From 0753c6c902015ee6d30c52cac1466b70389ad2d1 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Thu, 18 Jun 2026 13:16:06 +0200 Subject: [PATCH] feat(desec): wire caddy/dnsmasq community containers into the flow - caddy.json: pass DESEC_TOKEN to the caddy container so it can solve the DNS-01 challenge for the registered dedyn.io domain. - community-containers.twig: when the domain was registered via deSEC, explain that caddy and dnsmasq were enabled automatically and link the required dnsmasq router change, with a caution to disable dnsmasq on publicly reachable hosts. - compose.yaml: mention the built-in deSEC free domain option alongside Tailscale in the reverse-proxy hint. Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com> Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Simon L. --- community-containers/caddy/caddy.json | 3 ++- compose.yaml | 2 +- php/templates/includes/community-containers.twig | 4 ++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/community-containers/caddy/caddy.json b/community-containers/caddy/caddy.json index e27df683..4c821064 100644 --- a/community-containers/caddy/caddy.json +++ b/community-containers/caddy/caddy.json @@ -20,7 +20,8 @@ "NC_DOMAIN=%NC_DOMAIN%", "APACHE_PORT=%APACHE_PORT%", "APACHE_IP_BINDING=%APACHE_IP_BINDING%", - "NEXTCLOUD_EXPORTER_CADDY_PASSWORD=%NEXTCLOUD_EXPORTER_CADDY_PASSWORD%" + "NEXTCLOUD_EXPORTER_CADDY_PASSWORD=%NEXTCLOUD_EXPORTER_CADDY_PASSWORD%", + "DESEC_TOKEN=%DESEC_TOKEN%" ], "volumes": [ { diff --git a/compose.yaml b/compose.yaml index c27ca870..a4171ffe 100644 --- a/compose.yaml +++ b/compose.yaml @@ -42,7 +42,7 @@ services: # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock' # # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/discussions/575 -# # Alternatively, use Tailscale if you don't have a domain yet. See https://github.com/nextcloud/all-in-one/discussions/6817 +# # Alternatively, if you don't have a domain yet, use the built-in deSEC free domain registration in the AIO interface, or use Tailscale. See https://github.com/nextcloud/all-in-one#how-to-get-a-free-domain-via-desec and https://github.com/nextcloud/all-in-one/discussions/6817 # # Hint: You need to uncomment APACHE_PORT: 11000 above, adjust cloud.example.com to your domain and uncomment the necessary docker volumes at the bottom of this file in order to make it work # # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588 # caddy: diff --git a/php/templates/includes/community-containers.twig b/php/templates/includes/community-containers.twig index da1dd26d..2e67d010 100644 --- a/php/templates/includes/community-containers.twig +++ b/php/templates/includes/community-containers.twig @@ -1,6 +1,10 @@

Community Containers

In this section you can enable or disable optional Community Containers that are not included by default in the main installation. These containers are provided by the community and can be useful for various purposes and are automatically integrated in AIOs backup solution and update mechanisms.

⚠️ Caution: Community Containers are maintained by the community and not officially by Nextcloud. Some containers may not be compatible with your system, may not work as expected or may discontinue. Use them at your own risk. Please read the documentation for each container first before adding any as some are also incompatible between each other! Never add all of them at the same time!

+{% if is_desec_domain == true %} +

ℹ️ Your Nextcloud domain ({{ domain }}) was registered via deSEC. The caddy community container has been automatically enabled as a reverse proxy and the dnsmasq container has been automatically enabled so that LAN devices can resolve your Nextcloud domain to the server's local IP address. Please read the dnsmasq documentation for the required router change.

+

⚠️ Caution: if this is a publicly reachable instance, you must disable dnsmasq again as dnsmasq must only run on home servers where port 53 is not publicly exposed.

+{% endif %} {% if isAnyRunning == true %}

Please note: You can enable or disable the options below only when your containers are stopped.

{% else %}