daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-20 18:20:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into asymetrickey-token

Browse Source
This commit is contained in:
Zoey
2026-08-19 21:28:53 +02:00
committed by GitHub
parent 8483b060dc 6b788eec5e
commit 2c978e9556
99 changed files with 1237 additions and 784 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/dependabot.yml
+1
View File
@@ -33,6 +33,7 @@ updates:
- "/Containers/domaincheck"
- "/Containers/eurooffice"
- "/Containers/fulltextsearch"
- "/Containers/harp"
- "/Containers/imaginary"
- "/Containers/mastercontainer"
- "/Containers/nextcloud"
.github/pull_request_template.md
+1
View File
@@ -8,6 +8,7 @@
## Summary
- [ ] The PR was tested and verified that it works locally
- [ ] Or will be tested after merge on a dedicated test instance (available for maintainers)
- [ ] [Sign-off message](https://github.com/src-d/guide/blob/master/developer-community/fix-DCO.md) is added to all commits
- [ ] Tests (playwright if possible) are included
- [ ] Screenshots before/after for front-end changes
.github/workflows/lint-yaml.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
line-length: warning
- name: Install the latest version of uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
- name: Check GitHub actions
run: uvx zizmor --min-severity medium .github/workflows/*.yml
.github/workflows/nextcloud-update.yml
+7 -2
View File
@@ -13,6 +13,7 @@ jobs:
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Run nextcloud-update script
id: nextcloud_update
run: |
# Inspired by https://github.com/nextcloud/docker/blob/master/update.sh
@@ -77,6 +78,7 @@ jobs:
if [ -n "$NCVERSION" ]; then
sed -i "s|^ENV NEXTCLOUD_VERSION.*|ENV NEXTCLOUD_VERSION=$NCVERSION|" ./Containers/nextcloud/Dockerfile
fi
echo "nc_version=$NCVERSION" >> "$GITHUB_OUTPUT"
- name: Create Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
@@ -84,8 +86,11 @@ jobs:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: nextcloud-update automated change
signoff: true
title: Nextcloud dependency update
body: Automated Nextcloud container update
title: Nextcloud dependency update to ${{ steps.nextcloud_update.outputs.nc_version }}
body: |
Automated Nextcloud container update to version ${{ steps.nextcloud_update.outputs.nc_version }}.
See the [Nextcloud Server ${{ steps.nextcloud_update.outputs.nc_version }} release notes](https://github.com/nextcloud/server/releases/tag/v${{ steps.nextcloud_update.outputs.nc_version }}) for details.
labels: dependencies, 3. to review
milestone: next
branch: nextcloud-container-update
.github/workflows/update-helm.yml
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
signoff: true
title: Helm Chart updates
body: Automated Helm Chart updates for the yaml files. It can be merged if it looks good at any time which will automatically trigger a new release of the helm chart.
labels: dependencies, 3. to review
labels: 3. to review
milestone: next
branch: aio-helm-update
token: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/update-yaml.yml
+27 -27
View File
@@ -1,28 +1,28 @@
name: Update Yaml files
on:
workflow_dispatch:
schedule:
- cron: '00 12 * * *'
jobs:
update-yaml:
name: update yaml files
runs-on: ubuntu-latest
steps:
- name: Checkout code
name: Update Yaml files
on:
workflow_dispatch:
schedule:
- cron: '00 12 * * *'
jobs:
update-yaml:
name: update yaml files
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: update yaml files
run: |
sudo bash manual-install/update-yaml.sh
- name: Create Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
with:
commit-message: Yaml updates
signoff: true
title: Yaml updates
body: Automated yaml updates for the docker-compose files. Should only be merged shortly before the next latest release.
labels: dependencies, 3. to review
milestone: next
branch: aio-yaml-update
token: ${{ secrets.GITHUB_TOKEN }}
- name: update yaml files
run: |
sudo bash manual-install/update-yaml.sh
- name: Create Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
with:
commit-message: Yaml updates
signoff: true
title: Yaml updates
body: Automated yaml updates for the docker-compose files. Should only be merged shortly before the next latest release.
labels: dependencies, 3. to review
milestone: next
branch: aio-yaml-update
token: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/watchtower-update.yml
+8 -3
View File
@@ -12,6 +12,7 @@ jobs:
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Run watchtower-container-update
id: watchtower_update
run: |
# Watchtower
watchtower_version="$(
@@ -24,15 +25,19 @@ jobs:
watchtower_commit_hash="$(git ls-remote https://github.com/nicholas-fedor/watchtower $watchtower_version | sed 's/refs.*//')"
sed -i "s|^ENV WATCHTOWER_COMMIT_HASH.*$|ENV WATCHTOWER_COMMIT_HASH=$watchtower_commit_hash|" ./Containers/watchtower/Dockerfile
sed -i "s|\$WATCHTOWER_COMMIT_HASH.*$|\$WATCHTOWER_COMMIT_HASH # $watchtower_version|" ./Containers/watchtower/Dockerfile
echo "watchtower_version=$watchtower_version" >> "$GITHUB_OUTPUT"
- name: Create Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
with:
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: watchtower-update automated change
signoff: true
title: watchtower container update
body: Automated watchtower container update
title: watchtower container update to ${{ steps.watchtower_update.outputs.watchtower_version }}
body: |
Automated watchtower container update to version ${{ steps.watchtower_update.outputs.watchtower_version }}.
See the [Watchtower ${{ steps.watchtower_update.outputs.watchtower_version }} release notes](https://github.com/nicholas-fedor/watchtower/releases/tag/${{ steps.watchtower_update.outputs.watchtower_version }}) for details.
labels: dependencies, 3. to review
milestone: next
branch: watchtower-container-update
Containers/apache/Caddyfile
+2
View File
@@ -25,6 +25,8 @@ http://{$APACHE_HOST}.nextcloud-aio:23973, # For Collabora callback and WOPI req
-Via
}
encode
# Collabora
route /browser/* {
reverse_proxy {$COLLABORA_HOST}:9980
Containers/apache/Dockerfile
+1 -1
View File
@@ -47,7 +47,7 @@ RUN set -ex; \
-e 's/^#\(LoadModule .*mod_authz_core.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_alias.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_mpm_event.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_brotli.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_reqtimeout.so\)/\1/' \
-e 's/\(LoadModule .*mod_mpm_worker.so\)/#\1/' \
-e 's/\(LoadModule .*mod_mpm_prefork.so\)/#\1/' \
-e 's/\(ScriptAlias \)/#\1/' \
Containers/apache/nextcloud.conf
+7 -8
View File
@@ -17,14 +17,6 @@ Listen 8000
<Proxy "fcgi://${NEXTCLOUD_HOST}:9000" flushpackets=on>
</Proxy>
# Compress JS, CSS and SVG responses with Brotli.
# Other plain-text files are already compressed by Nextcloud itself.
# Desktop and mobile sync clients never request JS/CSS/SVG assets.
<IfModule mod_brotli.c>
AddOutputFilterByType BROTLI_COMPRESS text/javascript application/javascript application/x-javascript text/css image/svg+xml
BrotliCompressionQuality 0
</IfModule>
# Nextcloud dir
DocumentRoot /var/www/html/
<Directory /var/www/html/>
@@ -49,6 +41,13 @@ Listen 8000
# See https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxytimeout
ProxyTimeout ${APACHE_MAX_TIME}
# See https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html
# Disable body rate limit so that large uploads on slow connections are not aborted.
# The Timeout directive above still applies as the overall I/O timeout.
<IfModule reqtimeout_module>
RequestReadTimeout header=20-40,MinRate=500 body=0
</IfModule>
# See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable
TraceEnable Off
</VirtualHost>
Containers/apache/supervisord.conf
+22 -22
View File
@@ -1,22 +1,22 @@
[supervisord]
nodaemon=true
logfile=/var/log/supervisord/supervisord.log
pidfile=/var/run/supervisord/supervisord.pid
childlogdir=/var/log/supervisord/
logfile_maxbytes=50MB
logfile_backups=10
loglevel=%(ENV_AIO_LOG_LEVEL)s
[program:apache]
# Stdout logging is disabled as otherwise the logs are spammed
stdout_logfile=%(ENV_SUPERVISORD_STDOUT)s
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=httpd -DFOREGROUND
[program:caddy]
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=/usr/bin/caddy run --config /tmp/Caddyfile
[supervisord]
nodaemon=true
logfile=/var/log/supervisord/supervisord.log
pidfile=/var/run/supervisord/supervisord.pid
childlogdir=/var/log/supervisord/
logfile_maxbytes=50MB
logfile_backups=10
loglevel=%(ENV_AIO_LOG_LEVEL)s
[program:apache]
# Stdout logging is disabled as otherwise the logs are spammed
stdout_logfile=%(ENV_SUPERVISORD_STDOUT)s
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=httpd -DFOREGROUND
[program:caddy]
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=/usr/bin/caddy run --config /tmp/Caddyfile
Containers/borgbackup/backupscript.sh
+1 -1
View File
@@ -436,7 +436,7 @@ if [ "$BORG_MODE" = restore ]; then
#
# Older backups may still contain files we've since excluded, so we have to exclude on extract as well.
cd / # borg extract has no destination arg and extracts to CWD
if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --noxattrs --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
then
RESTORE_FAILED=1
echo "Failed to extract backup archive."
Containers/docker-socket-proxy/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM haproxy:3.4.2-alpine
FROM haproxy:3.4.3-alpine
# hadolint ignore=DL3002
USER root
Containers/eurooffice/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM ghcr.io/euro-office/documentserver:v9.3.2
FROM ghcr.io/euro-office/documentserver:v9.3.3
# USER root is probably used
Containers/fulltextsearch/Dockerfile
+33 -33
View File
@@ -1,33 +1,33 @@
# syntax=docker/dockerfile:latest
# Probably from here https://github.com/elastic/dockerfiles/blob/9.3/elasticsearch/Dockerfile
FROM elasticsearch:9.4.4
USER root
# hadolint ignore=DL3041
RUN set -ex; \
\
microdnf update -y; \
microdnf install -y --setopt=tsflags=nodocs \
tzdata \
; \
microdnf clean all;
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
USER 1000:0
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD /healthcheck.sh
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Full Text Search for Nextcloud AIO" \
org.opencontainers.image.description="Elasticsearch-based full-text search for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
ENV ES_JAVA_OPTS="-Xms512M -Xmx512M"
ENTRYPOINT ["/start.sh"]
# syntax=docker/dockerfile:latest
# Probably from here https://github.com/elastic/dockerfiles/blob/9.3/elasticsearch/Dockerfile
FROM elasticsearch:9.5.1
USER root
# hadolint ignore=DL3041
RUN set -ex; \
\
microdnf update -y; \
microdnf install -y --setopt=tsflags=nodocs \
tzdata \
; \
microdnf clean all;
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
USER 1000:0
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD /healthcheck.sh
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Full Text Search for Nextcloud AIO" \
org.opencontainers.image.description="Elasticsearch-based full-text search for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
ENV ES_JAVA_OPTS="-Xms512M -Xmx512M"
ENTRYPOINT ["/start.sh"]
Containers/harp/Dockerfile
+17
View File
@@ -0,0 +1,17 @@
# syntax=docker/dockerfile:latest
FROM ghcr.io/nextcloud/nextcloud-appapi-harp:v0.4.4
# USER root is probably used
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Nextcloud AppAPI HARP for Nextcloud AIO" \
org.opencontainers.image.description="Nextcloud AppAPI HARP for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
# Copied from upstream
HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh
Containers/imaginary/Dockerfile
+53 -53
View File
@@ -1,54 +1,54 @@
# syntax=docker/dockerfile:latest
FROM golang:1.26.5-alpine3.24 AS go
# syntax=docker/dockerfile:latest
FROM golang:1.26.6-alpine3.24 AS go
ENV IMAGINARY_HASH=6a274b488759a896aff02f52afee6e50b5e3a3ee
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
vips-dev \
vips-magick \
vips-heif \
vips-jxl \
vips-poppler \
build-base; \
go install github.com/h2non/imaginary@"$IMAGINARY_HASH";
FROM alpine:3.24.1
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
tzdata \
ca-certificates \
netcat-openbsd \
vips \
vips-magick \
vips-heif \
vips-jxl \
vips-poppler \
ttf-dejavu \
bash
COPY --from=go /go/bin/imaginary /usr/local/bin/imaginary
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
ENV PORT=9000 \
AIO_LOG_LEVEL=warn
USER 65534
# https://github.com/h2non/imaginary#memory-issues
ENV MALLOC_ARENA_MAX=2
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Imaginary for Nextcloud AIO" \
org.opencontainers.image.description="High-performance image processing service for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
vips-dev \
vips-magick \
vips-heif \
vips-jxl \
vips-poppler \
build-base; \
go install github.com/h2non/imaginary@"$IMAGINARY_HASH";
FROM alpine:3.24.1
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
tzdata \
ca-certificates \
netcat-openbsd \
vips \
vips-magick \
vips-heif \
vips-jxl \
vips-poppler \
ttf-dejavu \
bash
COPY --from=go /go/bin/imaginary /usr/local/bin/imaginary
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
ENV PORT=9000 \
AIO_LOG_LEVEL=warn
USER 65534
# https://github.com/h2non/imaginary#memory-issues
ENV MALLOC_ARENA_MAX=2
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Imaginary for Nextcloud AIO" \
org.opencontainers.image.description="High-performance image processing service for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
Containers/mastercontainer/Dockerfile
+6 -6
View File
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:latest
# Docker CLI is a requirement
FROM docker:29.6.2-cli AS docker
FROM docker:29.7.2-cli AS docker
ARG CADDY_REMOTE_HOST_HASH=e80a9931765a8dbcbb47db415863387f0df0e1b3
@@ -11,7 +11,7 @@ RUN set -ex; \
/usr/bin/caddy list-modules
# From https://github.com/docker-library/php/blob/master/8.5/alpine3.24/fpm/Dockerfile
FROM php:8.5.8-fpm-alpine3.24
FROM php:8.5.9-fpm-alpine3.24
EXPOSE 80
EXPOSE 8080
@@ -31,7 +31,7 @@ COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf
WORKDIR /var/www/docker-aio
# hadolint ignore=SC2086,DL3047,DL3003,DL3004
# hadolint ignore=SC2086,DL3047,DL3003
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache shadow; \
@@ -43,7 +43,7 @@ RUN set -ex; \
ca-certificates \
bash \
supervisor \
sudo \
su-exec \
netcat-openbsd \
curl \
grep; \
@@ -87,8 +87,8 @@ RUN set -ex; \
rm -r ./php/tests; \
chown www-data:www-data -R /var/www/docker-aio; \
cd php; \
sudo -E -u www-data composer install --no-dev; \
sudo -E -u www-data composer clear-cache; \
su-exec www-data composer install --no-dev; \
su-exec www-data composer clear-cache; \
cd ..; \
rm -f /usr/local/bin/composer; \
chmod -R 770 /var/www/docker-aio; \
Containers/mastercontainer/cron.sh
+10 -10
View File
@@ -51,33 +51,33 @@ while true; do
# Check for updates and send notification if yes on saturdays
if [ "$(date +%u)" = 6 ]; then
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
fi
# Check if AIO is outdated
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
# Update deSEC DNS IP record (no-op when IP is unchanged or deSEC is not configured)
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
# Remove sessions older than 24h
find "/mnt/docker-aio-config/session/" -mindepth 1 -mmin +1440 -delete
# Remove nextcloud-aio-domaincheck container
if sudo -E -u www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
sudo -E -u www-data docker container remove nextcloud-aio-domaincheck
if su-exec www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
su-exec www-data docker container remove nextcloud-aio-domaincheck
fi
# Remove dangling images (support both deprecated label-schema and OCI standard vendor label)
sudo -E -u www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
sudo -E -u www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
su-exec www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
su-exec www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
# Check for available free space
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
# Remove mastercontainer from default bridge network
if sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
sudo -E -u www-data docker network disconnect bridge nextcloud-aio-mastercontainer
if su-exec www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
su-exec www-data docker network disconnect bridge nextcloud-aio-mastercontainer
fi
# Wait 60s so that the whole loop will not be executed again
Containers/mastercontainer/daily-backup.sh
+18 -9
View File
@@ -13,6 +13,15 @@ if ! [ -f "$CONFIG_FILE" ] || (! grep -q "wasStartButtonClicked.*1" "$CONFIG_FIL
exit 0
fi
# Exit early if the backup container is currently running a restore
if docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
if grep -q '"backup-mode".*"restore"' "$CONFIG_FILE"; then
echo "Backup container is running in restore mode. Exiting to not interrupt the restore..."
rm -f "/mnt/docker-aio-config/data/daily_backup_running"
exit 0
fi
fi
# Daily backup and backup check cannot be run at the same time
if [ "$DAILY_BACKUP" = 1 ] && [ "$CHECK_BACKUP" = 1 ]; then
echo "Daily backup and backup check cannot be run at the same time. Exiting..."
@@ -24,7 +33,7 @@ fi
if [ "$LOCK_FILE_PRESENT" = 0 ] || ! [ -f "/mnt/docker-aio-config/data/daily_backup_running" ]; then
find "/mnt/docker-aio-config/session/" -mindepth 1 -delete
fi
sudo -E -u www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
su-exec www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
# Check if apache is running/stopped, watchtower is stopped and backupcontainer is stopped
LOCAL_APACHE_PORT="$(docker inspect nextcloud-aio-apache --format "{{.Config.Env}}" | grep -o 'APACHE_PORT=[0-9]\+' | grep -o '[0-9]\+' | head -1)"
@@ -54,7 +63,7 @@ done
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Starting mastercontainer update..."
echo "(The script might get exited due to that. In order to update all the other containers correctly, you need to run this script with the same settings a second time.)"
