daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-18 17:27:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'nextcloud:main' into restructure_caddy_readme

Browse Source
This commit is contained in:
derStephan
2026-08-05 13:28:15 +02:00
committed by GitHub
parent 8068fc3057 c261306a9d
commit 50d4319fc4
44 changed files with 211 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/dependabot.yml
+1
View File
@@ -33,6 +33,7 @@ updates:
- "/Containers/domaincheck"
- "/Containers/eurooffice"
- "/Containers/fulltextsearch"
- "/Containers/harp"
- "/Containers/imaginary"
- "/Containers/mastercontainer"
- "/Containers/nextcloud"
.github/workflows/lint-yaml.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
line-length: warning
- name: Install the latest version of uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Check GitHub actions
run: uvx zizmor --min-severity medium .github/workflows/*.yml
Containers/apache/Dockerfile
+1
View File
@@ -48,6 +48,7 @@ RUN set -ex; \
-e 's/^#\(LoadModule .*mod_alias.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_mpm_event.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_brotli.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_reqtimeout.so\)/\1/' \
-e 's/\(LoadModule .*mod_mpm_worker.so\)/#\1/' \
-e 's/\(LoadModule .*mod_mpm_prefork.so\)/#\1/' \
-e 's/\(ScriptAlias \)/#\1/' \
Containers/apache/nextcloud.conf
+7
View File
@@ -49,6 +49,13 @@ Listen 8000
# See https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxytimeout
ProxyTimeout ${APACHE_MAX_TIME}
# See https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html
# Disable body rate limit so that large uploads on slow connections are not aborted.
# The Timeout directive above still applies as the overall I/O timeout.
<IfModule reqtimeout_module>
RequestReadTimeout header=20-40,MinRate=500 body=0
</IfModule>
# See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable
TraceEnable Off
</VirtualHost>
Containers/borgbackup/backupscript.sh
+1 -1
View File
@@ -436,7 +436,7 @@ if [ "$BORG_MODE" = restore ]; then
#
# Older backups may still contain files we've since excluded, so we have to exclude on extract as well.
cd / # borg extract has no destination arg and extracts to CWD
if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --noxattrs --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
then
RESTORE_FAILED=1
echo "Failed to extract backup archive."
Containers/collabora/Dockerfile
+1 -1
View File
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:latest
# From a file located probably somewhere here: https://github.com/CollaboraOnline/online/blob/master/docker/from-packages/Dockerfile
FROM collabora/code:26.04.2.1.1
FROM collabora/code:26.04.2.4.1
USER root
ARG DEBIAN_FRONTEND=noninteractive
Containers/docker-socket-proxy/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM haproxy:3.4.2-alpine
FROM haproxy:3.4.3-alpine
# hadolint ignore=DL3002
USER root
Containers/harp/Dockerfile
+17
View File
@@ -0,0 +1,17 @@
# syntax=docker/dockerfile:latest
FROM ghcr.io/nextcloud/nextcloud-appapi-harp:v0.4.3
# USER root is probably used
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
org.opencontainers.image.title="Nextcloud AppAPI HARP for Nextcloud AIO" \
org.opencontainers.image.description="Nextcloud AppAPI HARP for Nextcloud All-in-One" \
org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
# Copied from upstream
HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh
Containers/mastercontainer/Dockerfile
+6 -6
View File
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:latest
# Docker CLI is a requirement
FROM docker:29.6.2-cli AS docker
FROM docker:29.7.0-cli AS docker
ARG CADDY_REMOTE_HOST_HASH=e80a9931765a8dbcbb47db415863387f0df0e1b3
@@ -11,7 +11,7 @@ RUN set -ex; \
/usr/bin/caddy list-modules
# From https://github.com/docker-library/php/blob/master/8.5/alpine3.24/fpm/Dockerfile
FROM php:8.5.8-fpm-alpine3.24
FROM php:8.5.9-fpm-alpine3.24
EXPOSE 80
EXPOSE 8080
@@ -31,7 +31,7 @@ COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf
WORKDIR /var/www/docker-aio
# hadolint ignore=SC2086,DL3047,DL3003,DL3004
# hadolint ignore=SC2086,DL3047,DL3003
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache shadow; \
@@ -43,7 +43,7 @@ RUN set -ex; \
ca-certificates \
bash \
supervisor \
sudo \
su-exec \
netcat-openbsd \
curl \
grep; \
@@ -87,8 +87,8 @@ RUN set -ex; \
rm -r ./php/tests; \
chown www-data:www-data -R /var/www/docker-aio; \
cd php; \
sudo -E -u www-data composer install --no-dev; \
sudo -E -u www-data composer clear-cache; \
su-exec www-data composer install --no-dev; \
su-exec www-data composer clear-cache; \
cd ..; \
rm -f /usr/local/bin/composer; \
chmod -R 770 /var/www/docker-aio; \
Containers/mastercontainer/cron.sh
+10 -10
