php(?:$|/) {
142146
# Required for legacy support
143-
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
147+
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
144148

145149
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
146150
set $path_info $fastcgi_path_info;
@@ -162,24 +166,16 @@ http {
162166
fastcgi_max_temp_file_size 0;
163167
}
164168

165-
# Javascript mimetype fixes for nginx
166-
# Note: The block below should be removed, and the js|mjs section should be
167-
# added to the block below this one. This is a temporary fix until Nginx
168-
# upstream fixes the js mime-type
169-
location ~* \.(?:js|mjs)$ {
170-
types {
171-
text/javascript js mjs;
172-
}
173-
default_type "text/javascript";
174-
try_files $uri /index.php$request_uri;
175-
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
176-
access_log off;
177-
}
178-
179169
# Serve static files
180-
location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
170+
location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
181171
try_files $uri /index.php$request_uri;
182-
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
172+
add_header Cache-Control "public, max-age=15778463$asset_immutable";
173+
add_header Referrer-Policy "no-referrer" always;
174+
add_header X-Content-Type-Options "nosniff" always;
175+
add_header X-Frame-Options "SAMEORIGIN" always;
176+
add_header X-Permitted-Cross-Domain-Policies "none" always;
177+
add_header X-Robots-Tag "noindex, nofollow" always;
178+
add_header X-XSS-Protection "1; mode=block" always;
183179
access_log off; # Optional: Don't log access to assets
184180

185181
location ~ \.wasm$ {

‎.examples/docker-compose/insecure/postgres/apache/docker-compose.yml ‎.examples/docker-compose/insecure/postgres/apache/compose.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
version: '3'
2-
31
services:
42
db:
53
image: postgres:alpine
@@ -20,6 +18,7 @@ services:
2018
- 127.0.0.1:8080:80
2119
volumes:
2220
- nextcloud:/var/www/html:z
21+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
2322
environment:
2423
- POSTGRES_HOST=db
2524
- REDIS_HOST=redis
@@ -34,6 +33,7 @@ services:
3433
restart: always
3534
volumes:
3635
- nextcloud:/var/www/html:z
36+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
3737
entrypoint: /cron.sh
3838
depends_on:
3939
- db

‎.examples/docker-compose/insecure/postgres/fpm/docker-compose.yml ‎.examples/docker-compose/insecure/postgres/fpm/compose.yaml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
1-
version: '3'
2-
31
services:
42
db:
53
image: postgres:alpine
64
restart: always
75
volumes:
8-
- db:/var/lib/postgresql/data:z
6+
- db:/var/lib/postgresql/data:Z
97
env_file:
108
- db.env
119

@@ -18,6 +16,7 @@ services:
1816
restart: always
1917
volumes:
2018
- nextcloud:/var/www/html:z
19+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
2120
environment:
2221
- POSTGRES_HOST=db
2322
- REDIS_HOST=redis
@@ -34,6 +33,7 @@ services:
3433
- 127.0.0.1:8080:80
3534
volumes:
3635
- nextcloud:/var/www/html:z,ro
36+
# NOTE: The `volumes` included here should match those of the `app` container (unless you know what you're doing)
3737
depends_on:
3838
- app
3939

@@ -42,6 +42,7 @@ services:
4242
restart: always
4343
volumes:
4444
- nextcloud:/var/www/html:z
45+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
4546
entrypoint: /cron.sh
4647
depends_on:
4748
- db

‎.examples/docker-compose/insecure/postgres/fpm/web/nginx.conf

+14-17
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ events {
1212
http {
1313
include mime.types;
1414
default_type application/octet-stream;
15+
types {
16+
text/javascript mjs;
17+
application/wasm wasm;
18+
}
1519

1620
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
1721
'$status $body_bytes_sent "$http_referer" '
@@ -30,7 +34,7 @@ http {
3034
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
3135
map $arg_v $asset_immutable {
3236
"" "";
33-
default "immutable";
37+
default ", immutable";
3438
}
3539