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
fi
# Wait for watchtower to stop
@@ -71,20 +80,20 @@ fi
# Update container images to reduce downtime later on
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Updating container images..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
fi
# Stop containers if required
# shellcheck disable=SC2235
if [ "$CHECK_BACKUP" != 1 ] && ([ "$DAILY_BACKUP" != 1 ] || [ "$STOP_CONTAINERS" = 1 ]); then
echo "Stopping containers..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
fi
# Execute the backup itself and some related tasks (also stops the containers)
if [ "$DAILY_BACKUP" = 1 ]; then
echo "Creating daily backup..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
if ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
echo "Something seems to be wrong: the borg container should be started at this step."
fi
@@ -97,17 +106,17 @@ fi
# Execute backup check
if [ "$CHECK_BACKUP" = 1 ]; then
echo "Starting backup check..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
fi
# Start and/or update containers
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Starting and updating containers..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
else
if [ "$START_CONTAINERS" = 1 ]; then
echo "Starting containers without updating them..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
fi
fi
@@ -131,7 +140,7 @@ if [ "$DAILY_BACKUP" = 1 ] && ([ "$AUTOMATIC_UPDATES" = 1 ] || [ "$START_CONTAIN
done
fi
echo "Sending backup notification..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
fi
echo "Daily backup script has finished"
Containers/mastercontainer/start.sh
+12 -12
View File
@@ -55,7 +55,7 @@ elif mountpoint -q /var/www/docker-aio/php/containers.json; then
echo "If you need to customize things, feel free to use https://github.com/nextcloud/all-in-one/tree/main/manual-install"
echo "See https://github.com/nextcloud/all-in-one/blob/main/manual-install/latest.yml"
exit 1
elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
elif ! su-exec www-data test -r /var/run/docker.sock; then
echo "Trying to fix docker.sock permissions internally..."
DOCKER_GROUP=$(stat -c '%G' /var/run/docker.sock)
DOCKER_GROUP_ID=$(stat -c '%g' /var/run/docker.sock)
@@ -73,7 +73,7 @@ elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
groupadd -g "$DOCKER_GROUP_ID" docker
usermod -aG docker www-data
fi
if ! sudo -E -u www-data test -r /var/run/docker.sock; then
if ! su-exec www-data test -r /var/run/docker.sock; then
print_red "Docker socket is not readable by the www-data user. Cannot continue."
exit 1
fi
@@ -108,8 +108,8 @@ fi
FALLBACK_DOCKER_API_VERSION="1.41"
# Check if docker info can be used
if ! sudo -E -u www-data docker info &>/dev/null; then
if ! sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
if ! su-exec www-data docker info &>/dev/null; then
if ! su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
print_red "Cannot connect to the docker socket. Cannot proceed."
echo "Did you maybe remove group read permissions for the docker socket? AIO needs them in order to access the docker socket."
echo "If SELinux is enabled on your host, see https://github.com/nextcloud/all-in-one#are-there-known-problems-when-selinux-is-enabled"
@@ -125,9 +125,9 @@ fi
# Docker api version check
# shellcheck disable=SC2001
API_VERSION_NUMB="$(echo "$DOCKER_API_VERSION" | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(su-exec www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
if [ -z "$LOCAL_API_VERSION_NUMB" ]; then
LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
fi
if [ -n "$LOCAL_API_VERSION_NUMB" ] && [ -n "$API_VERSION_NUMB" ]; then
if ! [ "$LOCAL_API_VERSION_NUMB" -ge "$API_VERSION_NUMB" ]; then
@@ -143,7 +143,7 @@ else
fi
# Check Storage drivers
STORAGE_DRIVER="$(sudo -E -u www-data docker info | grep "Storage Driver")"
STORAGE_DRIVER="$(su-exec www-data docker info | grep "Storage Driver")"
# Check if vfs is used: https://github.com/nextcloud/all-in-one/discussions/1467
if echo "$STORAGE_DRIVER" | grep -q vfs; then
echo "$STORAGE_DRIVER"
@@ -154,26 +154,26 @@ elif echo "$STORAGE_DRIVER" | grep -q fuse-overlayfs; then
fi
# Check if snap install
if sudo -E -u www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
if su-exec www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
print_red "Warning: It looks like your installation uses docker installed via snap."
print_red "This comes with some limitations and is disrecommended by the docker maintainers."
print_red "See for example https://github.com/nextcloud/all-in-one/discussions/4890#discussioncomment-10386752"
fi
# Check if startup command was executed correctly
if ! sudo -E -u www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
if ! su-exec www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
print_red "It seems like you did not give the mastercontainer the correct name? (The 'nextcloud-aio-mastercontainer' container was not found.)
Using a different name is not supported since mastercontainer updates will not work in that case!
If you are on docker swarm and try to run AIO, see https://github.com/nextcloud/all-in-one#can-i-run-this-with-docker-swarm"
exit 1
elif sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
elif su-exec www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
print_red "It seems like you used a hash for the mastercontainer image tag. This is not supported!"
exit 1
elif ! sudo -E -u www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
elif ! su-exec www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
print_red "It seems like you did not give the mastercontainer volume the correct name? (The 'nextcloud_aio_mastercontainer' volume was not found.)
Using a different name is not supported since the built-in backup solution will not work in that case!"
exit 1
elif ! sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
elif ! su-exec www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
print_red "It seems like you did not attach the 'nextcloud_aio_mastercontainer' volume to the mastercontainer?
This is not supported since the built-in backup solution will not work in that case!"
exit 1
Containers/nextcloud/Dockerfile
+3 -3
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM php:8.3.32-fpm-alpine3.24
FROM php:8.3.33-fpm-alpine3.24
ENV PHP_MEMORY_LIMIT=512M
ENV PHP_UPLOAD_LIMIT=16G
@@ -8,7 +8,7 @@ ENV SOURCE_LOCATION=/usr/src/nextcloud
ENV REDIS_DB_INDEX=0
# AIO settings start # Do not remove or change this line!
ENV NEXTCLOUD_VERSION=33.0.7
ENV NEXTCLOUD_VERSION=33.0.8
ENV AIO_TOKEN=123456
ENV AIO_URL=localhost
# AIO settings end # Do not remove or change this line!
@@ -234,7 +234,7 @@ RUN set -ex; \
git \
postgresql-client \
tzdata \
sudo \
su-exec \
grep \
nodejs \
bind-tools \
Containers/nextcloud/config/s3.config.php
+47 -47
View File
@@ -1,47 +1,47 @@
<?php
if (getenv('OBJECTSTORE_S3_BUCKET')) {
$use_ssl = getenv('OBJECTSTORE_S3_SSL');
$use_path = getenv('OBJECTSTORE_S3_USEPATH_STYLE');
$use_legacyauth = getenv('OBJECTSTORE_S3_LEGACYAUTH');
$autocreate = getenv('OBJECTSTORE_S3_AUTOCREATE');
$multibucket = getenv('OBJECTSTORE_S3_MULTIBUCKET');
$CONFIG = array(
'objectstore' => array(
'class' => '\OC\Files\ObjectStore\S3',
'arguments' => array(
'multibucket' => $multibucket === 'true',
'num_buckets' => (int)getenv('OBJECTSTORE_S3_NUM_BUCKETS') ?: 64,
'bucket' => getenv('OBJECTSTORE_S3_BUCKET'),
'key' => getenv('OBJECTSTORE_S3_KEY') ?: '',
'secret' => getenv('OBJECTSTORE_S3_SECRET') ?: '',
'region' => getenv('OBJECTSTORE_S3_REGION') ?: '',
'hostname' => getenv('OBJECTSTORE_S3_HOST') ?: '',
'port' => getenv('OBJECTSTORE_S3_PORT') ?: '',
'storageClass' => getenv('OBJECTSTORE_S3_STORAGE_CLASS') ?: '',
'objectPrefix' => getenv("OBJECTSTORE_S3_OBJECT_PREFIX") ? getenv("OBJECTSTORE_S3_OBJECT_PREFIX") : "urn:oid:",
'autocreate' => strtolower($autocreate) !== 'false',
'use_ssl' => strtolower($use_ssl) !== 'false',
// required for some non Amazon S3 implementations
'use_path_style' => strtolower($use_path) === 'true',
// required for older protocol versions
'legacy_auth' => strtolower($use_legacyauth) === 'true',
'use_nextcloud_bundle' => 1,
)
)
);
$sse_c_key = getenv('OBJECTSTORE_S3_SSE_C_KEY');
if ($sse_c_key) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = $sse_c_key;
}
$requestChecksumValidation = getenv('OBJECTSTORE_S3_REQUEST_CHECKSUM_VALIDATION');
if ($requestChecksumValidation) {
$CONFIG['objectstore']['arguments']['request_checksum_calculation'] = $requestChecksumValidation;
}
$responseChecksumValidation = getenv('OBJECTSTORE_S3_RESPONSE_CHECKSUM_VALIDATION');
if ($responseChecksumValidation) {
$CONFIG['objectstore']['arguments']['response_checksum_validation'] = $responseChecksumValidation;
}
}
<?php
if (getenv('OBJECTSTORE_S3_BUCKET')) {
$use_ssl = getenv('OBJECTSTORE_S3_SSL');
$use_path = getenv('OBJECTSTORE_S3_USEPATH_STYLE');
$use_legacyauth = getenv('OBJECTSTORE_S3_LEGACYAUTH');
$autocreate = getenv('OBJECTSTORE_S3_AUTOCREATE');
$multibucket = getenv('OBJECTSTORE_S3_MULTIBUCKET');
$CONFIG = array(
'objectstore' => array(
'class' => '\OC\Files\ObjectStore\S3',
'arguments' => array(
'multibucket' => $multibucket === 'true',
'num_buckets' => (int)getenv('OBJECTSTORE_S3_NUM_BUCKETS') ?: 64,
'bucket' => getenv('OBJECTSTORE_S3_BUCKET'),
'key' => getenv('OBJECTSTORE_S3_KEY') ?: '',
'secret' => getenv('OBJECTSTORE_S3_SECRET') ?: '',
'region' => getenv('OBJECTSTORE_S3_REGION') ?: '',
'hostname' => getenv('OBJECTSTORE_S3_HOST') ?: '',
'port' => getenv('OBJECTSTORE_S3_PORT') ?: '',
'storageClass' => getenv('OBJECTSTORE_S3_STORAGE_CLASS') ?: '',
'objectPrefix' => getenv("OBJECTSTORE_S3_OBJECT_PREFIX") ? getenv("OBJECTSTORE_S3_OBJECT_PREFIX") : "urn:oid:",
'autocreate' => strtolower($autocreate) !== 'false',
'use_ssl' => strtolower($use_ssl) !== 'false',
// required for some non Amazon S3 implementations
'use_path_style' => strtolower($use_path) === 'true',
// required for older protocol versions
'legacy_auth' => strtolower($use_legacyauth) === 'true',
'use_nextcloud_bundle' => 1,
)
)
);
$sse_c_key = getenv('OBJECTSTORE_S3_SSE_C_KEY');
if ($sse_c_key) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = $sse_c_key;
}
$requestChecksumValidation = getenv('OBJECTSTORE_S3_REQUEST_CHECKSUM_VALIDATION');
if ($requestChecksumValidation) {
$CONFIG['objectstore']['arguments']['request_checksum_calculation'] = $requestChecksumValidation;
}
$responseChecksumValidation = getenv('OBJECTSTORE_S3_RESPONSE_CHECKSUM_VALIDATION');
if ($responseChecksumValidation) {
$CONFIG['objectstore']['arguments']['response_checksum_validation'] = $responseChecksumValidation;
}
}
Containers/nextcloud/config/swift.config.php
+31 -31
View File
@@ -1,31 +1,31 @@
<?php
if (getenv('OBJECTSTORE_SWIFT_URL')) {
$autocreate = getenv('OBJECTSTORE_SWIFT_AUTOCREATE');
$CONFIG = array(
'objectstore' => [
'class' => 'OC\\Files\\ObjectStore\\Swift',
'arguments' => [
'autocreate' => $autocreate == true && strtolower($autocreate) !== 'false',
'user' => [
'name' => getenv('OBJECTSTORE_SWIFT_USER_NAME'),
'password' => getenv('OBJECTSTORE_SWIFT_USER_PASSWORD'),
'domain' => [
'name' => (getenv('OBJECTSTORE_SWIFT_USER_DOMAIN')) ?: 'Default',
],
],
'scope' => [
'project' => [
'name' => getenv('OBJECTSTORE_SWIFT_PROJECT_NAME'),
'domain' => [
'name' => (getenv('OBJECTSTORE_SWIFT_PROJECT_DOMAIN')) ?: 'Default',
],
],
],
'serviceName' => (getenv('OBJECTSTORE_SWIFT_SERVICE_NAME')) ?: 'swift',
'region' => getenv('OBJECTSTORE_SWIFT_REGION'),
'url' => getenv('OBJECTSTORE_SWIFT_URL'),
'bucket' => getenv('OBJECTSTORE_SWIFT_CONTAINER_NAME'),
]
]
);
}
<?php
if (getenv('OBJECTSTORE_SWIFT_URL')) {
$autocreate = getenv('OBJECTSTORE_SWIFT_AUTOCREATE');
$CONFIG = array(
'objectstore' => [
'class' => 'OC\\Files\\ObjectStore\\Swift',
'arguments' => [
'autocreate' => $autocreate == true && strtolower($autocreate) !== 'false',
'user' => [
'name' => getenv('OBJECTSTORE_SWIFT_USER_NAME'),
'password' => getenv('OBJECTSTORE_SWIFT_USER_PASSWORD'),
'domain' => [
'name' => (getenv('OBJECTSTORE_SWIFT_USER_DOMAIN')) ?: 'Default',
],
],
'scope' => [
'project' => [
'name' => getenv('OBJECTSTORE_SWIFT_PROJECT_NAME'),
'domain' => [
'name' => (getenv('OBJECTSTORE_SWIFT_PROJECT_DOMAIN')) ?: 'Default',
],
],
],
'serviceName' => (getenv('OBJECTSTORE_SWIFT_SERVICE_NAME')) ?: 'swift',
'region' => getenv('OBJECTSTORE_SWIFT_REGION'),
'url' => getenv('OBJECTSTORE_SWIFT_URL'),
'bucket' => getenv('OBJECTSTORE_SWIFT_CONTAINER_NAME'),
]
]
);
}
Containers/nextcloud/notify-all.sh
+1 -1
View File
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
fi
if [[ "$EUID" = 0 ]]; then
COMMAND=(sudo -E -u www-data php /var/www/html/occ)
COMMAND=(su-exec www-data php /var/www/html/occ)
else
COMMAND=(php /var/www/html/occ)
fi
Containers/nextcloud/notify.sh
+1 -1
View File
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
fi
if [[ "$EUID" = 0 ]]; then
COMMAND=(sudo -E -u www-data php /var/www/html/occ)
COMMAND=(su-exec www-data php /var/www/html/occ)
else
COMMAND=(php /var/www/html/occ)
fi
Containers/nextcloud/root.motd
+1 -1
View File
@@ -1,4 +1,4 @@
Warning: You have logged in into the Nextcloud container as root user.
See https://github.com/nextcloud/all-in-one#how-to-run-occ-commands if you want to run occ commands.
Apart from that, you can use 'sudo -E -u www-data php occ <your-command>' in order to run occ commands.
Apart from that, you can use 'su-exec www-data php occ <your-command>' in order to run occ commands.
Of course <your-command> needs to be substituted with the command that you want to use.
Containers/nextcloud/start.sh
+5 -5
View File
@@ -12,7 +12,7 @@ fi
# Only start container if database is accessible
# POSTGRES_HOST must be set in the containers env vars and POSTGRES_PORT has a default above
# shellcheck disable=SC2153
while ! sudo -E -u www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
while ! su-exec www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
echo "Waiting for database to start..."
sleep 5
done
@@ -29,7 +29,7 @@ fi
# Fix false database connection on old instances
if [ -f "/var/www/html/config/config.php" ]; then
sleep 2
while ! sudo -E -u www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
while ! su-exec www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
echo "Waiting for the database to start..."
sleep 5
done
@@ -62,12 +62,12 @@ if [ "$AIO_LOG_LEVEL" != 'debug' ]; then
fi
# Check datadir permissions
sudo -E -u www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
su-exec www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
if ! [ -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" ]; then
chown -R www-data:root "$NEXTCLOUD_DATA_DIR"
chmod 750 -R "$NEXTCLOUD_DATA_DIR"
fi
sudo -E -u www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
su-exec www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
# Install additional dependencies
if [ -n "$ADDITIONAL_APKS" ]; then
@@ -153,7 +153,7 @@ if [ -n "$ADDITIONAL_PHP_EXTENSIONS" ]; then
fi
# Run original entrypoint
if ! sudo -E -u www-data bash /entrypoint.sh; then
if ! su-exec www-data bash /entrypoint.sh; then
exit 1
fi
Containers/nextcloud/supervisord.conf
+1
View File
@@ -31,6 +31,7 @@ stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=php /var/www/html/occ taskprocessing:worker --timeout 300
autorestart=true
user=www-data
[program:run-exec-commands]
Containers/nextcloud/upgrade-latest-major.sh
+1 -1
View File
@@ -2,7 +2,7 @@
PHP_CLI="php"
if [[ "$EUID" = 0 ]]; then
PHP_CLI="sudo -u www-data -E $PHP_CLI"
PHP_CLI="su-exec www-data $PHP_CLI"
fi
# shellcheck disable=SC2016
Containers/postgresql/Dockerfile
+1 -1
View File
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:latest
# From https://github.com/docker-library/postgres/blob/master/18/alpine3.24/Dockerfile
FROM postgres:18.4-alpine
FROM postgres:18.6-alpine
ENV PGDATA=/var/lib/postgresql/data
Containers/talk-recording/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM python:3.14.6-alpine3.24
FROM python:3.14.7-alpine3.24
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
Containers/talk/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM nats:2.14.3-scratch AS nats
FROM nats:2.14.5-scratch AS nats
FROM eturnal/eturnal:1.12.2-alpine AS eturnal
FROM strukturag/nextcloud-spreed-signaling:2.1.1 AS signaling
FROM alpine:3.24.1 AS janus
Containers/watchtower/Dockerfile
+3 -3
View File
@@ -1,13 +1,13 @@
# syntax=docker/dockerfile:latest
FROM golang:1.26.5-alpine3.24 AS go
FROM golang:1.26.6-alpine3.24 AS go
ENV WATCHTOWER_COMMIT_HASH=e48a0307b9cab185e08f6f8453ee62f937f43a06
ENV WATCHTOWER_COMMIT_HASH=dcc6e4acd3bd798c46b21bb4e70870f2dca6675d
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
build-base; \
go install github.com/nicholas-fedor/watchtower@$WATCHTOWER_COMMIT_HASH # v1.20.2
go install github.com/nicholas-fedor/watchtower@$WATCHTOWER_COMMIT_HASH # v1.20.3
FROM alpine:3.24.1
community-containers/caddy/caddy.json
+3 -1
View File
@@ -21,6 +21,7 @@
"APACHE_PORT=%APACHE_PORT%",
"APACHE_IP_BINDING=%APACHE_IP_BINDING%",
"NEXTCLOUD_EXPORTER_CADDY_PASSWORD=%NEXTCLOUD_EXPORTER_CADDY_PASSWORD%",
"NEXTCLOUD_GLANCES_CADDY_PASSWORD=%NEXTCLOUD_GLANCES_CADDY_PASSWORD%",
"DESEC_TOKEN=%DESEC_TOKEN%"
],
"volumes": [
@@ -36,7 +37,8 @@
}
],
"secrets": [
"NEXTCLOUD_EXPORTER_CADDY_PASSWORD"
"NEXTCLOUD_EXPORTER_CADDY_PASSWORD",
"NEXTCLOUD_GLANCES_CADDY_PASSWORD"
],
"aio_variables": [
"apache_ip_binding=@INTERNAL",
community-containers/caddy/readme.md
+151 -30
View File
@@ -1,36 +1,157 @@
## Caddy with geoblocking
This container bundles [caddy](https://caddyserver.com/) and auto-configures it for you as a reverse proxy.