View File
@@ -51,33 +51,33 @@ while true; do
# Check for updates and send notification if yes on saturdays
if [ "$(date +%u)" = 6 ]; then
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
fi
# Check if AIO is outdated
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
# Update deSEC DNS IP record (no-op when IP is unchanged or deSEC is not configured)
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
# Remove sessions older than 24h
find "/mnt/docker-aio-config/session/" -mindepth 1 -mmin +1440 -delete
# Remove nextcloud-aio-domaincheck container
if sudo -E -u www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
sudo -E -u www-data docker container remove nextcloud-aio-domaincheck
if su-exec www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
su-exec www-data docker container remove nextcloud-aio-domaincheck
fi
# Remove dangling images (support both deprecated label-schema and OCI standard vendor label)
sudo -E -u www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
sudo -E -u www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
su-exec www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
su-exec www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
# Check for available free space
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
# Remove mastercontainer from default bridge network
if sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
sudo -E -u www-data docker network disconnect bridge nextcloud-aio-mastercontainer
if su-exec www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
su-exec www-data docker network disconnect bridge nextcloud-aio-mastercontainer
fi
# Wait 60s so that the whole loop will not be executed again
Containers/mastercontainer/daily-backup.sh
+18 -9
View File
@@ -13,6 +13,15 @@ if ! [ -f "$CONFIG_FILE" ] || (! grep -q "wasStartButtonClicked.*1" "$CONFIG_FIL
exit 0
fi
# Exit early if the backup container is currently running a restore
if docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
if grep -q '"backup-mode".*"restore"' "$CONFIG_FILE"; then
echo "Backup container is running in restore mode. Exiting to not interrupt the restore..."
rm -f "/mnt/docker-aio-config/data/daily_backup_running"
exit 0
fi
fi
# Daily backup and backup check cannot be run at the same time
if [ "$DAILY_BACKUP" = 1 ] && [ "$CHECK_BACKUP" = 1 ]; then
echo "Daily backup and backup check cannot be run at the same time. Exiting..."
@@ -24,7 +33,7 @@ fi
if [ "$LOCK_FILE_PRESENT" = 0 ] || ! [ -f "/mnt/docker-aio-config/data/daily_backup_running" ]; then
find "/mnt/docker-aio-config/session/" -mindepth 1 -delete
fi
sudo -E -u www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
su-exec www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
# Check if apache is running/stopped, watchtower is stopped and backupcontainer is stopped
LOCAL_APACHE_PORT="$(docker inspect nextcloud-aio-apache --format "{{.Config.Env}}" | grep -o 'APACHE_PORT=[0-9]\+' | grep -o '[0-9]\+' | head -1)"
@@ -54,7 +63,7 @@ done
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Starting mastercontainer update..."
echo "(The script might get exited due to that. In order to update all the other containers correctly, you need to run this script with the same settings a second time.)"
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
fi
# Wait for watchtower to stop
@@ -71,20 +80,20 @@ fi
# Update container images to reduce downtime later on
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Updating container images..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
fi
# Stop containers if required
# shellcheck disable=SC2235
if [ "$CHECK_BACKUP" != 1 ] && ([ "$DAILY_BACKUP" != 1 ] || [ "$STOP_CONTAINERS" = 1 ]); then
echo "Stopping containers..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
fi
# Execute the backup itself and some related tasks (also stops the containers)
if [ "$DAILY_BACKUP" = 1 ]; then
echo "Creating daily backup..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
if ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
echo "Something seems to be wrong: the borg container should be started at this step."
fi
@@ -97,17 +106,17 @@ fi
# Execute backup check
if [ "$CHECK_BACKUP" = 1 ]; then
echo "Starting backup check..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
fi
# Start and/or update containers
if [ "$AUTOMATIC_UPDATES" = 1 ]; then
echo "Starting and updating containers..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
else
if [ "$START_CONTAINERS" = 1 ]; then
echo "Starting containers without updating them..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
fi
fi
@@ -131,7 +140,7 @@ if [ "$DAILY_BACKUP" = 1 ] && ([ "$AUTOMATIC_UPDATES" = 1 ] || [ "$START_CONTAIN
done
fi
echo "Sending backup notification..."
sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
su-exec www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
fi
echo "Daily backup script has finished"
Containers/mastercontainer/start.sh
+12 -12
View File
@@ -55,7 +55,7 @@ elif mountpoint -q /var/www/docker-aio/php/containers.json; then
echo "If you need to customize things, feel free to use https://github.com/nextcloud/all-in-one/tree/main/manual-install"
echo "See https://github.com/nextcloud/all-in-one/blob/main/manual-install/latest.yml"
exit 1
elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
elif ! su-exec www-data test -r /var/run/docker.sock; then
echo "Trying to fix docker.sock permissions internally..."
DOCKER_GROUP=$(stat -c '%G' /var/run/docker.sock)
DOCKER_GROUP_ID=$(stat -c '%g' /var/run/docker.sock)
@@ -73,7 +73,7 @@ elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
groupadd -g "$DOCKER_GROUP_ID" docker
usermod -aG docker www-data
fi
if ! sudo -E -u www-data test -r /var/run/docker.sock; then
if ! su-exec www-data test -r /var/run/docker.sock; then
print_red "Docker socket is not readable by the www-data user. Cannot continue."
exit 1
fi
@@ -108,8 +108,8 @@ fi
FALLBACK_DOCKER_API_VERSION="1.41"
# Check if docker info can be used
if ! sudo -E -u www-data docker info &>/dev/null; then
if ! sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
if ! su-exec www-data docker info &>/dev/null; then
if ! su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
print_red "Cannot connect to the docker socket. Cannot proceed."
echo "Did you maybe remove group read permissions for the docker socket? AIO needs them in order to access the docker socket."
echo "If SELinux is enabled on your host, see https://github.com/nextcloud/all-in-one#are-there-known-problems-when-selinux-is-enabled"
@@ -125,9 +125,9 @@ fi
# Docker api version check
# shellcheck disable=SC2001
API_VERSION_NUMB="$(echo "$DOCKER_API_VERSION" | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(su-exec www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
if [ -z "$LOCAL_API_VERSION_NUMB" ]; then
LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
LOCAL_API_VERSION_NUMB="$(su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
fi
if [ -n "$LOCAL_API_VERSION_NUMB" ] && [ -n "$API_VERSION_NUMB" ]; then
if ! [ "$LOCAL_API_VERSION_NUMB" -ge "$API_VERSION_NUMB" ]; then
@@ -143,7 +143,7 @@ else
fi
# Check Storage drivers
STORAGE_DRIVER="$(sudo -E -u www-data docker info | grep "Storage Driver")"
STORAGE_DRIVER="$(su-exec www-data docker info | grep "Storage Driver")"
# Check if vfs is used: https://github.com/nextcloud/all-in-one/discussions/1467
if echo "$STORAGE_DRIVER" | grep -q vfs; then
echo "$STORAGE_DRIVER"
@@ -154,26 +154,26 @@ elif echo "$STORAGE_DRIVER" | grep -q fuse-overlayfs; then
fi
# Check if snap install
if sudo -E -u www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
if su-exec www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
print_red "Warning: It looks like your installation uses docker installed via snap."
print_red "This comes with some limitations and is disrecommended by the docker maintainers."
print_red "See for example https://github.com/nextcloud/all-in-one/discussions/4890#discussioncomment-10386752"
fi
# Check if startup command was executed correctly
if ! sudo -E -u www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
if ! su-exec www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
print_red "It seems like you did not give the mastercontainer the correct name? (The 'nextcloud-aio-mastercontainer' container was not found.)
Using a different name is not supported since mastercontainer updates will not work in that case!
If you are on docker swarm and try to run AIO, see https://github.com/nextcloud/all-in-one#can-i-run-this-with-docker-swarm"
exit 1
elif sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
elif su-exec www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
print_red "It seems like you used a hash for the mastercontainer image tag. This is not supported!"
exit 1
elif ! sudo -E -u www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
elif ! su-exec www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
print_red "It seems like you did not give the mastercontainer volume the correct name? (The 'nextcloud_aio_mastercontainer' volume was not found.)
Using a different name is not supported since the built-in backup solution will not work in that case!"
exit 1
elif ! sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
elif ! su-exec www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
print_red "It seems like you did not attach the 'nextcloud_aio_mastercontainer' volume to the mastercontainer?