3640
#gzip on;
@@ -140,7 +144,7 @@ http {
140144
# to the URI, resulting in a HTTP 500 error response.
141145
location ~ \.php(?:$|/) {
142146
# Required for legacy support
143-
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
147+
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
144148

145149
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
146150
set $path_info $fastcgi_path_info;
@@ -162,23 +166,16 @@ http {
162166
fastcgi_max_temp_file_size 0;
163167
}
164168

165-
# Javascript mimetype fixes for nginx
166-
# Note: The block below should be removed, and the js|mjs section should be
167-
# added to the block below this one. This is a temporary fix until Nginx
168-
# upstream fixes the js mime-type
169-
location ~* \.(?:js|mjs)$ {
170-
types {
171-
text/javascript js mjs;
172-
}
173-
try_files $uri /index.php$request_uri;
174-
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
175-
access_log off;
176-
}
177-
178169
# Serve static files
179-
location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
170+
location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
180171
try_files $uri /index.php$request_uri;
181-
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
172+
add_header Cache-Control "public, max-age=15778463$asset_immutable";
173+
add_header Referrer-Policy "no-referrer" always;
174+
add_header X-Content-Type-Options "nosniff" always;
175+
add_header X-Frame-Options "SAMEORIGIN" always;
176+
add_header X-Permitted-Cross-Domain-Policies "none" always;
177+
add_header X-Robots-Tag "noindex, nofollow" always;
178+
add_header X-XSS-Protection "1; mode=block" always;
182179
access_log off; # Optional: Don't log access to assets
183180

184181
location ~ \.wasm$ {

‎.examples/docker-compose/with-nginx-proxy/mariadb/apache/docker-compose.yml ‎.examples/docker-compose/with-nginx-proxy/mariadb/apache/compose.yaml

+13-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
1-
version: '3'
2-
31
services:
42
db:
5-
image: mariadb:10.6
3+
image: mariadb:10.11
64
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
75
restart: always
86
volumes:
@@ -23,6 +21,7 @@ services:
2321
restart: always
2422
volumes:
2523
- nextcloud:/var/www/html:z
24+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
2625
environment:
2726
- VIRTUAL_HOST=
2827
- LETSENCRYPT_HOST=
@@ -34,6 +33,10 @@ services:
3433
depends_on:
3534
- db
3635
- redis
36+
# Added proxy container dependency below.
37+
# It is unclear on when or why it happens, but sometimes NC manages to start before the proxy
38+
# and it breaks for whatever weird reason resulting in the need of manual proxy container restart.
39+
- proxy
3740
networks:
3841
- proxy-tier
3942
- default
@@ -43,6 +46,7 @@ services:
4346
restart: always
4447
volumes:
4548
- nextcloud:/var/www/html:z
49+
# NOTE: The `volumes` config of the `cron` and `app` containers must match
4650
entrypoint: /cron.sh
4751
depends_on:
4852
- db
@@ -55,18 +59,21 @@ services:
5559
- 80:80
5660
- 443:443
5761
labels:
58-
com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
62+
- "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy"
5963
volumes:
60-
- certs:/etc/nginx/certs:z,ro
64+
- certs:/etc/nginx/certs:ro,z
6165
- vhost.d:/etc/nginx/vhost.d:z
6266
- html:/usr/share/nginx/html:z
67+
- dhparam:/etc/nginx/dhparam:z
6368
- /var/run/docker.sock:/tmp/docker.sock:z,ro
6469
networks:
6570
- proxy-tier
6671

6772
letsencrypt-companion:
6873
image: nginxproxy/acme-companion
6974
restart: always
75+
environment:
76+
- DEFAULT_EMAIL=
7077
volumes:
7178
- certs:/etc/nginx/certs:z
7279
- acme:/etc/acme.sh:z
@@ -100,6 +107,7 @@ volumes:
100107
acme:
101108
vhost.d:
102109
html:
110+
dhparam:
103111

104112
networks:
105113
proxy-tier:

0 commit comments

Comments
 (0)