It also covers [vaultwarden](https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden) by listening on `bw.$NC_DOMAIN`, if installed.
It also covers [stalwart](https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart) by listening on `mail.$NC_DOMAIN`, if installed.
It also covers [jellyfin](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyfin) by listening on `media.$NC_DOMAIN`, if installed.
It also covers [lldap](https://github.com/nextcloud/all-in-one/tree/main/community-containers/lldap) by listening on `ldap.$NC_DOMAIN`, if installed.
It also covers [nocodb](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nocodb) by listening on `tables.$NC_DOMAIN`, if installed.
It also covers [seerr](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr) by listening on `requests.$NC_DOMAIN`, if installed.
It also covers [nextcloud-exporter](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nextcloud-exporter) by listening on `metrics.$NC_DOMAIN`, if installed.
It also covers [LocalAI](https://github.com/nextcloud/all-in-one/tree/main/community-containers/local-ai) by listening on `ai.$NC_DOMAIN`, if installed.
It also covers [azuracast](https://github.com/nextcloud/all-in-one/tree/main/community-containers/azuracast) by listening on `radio.$NC_DOMAIN`, if installed.
It also covers [joplin-server](https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server) by listening on `joplin.$NC_DOMAIN`, if installed.
# Caddy community container
This container bundles [caddy](https://caddyserver.com/) and auto-configures it for you as a reverse proxy. It automatically obtains SSL certificates from let's encrypt
> [!Caution]
> - This container is incompatible with the [npmplus](https://github.com/nextcloud/all-in-one/tree/main/community-containers/npmplus) community container. So make sure that you do not enable both at the same time!
> - Make sure that no other service is using port 443/tcp on your host as otherwise the containers will fail to start. You can check this with `sudo netstat -tulpn | grep 443` before installing this container
> - the default `admin` Nextcloud user needs to be present, i.e. it can not be deleted because caddy configuration can be done there.
## Supported community containers
This container creates Let's Encrypt certificates for subdomains of `your-nc-domain.com` for a number of community containers.
> [!Important]
> You need to set the correct DNS records for this to work
>
> Example:
> - Your domain is `your-nc-domain.com` and you want to use the vaultwarden container.
> - Then you need to set CNAME record for the subdomain `bw.your-nc-domain.com` to point to your main domain `your-nc-domain.com`.
> - Alternatively, you can configure the A/AAAA records of `bw.your-nc-domain.com` to point to the public IP-address of your Nextcloud AIO server.
### Notes
- This container is incompatible with the [npmplus](https://github.com/nextcloud/all-in-one/tree/main/community-containers/npmplus) community container. So make sure that you do not enable both at the same time!
- Make sure that no other service is using port 443/tcp on your host as otherwise the containers will fail to start. You can check this with `sudo netstat -tulpn | grep 443` before installing AIO.
| Container | Subdomain | Geoblocking | IP Allow List | Authentication |
|---------------------------------------------------------------------------------------------------------------------|----------------------------------|-------------|---------------|----------------|
| [azuracast](https://github.com/nextcloud/all-in-one/tree/main/community-containers/azuracast) | `radio.your-nc-domain.com` | ✅ | | |
| [glances](https://github.com/nextcloud/all-in-one/tree/main/community-containers/glances) | `glances.your-nc-domain.com` | ✅ | | ✅ |
| [jellyfin](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyfin) | `media.your-nc-domain.com` | ✅ | | |
| [joplin-server](https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server) | `joplin.your-nc-domain.com` | ✅ | | |
| [lldap](https://github.com/nextcloud/all-in-one/tree/main/community-containers/lldap) | `ldap.your-nc-domain.com` | ✅ | ✅ | |
| [LocalAI](https://github.com/nextcloud/all-in-one/tree/main/community-containers/local-ai) | `ai.your-nc-domain.com` | ✅ | | |
| [nextcloud-exporter](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nextcloud-exporter) | `metrics.your-nc-domain.com` | ✅ | | ✅ |
| [nocodb](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nocodb) | `tables.your-nc-domain.com` | ✅ | | |
| [seerr](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr) | `requests.your-nc-domain.com` | ✅ | | |
| [stalwart](https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart) | `mail.your-nc-domain.com` | ✅ | ✅ | |
| [vaultwarden](https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden) | `bw.your-nc-domain.com` | ✅ | ✅ | |
## Geoblocking
- After the container was started the first time, log in in Nextcloud as default `admin` user. You should see a new `nextcloud-aio-caddy` folder in the files app and inside there an `allowed-countries.txt` file
- In there you can adjust the allowed country codes for caddy by adding them to the first line, e.g. `IT FR` would allow access from italy and france.
- Additionally, in order to activate this config, you need to get an account at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
- download the `GeoLite2-Country.mmdb` from there and upload it with this exact name into the `nextcloud-aio-caddy` folder.
- Afterwards restart all containers from the AIO interface and your new config should be active
> [!Warning]
> - no entry in that file disables blocking
> - Private ip-ranges are always allowed.
## IP allow lists
- Some containers allow for setting allowed IP addresses
- This way you can secure administration interfaces from the external access
- After the container was started the first time, log in as default `admin` user. You should see a new `nextcloud-aio-caddy` folder
- put one of the following files there with the allowed IPs
- allowed-IPs-vaultwarden.txt
- allowed-IPs-stalwart.txt
- allowed-IPs-lldap.txt
- In there you can adjust the allowed IPs by adding them to the first line, e.g. `11.22.33.44 192.168.1.0/24` will allow access from those IPs
> [!Warning]
> - missing files or no entries in that file means no IP restriction is applied
## Authentication
- Some containers have randomly created access passwords for additional security
- Those secrets will be shown in the AIO interface after installation
## Custom configuration
It is possible to add configuration for even more services and subdomains.
> [!Caution]
> - Errors in config will result in caddy not starting at all
> - Be sure to know what you are doing, the risk is all yours
> - You should probably check everything before breaking stuff. Use at least a service like https://abacktools.com/tools/data/validators/caddy-config-validator
There are 2 different approaches:
1. within nextcloud
- After the container was started the first time, log in as default `admin` user. You should see a new `nextcloud-aio-caddy` folder
- create a sub folder `caddy-imports`
- in there you can add one or more \*.txt files
- These will be imported on container startup
- if this fails, caddy won't come up and you can not correct yourself
- in that case open this txt-file on your server using the command line
- if you did not change the default location of Nextcloud's Datadir then you will find it here: `/var/lib/docker/volumes/nextcloud_aio_nextcloud_data/_data/admin/files/nextcloud-aio-caddy/caddy-imports`
2. inside the Caddy container
- You can alternatively add your own Caddy configurations inside the Caddy container
- on your CLI:
- `sudo docker exec -it nextcloud-aio-caddy bash`
- `cd /data/caddy-imports/`
- in there you can add one or more \*.txt files
- These will be imported on container startup
> [!Note]
> If you do not have CLI access to the server run docker commands via a web session by using this community container: https://github.com/nextcloud/all-in-one/tree/main/community-containers/container-management
Simple example for a custom configuration:
```
https://subdomain.your-nc-domain.com:443 {
# actual redirection to port 1234 of container testme
reverse_proxy testme:1234
# TLS options
tls {
issuer acme {
disable_http_challenge
}
}
}
```
More complex example for a custom configuration:
```
https://subdomain.your-nc-domain.com:443 {
# Geofilter will be added by caddy in the next line, if you keep it
# import GEOFILTER
# own IP filter for that configuration, only those are allowed
@public_networks not remote_ip 11.22.33.44 192.168.1.0/24
respond @public_networks 403 {
close
}
# actual redirection to port 1234 of container testme
reverse_proxy testme:1234
# TLS options
tls {
issuer acme {
disable_http_challenge
}
}
# own username and password for that configuration
# password is hashed by bcrypt algorithm
basic_auth {
# Username "Bob", password "hiccup"
Bob $2a$14$Zkx19XLiW6VYouLHR5NmfOFU0z2GTNmpkT/5qqR7hx4IjWJPDhjvG
}
}
```
## Running caddy behind a proxy
- The container also supports the proxy protocol inside caddy. That means that you can run a supported web server in front of port 443/tcp and use the proxy protocol.
- You can enable this by configuring the `APACHE_IP_BINDING` environmental variable for the mastercontainer and set it to an ip-address from which the protocol shall be accepted.
- ⚠️ Note that the initial domain validation will not work correctly if you want to use the proxy protocol. So make sure to skip the domain validation in that case. See the [documentation](https://github.com/nextcloud/all-in-one#how-to-skip-the-domain-validation).
## Notes
- Starting with AIO v12, the Talk port that was usually exposed on port 3478 is now set to port 443 udp and tcp and reachable via `your-nc-domain.com`. For the changes to become activated, you need to go to `https://your-nc-domain.com/settings/admin/talk` and delete all turn and stun servers. Then restart the containers and the new config should become active.
- Starting with AIO v12, you can also limit vaultwarden, stalwart and lldap to certain ip-addresses. You can do so by creating a `allowed-IPs-vaultwarden.txt`, `allowed-IPs-stalwart.txt`, or `allowed-IPs-lldap.txt` file in the `nextcloud-aio-caddy` directory of your admin user and adding the ip-addresses in these files.
- The container also supports the proxy protocol inside caddy. That means that you can run a supported web server in front of port 443/tcp and use the proxy protocol. You can enable this by configuring the `APACHE_IP_BINDING` environmental variable for the mastercontainer and set it to an ip-address from which the protocol shall be accepted. ⚠️ Note that the initial domain validation will not work correctly if you want to use the proxy protocol. So make sure to skip the domain validation in that case. See the [documentation](https://github.com/nextcloud/all-in-one#how-to-skip-the-domain-validation).
- If you want to use this with [vaultwarden](https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden), make sure that you point `bw.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for vaultwarden.
- If you want to use this with [stalwart](https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart), make sure that you point `mail.your-nc-domain.com` to your server using an A, AAAA or CNAME record so that caddy can get a certificate automatically for stalwart.
- If you want to use this with [jellyfin](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyfin), make sure that you point `media.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for jellyfin.
- If you want to use this with [lldap](https://github.com/nextcloud/all-in-one/tree/main/community-containers/lldap), make sure that you point `ldap.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for lldap.
- If you want to use this with [nocodb](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nocodb), make sure that you point `tables.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for nocodb.
- If you want to use this with [seerr](https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr), make sure that you point `requests.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for seerr.
- If you want to use this with [nextcloud-exporter](https://github.com/nextcloud/all-in-one/tree/main/community-containers/nextcloud-exporter), make sure that you point `metrics.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for nextcloud-exporter.
- If you want to use this with [local AI](https://github.com/nextcloud/all-in-one/tree/main/community-containers/local-ai), make sure that you point `ai.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for local AI.
- If you want to use this with [azuracast](https://github.com/nextcloud/all-in-one/tree/main/community-containers/azuracast), make sure that you point `radio.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for azuracast.
- If you want to use this with [Joplin Server](https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server), make sure that you point `joplin.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for local AI.
- After the container was started the first time, you should see a new `nextcloud-aio-caddy` folder and inside there an `allowed-countries.txt` file when you open the files app with the default `admin` user. In there you can adjust the allowed country codes for caddy by adding them to the first line, e.g. `IT FR` would allow access from italy and france. Private ip-ranges are always allowed. Additionally, in order to activate this config, you need to get an account at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data and download the `GeoLite2-Country.mmdb` and upload it with this exact name into the `nextcloud-aio-caddy` folder. Afterwards restart all containers from the AIO interface and your new config should be active!
- You can add your own Caddy configurations in the folder `nextcloud-aio-caddy/caddy-imports` in the files app of the default `admin` user. You need to create that folder manually. These will be imported on container startup.
- You can alternatively add your own Caddy configurations in `/data/caddy-imports/` inside the Caddy container (`sudo docker exec -it nextcloud-aio-caddy bash`). These will be imported on container startup. **Please note:** If you do not have CLI access to the server use the previous option or run docker commands via a web session by using this community container: https://github.com/nextcloud/all-in-one/tree/main/community-containers/container-management
- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
- If you want to remove the container again and revert back to the default, you need to disable the container via the AIO-interface and follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#8-removing-the-reverse-proxy
community-containers/glances/glances.json
+5 -1
View File
@@ -30,9 +30,13 @@
"environment": [
"GLANCES_OPT=-w"
],
"ui_secret": "NEXTCLOUD_GLANCES_CADDY_PASSWORD",
"secrets": [
"NEXTCLOUD_GLANCES_CADDY_PASSWORD"
],
"backup_volumes": [
"nextcloud_aio_glances"
]
}
]
}
}
community-containers/glances/readme.md
+1
View File
@@ -6,6 +6,7 @@ This container starts [Glances](https://nicolargo.github.io/glances/), a web-bas
### Notes
- After adding and starting the container, you can directly visit http://ip.address.of.server:61208/ and access your new Glances instance!
- if you are using caddy community container, this will be available at `https://glances.your-server.com`, For security reasons, a password will be generated and shown in the AIO interface (if you click on showing the secret for glances). Use `glances` as user name.
- It is recommended to start this container only in home networks, because there is no built-in authentication. But you can do a http-auth with your proxy.
- In order to access your Glances outside the local network, you have to set up your own reverse proxy. You can set up a reverse proxy following [these instructions](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md).
- The data of Glances will be automatically included in AIO's backup solution!
community-containers/joplin-server/joplin-server.json
+3 -1
View File
@@ -6,6 +6,7 @@
"display_name": "Joplin Server",
"documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server",
"image": "joplin/server",
"restart": "unless-stopped",
"depends_on": [
"nextcloud-aio-joplin-database"
],
@@ -35,6 +36,7 @@
"image_tag": "18",
"display_name": "Joplin Database (PostgreSQL)",
"image": "postgres",
"restart": "unless-stopped",
"internal_port": "5432",
"environment": [
"POSTGRES_PASSWORD=%JOPLIN_DB_PASSWORD%",
@@ -57,4 +59,4 @@
]
}
]
}
}
community-containers/stalwart/readme.md
+8 -6
View File
@@ -1,22 +1,24 @@
> [!CAUTION]
> Be aware that the mail server is the most difficult service to deploy.
>
> Be aware that the mail server is the most challenging service to deploy.
>
> Do not use this feature as a main mail server or without a redundancy system and without knowledge.
## Stalwart mail server
This container bundles the [Stalwart](https://stalw.art/) mail server and auto-configures it for you.
This container bundles the [Stalwart](https://stalw.art/) mail server and autoconfigures it for you.
### Notes
Documentation is available on the container repository.
This documentation is regularly updated and is intended to be as simple and detailed as possible.
Thanks for all your feedback!
- See https://github.com/docjyJ/aio-stalwart#getting-started for getting start with this container.
- See https://github.com/winterrific/aio-stalwart#getting-started for getting start with this container.