This is not supported since the built-in backup solution will not work in that case!"
exit 1
Containers/nextcloud/Dockerfile
+2 -2
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM php:8.3.32-fpm-alpine3.24
FROM php:8.3.33-fpm-alpine3.24
ENV PHP_MEMORY_LIMIT=512M
ENV PHP_UPLOAD_LIMIT=16G
@@ -234,7 +234,7 @@ RUN set -ex; \
git \
postgresql-client \
tzdata \
sudo \
su-exec \
grep \
nodejs \
bind-tools \
Containers/nextcloud/notify-all.sh
+1 -1
View File
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
fi
if [[ "$EUID" = 0 ]]; then
COMMAND=(sudo -E -u www-data php /var/www/html/occ)
COMMAND=(su-exec www-data php /var/www/html/occ)
else
COMMAND=(php /var/www/html/occ)
fi
Containers/nextcloud/notify.sh
+1 -1
View File
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
fi
if [[ "$EUID" = 0 ]]; then
COMMAND=(sudo -E -u www-data php /var/www/html/occ)
COMMAND=(su-exec www-data php /var/www/html/occ)
else
COMMAND=(php /var/www/html/occ)
fi
Containers/nextcloud/root.motd
+1 -1
View File
@@ -1,4 +1,4 @@
Warning: You have logged in into the Nextcloud container as root user.
See https://github.com/nextcloud/all-in-one#how-to-run-occ-commands if you want to run occ commands.
Apart from that, you can use 'sudo -E -u www-data php occ <your-command>' in order to run occ commands.
Apart from that, you can use 'su-exec www-data php occ <your-command>' in order to run occ commands.
Of course <your-command> needs to be substituted with the command that you want to use.
Containers/nextcloud/start.sh
+5 -5
View File
@@ -12,7 +12,7 @@ fi
# Only start container if database is accessible
# POSTGRES_HOST must be set in the containers env vars and POSTGRES_PORT has a default above
# shellcheck disable=SC2153
while ! sudo -E -u www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
while ! su-exec www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
echo "Waiting for database to start..."
sleep 5
done
@@ -29,7 +29,7 @@ fi
# Fix false database connection on old instances
if [ -f "/var/www/html/config/config.php" ]; then
sleep 2
while ! sudo -E -u www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
while ! su-exec www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
echo "Waiting for the database to start..."
sleep 5
done
@@ -62,12 +62,12 @@ if [ "$AIO_LOG_LEVEL" != 'debug' ]; then
fi
# Check datadir permissions
sudo -E -u www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
su-exec www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
if ! [ -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" ]; then
chown -R www-data:root "$NEXTCLOUD_DATA_DIR"
chmod 750 -R "$NEXTCLOUD_DATA_DIR"
fi
sudo -E -u www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
su-exec www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
# Install additional dependencies
if [ -n "$ADDITIONAL_APKS" ]; then
@@ -153,7 +153,7 @@ if [ -n "$ADDITIONAL_PHP_EXTENSIONS" ]; then
fi
# Run original entrypoint
if ! sudo -E -u www-data bash /entrypoint.sh; then
if ! su-exec www-data bash /entrypoint.sh; then
exit 1
fi
Containers/nextcloud/upgrade-latest-major.sh
+1 -1
View File
@@ -2,7 +2,7 @@
PHP_CLI="php"
if [[ "$EUID" = 0 ]]; then
PHP_CLI="sudo -u www-data -E $PHP_CLI"
PHP_CLI="su-exec www-data $PHP_CLI"
fi
# shellcheck disable=SC2016
Containers/talk/Dockerfile
+1 -1
View File
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:latest
FROM nats:2.14.3-scratch AS nats
FROM nats:2.14.4-scratch AS nats
FROM eturnal/eturnal:1.12.2-alpine AS eturnal
FROM strukturag/nextcloud-spreed-signaling:2.1.1 AS signaling
FROM alpine:3.24.1 AS janus
community-containers/joplin-server/joplin-server.json
+3 -1
View File
@@ -6,6 +6,7 @@
"display_name": "Joplin Server",
"documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server",
"image": "joplin/server",
"restart": "unless-stopped",
"depends_on": [
"nextcloud-aio-joplin-database"
],
@@ -35,6 +36,7 @@
"image_tag": "18",
"display_name": "Joplin Database (PostgreSQL)",
"image": "postgres",
"restart": "unless-stopped",
"internal_port": "5432",
"environment": [
"POSTGRES_PASSWORD=%JOPLIN_DB_PASSWORD%",
@@ -57,4 +59,4 @@
]
}
]
}
}
community-containers/readme.md
+10 -1
View File
@@ -68,7 +68,16 @@ Starting with v11 of AIO, the management of Community Containers is done via the
⚠️⚠️⚠️ Please review the folder for documentation on each of the containers before adding them! Not reviewing the documentation for each of them first might break starting the AIO containers because some containers are not compatible with each other and more.