- See https://stalw.art/docs/faq for further faq and docs on the project
- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
### Repository
https://github.com/docjyj/aio-stalwart
https://github.com/winterrific/aio-stalwart
### Maintainer
https://github.com/docjyj
https://github.com/winterrific
Created by https://github.com/docjyj
community-containers/stalwart/stalwart.json
+2 -2
View File
@@ -4,8 +4,8 @@
"container_name": "nextcloud-aio-stalwart",
"display_name": "Stalwart",
"documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart",
"image": "ghcr.io/docjyj/aio-stalwart",
"image_tag": "v3",
"image": "ghcr.io/winterrific/aio-stalwart",
"image_tag": "v0",
"internal_port": "10003",
"restart": "unless-stopped",
"ports": [
manual-install/latest.yml
+41
View File
@@ -19,6 +19,9 @@ services:
nextcloud-aio-whiteboard:
condition: service_started
required: false
nextcloud-aio-harp:
condition: service_started
required: false
nextcloud-aio-nextcloud:
condition: service_started
required: false
@@ -50,6 +53,7 @@ services:
- APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME}
- NOTIFY_PUSH_HOST=nextcloud-aio-notify-push
- WHITEBOARD_HOST=nextcloud-aio-whiteboard
- HARP_HOST=nextcloud-aio-harp
volumes:
- nextcloud_aio_nextcloud:/var/www/html:ro
- nextcloud_aio_apache:/mnt/data:rw
@@ -193,6 +197,8 @@ services:
- IMAGINARY_SECRET
- WHITEBOARD_SECRET
- WHITEBOARD_ENABLED
- HARP_ENABLED
- HP_SHARED_KEY
stop_grace_period: 600s
restart: unless-stopped
shm_size: 134217728
@@ -434,6 +440,7 @@ services:
- JWT_SECRET=${EUROOFFICE_SECRET}
volumes:
- nextcloud_aio_eurooffice:/var/lib/euro-office:rw
- nextcloud_aio_eurooffice_data:/var/www/euro-office/Data:rw
restart: unless-stopped
profiles:
- eurooffice
@@ -504,6 +511,36 @@ services:
cap_drop:
- NET_RAW
nextcloud-aio-harp:
image: ghcr.io/nextcloud-releases/aio-harp:latest
init: true
expose:
- "8780"
healthcheck:
start_period: 0s
test: /healthcheck.sh
interval: 10s
timeout: 10s
start_interval: 5s
retries: 9
environment:
- HP_SHARED_KEY
- NC_INSTANCE_URL=https://${NC_DOMAIN}
- HP_FRP_DISABLE_TLS=true
- TZ=${TIMEZONE}
volumes:
- ${WATCHTOWER_DOCKER_SOCKET_PATH}:/var/run/docker.sock:ro
- nextcloud_aio_harp:/certs:rw
restart: unless-stopped
read_only: true
tmpfs:
- /tmp
- /run/harp
cap_drop:
- NET_RAW
profiles:
- harp
nextcloud-aio-whiteboard:
image: ghcr.io/nextcloud-releases/aio-whiteboard:latest
user: "65534"
@@ -549,6 +586,10 @@ volumes:
name: nextcloud_aio_elasticsearch
nextcloud_aio_eurooffice:
name: nextcloud_aio_eurooffice
nextcloud_aio_eurooffice_data:
name: nextcloud_aio_eurooffice_data
nextcloud_aio_harp:
name: nextcloud_aio_harp
nextcloud_aio_nextcloud:
name: nextcloud_aio_nextcloud
nextcloud_aio_onlyoffice:
manual-install/readme.md
+54 -54
View File
@@ -1,54 +1,54 @@
# Manual installation
You can run the containers that are build for AIO with docker-compose. This comes with a few downsides, that are discussed below.
### Advantages
- You can run it without a container having access to the docker socket
- You can modify all values on your own
- You can run the containers with docker swarm
- You can run this in environments where access to ghcr.io is not possible. See [this issue](https://github.com/nextcloud/all-in-one/discussions/5268).
### Disadvantages
- You lose the AIO interface
- You lose update notifications and automatic updates
- You lose all AIO backup and restore features
- You lose the built-in [Docker Socket Proxy container](https://github.com/nextcloud/docker-socket-proxy#readme) and [HaRP container](https://github.com/nextcloud/HaRP) (needed for [Nextcloud App API](https://github.com/nextcloud/app_api#nextcloud-appapi))
- You lose all community containers: https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers
- **You need to know what you are doing, especially when modifying the compose.yaml file**
- For updating, you need to strictly follow the at the bottom described update routine
- Probably more
## How to use this?
First, install docker and docker-compose (v2) if not already done. Then simply run the following:
```bash
git clone https://github.com/nextcloud/all-in-one.git
cd all-in-one/manual-install
```
Then copy the sample.conf to default environment file, e.g. `cp sample.conf .env`, open the new conf file, e.g. with `nano .env`, edit all values that are marked with `# TODO!`, close and save the file.<br>
⚠️ **Warning**: Do not use the symbols `@` and `:` in your passwords. These symbols are used to build database connection strings. You will experience issues when using these symbols! Also please note that values inside the latest.yaml that are not exposed as variables are not officially supported to be changed. See for example [this report](https://github.com/nextcloud/all-in-one/issues/5612).
Now copy the provided yaml file to a compose.yaml file by running `cp latest.yml compose.yaml`.
Now you should be ready to go with `sudo docker compose up`.
## Docker profiles
The default profile of `latest.yml` only provide the minimum necessary services: nextcloud, database, redis and apache. To get optional services collabora, talk, whiteboard, talk-recording, clamav, imaginary or fulltextsearch use additional arguments for each of them, for example `--profile collabora`.
For a complete all-in-one with collabora use `sudo docker compose --profile collabora --profile talk --profile talk-recording --profile clamav --profile imaginary --profile fulltextsearch --profile whiteboard up`.
## How to update?
Since the AIO containers may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade your containers.
1. If your previous copy of `sample.conf` is named `my.conf`, run `mv -vn my.conf .env` in order to rename the file to `.env`.
1. Run `sudo docker compose down` to stop all running containers
1. Back up all important files and folders
1. If your compose file is still named `docker-compose.yml` rename it to `compose.yaml` by running `mv -vn docker-compose.yml compose.yaml`
1. Run `git pull` in order to get the updated yaml files from the repository. Now bring your `compose.yaml` file up-to-date with the updated one from the repository. You can use `diff compose.yaml latest.yml` for comparing. ⚠️ **Please note**: Starting with AIO v5.1.0, ipv6 networking will be enabled by default, so make sure to either enable it first by following steps 1 and 2 of https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md and then proceed with the steps below or disable ipv6 networking by editing the compose.yaml file and removing ipv6 from the network.
1. Also have a look at the `sample.conf` if any variable was added or renamed and add that to your conf file as well. Here may help the diff command as well.
1. After the file update was successful, simply run `sudo docker compose pull` to pull the new images.
1. At the end run `sudo docker compose up` in order to start and update the containers with the new configuration.
## FAQ
### Backup and restore?
If you leave `NEXTCLOUD_DATADIR` in your conf file at the default value of `nextcloud_aio_nextcloud_data` and don't modify the yaml file, all data will be stored inside docker volumes which are on Linux by default located here: `/var/lib/docker/volumes`. Simply backing up this location should be a valid backup solution. Then you can also easily restore in case something bad happens. However if you change `NEXTCLOUD_DATADIR` to a path like `/mnt/ncdata`, you obviously need to back up this location, too because the Nextcloud data will be stored there. The same applies to any change to the yaml file.
Obviously you also need to back up the conf file and the yaml file if you modified it.
# Manual installation
You can run the containers that are build for AIO with docker-compose. This comes with a few downsides, that are discussed below.
### Advantages
- You can run it without a container having access to the docker socket
- You can modify all values on your own
- You can run the containers with docker swarm
- You can run this in environments where access to ghcr.io is not possible. See [this issue](https://github.com/nextcloud/all-in-one/discussions/5268).
### Disadvantages
- You lose the AIO interface
- You lose update notifications and automatic updates
- You lose all AIO backup and restore features
- You lose the built-in [Docker Socket Proxy container](https://github.com/nextcloud/docker-socket-proxy#readme) and [HaRP container](https://github.com/nextcloud/HaRP) (needed for [Nextcloud App API](https://github.com/nextcloud/app_api#nextcloud-appapi))
- You lose all community containers: https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers
- **You need to know what you are doing, especially when modifying the compose.yaml file**
- For updating, you need to strictly follow the at the bottom described update routine
- Probably more
## How to use this?
First, install docker and docker-compose (v2) if not already done. Then simply run the following:
```bash
git clone https://github.com/nextcloud/all-in-one.git
cd all-in-one/manual-install
```
Then copy the sample.conf to default environment file, e.g. `cp sample.conf .env`, open the new conf file, e.g. with `nano .env`, edit all values that are marked with `# TODO!`, close and save the file.<br>
⚠️ **Warning**: Do not use the symbols `@` and `:` in your passwords. These symbols are used to build database connection strings. You will experience issues when using these symbols! Also please note that values inside the latest.yaml that are not exposed as variables are not officially supported to be changed. See for example [this report](https://github.com/nextcloud/all-in-one/issues/5612).
Now copy the provided yaml file to a compose.yaml file by running `cp latest.yml compose.yaml`.
Now you should be ready to go with `sudo docker compose up`.
## Docker profiles
The default profile of `latest.yml` only provide the minimum necessary services: nextcloud, database, redis and apache. To get optional services collabora, talk, whiteboard, talk-recording, clamav, imaginary or fulltextsearch use additional arguments for each of them, for example `--profile collabora`.
For a complete all-in-one with collabora use `sudo docker compose --profile collabora --profile talk --profile talk-recording --profile clamav --profile imaginary --profile fulltextsearch --profile whiteboard up`.
## How to update?
Since the AIO containers may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade your containers.
1. If your previous copy of `sample.conf` is named `my.conf`, run `mv -vn my.conf .env` in order to rename the file to `.env`.
1. Run `sudo docker compose down` to stop all running containers
1. Back up all important files and folders
1. If your compose file is still named `docker-compose.yml` rename it to `compose.yaml` by running `mv -vn docker-compose.yml compose.yaml`
1. Run `git pull` in order to get the updated yaml files from the repository. Now bring your `compose.yaml` file up-to-date with the updated one from the repository. You can use `diff compose.yaml latest.yml` for comparing. ⚠️ **Please note**: Starting with AIO v5.1.0, ipv6 networking will be enabled by default, so make sure to either enable it first by following steps 1 and 2 of https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md and then proceed with the steps below or disable ipv6 networking by editing the compose.yaml file and removing ipv6 from the network.
1. Also have a look at the `sample.conf` if any variable was added or renamed and add that to your conf file as well. Here may help the diff command as well.
1. After the file update was successful, simply run `sudo docker compose pull` to pull the new images.
1. At the end run `sudo docker compose up` in order to start and update the containers with the new configuration.
## FAQ
### Backup and restore?
If you leave `NEXTCLOUD_DATADIR` in your conf file at the default value of `nextcloud_aio_nextcloud_data` and don't modify the yaml file, all data will be stored inside docker volumes which are on Linux by default located here: `/var/lib/docker/volumes`. Simply backing up this location should be a valid backup solution. Then you can also easily restore in case something bad happens. However if you change `NEXTCLOUD_DATADIR` to a path like `/mnt/ncdata`, you obviously need to back up this location, too because the Nextcloud data will be stored there. The same applies to any change to the yaml file.
Obviously you also need to back up the conf file and the yaml file if you modified it.
manual-install/sample.conf
+3
View File
@@ -1,6 +1,7 @@
DATABASE_PASSWORD= # TODO! This needs to be a unique and good password!
EUROOFFICE_SECRET= # TODO! This needs to be a unique and good password!
FULLTEXTSEARCH_PASSWORD= # TODO! This needs to be a unique and good password!
HP_SHARED_KEY= # TODO! This needs to be a unique and good password!
IMAGINARY_SECRET= # TODO! This needs to be a unique and good password!
NC_DOMAIN=yourdomain.com # TODO! Needs to be changed to the domain that you want to use for Nextcloud.
NEXTCLOUD_PASSWORD= # TODO! This is the password of the initially created Nextcloud admin with username "admin".
@@ -17,6 +18,7 @@ CLAMAV_ENABLED="no" # Setting this to "yes" (with quotes) enables the o
COLLABORA_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
EUROOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
FULLTEXTSEARCH_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
HARP_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
IMAGINARY_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
ONLYOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
TALK_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
@@ -43,3 +45,4 @@ NEXTCLOUD_UPLOAD_LIMIT=16G # This allows to change the upload limit of
REMOVE_DISABLED_APPS=yes # Setting this to no keep Nextcloud apps that are disabled via their switch and not uninstall them if they should be installed in Nextcloud.
TALK_PORT=3478 # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!
UPDATE_NEXTCLOUD_APPS="no" # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.
WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # This can be changed depending on where the docker socket is located on your host
manual-install/update-yaml.sh
+1 -5
View File
@@ -27,8 +27,6 @@ OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "next
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-borgbackup"))')"
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-docker-socket-proxy"))')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-docker-socket-proxy"]) then del(.[index("nextcloud-aio-docker-socket-proxy")]) else . end else . end')"
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-harp"))')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-harp"]) then del(.[index("nextcloud-aio-harp")]) else . end else . end')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= map({ (.): { "condition": "service_started", "required": false } }) else . end' | jq '.services[] |= if has("depends_on") then .depends_on |= reduce .[] as $item ({}; . + $item) else . end')"
sudo snap install yq
@@ -47,9 +45,6 @@ sed -i 's|- ip_binding: |- |' containers.yml
sed -i '/AIO_TOKEN/d' containers.yml
sed -i '/AIO_URL/d' containers.yml
sed -i '/DOCKER_SOCKET_PROXY_ENABLED/d' containers.yml
sed -i '/HARP_ENABLED/d' containers.yml
sed -i '/HARP_HOST/d' containers.yml
sed -i '/HP_SHARED_KEY/d' containers.yml
sed -i '/ADDITIONAL_TRUSTED_PROXY/d' containers.yml
sed -i '/TURN_DOMAIN/d' containers.yml
sed -i '/NC_AIO_VERSION/d' containers.yml
@@ -96,6 +91,7 @@ sed -i 's|NEXTCLOUD_TRUSTED_CACERTS_DIR=|NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/loca
sed -i 's|UPDATE_NEXTCLOUD_APPS=|UPDATE_NEXTCLOUD_APPS="no" # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.|' sample.conf
sed -i 's|APACHE_PORT=|APACHE_PORT=443 # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).|' sample.conf
sed -i 's|APACHE_IP_BINDING=|APACHE_IP_BINDING=0.0.0.0 # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect|' sample.conf
sed -i 's|WATCHTOWER_DOCKER_SOCKET_PATH=|WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # This can be changed depending on where the docker socket is located on your host|' sample.conf
sed -i 's|TALK_PORT=|TALK_PORT=3478 # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!|' sample.conf
sed -i 's|NC_DOMAIN=|NC_DOMAIN=yourdomain.com # TODO! Needs to be changed to the domain that you want to use for Nextcloud.|' sample.conf
sed -i 's|NEXTCLOUD_PASSWORD=|NEXTCLOUD_PASSWORD= # TODO! This is the password of the initially created Nextcloud admin with username "admin".|' sample.conf
nextcloud-aio-helm-chart/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
name: nextcloud-aio-helm-chart
description: A generated Helm Chart for Nextcloud AIO from Skippbox Kompose
version: 13.4.0
version: 13.5.2
apiVersion: v2
keywords:
- latest
nextcloud-aio-helm-chart/readme.md
+22
View File
@@ -36,6 +36,28 @@ helm install nextcloud-aio nextcloud-aio/nextcloud-aio-helm-chart -f values.yaml
And after a while, everything should be set up.
## HaRP / AppAPI (ExApps) configuration
When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
> [!IMPORTANT]
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists.
> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod.
> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
>
> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions.
The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP:
| Value | Default | Description |
| --- | --- | --- |
| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. |
| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
## How to update?
Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
1. Stop all running pods
nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
+3 -1
View File
@@ -51,6 +51,8 @@ spec:
value: nextcloud-aio-collabora
- name: EUROOFFICE_HOST
value: nextcloud-aio-eurooffice
- name: HARP_HOST
value: nextcloud-aio-harp
- name: NC_DOMAIN
value: "{{ .Values.NC_DOMAIN }}"
- name: NEXTCLOUD_HOST
@@ -65,7 +67,7 @@ spec:
value: "{{ .Values.TIMEZONE }}"
- name: WHITEBOARD_HOST
value: nextcloud-aio-whiteboard
image: ghcr.io/nextcloud-releases/aio-apache:20260727_092405
image: ghcr.io/nextcloud-releases/aio-apache:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
+2 -2
View File
@@ -36,7 +36,7 @@ spec:
{{- end }}
initContainers:
- name: init-subpath
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- mkdir
- "-p"
@@ -61,7 +61,7 @@ spec:
value: "{{ .Values.NEXTCLOUD_UPLOAD_LIMIT }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-clamav:20260727_092405
image: ghcr.io/nextcloud-releases/aio-clamav:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml
+1 -1
View File
@@ -37,7 +37,7 @@ spec:
value: --o:ssl.enable=false --o:ssl.termination=true --o:logging.disable_server_audit=true --o:welcome.enable=false --o:fetch_update_check=0 --o:allow_update_popup=false --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+
- name: server_name
value: "{{ .Values.NC_DOMAIN }}"
image: ghcr.io/nextcloud-releases/aio-collabora:20260727_092405
image: ghcr.io/nextcloud-releases/aio-collabora:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
+2 -2
View File
@@ -35,7 +35,7 @@ spec:
{{- end }}
initContainers:
- name: init-subpath
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- mkdir
- "-p"
@@ -66,7 +66,7 @@ spec:
value: nextcloud
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-postgresql:20260727_092405
image: ghcr.io/nextcloud-releases/aio-postgresql:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-data-persistentvolumeclaim.yaml
Executable
+18
View File
@@ -0,0 +1,18 @@
{{- if eq .Values.EUROOFFICE_ENABLED "yes" }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
io.kompose.service: nextcloud-aio-eurooffice-data
name: nextcloud-aio-eurooffice-data
namespace: "{{ .Values.NAMESPACE }}"
spec:
{{- if .Values.STORAGE_CLASS }}
storageClassName: {{ .Values.STORAGE_CLASS }}
{{- end }}
accessModes:
- ReadWriteOnce
resources:
requests:
storage: {{ .Values.EUROOFFICE_DATA_STORAGE_SIZE }}
{{- end }}
nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml
+10 -2
View File
@@ -24,12 +24,15 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- chmod
- "777"
- /nextcloud-aio-eurooffice
- /nextcloud-aio-eurooffice-data
volumeMounts:
- name: nextcloud-aio-eurooffice-data
mountPath: /nextcloud-aio-eurooffice-data
- name: nextcloud-aio-eurooffice
mountPath: /nextcloud-aio-eurooffice
containers:
@@ -46,7 +49,7 @@ spec:
value: "{{ .Values.AIO_LOG_LEVEL }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-eurooffice:20260727_092405
image: ghcr.io/nextcloud-releases/aio-eurooffice:20260817_082005
readinessProbe:
exec:
command:
@@ -70,8 +73,13 @@ spec:
volumeMounts:
- mountPath: /var/lib/euro-office
name: nextcloud-aio-eurooffice
- mountPath: /var/www/euro-office/Data
name: nextcloud-aio-eurooffice-data
volumes:
- name: nextcloud-aio-eurooffice
persistentVolumeClaim:
claimName: nextcloud-aio-eurooffice
- name: nextcloud-aio-eurooffice-data
persistentVolumeClaim:
claimName: nextcloud-aio-eurooffice-data
{{- end }}
nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml
+2 -2
View File
@@ -24,7 +24,7 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- chmod
- "777"
@@ -64,7 +64,7 @@ spec:
value: "false"
- name: xpack.security.transport.ssl.enabled
value: "false"
image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260727_092405
image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-harp-deployment.yaml
Executable
+74
View File
@@ -0,0 +1,74 @@
{{- if eq .Values.HARP_ENABLED "yes" }}
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
kompose.version: 1.38.0 (a8f5d1cbd)
labels:
io.kompose.service: nextcloud-aio-harp
name: nextcloud-aio-harp
namespace: "{{ .Values.NAMESPACE }}"
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: nextcloud-aio-harp
strategy:
type: Recreate
template:
metadata:
annotations:
kompose.version: 1.38.0 (a8f5d1cbd)
labels:
io.kompose.service: nextcloud-aio-harp
spec:
{{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
{{- end }}
containers:
- env:
- name: HP_K8S_ENABLED
value: "true"
- name: HP_K8S_NAMESPACE
value: "{{ .Values.HARP_K8S_NAMESPACE }}"
- name: HP_K8S_STORAGE_CLASS
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
- name: HP_K8S_DEFAULT_STORAGE_SIZE
value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
- name: HP_K8S_HOST_ALIASES
value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
- name: HP_FRP_DISABLE_TLS
value: "true"
- name: HP_SHARED_KEY
value: "{{ .Values.HP_SHARED_KEY }}"
- name: NC_INSTANCE_URL
value: https://{{ .Values.NC_DOMAIN }}
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-harp:20260817_082005
readinessProbe:
exec:
command:
- /healthcheck.sh
failureThreshold: 9
periodSeconds: 10
timeoutSeconds: 10
livenessProbe:
exec:
command:
- /healthcheck.sh
failureThreshold: 9
periodSeconds: 10
timeoutSeconds: 10
name: nextcloud-aio-harp
ports:
- containerPort: 8780
protocol: TCP
volumeMounts:
- mountPath: /certs
name: nextcloud-aio-harp
volumes:
- name: nextcloud-aio-harp
persistentVolumeClaim:
claimName: nextcloud-aio-harp
{{- end }}
nextcloud-aio-helm-chart/templates/nextcloud-aio-harp-persistentvolumeclaim.yaml
Executable
+18
View File
@@ -0,0 +1,18 @@
{{- if eq .Values.HARP_ENABLED "yes" }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
io.kompose.service: nextcloud-aio-harp
name: nextcloud-aio-harp
namespace: "{{ .Values.NAMESPACE }}"
spec:
{{- if .Values.STORAGE_CLASS }}
storageClassName: {{ .Values.STORAGE_CLASS }}
{{- end }}
accessModes:
- ReadWriteOnce
resources:
requests:
storage: {{ .Values.HARP_STORAGE_SIZE }}
{{- end }}
nextcloud-aio-helm-chart/templates/nextcloud-aio-harp-service.yaml
Executable
+19
View File
@@ -0,0 +1,19 @@
{{- if eq .Values.HARP_ENABLED "yes" }}
apiVersion: v1
kind: Service
metadata:
annotations:
kompose.version: 1.38.0 (a8f5d1cbd)
labels:
io.kompose.service: nextcloud-aio-harp
name: nextcloud-aio-harp
namespace: "{{ .Values.NAMESPACE }}"
spec:
ipFamilyPolicy: PreferDualStack
ports:
- name: "8780"
port: 8780
targetPort: 8780
selector:
io.kompose.service: nextcloud-aio-harp
{{- end }}
nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
+1 -1
View File
@@ -40,7 +40,7 @@ spec:
value: "{{ .Values.IMAGINARY_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-imaginary:20260727_092405
image: ghcr.io/nextcloud-releases/aio-imaginary:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
+6 -2
View File
@@ -38,7 +38,7 @@ spec:
# AIO settings start # Do not remove or change this line!
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- chmod
- "777"
@@ -126,6 +126,10 @@ spec:
value: http
- name: FULLTEXTSEARCH_USER
value: elastic
- name: HARP_ENABLED
value: "{{ .Values.HARP_ENABLED }}"
- name: HP_SHARED_KEY
value: "{{ .Values.HP_SHARED_KEY }}"
- name: IMAGINARY_ENABLED
value: "{{ .Values.IMAGINARY_ENABLED }}"
- name: IMAGINARY_HOST
@@ -198,7 +202,7 @@ spec:
value: "{{ .Values.WHITEBOARD_ENABLED }}"
- name: WHITEBOARD_SECRET
value: "{{ .Values.WHITEBOARD_SECRET }}"
image: ghcr.io/nextcloud-releases/aio-nextcloud:20260727_092405
image: ghcr.io/nextcloud-releases/aio-nextcloud:20260817_082005
{{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment!
securityContext:
# The items below only work in container context
nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
+1 -1
View File
@@ -41,7 +41,7 @@ spec:
value: nextcloud-aio-nextcloud
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-notify-push:20260727_092405
image: ghcr.io/nextcloud-releases/aio-notify-push:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml
+2 -2
View File
@@ -24,7 +24,7 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260817_082005
command:
- chmod
- "777"
@@ -46,7 +46,7 @@ spec:
value: "{{ .Values.AIO_LOG_LEVEL }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260727_092405
image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
+1 -1
View File
@@ -41,7 +41,7 @@ spec:
value: "{{ .Values.REDIS_PASSWORD }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-redis:20260727_092405
image: ghcr.io/nextcloud-releases/aio-redis:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
+1 -1
View File
@@ -56,7 +56,7 @@ spec:
value: "{{ .Values.TURN_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-talk:20260727_092405
image: ghcr.io/nextcloud-releases/aio-talk:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
+1 -1
View File
@@ -46,7 +46,7 @@ spec:
value: "{{ .Values.RECORDING_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-talk-recording:20260727_092405
image: ghcr.io/nextcloud-releases/aio-talk-recording:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
+1 -1
View File
@@ -52,7 +52,7 @@ spec:
value: redis
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-whiteboard:20260727_092405
image: ghcr.io/nextcloud-releases/aio-whiteboard:20260817_082005
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/update-helm.sh
+43
View File
@@ -44,6 +44,7 @@ sed -i "s|- \${TALK_PORT}|- $TALK_PORT|" latest.yml
sed -i "s|\${NEXTCLOUD_DATADIR}|$NEXTCLOUD_DATADIR|" latest.yml
sed -i "s|\${ADDITIONAL_COLLABORA_OPTIONS}|ADDITIONAL_COLLABORA_OPTIONS_PLACEHOLDER|" latest.yml
sed -i "/name: nextcloud-aio/,$ d" latest.yml
sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" latest.yml
sed -i "/NEXTCLOUD_DATADIR/d" latest.yml
sed -i "/\${NEXTCLOUD_MOUNT}/d" latest.yml
sed -i "/^volumes:/a\ \ nextcloud_aio_nextcloud_trusted_cacerts:\n \ \ \ \ name: nextcloud_aio_nextcloud_trusted_cacerts" latest.yml
@@ -343,6 +344,35 @@ EOL
# shellcheck disable=SC1083
find ./ -name '*talk-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-talk.config" \{} \;
# Additional config for HaRP
# The manual-install (docker) only configures HaRP with the docker backend. In the
# helm chart HaRP needs to talk to the Kubernetes API instead, so we enable the
# Kubernetes backend here and expose its settings via values.yaml.
cat << EOL > /tmp/additional-harp.config
- name: HP_K8S_ENABLED
value: "true"
- name: HP_K8S_NAMESPACE
value: "{{ .Values.HARP_K8S_NAMESPACE }}"
- name: HP_K8S_STORAGE_CLASS
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
- name: HP_K8S_DEFAULT_STORAGE_SIZE
value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
- name: HP_K8S_HOST_ALIASES
value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \;
# HaRP authenticates against the Kubernetes API with the service account that is
# mounted into its pod. Allow the service account name to be set via values.yaml
# so that the user can grant it the required RBAC permissions (see the readme).
cat << EOL > /tmp/additional-harp-sa.config
{{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
{{- end }}
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^ spec:$/r /tmp/additional-harp-sa.config" \{} \;
cat << EOL > templates/nextcloud-aio-networkpolicy.yaml
{{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }}
# https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md
@@ -403,6 +433,7 @@ sed -i 's|= |: |' /tmp/sample.conf
sed -i '/^NEXTCLOUD_DATADIR/d' /tmp/sample.conf
sed -i '/^APACHE_IP_BINDING/d' /tmp/sample.conf
sed -i '/^NEXTCLOUD_MOUNT/d' /tmp/sample.conf
sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" /tmp/sample.conf
sed -i 's/ yes / "yes" /' /tmp/sample.conf
sed -i 's/ no / "no" /' /tmp/sample.conf
sed -i 's/"no" authentication/no authentication/' /tmp/sample.conf
@@ -443,6 +474,12 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f
MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb
TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
# HP_SHARED_KEY: # This allows to set the shared key for HaRP which is getting set at the very top of this values.yaml file.
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
ADDITIONAL_CONFIG
mv /tmp/sample.conf ../helm-chart/values.yaml
@@ -473,6 +510,12 @@ find ./ -name "*nextcloud-aio-elasticsearch-persistentvolumeclaim.yaml" -exec se
# shellcheck disable=SC1083
find ./ -name "*nextcloud-aio-elasticsearch-persistentvolumeclaim.yaml" -exec sed -i "$ a {{- end }}" \{} \;
# Additional case for Eurooffice-data
# shellcheck disable=SC1083
find ./ -name "*nextcloud-aio-eurooffice-data-persistentvolumeclaim.yaml" -exec sed -i "1i\\{{- if eq .Values.EUROOFFICE_ENABLED \"yes\" }}" \{} \;
# shellcheck disable=SC1083
find ./ -name "*nextcloud-aio-eurooffice-data-persistentvolumeclaim.yaml" -exec sed -i "$ a {{- end }}" \{} \;
cat << EOL > /tmp/security.conf
# The items below only work in container context
allowPrivilegeEscalation: false
nextcloud-aio-helm-chart/values.yaml
+10
View File
@@ -1,6 +1,7 @@
DATABASE_PASSWORD: # TODO! This needs to be a unique and good password!
EUROOFFICE_SECRET: # TODO! This needs to be a unique and good password!
FULLTEXTSEARCH_PASSWORD: # TODO! This needs to be a unique and good password!
HP_SHARED_KEY: # TODO! This needs to be a unique and good password!
IMAGINARY_SECRET: # TODO! This needs to be a unique and good password!
NC_DOMAIN: yourdomain.com # TODO! Needs to be changed to the domain that you want to use for Nextcloud.
NEXTCLOUD_PASSWORD: # TODO! This is the password of the initially created Nextcloud admin with username admin.
@@ -17,6 +18,7 @@ CLAMAV_ENABLED: "no" # Setting this to "yes" (with quotes) enables the
COLLABORA_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
EUROOFFICE_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
FULLTEXTSEARCH_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
HARP_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
IMAGINARY_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
ONLYOFFICE_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
TALK_ENABLED: "no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
@@ -49,6 +51,8 @@ DATABASE_STORAGE_SIZE: 1Gi # You can change the size of the database volum
DATABASE_DUMP_STORAGE_SIZE: 1Gi # You can change the size of the database-dump volume that default to 1Gi with this value
ELASTICSEARCH_STORAGE_SIZE: 1Gi # You can change the size of the elasticsearch volume that default to 1Gi with this value
EUROOFFICE_STORAGE_SIZE: 1Gi # You can change the size of the eurooffice volume that default to 1Gi with this value
EUROOFFICE_DATA_STORAGE_SIZE: 1Gi # You can change the size of the eurooffice-data volume that default to 1Gi with this value
HARP_STORAGE_SIZE: 1Gi # You can change the size of the harp volume that default to 1Gi with this value
NEXTCLOUD_STORAGE_SIZE: 5Gi # You can change the size of the nextcloud volume that default to 1Gi with this value
NEXTCLOUD_DATA_STORAGE_SIZE: 5Gi # You can change the size of the nextcloud-data volume that default to 1Gi with this value
NEXTCLOUD_TRUSTED_CACERTS_STORAGE_SIZE: 1Gi # You can change the size of the nextcloud-trusted-cacerts volume that default to 1Gi with this value
@@ -77,3 +81,9 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f
MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb
TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
# HP_SHARED_KEY: # This allows to set the shared key for HaRP which is getting set at the very top of this values.yaml file.
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
php/composer.lock
Generated
+13 -13
View File
@@ -64,21 +64,21 @@
},
{
"name": "guzzlehttp/guzzle",
"version": "7.15.2",
"version": "7.15.3",
"source": {
"type": "git",
"url": "https://github.com/guzzle/guzzle.git",
"reference": "744101956d78b7c1384d0cbf379db13e859167bf"
"reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/guzzle/guzzle/zipball/744101956d78b7c1384d0cbf379db13e859167bf",
"reference": "744101956d78b7c1384d0cbf379db13e859167bf",
"url": "https://api.github.com/repos/guzzle/guzzle/zipball/ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
"reference": "ae311b8f045ea93ce7b1c9cdb7cec06c53f944bc",
"shasum": ""
},
"require": {
"ext-json": "*",
"guzzlehttp/promises": "^2.5.1",
"guzzlehttp/promises": "^2.5.2",
"guzzlehttp/psr7": "^2.13",
"php": "^7.2.5 || ^8.0",
"psr/http-client": "^1.0",
@@ -172,7 +172,7 @@
],
"support": {
"issues": "https://github.com/guzzle/guzzle/issues",
"source": "https://github.com/guzzle/guzzle/tree/7.15.2"
"source": "https://github.com/guzzle/guzzle/tree/7.15.3"
},
"funding": [
{
@@ -188,20 +188,20 @@
"type": "tidelift"
}
],
"time": "2026-07-26T23:23:20+00:00"
"time": "2026-08-05T19:48:21+00:00"
},
{
"name": "guzzlehttp/promises",
"version": "2.5.1",
"version": "2.5.2",
"source": {
"type": "git",
"url": "https://github.com/guzzle/promises.git",
"reference": "9ad1e4fc607446a055b95870c7f668e93b5cff29"
"reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/guzzle/promises/zipball/9ad1e4fc607446a055b95870c7f668e93b5cff29",
"reference": "9ad1e4fc607446a055b95870c7f668e93b5cff29",
"url": "https://api.github.com/repos/guzzle/promises/zipball/2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
"reference": "2823687acff28b2dbe67b2508a6b300e2c3fa4ce",
"shasum": ""
},
"require": {
@@ -256,7 +256,7 @@
],
"support": {
"issues": "https://github.com/guzzle/promises/issues",
"source": "https://github.com/guzzle/promises/tree/2.5.1"
"source": "https://github.com/guzzle/promises/tree/2.5.2"
},
"funding": [
{
@@ -272,7 +272,7 @@
"type": "tidelift"
}
],
"time": "2026-07-08T15:48:39+00:00"
"time": "2026-08-05T19:30:54+00:00"
},
{
"name": "guzzlehttp/psr7",
php/containers-schema.json
+1 -1
View File
@@ -216,7 +216,7 @@
"properties": {
"destination": {
"type": "string",
"pattern": "^((/[a-z_/.-]+)|(%[A-Z_]+%))$"
"pattern": "^((/[a-zA-Z_/.-]+)|(%[A-Z_]+%))$"
},
"source": {
"type": "string",
php/containers.json
+18 -2
View File
@@ -795,6 +795,11 @@
"source": "nextcloud_aio_eurooffice",
"destination": "/var/lib/euro-office",
"writeable": true
},
{
"source": "nextcloud_aio_eurooffice_data",
"destination": "/var/www/euro-office/Data",
"writeable": true
}
],
"secrets": [
@@ -933,14 +938,22 @@
},
{
"container_name": "nextcloud-aio-harp",
"image_tag": "release",
"image_tag": "%AIO_CHANNEL%",
"display_name": "HaRP",
"image": "ghcr.io/nextcloud/nextcloud-appapi-harp",
"image": "ghcr.io/nextcloud-releases/aio-harp",
"init": true,
"internal_port": "8780",
"expose": [
"8780"
],
"healthcheck": {
"start_period": "0s",
"test": "/healthcheck.sh",
"interval": "10s",
"timeout": "10s",
"start_interval": "5s",
"retries": 9
},
"environment": [
"HP_SHARED_KEY=%HP_SHARED_KEY%",
"NC_INSTANCE_URL=https://%NC_DOMAIN%",
@@ -970,6 +983,9 @@
],
"cap_drop": [
"NET_RAW"
],
"profiles": [
"harp"
]
},
{
php/public/second-tab-warning.js
+11 -11
View File
@@ -1,12 +1,12 @@
const channel = new BroadcastChannel('tab')
channel.postMessage('second-tab')
// note that listener is added after posting the message
channel.addEventListener('message', (msg) => {
if (msg.data === 'second-tab') {
// message received from 2nd tab
document.getElementById('overlay').classList.add('loading')
alert('Cannot open multiple instances. You can use AIO here by reloading the page.')