## How to add containers?
Simply submit a PR by creating a new folder in this directory: https://github.com/nextcloud/all-in-one/tree/main/community-containers with the name of your container. It must include a json file with the same name and with correct syntax and a readme.md with additional information. You might get inspired by caddy, fail2ban, local-ai, libretranslate, plex, pi-hole or vaultwarden (subfolders in this directory). For a full-blown example of the json file, see https://github.com/nextcloud/all-in-one/blob/main/php/containers.json. The json-schema that it validates against can be found here: https://github.com/nextcloud/all-in-one/blob/main/php/containers-schema.json.
Simply submit a PR by creating a new folder in this directory: https://github.com/nextcloud/all-in-one/tree/main/community-containers with the name of your container. It must include a json file with the same name and with correct syntax and a readme.md with additional information. You might get inspired by caddy, fail2ban, local-ai, libretranslate, plex, pi-hole or vaultwarden (subfolders in this directory). For a full-blown example of the json file, see https://github.com/nextcloud/all-in-one/blob/main/php/containers.json.
### How to test new containers in your own installation?
1. Validate your JSON file against standard validators as well as the specific json-schema: https://github.com/nextcloud/all-in-one/blob/main/php/containers-schema.json
2. create a folder with all files somewhere, e.g. /root
3. put your container's folder there, e.g. `new-container`
4. copy this folder to your container: `docker cp /root/new-container nextcloud-aio-mastercontainer:/var/www/docker-aio/community-containers/`
5. restart mastercontainer `docker restart nextcloud-aio-mastercontainer`
6. open you AIO interface and you should see your community container
### Is there a list of ideas for new community containers?
Yes, see [this list](https://github.com/nextcloud/all-in-one/issues/5251) for already existing ideas for new community containers. Feel free to pick one up and add it to this folder by following the instructions above.
manual-install/update-yaml.sh
+1 -4
View File
@@ -27,8 +27,6 @@ OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "next
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-borgbackup"))')"
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-docker-socket-proxy"))')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-docker-socket-proxy"]) then del(.[index("nextcloud-aio-docker-socket-proxy")]) else . end else . end')"
OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-harp"))')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-harp"]) then del(.[index("nextcloud-aio-harp")]) else . end else . end')"
OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= map({ (.): { "condition": "service_started", "required": false } }) else . end' | jq '.services[] |= if has("depends_on") then .depends_on |= reduce .[] as $item ({}; . + $item) else . end')"
sudo snap install yq
@@ -47,8 +45,6 @@ sed -i 's|- ip_binding: |- |' containers.yml
sed -i '/AIO_TOKEN/d' containers.yml
sed -i '/AIO_URL/d' containers.yml
sed -i '/DOCKER_SOCKET_PROXY_ENABLED/d' containers.yml
sed -i '/HARP_ENABLED/d' containers.yml
sed -i '/HARP_HOST/d' containers.yml
sed -i '/HP_SHARED_KEY/d' containers.yml
sed -i '/ADDITIONAL_TRUSTED_PROXY/d' containers.yml
sed -i '/TURN_DOMAIN/d' containers.yml
@@ -96,6 +92,7 @@ sed -i 's|NEXTCLOUD_TRUSTED_CACERTS_DIR=|NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/loca
sed -i 's|UPDATE_NEXTCLOUD_APPS=|UPDATE_NEXTCLOUD_APPS="no" # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.|' sample.conf
sed -i 's|APACHE_PORT=|APACHE_PORT=443 # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).|' sample.conf
sed -i 's|APACHE_IP_BINDING=|APACHE_IP_BINDING=0.0.0.0 # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect|' sample.conf
sed -i 's|WATCHTOWER_DOCKER_SOCKET_PATH=|WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # This can be changed depending on where the docker socket is located on your host|' sample.conf
sed -i 's|TALK_PORT=|TALK_PORT=3478 # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!|' sample.conf
sed -i 's|NC_DOMAIN=|NC_DOMAIN=yourdomain.com # TODO! Needs to be changed to the domain that you want to use for Nextcloud.|' sample.conf
sed -i 's|NEXTCLOUD_PASSWORD=|NEXTCLOUD_PASSWORD= # TODO! This is the password of the initially created Nextcloud admin with username "admin".|' sample.conf
nextcloud-aio-helm-chart/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
name: nextcloud-aio-helm-chart
description: A generated Helm Chart for Nextcloud AIO from Skippbox Kompose
version: 13.4.0
version: 13.4.1
apiVersion: v2
keywords:
- latest
nextcloud-aio-helm-chart/readme.md
+22
View File
@@ -36,6 +36,28 @@ helm install nextcloud-aio nextcloud-aio/nextcloud-aio-helm-chart -f values.yaml
And after a while, everything should be set up.