}
const channel = new BroadcastChannel('tab')
channel.postMessage('second-tab')
// note that listener is added after posting the message
channel.addEventListener('message', (msg) => {
if (msg.data === 'second-tab') {
// message received from 2nd tab
document.getElementById('overlay').classList.add('loading')
alert('Cannot open multiple instances. You can use AIO here by reloading the page.')
}
});
php/src/Cron/CheckBackup.php
+17 -17
View File
@@ -1,17 +1,17 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Stop container and start backup check
$dockerController->checkBackup();
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Stop container and start backup check
$dockerController->checkBackup();
php/src/Cron/CreateBackup.php
+17 -17
View File
@@ -1,17 +1,17 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Stop container and start backup
$dockerController->startBackup();
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Stop container and start backup
$dockerController->startBackup();
php/src/Cron/OutdatedNotification.php
+1 -1
View File
@@ -21,6 +21,6 @@ $nextcloudContainer = $containerDefinitionFetcher->GetContainerById($id);
$isNextcloudImageOutdated = $dockerActionManager->isNextcloudImageOutdated();
if ($isNextcloudImageOutdated === true) {
$dockerActionManager->sendNotification($nextcloudContainer, 'AIO is outdated!', 'Please open the AIO interface or ask an administrator to update it. If you do not want to do it manually each time, you can enable the daily backup feature from the AIO interface which automatically updates all containers.', '/notify-all.sh');
$dockerActionManager->sendNotification($nextcloudContainer, 'AIO is outdated!', 'Please open the AIO interface to update it. If you do not want to do it manually each time, you can enable the daily backup feature from the AIO interface which automatically updates all containers.');
}
php/src/Cron/StartAndUpdateContainers.php
+20 -20
View File
@@ -1,20 +1,20 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
// Log whole log messages
ini_set('log_errors_max_len', '0');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->startTopContainer(true);
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
// Log whole log messages
ini_set('log_errors_max_len', '0');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->startTopContainer(true);
php/src/Cron/StartContainers.php
+20 -20
View File
@@ -1,20 +1,20 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
// Log whole log messages
ini_set('log_errors_max_len', '0');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->startTopContainer(false);
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
// Log whole log messages
ini_set('log_errors_max_len', '0');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->startTopContainer(false);
php/src/Cron/StopContainers.php
+17 -17
View File
@@ -1,17 +1,17 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->stopTopContainer();
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
// Start apache
$dockerController->stopTopContainer();
php/src/Cron/UpdateMastercontainer.php
+17 -17
View File
@@ -1,17 +1,17 @@
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
# Update the mastercontainer
$dockerController->startWatchtower();
<?php
declare(strict_types=1);
// increase memory limit to 2GB
ini_set('memory_limit', '2048M');
use DI\Container;
require __DIR__ . '/../../vendor/autoload.php';
$container = \AIO\DependencyInjection::GetContainer();
/** @var \AIO\Controller\DockerController $dockerController */
$dockerController = $container->get(\AIO\Controller\DockerController::class);
# Update the mastercontainer
$dockerController->startWatchtower();
php/src/Docker/DockerActionManager.php
+5 -2
View File
@@ -480,8 +480,11 @@ readonly class DockerActionManager {
}
// Special things for the scrutiny container which should not be exposed in the containers.json
} elseif ($container->identifier === 'nextcloud-aio-scrutiny') {
// Allow it to access block devices
$requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw"];
// Allow it to access block devices (e.g. /dev/sda for SATA drives) and
// character devices (needed for NVMe drives: smartctl reads their SMART data
// via admin passthrough ioctls on the NVMe controller character device
// /dev/nvme0 and not via the block device /dev/nvme0n1)
$requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw", "c *:* rmw"];
// Special things for the makemkv container which should not be exposed in the containers.json
} elseif ($container->identifier === 'nextcloud-aio-makemkv') {
// Allow it to access block devices
php/templates/includes/aio-version.twig
+1 -1
View File
@@ -1 +1 @@
13.4.1
13.6.0
php/tests/Containers/composer/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM docker.io/library/composer:2@sha256:5946476338742b200bb9ff88f8be56275ddae4b3949c72305cb0dbf10cfcb760
FROM docker.io/library/composer:2@sha256:4d71c3c2109c61d5415544264b59ad4087e4c5b7244481723664138fd36d5040
RUN pecl bundle -d /usr/src/php/ext apcu \
&& docker-php-ext-install apcu
php/tests/compose.yaml
+2 -2
View File
@@ -59,14 +59,14 @@ services:
- local-code
desec-mock:
image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
image: docker.io/library/node:26@sha256:bde0dae02f2b12d2bce5ee72b2432f0e511767b7b2dc4dd3b064df11ae422fee
volumes:
- ..:/app/php
working_dir: /app
command: node php/tests/desec-mock.mjs 8090 2>&1
npm-installer:
image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
image: docker.io/library/node:26@sha256:bde0dae02f2b12d2bce5ee72b2432f0e511767b7b2dc4dd3b064df11ae422fee
volumes:
- ..:/app
working_dir: /app/tests
php/tests/run.sh
+1 -1
View File
@@ -36,7 +36,7 @@ run_tests() {
exitcode=$?
if test $exitcode -gt 0; then
for container in nextcloud-aio-{mastercontainer,borgbackup,desec-mock}; do
if docker container list --format="{{ .Names }}" | grep -q "$container"; then
if docker container list -a --format="{{ .Names }}" | grep -q "$container"; then
echo -e "\n 📣 Log output from container ${container}:\n"
docker logs "$container"
fi
readme.md
+2 -2
View File
@@ -40,7 +40,7 @@ Included are:
- PHP and web server timeouts set to 3600s, [adjustable](https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud) (important for big file uploads)
- Defaults to a max of 512 MB RAM per PHP process, [adjustable](https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud)
- Automatic TLS included (by using Let's Encrypt)
- Brotli compression enabled by default for javascript, css and svg files which reduces Nextcloud load times
- zstd/gzip compression enabled by default inside caddy inside the apache container
- HTTP/2 and HTTP/3 enabled
- "Pretty URLs" for Nextcloud are enabled by default (removes the index.php from all links)
- Video previews work out of the box and when Imaginary is enabled, many recent image formats as well!
@@ -1314,7 +1314,7 @@ What are the requirements?
This project values stability over new features. That means that when a new major Nextcloud update gets introduced, we will wait at least until the first patch release, e.g. `24.0.1` is out before upgrading to it. Also we will wait with the upgrade until all important apps are compatible with the new major version. Minor or patch releases for Nextcloud and all dependencies as well as all containers will be updated to new versions as soon as possible but we try to give all updates first a good test round before pushing them. That means that it can take around 2 weeks before new updates reach the `latest` channel. If you want to help testing, you can switch to the `beta` channel by following [this documentation](#how-to-switch-the-channel) which will also give you the updates earlier.
### How often are update notifications sent?
AIO ships its own update notifications implementation. It checks if container updates are available. If so, it sends a notification with the title `Container updates available!` on saturdays to Nextcloud users that are part of the `admin` group. If the Nextcloud container image should be older than 90 days (~3 months) and thus badly outdated, AIO sends a notification to all Nextcloud users with the title `AIO is outdated!`. Thus admins should make sure to update the container images at least once every 3 months in order to make sure that the instance gets all security bugfixes as soon as possible.
AIO ships its own update notifications implementation. It checks if container updates are available. If so, it sends a notification with the title `Container updates available!` on saturdays to Nextcloud users that are part of the `admin` group. If the Nextcloud container image should be older than 90 days (~3 months) and thus badly outdated, AIO sends a notification to Nextcloud users that are part of the `admin` group with the title `AIO is outdated!` every day. Thus admins should make sure to update the container images at least once every 3 months in order to make sure that the instance gets all security bugfixes as soon as possible.
### Huge docker logs
If you should run into issues with huge docker logs, you can adjust the log size by following https://docs.docker.com/config/containers/logging/local/#usage. You can additionally reduce the verbosity of the included AIO containers by setting `AIO_LOG_LEVEL=error` on the mastercontainer. By default, AIO keeps the existing component-specific log defaults, so this should usually not be needed.
reverse-proxy.md
+12 -8
View File
@@ -214,7 +214,6 @@ Add this as a new Apache site config:
<VirtualHost *:443>
ServerName <your-nc-domain>
# Reverse proxy based on https://httpd.apache.org/docs/current/mod/mod_proxy_wstunnel.html
RewriteEngine On
ProxyPreserveHost On
RequestHeader set X-Real-IP %{REMOTE_ADDR}s
@@ -223,13 +222,8 @@ Add this as a new Apache site config:
AllowEncodedSlashes NoDecode
# Adjust the two lines below to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below
ProxyPass / http://localhost:11000/ nocanon
ProxyPass / http://localhost:11000/ nocanon upgrade=websocket
ProxyPassReverse / http://localhost:11000/
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteCond %{THE_REQUEST} "^[a-zA-Z]+ /(.*) HTTP/\d+(\.\d+)?$"
RewriteRule .? "ws://localhost:11000/%1" [P,L,UnsafeAllow3F] # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below
# Enable h2, h2c and http1.1
Protocols h2 h2c http/1.1
@@ -270,7 +264,17 @@ Add this as a new Apache site config:
⚠️ **Please note:** Look into [this](#adapting-the-sample-web-server-configurations-below) to adapt the above example configuration.
To make the config work you can run the following command:
`sudo a2enmod rewrite proxy proxy_http proxy_wstunnel ssl headers http2`
`sudo a2enmod rewrite proxy proxy_http ssl headers http2`
The `upgrade=websocket` parameter requires Apache 2.4.47 or later. On older versions, replace it with the following block, which needs `proxy_wstunnel` enabled additionally:
```
RewriteEngine On
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteCond %{THE_REQUEST} "^[a-zA-Z]+ /(.*) HTTP/\d+(\.\d+)?$"
RewriteRule .? "ws://localhost:11000/%1" [P,L,NE,UnsafeAllow3F] # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below
```
</details>
tests/QA/001-initial-setup.md
+10 -10
View File
@@ -1,10 +1,10 @@
# Initial setup
- [ ] Verify that after starting the test container, you can access the AIO interface using https://internal.ip.address:8080
- [ ] After clicking the self-signed-certificate warning away, it should show the setup page with an explanation what AIO is and the initial passphrase and a button that contains a link to the AIO login page
- [ ] After copying the passphrase and clicking on this button, it should open a new tab with the login page
- [ ] The login page should show an input field that allows to enter the AIO passphrase and a `Log in` button
- [ ] After pasting the passphrase into the input field and clicking on this button, you should be logged in
- [ ] You should now see the containers page and you should see three sections: one general section which explains what AIO is, one `New AIO instance` section and one section that allows to restore the whole AIO instance from backup.
You can now continue with [002-new-instance.md](./002-new-instance.md) or [010-restore-instance.md](./010-restore-instance.md).
# Initial setup
- [ ] Verify that after starting the test container, you can access the AIO interface using https://internal.ip.address:8080
- [ ] After clicking the self-signed-certificate warning away, it should show the setup page with an explanation what AIO is and the initial passphrase and a button that contains a link to the AIO login page
- [ ] After copying the passphrase and clicking on this button, it should open a new tab with the login page
- [ ] The login page should show an input field that allows to enter the AIO passphrase and a `Log in` button
- [ ] After pasting the passphrase into the input field and clicking on this button, you should be logged in
- [ ] You should now see the containers page and you should see three sections: one general section which explains what AIO is, one `New AIO instance` section and one section that allows to restore the whole AIO instance from backup.
You can now continue with [002-new-instance.md](./002-new-instance.md) or [010-restore-instance.md](./010-restore-instance.md).
tests/QA/002-new-instance.md
+40 -40
View File
@@ -1,41 +1,41 @@
# New instance
For the below to work, it is important that you have a domain that you point onto your testserver and open port 443 in your router/firewall.
- [ ] The `New AIO instance` section should show an input field that allows to enter a domain that will be used for Nextcloud later on as well as a short explanation regarding dynamic DNS
- [ ] Now test a few examples in the input box:
- [ ] Entering `djfslkklk` should report that DNS config is not set or the domain is not in a valid format
- [ ] Entering `https://sdjflkjk.cpm` should report that this is not a valid domain
- [ ] Entering `10.0.0.1` should report that ip-addresses are not supported
- [ ] Entering `nextcloud.com` should report that the domain does not point to this server
- [ ] Entering the domain that does point to your server e.g. `yourdomain.com` should finally redirect you to the next screen (if you did not configure your domain yet or did not open port 443, it should report that to you)
- [ ] Below the domain input box there should be a collapsed `<details>` element labelled **"Don't have a domain? Get a free one from deSEC"**
- [ ] Expanding it should show a short explanation and a **Register free domain via deSEC** button
- [ ] Clicking the button should open a modal window with the registration form (email address and an optional subdomain slug) without reloading the page
- [ ] Submitting with an empty email should show an error asking for a valid email address (inside the modal)
- [ ] Submitting with an invalid slug (e.g. `-bad-`) should show a validation error about the allowed slug format (inside the modal)
- [ ] Submitting with a valid email should step the modal through the register → verify email → register domain flow without closing it; you can adjust the details and re-submit between steps
- [ ] Closing the modal (via the × button, clicking the backdrop, or pressing Escape) and re-opening it should resume the registration where you left off
- [ ] Once the domain is fully registered the modal should close on its own and the whole page should reload with the new `*.dedyn.io` domain set as the Nextcloud domain
- [ ] After successful registration, the `caddy` and `dnsmasq` community containers should be listed as enabled in the Community Containers section
- [ ] After successful registration, there should be a **deSEC account credentials** section in the AIO interface that shows the registered email and allows revealing the password
- [ ] Now you should see a button `Start containers` and an explanation which points out that clicking on the button will start the containers and that this can take a long time.
- [ ] Below that you should see a section `Optional addons` which shows a checkbox list with addons that can be enabled or disabled.
- [ ] Collabora, Imaginary, Talk and Whiteboard should be enabled, the rest disabled
- [ ] Unchecking/Checking any of these should insert a button that allows to save the set config
- [ ] Only one of Collabora, OnlyOffice and EuroOffice should be selectable at the same time
- [ ] Recommended is to uncheck all options now
- [ ] Clicking on the save button should reload the page and activate the new config
- [ ] Clickig on the `Start containers` button should finally reveal a big spinning wheel that should block all elements on the side of being clicked.
- [ ] After waiting a few minutes, it should reload and show a new page
- [ ] On top of the page should be shown which channel you are running
- [ ] Below that, it should show that containers are currently starting
- [ ] Below that it should show a section with Containers: Apache, Database, Nextcloud and Redis and that your containers are up-to-date
- [ ] On the bottom should be the Optional addons section shown but with disabled checkboxes (not clickable)
- [ ] A automatic reload every 5s should happen until all Containers are started (as long as this window is focused)
- [ ] After waiting a bit longer it should instead of the advice that your containers are currently running show the initial Nextcloud credentials (username, password) and below that a button that allows to open the Nextcloud interface in a new tab
- [ ] Clicking on that button should open the Nextcloud interface in a new tab and you should be able to log in using the provided credentials
- [ ] Below the Containers section it should show a `Stop containers` button
- [ ] Below the Containers section and above the Optional Addons section, you should see a Backup and restore section and an AIO password change section
# New instance
For the below to work, it is important that you have a domain that you point onto your testserver and open port 443 in your router/firewall.
- [ ] The `New AIO instance` section should show an input field that allows to enter a domain that will be used for Nextcloud later on as well as a short explanation regarding dynamic DNS
- [ ] Now test a few examples in the input box:
- [ ] Entering `djfslkklk` should report that DNS config is not set or the domain is not in a valid format
- [ ] Entering `https://sdjflkjk.cpm` should report that this is not a valid domain
- [ ] Entering `10.0.0.1` should report that ip-addresses are not supported
- [ ] Entering `nextcloud.com` should report that the domain does not point to this server
- [ ] Entering the domain that does point to your server e.g. `yourdomain.com` should finally redirect you to the next screen (if you did not configure your domain yet or did not open port 443, it should report that to you)
- [ ] Below the domain input box there should be a collapsed `<details>` element labelled **"Don't have a domain? Get a free one from deSEC"**
- [ ] Expanding it should show a short explanation and a **Register free domain via deSEC** button
- [ ] Clicking the button should open a modal window with the registration form (email address and an optional subdomain slug) without reloading the page
- [ ] Submitting with an empty email should show an error asking for a valid email address (inside the modal)
- [ ] Submitting with an invalid slug (e.g. `-bad-`) should show a validation error about the allowed slug format (inside the modal)
- [ ] Submitting with a valid email should step the modal through the register → verify email → register domain flow without closing it; you can adjust the details and re-submit between steps
- [ ] Closing the modal (via the × button, clicking the backdrop, or pressing Escape) and re-opening it should resume the registration where you left off
- [ ] Once the domain is fully registered the modal should close on its own and the whole page should reload with the new `*.dedyn.io` domain set as the Nextcloud domain
- [ ] After successful registration, the `caddy` and `dnsmasq` community containers should be listed as enabled in the Community Containers section
- [ ] After successful registration, there should be a **deSEC account credentials** section in the AIO interface that shows the registered email and allows revealing the password
- [ ] Now you should see a button `Start containers` and an explanation which points out that clicking on the button will start the containers and that this can take a long time.
- [ ] Below that you should see a section `Optional addons` which shows a checkbox list with addons that can be enabled or disabled.
- [ ] Collabora, Imaginary, Talk and Whiteboard should be enabled, the rest disabled
- [ ] Unchecking/Checking any of these should insert a button that allows to save the set config
- [ ] Only one of Collabora, OnlyOffice and EuroOffice should be selectable at the same time
- [ ] Recommended is to uncheck all options now
- [ ] Clicking on the save button should reload the page and activate the new config
- [ ] Clickig on the `Start containers` button should finally reveal a big spinning wheel that should block all elements on the side of being clicked.
- [ ] After waiting a few minutes, it should reload and show a new page
- [ ] On top of the page should be shown which channel you are running
- [ ] Below that, it should show that containers are currently starting
- [ ] Below that it should show a section with Containers: Apache, Database, Nextcloud and Redis and that your containers are up-to-date
- [ ] On the bottom should be the Optional addons section shown but with disabled checkboxes (not clickable)
- [ ] A automatic reload every 5s should happen until all Containers are started (as long as this window is focused)
- [ ] After waiting a bit longer it should instead of the advice that your containers are currently running show the initial Nextcloud credentials (username, password) and below that a button that allows to open the Nextcloud interface in a new tab
- [ ] Clicking on that button should open the Nextcloud interface in a new tab and you should be able to log in using the provided credentials
- [ ] Below the Containers section it should show a `Stop containers` button
- [ ] Below the Containers section and above the Optional Addons section, you should see a Backup and restore section and an AIO password change section
You can now continue with [003-automatic-login.md](./003-automatic-login.md).
tests/QA/003-automatic-login.md
+7 -7
View File
@@ -1,8 +1,8 @@
# Automatic login
- [ ] After you log in to Nextcloud using the provided initial credentials, open https://yourdomain.com/settings/admin/overview
- [ ] There you should see a Nextcloud AIO section and a button that allows to log into the AIO interface.
- [ ] Clicking on this button should open the AIO interface in a new tab and should automatically log you in
- [ ] All sessions in other tabs that are currently open should be closed (you can verify by reloading all other AIO tabs)
# Automatic login
- [ ] After you log in to Nextcloud using the provided initial credentials, open https://yourdomain.com/settings/admin/overview
- [ ] There you should see a Nextcloud AIO section and a button that allows to log into the AIO interface.
- [ ] Clicking on this button should open the AIO interface in a new tab and should automatically log you in
- [ ] All sessions in other tabs that are currently open should be closed (you can verify by reloading all other AIO tabs)
You can now continue with [004-initial-backup.md](./004-initial-backup.md).
tests/QA/004-initial-backup.md
+31 -31
View File
@@ -1,32 +1,32 @@
# Initial backup
- [ ] In the Backup and restore section, you should now see two input boxes where for one you should type in the path where the backup should get created and some explanation below or the other type in a remote ssh location
- [ ] First, check a local backup:
- [ ] Enter `/` which should send an error
- [ ] Enter `/mnt/` or `/media/` or `/host_mnt/` or `/var/backups/` should send an error as well
- [ ] Accepted should be `/mnt/backup`, `/media/backup`, `/host_mnt/c/backup` and `/var/backups`.
- [ ] The side should now reload
- [ ] In the Backup restore section you should now see a Backup information section with important info like the encryption password, the backup location and more.
- [ ] Also you should see a Backup creation section that contains a `Create backup` button.
- [ ] Clicking on the `Create backup` button should open a window prompt that allows to cancel the operation.
- [ ] Canceling should return to the website, confirming should reveal the big spinner again which should block the website again.
- [ ] After a while you should see the information that Backup container is currently running
- [ ] another option are remote backups via SSH using borgbackup. The remote borg repo URL must contain both `@` and `:`. The process works as follows:
1. You enter a remote borg repo URL (e.g. `ssh://user@host:port/path/to/repo` or `user@host:/path/to/repo`).
2. On the first connection attempt, a SSH key pair is generated automatically and the public key is displayed.
3. You add the public key to the `~/.ssh/authorized_keys` file on the remote server so that AIO can connect to it.
4. Once authorized, AIO can create and restore backups on the remote server.
- [ ] Enter `user` (no `@` and no `:`) which should send an error
- [ ] Enter `user@host` (no `:`) which should send an error
- [ ] Enter `userhost:/path` (no `@`) which should send an error
- [ ] Accepted should be `ssh://user@host:22/path/to/repo` or `user@host:/path/to/repo`
- [ ] Both a local backup location and a remote repo URL should not be accepted at the same time
- [ ] The page should now reload
- [ ] Now click on `Create backup`
- [ ] After the first failed backup attempt with a remote repo, the SSH public key for borg should be shown so it can be authorized on the remote server
- [ ] After authorizing the server on the remote, scroll down and click on `Create backup` again to create another backup. This time it should succeed.
- [ ] The initial Nextcloud credentials on top of the page that are visible when the containers are running should now be hidden in a details tag
- [ ] After a while and a few automatic reloads (as long as the side is focused), you should be redirected to the usual page and seen in the Backup and restore section that the last backup was successful.
- [ ] Below that you should see a details tag that allows to reveal all backup options
# Initial backup
- [ ] In the Backup and restore section, you should now see two input boxes where for one you should type in the path where the backup should get created and some explanation below or the other type in a remote ssh location
- [ ] First, check a local backup:
- [ ] Enter `/` which should send an error
- [ ] Enter `/mnt/` or `/media/` or `/host_mnt/` or `/var/backups/` should send an error as well
- [ ] Accepted should be `/mnt/backup`, `/media/backup`, `/host_mnt/c/backup` and `/var/backups`.
- [ ] The side should now reload
- [ ] In the Backup restore section you should now see a Backup information section with important info like the encryption password, the backup location and more.
- [ ] Also you should see a Backup creation section that contains a `Create backup` button.
- [ ] Clicking on the `Create backup` button should open a window prompt that allows to cancel the operation.
- [ ] Canceling should return to the website, confirming should reveal the big spinner again which should block the website again.
- [ ] After a while you should see the information that Backup container is currently running
- [ ] another option are remote backups via SSH using borgbackup. The remote borg repo URL must contain both `@` and `:`. The process works as follows:
1. You enter a remote borg repo URL (e.g. `ssh://user@host:port/path/to/repo` or `user@host:/path/to/repo`).
2. On the first connection attempt, a SSH key pair is generated automatically and the public key is displayed.
3. You add the public key to the `~/.ssh/authorized_keys` file on the remote server so that AIO can connect to it.
4. Once authorized, AIO can create and restore backups on the remote server.
- [ ] Enter `user` (no `@` and no `:`) which should send an error
- [ ] Enter `user@host` (no `:`) which should send an error
- [ ] Enter `userhost:/path` (no `@`) which should send an error
- [ ] Accepted should be `ssh://user@host:22/path/to/repo` or `user@host:/path/to/repo`
- [ ] Both a local backup location and a remote repo URL should not be accepted at the same time
- [ ] The page should now reload
- [ ] Now click on `Create backup`
- [ ] After the first failed backup attempt with a remote repo, the SSH public key for borg should be shown so it can be authorized on the remote server
- [ ] After authorizing the server on the remote, scroll down and click on `Create backup` again to create another backup. This time it should succeed.
- [ ] The initial Nextcloud credentials on top of the page that are visible when the containers are running should now be hidden in a details tag
- [ ] After a while and a few automatic reloads (as long as the side is focused), you should be redirected to the usual page and seen in the Backup and restore section that the last backup was successful.
- [ ] Below that you should see a details tag that allows to reveal all backup options
You can now continue with [020-backup-and-restore.md](.//020-backup-and-restore.md)
tests/QA/010-restore-instance.md
+35 -35
View File
@@ -1,36 +1,36 @@
# Restore instance
For the below to work, you need a backup archive of an AIO instance and the location on the test machine and the password for the backup archive. You can get one here: [backup-archive](./assets/backup-archive/)
- [ ] The section that allows to restore the whole AIO instance from backup should show three input fields: one that allows to enter a location where the backup archive is located and one that allows to enter a remote ssh path and one that allows to enter password of the archive. It should also show a short explanation regarding the path requirements
- [ ] First, check restoring from a local backup location:
- [ ] Entering an incorrect path and/or password should let you continue and test your settings in the next step
- [ ] Clicking on the test button should after a reload bring you back to the initial screen where it should say that the test was unsuccessful. Also you should be able to have a look at the backup container logs for investigation what exactly failed.
- [ ] You should also now see the input boxes again where you can change the path and password, confirm it and bring you again to the screen where you can test your settings.
- [ ] Entering the correct path to the backup archive and the correct password here should:
- [ ] Should reload and should hide all options except the option to test the path and password
- [ ] After the test you should see the options to check the integrity of the backup and a list of backup archives that you can choose from to restore your instance
- [ ] Clicking on either option should show a window prompt that lets you cancel the operation
- [ ] Clicking on the integrity check option should check the integrity and report that the backup integrity is good after a while which should then only show the option to choose the backup archive that should be restored
- [ ] Choosing the restore option should finally restore your files.
- [ ] After waiting a while it should reload the page and should show the usual container interface again with the state of your containers (stopped) and the option to start and update the containers again.
- [ ] Next, check restoring from a remote backup location via SSH. The remote borg repo URL must contain both `@` and `:`. The restore process works as follows:
1. You enter a remote borg repo URL (e.g. `ssh://user@host:port/path/to/repo` or `user@host:/path/to/repo`) and the backup password.
2. On the first connection attempt, a SSH key pair is generated automatically and the public key is displayed.
3. You add the public key to the `~/.ssh/authorized_keys` file on the remote server so that AIO can connect to it.
4. Once authorized, AIO can list and restore backups from the remote server.
- [ ] Enter an invalid remote repo URL (e.g. `user` without `@` and `:`) which should send an error
- [ ] Enter a valid remote borg repo URL and the correct backup password:
- [ ] Should reload and should hide all options except the option to test the path and password
- [ ] After the first failed connection attempt, the SSH public key for borg should be shown so it can be authorized on the remote server
- [ ] After authorizing the key on the remote server, scroll down and click on the test button again. This time it should succeed and show the options to check the integrity and list backup archives
- [ ] After the test you should see the options to check the integrity of the backup and a list of backup archives that you can choose from to restore your instance
- [ ] Clicking on either option should show a window prompt that lets you cancel the operation
- [ ] Clicking on the integrity check option should check the integrity and report that the backup integrity is good after a while which should then only show the option to choose the backup archive that should be restored
- [ ] Choosing the restore option should finally restore your files.
- [ ] After waiting a while it should reload the page and should show the usual container interface again with the state of your containers (stopped) and the option to start and update the containers again.
- [ ] Clicking on `Start and update containers` should show a window prompt that you should create a backup. Canceling should cancel the operation, confirming should reveal the big spinner again.
- [ ] After waiting a bit, all containers should be green and your instance should be fully functional again
# Restore instance
For the below to work, you need a backup archive of an AIO instance and the location on the test machine and the password for the backup archive. You can get one here: [backup-archive](./assets/backup-archive/)
- [ ] The section that allows to restore the whole AIO instance from backup should show three input fields: one that allows to enter a location where the backup archive is located and one that allows to enter a remote ssh path and one that allows to enter password of the archive. It should also show a short explanation regarding the path requirements
- [ ] First, check restoring from a local backup location:
- [ ] Entering an incorrect path and/or password should let you continue and test your settings in the next step
- [ ] Clicking on the test button should after a reload bring you back to the initial screen where it should say that the test was unsuccessful. Also you should be able to have a look at the backup container logs for investigation what exactly failed.
- [ ] You should also now see the input boxes again where you can change the path and password, confirm it and bring you again to the screen where you can test your settings.
- [ ] Entering the correct path to the backup archive and the correct password here should:
- [ ] Should reload and should hide all options except the option to test the path and password
- [ ] After the test you should see the options to check the integrity of the backup and a list of backup archives that you can choose from to restore your instance
- [ ] Clicking on either option should show a window prompt that lets you cancel the operation
- [ ] Clicking on the integrity check option should check the integrity and report that the backup integrity is good after a while which should then only show the option to choose the backup archive that should be restored
- [ ] Choosing the restore option should finally restore your files.
- [ ] After waiting a while it should reload the page and should show the usual container interface again with the state of your containers (stopped) and the option to start and update the containers again.
- [ ] Next, check restoring from a remote backup location via SSH. The remote borg repo URL must contain both `@` and `:`. The restore process works as follows:
1. You enter a remote borg repo URL (e.g. `ssh://user@host:port/path/to/repo` or `user@host:/path/to/repo`) and the backup password.
2. On the first connection attempt, a SSH key pair is generated automatically and the public key is displayed.
3. You add the public key to the `~/.ssh/authorized_keys` file on the remote server so that AIO can connect to it.
4. Once authorized, AIO can list and restore backups from the remote server.
- [ ] Enter an invalid remote repo URL (e.g. `user` without `@` and `:`) which should send an error
- [ ] Enter a valid remote borg repo URL and the correct backup password:
- [ ] Should reload and should hide all options except the option to test the path and password
- [ ] After the first failed connection attempt, the SSH public key for borg should be shown so it can be authorized on the remote server
- [ ] After authorizing the key on the remote server, scroll down and click on the test button again. This time it should succeed and show the options to check the integrity and list backup archives
- [ ] After the test you should see the options to check the integrity of the backup and a list of backup archives that you can choose from to restore your instance
- [ ] Clicking on either option should show a window prompt that lets you cancel the operation
- [ ] Clicking on the integrity check option should check the integrity and report that the backup integrity is good after a while which should then only show the option to choose the backup archive that should be restored
- [ ] Choosing the restore option should finally restore your files.
- [ ] After waiting a while it should reload the page and should show the usual container interface again with the state of your containers (stopped) and the option to start and update the containers again.
- [ ] Clicking on `Start and update containers` should show a window prompt that you should create a backup. Canceling should cancel the operation, confirming should reveal the big spinner again.
- [ ] After waiting a bit, all containers should be green and your instance should be fully functional again
You can now continue with [020-backup-and-restore.md](./020-backup-and-restore.md)
tests/QA/020-backup-and-restore.md
+11 -11
View File
@@ -1,12 +1,12 @@
# Backup and restore
- [ ] Expanding all backup options in the Backup and restore sectioin should reveal a Backup information section, Backup creation section, Backup check section, Backup restore section and a Daily backup section as well as a additional backup location section
- [ ] The backup restore section should list all available backup archives and list them from most recent to least recent.
- [ ] Clicking on either option of Create backup, Check backup integrity or Restore selected backup should run the corresponding action and report after a while in the last check, backup or restore was successful.
- [ ] Daily backup creatio should allow to enter a time in 24h format e.g. `04:00` should be accepted, `24:00` or `dfjlk` not.
- [ ] Submitting a time here should reload the page and reveal at the same place the option to delete the setting again.
- [ ] When the time of the automatic backup has come (you can test it by choosing a time that is e.g. only a minute away), it should automatically log you out (you can verify by reloading) and after you log in again you should see that the automatic backup is currently running.
- [ ] After a while you should see that your container are starting and in the Backup and restore section you should see that the backup was successful
- [ ] When entering additional backup directories, it should allow e.g. `/etc` and `nextcloud_aio_mastercontainer` but not `nextcloud/test`. Running a backup with this should back up these directories/volumes successfully.
# Backup and restore
- [ ] Expanding all backup options in the Backup and restore sectioin should reveal a Backup information section, Backup creation section, Backup check section, Backup restore section and a Daily backup section as well as a additional backup location section
- [ ] The backup restore section should list all available backup archives and list them from most recent to least recent.
- [ ] Clicking on either option of Create backup, Check backup integrity or Restore selected backup should run the corresponding action and report after a while in the last check, backup or restore was successful.
- [ ] Daily backup creatio should allow to enter a time in 24h format e.g. `04:00` should be accepted, `24:00` or `dfjlk` not.
- [ ] Submitting a time here should reload the page and reveal at the same place the option to delete the setting again.
- [ ] When the time of the automatic backup has come (you can test it by choosing a time that is e.g. only a minute away), it should automatically log you out (you can verify by reloading) and after you log in again you should see that the automatic backup is currently running.
- [ ] After a while you should see that your container are starting and in the Backup and restore section you should see that the backup was successful
- [ ] When entering additional backup directories, it should allow e.g. `/etc` and `nextcloud_aio_mastercontainer` but not `nextcloud/test`. Running a backup with this should back up these directories/volumes successfully.
You can now continue with [030-aio-password-change.md](./030-aio-password-change.md)
tests/QA/030-aio-password-change.md
+11 -11
View File
@@ -1,12 +1,12 @@
# AIO passphrase change
- [ ] In the AIO passphrase change section you should see two input fields. And below the requirements for a new passphrase
- [ ] When entering nothing it should report that you need to enter your current AIO passphrase
- [ ] When entering a false passphrase, it should report that to you
- [ ] After entering your current passphrase and leaving the new passphrase empty it should report that you need to enter a new passphrase
- [ ] After entering a new passphrase shorter than 24 characters or not allowed characters, it should report that the passphrase requirements are not met.
- [ ] `sdfjlksj` should not be accepted
- [ ] `jdsfklöjiroewoäsadjkfölk` should not be accepted
- [ ] `sdjlfj SDJFLK 32489 sdjklf` should be accepted, which should reload the page
# AIO passphrase change
- [ ] In the AIO passphrase change section you should see two input fields. And below the requirements for a new passphrase
- [ ] When entering nothing it should report that you need to enter your current AIO passphrase
- [ ] When entering a false passphrase, it should report that to you
- [ ] After entering your current passphrase and leaving the new passphrase empty it should report that you need to enter a new passphrase
- [ ] After entering a new passphrase shorter than 24 characters or not allowed characters, it should report that the passphrase requirements are not met.
- [ ] `sdfjlksj` should not be accepted
- [ ] `jdsfklöjiroewoäsadjkfölk` should not be accepted
- [ ] `sdjlfj SDJFLK 32489 sdjklf` should be accepted, which should reload the page
You can now continue with [040-login-behavior.md](./040-login-behavior.md)
tests/QA/040-login-behavior.md
+6 -6
View File
@@ -1,7 +1,7 @@
# Login behavior
- [ ] When opening the AIO interface in a new tab while the apache container is running, it should report on the login page that Nextcloud is running and you should use the automatic login
- [ ] When the apache container is stopped, you should see here an input field that allows you to enter the AIO passphrase which should log you in
- [ ] Starting and stopping the containers multiple times should every time produce a new token that is used in the admin overview in Nextcloud as link in the button to log you into the AIO interface. (see [003-automatic-login.md](./003-automatic-login.md))
# Login behavior
- [ ] When opening the AIO interface in a new tab while the apache container is running, it should report on the login page that Nextcloud is running and you should use the automatic login
- [ ] When the apache container is stopped, you should see here an input field that allows you to enter the AIO passphrase which should log you in
- [ ] Starting and stopping the containers multiple times should every time produce a new token that is used in the admin overview in Nextcloud as link in the button to log you into the AIO interface. (see [003-automatic-login.md](./003-automatic-login.md))
You can now continue with [050-optional-addons.md](./050-optional-addons.md)
tests/QA/050-optional-addons.md
+16 -16
View File
@@ -1,17 +1,17 @@
# Optional addons
- [ ] Close to the bottom of the page in the AIO interface, you should see the optional addons section
- [ ] You should be able to change optional addons when containers are stopped and not change them when containers are running
- [ ] Enabling either of the options should start a new container with the same or comparable name and should also list them in the containers section
- [ ] After all containers are started with the new config active, you should verify that the options were automatically activated/deactivated.
- [ ] ClamAV by trying to upload a testvirus to Nextcloud https://www.eicar.org/?page_id=3950
- [ ] Collabora by trying to open a .docx or .odt file in Nextcloud
- [ ] Nextcloud Talk by opening the Talk app in Nextcloud, creating a new chat and trying to join a call in this chat. Also verifying in the settings that the HPB and turn server work.
- [ ] Imaginary by having a look if when uploading a new picture in Nextcloud, it adds some log entries to the container
- [ ] Fulltextsearch by trying to search for a heading inside a file in Nextcloud
- [ ] Talk-recording by starting a call and trying to record something
- [ ] When Collabora is enabled
- [ ] It should show below the Optional Addons section a section where you can change the dictionaries for collabora. `de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru` should be a valid setting. E.g. `de.De` not. If already set, it should show a button that allows to remove the setting again.
- [ ] Also, you should see an input field that allows to enter additional collabora options. E.g. `net.content_security_policy=false` should not be accepted, but `--o:net.content_security_policy="frame-ancestors *.example.com:*;"` should.
# Optional addons
- [ ] Close to the bottom of the page in the AIO interface, you should see the optional addons section
- [ ] You should be able to change optional addons when containers are stopped and not change them when containers are running
- [ ] Enabling either of the options should start a new container with the same or comparable name and should also list them in the containers section
- [ ] After all containers are started with the new config active, you should verify that the options were automatically activated/deactivated.
- [ ] ClamAV by trying to upload a testvirus to Nextcloud https://www.eicar.org/?page_id=3950
- [ ] Collabora by trying to open a .docx or .odt file in Nextcloud
- [ ] Nextcloud Talk by opening the Talk app in Nextcloud, creating a new chat and trying to join a call in this chat. Also verifying in the settings that the HPB and turn server work.
- [ ] Imaginary by having a look if when uploading a new picture in Nextcloud, it adds some log entries to the container
- [ ] Fulltextsearch by trying to search for a heading inside a file in Nextcloud
- [ ] Talk-recording by starting a call and trying to record something
- [ ] When Collabora is enabled
- [ ] It should show below the Optional Addons section a section where you can change the dictionaries for collabora. `de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru` should be a valid setting. E.g. `de.De` not. If already set, it should show a button that allows to remove the setting again.
- [ ] Also, you should see an input field that allows to enter additional collabora options. E.g. `net.content_security_policy=false` should not be accepted, but `--o:net.content_security_policy="frame-ancestors *.example.com:*;"` should.
You can now continue with [055-community-containers.md](./055-community-containers.md)
tests/QA/060-environmental-variables.md
+31 -31
View File
@@ -1,31 +1,31 @@
# Environmental variables
- [ ] When starting the mastercontainer with `--env APACHE_PORT=11000` on a clean instance, the domaincheck container should be started with that same port published. That makes sure that also the Apache container will use that port later on. Using a value here that is not a port will not allow the mastercontainer to start correctly. However `@INTERNAL` is also an allowed value which skips publishing the port on the host for internal usage inside a bridged network for example.
- [ ] When starting the mastercontainer with `--env APACHE_IP_BINDING=127.0.0.1` on a clean instance, the domaincheck container's apache port should only listen on localhost on the host. Using a value here that is not a number or dot will not allow the mastercontainer to start correctly.
- [ ] When starting the mastercontainer with `--env APACHE_ADDITIONAL_NETWORK=frontend_net` on a clean instance, the domaincheck and subsequently the apache containers should be connected to the specified `frontend_net` docker network, in addition to the default `nextcloud-aio` network. Specifying the network that doesn't already exist will not allow the mastercontainer to start correctly.
- [ ] When starting the mastercontainer with `--env TALK_PORT=3479` on a clean instance, the talk container should use this port later on. Using a value here that is not a port will not allow the mastercontainer to start correctly. Also it should stop if apache_port and talk_port are set to the same value.
- [ ] Make also sure that reverse proxies work by following https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#reverse-proxy-documentation and following [001-initial-setup.md](./001-initial-setup.md) and [002-new-instance.md](./002-new-instance.md)
- [ ] When starting the mastercontainer with `--env SKIP_DOMAIN_VALIDATION=true` on a clean instance, it should skip the domain verification. So it should accept any domain that you type in then.
- [ ] When starting the mastercontainer with `--env DOCKER_API_VERSION=1.44` it should use the mentioned docker API version internally for all requests
- [ ] When starting the mastercontainer with `--env AIO_LOG_LEVEL=info` on a clean instance, the resulting sibling containers should receive the propagated global log-level variable and the configured components should no longer use their default warning or error levels. This should at least be verified for the mastercontainer, Apache, Nextcloud, Redis and Talk containers. In addition, previously suppressed supervisord stdout or stderr logs should become visible for the affected components.
- [ ] When starting the mastercontainer with an invalid `AIO_LOG_LEVEL` value like `warning` or `verbose`, the container startup should fail with a message that only `debug`, `info`, `warn` and `error` are allowed.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_DATADIR="/mnt/testdata"` it should map that location from `/mnt/testdata` to `/mnt/ncdata` inside the Nextcloud container. Not having adjusted the permissions correctly before starting the Nextcloud container the first time will not allow the Nextcloud container to start correctly. See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MOUNT="/mnt/"` it should map `/mnt/` to `/mnt/` inside the Nextcloud container. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_UPLOAD_LIMIT=11G` it should change Nextclouds upload limit to 11G. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MEMORY_LIMIT=1024M` it should change Nextclouds PHP memory limit to 1024M. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MAX_TIME=4000` it should change Nextclouds upload max time 4000s. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env BORG_RETENTION_POLICY="--keep-within=1d --keep-weekly=1 --keep-monthly=1"` it should change borgs retention policy to the defined one. This can be checked when creating a backup and looking at the logs.
- [ ] When starting the mastercontainer with `--env FULLTEXTSEARCH_JAVA_OPTIONS="-Xms1024M -Xmx1024M"` it should change Elasticsearchs `ES_JAVA_OPTS` options to the defined one. This can be checked by checking the `ES_JAVA_OPTS` variable for the nextcloud-aio-fulltextsearch container.
- [ ] When starting the mastercontainer with `--env WATCHTOWER_DOCKER_SOCKET_PATH="$XDG_RUNTIME_DIR/docker.sock"` it should map `$XDG_RUNTIME_DIR/docker.sock` to `/var/run/docker.sock` inside the watchtower container which allow to update the mastercontainer on docker rootless.
- [ ] When starting the mastercontainer with `--env AIO_DISABLE_BACKUP_SECTION=true` it should hide the backup section that gets shown after AIO is set up (everything of [020-backup-and-restore](./020-backup-and-restore.md)) and simply show that the backup section is disabled.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts`, the resulting nextcloud container should trust all the Certification Authorities, whose certificates are included in the directory `/path/to/my/cacerts` on the host.
See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
- [ ] When starting the mastercontainer with `--env COLLABORA_SECCOMP_DISABLED=true`, the resulting collabora container should have `--o:security.seccomp=false` applied to it.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_STARTUP_APPS=deck`, the resulting Nextcloud should have only installed the deck app and not the other apps that get installed by default. Default are `deck twofactor_totp tasks calendar contacts notes`.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ADDITIONAL_APKS=zip`, the resulting Nextcloud container should have the zip package installed and not imagemagick.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=inotify`, the resulting Nextcloud container should have the inotify extension installed and not the imagick extension.
- [ ] When mounting `/dev/dri` into the mastercontainer with `--device=/dev/dri`, the /dev/dri device mounted into all sibling containers that require it like talk-recording. (Only works if a `/dev/dri` device is present on the host)
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ENABLE_NVIDIA_GPU=true`, the resulting Nextcloud container should have the nvidia gpu device mounted into the container. (Only works if a Nvidia GPU and runtime is installed on the host)
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_KEEP_DISABLED_APPS=true` it should keep apps in Nextcloud that are disabled in the AIO interface. For example if Collabora is disabled in the AIO interface and you install the richdocuments app in Nextcloud, a restart should not uninstall the richdocuments app in Nextcloud anymore.
You can now continue with [070-timezone-change.md](./070-timezone-change.md)
# Environmental variables
- [ ] When starting the mastercontainer with `--env APACHE_PORT=11000` on a clean instance, the domaincheck container should be started with that same port published. That makes sure that also the Apache container will use that port later on. Using a value here that is not a port will not allow the mastercontainer to start correctly. However `@INTERNAL` is also an allowed value which skips publishing the port on the host for internal usage inside a bridged network for example.
- [ ] When starting the mastercontainer with `--env APACHE_IP_BINDING=127.0.0.1` on a clean instance, the domaincheck container's apache port should only listen on localhost on the host. Using a value here that is not a number or dot will not allow the mastercontainer to start correctly.
- [ ] When starting the mastercontainer with `--env APACHE_ADDITIONAL_NETWORK=frontend_net` on a clean instance, the domaincheck and subsequently the apache containers should be connected to the specified `frontend_net` docker network, in addition to the default `nextcloud-aio` network. Specifying the network that doesn't already exist will not allow the mastercontainer to start correctly.
- [ ] When starting the mastercontainer with `--env TALK_PORT=3479` on a clean instance, the talk container should use this port later on. Using a value here that is not a port will not allow the mastercontainer to start correctly. Also it should stop if apache_port and talk_port are set to the same value.
- [ ] Make also sure that reverse proxies work by following https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#reverse-proxy-documentation and following [001-initial-setup.md](./001-initial-setup.md) and [002-new-instance.md](./002-new-instance.md)
- [ ] When starting the mastercontainer with `--env SKIP_DOMAIN_VALIDATION=true` on a clean instance, it should skip the domain verification. So it should accept any domain that you type in then.
- [ ] When starting the mastercontainer with `--env DOCKER_API_VERSION=1.44` it should use the mentioned docker API version internally for all requests
- [ ] When starting the mastercontainer with `--env AIO_LOG_LEVEL=info` on a clean instance, the resulting sibling containers should receive the propagated global log-level variable and the configured components should no longer use their default warning or error levels. This should at least be verified for the mastercontainer, Apache, Nextcloud, Redis and Talk containers. In addition, previously suppressed supervisord stdout or stderr logs should become visible for the affected components.
- [ ] When starting the mastercontainer with an invalid `AIO_LOG_LEVEL` value like `warning` or `verbose`, the container startup should fail with a message that only `debug`, `info`, `warn` and `error` are allowed.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_DATADIR="/mnt/testdata"` it should map that location from `/mnt/testdata` to `/mnt/ncdata` inside the Nextcloud container. Not having adjusted the permissions correctly before starting the Nextcloud container the first time will not allow the Nextcloud container to start correctly. See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MOUNT="/mnt/"` it should map `/mnt/` to `/mnt/` inside the Nextcloud container. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_UPLOAD_LIMIT=11G` it should change Nextclouds upload limit to 11G. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MEMORY_LIMIT=1024M` it should change Nextclouds PHP memory limit to 1024M. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_MAX_TIME=4000` it should change Nextclouds upload max time 4000s. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud for allowed values.
- [ ] When starting the mastercontainer with `--env BORG_RETENTION_POLICY="--keep-within=1d --keep-weekly=1 --keep-monthly=1"` it should change borgs retention policy to the defined one. This can be checked when creating a backup and looking at the logs.
- [ ] When starting the mastercontainer with `--env FULLTEXTSEARCH_JAVA_OPTIONS="-Xms1024M -Xmx1024M"` it should change Elasticsearchs `ES_JAVA_OPTS` options to the defined one. This can be checked by checking the `ES_JAVA_OPTS` variable for the nextcloud-aio-fulltextsearch container.
- [ ] When starting the mastercontainer with `--env WATCHTOWER_DOCKER_SOCKET_PATH="$XDG_RUNTIME_DIR/docker.sock"` it should map `$XDG_RUNTIME_DIR/docker.sock` to `/var/run/docker.sock` inside the watchtower container which allow to update the mastercontainer on docker rootless.
- [ ] When starting the mastercontainer with `--env AIO_DISABLE_BACKUP_SECTION=true` it should hide the backup section that gets shown after AIO is set up (everything of [020-backup-and-restore](./020-backup-and-restore.md)) and simply show that the backup section is disabled.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts`, the resulting nextcloud container should trust all the Certification Authorities, whose certificates are included in the directory `/path/to/my/cacerts` on the host.
See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
- [ ] When starting the mastercontainer with `--env COLLABORA_SECCOMP_DISABLED=true`, the resulting collabora container should have `--o:security.seccomp=false` applied to it.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_STARTUP_APPS=deck`, the resulting Nextcloud should have only installed the deck app and not the other apps that get installed by default. Default are `deck twofactor_totp tasks calendar contacts notes`.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ADDITIONAL_APKS=zip`, the resulting Nextcloud container should have the zip package installed and not imagemagick.
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=inotify`, the resulting Nextcloud container should have the inotify extension installed and not the imagick extension.
- [ ] When mounting `/dev/dri` into the mastercontainer with `--device=/dev/dri`, the /dev/dri device mounted into all sibling containers that require it like talk-recording. (Only works if a `/dev/dri` device is present on the host)
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_ENABLE_NVIDIA_GPU=true`, the resulting Nextcloud container should have the nvidia gpu device mounted into the container. (Only works if a Nvidia GPU and runtime is installed on the host)
- [ ] When starting the mastercontainer with `--env NEXTCLOUD_KEEP_DISABLED_APPS=true` it should keep apps in Nextcloud that are disabled in the AIO interface. For example if Collabora is disabled in the AIO interface and you install the richdocuments app in Nextcloud, a restart should not uninstall the richdocuments app in Nextcloud anymore.
You can now continue with [070-timezone-change.md](./070-timezone-change.md)
tests/QA/070-timezone-change.md
+9 -9
View File
@@ -1,10 +1,10 @@
# Timezone change
- [ ] At the very bottom of the page you should see the timezone change section
- [ ] When the containers are stopped, you should be able to change it and set/reset it
- [ ] If not already set, it should show an input field where you can enter a timezone
- [ ] `Europe/Berlin` should be accepted, e.g. `Europe Berlin` not
- [ ] When it is set, it should show that it is set to which timezone and display a button that allows to reset it again which does this on a press
- [ ] When it is set, running `date` inside Nextcloud related containers should return the correct timezone
# Timezone change
- [ ] At the very bottom of the page you should see the timezone change section
- [ ] When the containers are stopped, you should be able to change it and set/reset it
- [ ] If not already set, it should show an input field where you can enter a timezone
- [ ] `Europe/Berlin` should be accepted, e.g. `Europe Berlin` not
- [ ] When it is set, it should show that it is set to which timezone and display a button that allows to reset it again which does this on a press
- [ ] When it is set, running `date` inside Nextcloud related containers should return the correct timezone
You can now continue with [080-daily-backup-script.md](./080-daily-backup-script.md)
tests/QA/080-daily-backup-script.md
+5 -5
View File
@@ -1,5 +1,5 @@
# Daily backup script
The script is delivered within the mastercontainer and allows to run a few things like daily backup and container updates from an external script.
You can find the documentation on this here which needs to work as documented: https://github.com/nextcloud/all-in-one#how-to-stopstartupdate-containers-or-trigger-the-daily-backup-from-a-script-externally
# Daily backup script
The script is delivered within the mastercontainer and allows to run a few things like daily backup and container updates from an external script.
You can find the documentation on this here which needs to work as documented: https://github.com/nextcloud/all-in-one#how-to-stopstartupdate-containers-or-trigger-the-daily-backup-from-a-script-externally
tests/QA/assets/backup-archive/readme.md
+4 -4
View File
@@ -1,4 +1,4 @@
# Backup archive
The backup archive was moved here because of Git LFS limitations:
https://cloud.nextcloud.com/s/m5DF3AjRs72kWKY
# Backup archive
The backup archive was moved here because of Git LFS limitations:
https://cloud.nextcloud.com/s/m5DF3AjRs72kWKY
tests/QA/readme.md
+7 -7
View File
@@ -1,7 +1,7 @@
# QA test plans
In this folder are manual test plans for QA located that allow to manually step through certain features and make sure that everything works as expected.
For a test instance, you should make sure that all potentially breaking changes are merged, build new containers by following https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-build-new-containers, stop a potential old instance, remove it and delete all volumes. Afterwards start a new clean test instance by following https://github.com/nextcloud/all-in-one/blob/main/develop.md#developer-channel.
Best is to start testing with [001-initial-setup.md](./001-initial-setup.md).
# QA test plans
In this folder are manual test plans for QA located that allow to manually step through certain features and make sure that everything works as expected.
For a test instance, you should make sure that all potentially breaking changes are merged, build new containers by following https://github.com/nextcloud/all-in-one/blob/main/develop.md#how-to-build-new-containers, stop a potential old instance, remove it and delete all volumes. Afterwards start a new clean test instance by following https://github.com/nextcloud/all-in-one/blob/main/develop.md#developer-channel.
Best is to start testing with [001-initial-setup.md](./001-initial-setup.md).