## HaRP / AppAPI (ExApps) configuration
When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
> [!IMPORTANT]
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists.
> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod.
> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
>
> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions.
The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP:
| Value | Default | Description |
| --- | --- | --- |
| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. |
| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
## How to update?
Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
1. Stop all running pods
nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
+1 -1
View File
@@ -65,7 +65,7 @@ spec:
value: "{{ .Values.TIMEZONE }}"
- name: WHITEBOARD_HOST
value: nextcloud-aio-whiteboard
image: ghcr.io/nextcloud-releases/aio-apache:20260727_092405
image: ghcr.io/nextcloud-releases/aio-apache:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
+2 -2
View File
@@ -36,7 +36,7 @@ spec:
{{- end }}
initContainers:
- name: init-subpath
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- mkdir
- "-p"
@@ -61,7 +61,7 @@ spec:
value: "{{ .Values.NEXTCLOUD_UPLOAD_LIMIT }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-clamav:20260727_092405
image: ghcr.io/nextcloud-releases/aio-clamav:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml
+1 -1
View File
@@ -37,7 +37,7 @@ spec:
value: --o:ssl.enable=false --o:ssl.termination=true --o:logging.disable_server_audit=true --o:welcome.enable=false --o:fetch_update_check=0 --o:allow_update_popup=false --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+
- name: server_name
value: "{{ .Values.NC_DOMAIN }}"
image: ghcr.io/nextcloud-releases/aio-collabora:20260727_092405
image: ghcr.io/nextcloud-releases/aio-collabora:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
+2 -2
View File
@@ -35,7 +35,7 @@ spec:
{{- end }}
initContainers:
- name: init-subpath
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- mkdir
- "-p"
@@ -66,7 +66,7 @@ spec:
value: nextcloud
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-postgresql:20260727_092405
image: ghcr.io/nextcloud-releases/aio-postgresql:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml
+2 -2
View File
@@ -24,7 +24,7 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- chmod
- "777"
@@ -46,7 +46,7 @@ spec:
value: "{{ .Values.AIO_LOG_LEVEL }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-eurooffice:20260727_092405
image: ghcr.io/nextcloud-releases/aio-eurooffice:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml
+2 -2
View File
@@ -24,7 +24,7 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- chmod
- "777"
@@ -64,7 +64,7 @@ spec:
value: "false"
- name: xpack.security.transport.ssl.enabled
value: "false"
image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260727_092405
image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
+1 -1
View File
@@ -40,7 +40,7 @@ spec:
value: "{{ .Values.IMAGINARY_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-imaginary:20260727_092405
image: ghcr.io/nextcloud-releases/aio-imaginary:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
+2 -2
View File
@@ -38,7 +38,7 @@ spec:
# AIO settings start # Do not remove or change this line!
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- chmod
- "777"
@@ -198,7 +198,7 @@ spec:
value: "{{ .Values.WHITEBOARD_ENABLED }}"
- name: WHITEBOARD_SECRET
value: "{{ .Values.WHITEBOARD_SECRET }}"
image: ghcr.io/nextcloud-releases/aio-nextcloud:20260727_092405
image: ghcr.io/nextcloud-releases/aio-nextcloud:20260805_083533
{{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment!
securityContext:
# The items below only work in container context
nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
+1 -1
View File
@@ -41,7 +41,7 @@ spec:
value: nextcloud-aio-nextcloud
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-notify-push:20260727_092405
image: ghcr.io/nextcloud-releases/aio-notify-push:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml
+2 -2
View File
@@ -24,7 +24,7 @@ spec:
spec:
initContainers:
- name: init-volumes
image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
command:
- chmod
- "777"
@@ -46,7 +46,7 @@ spec:
value: "{{ .Values.AIO_LOG_LEVEL }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260727_092405
image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
+1 -1
View File
@@ -41,7 +41,7 @@ spec:
value: "{{ .Values.REDIS_PASSWORD }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-redis:20260727_092405
image: ghcr.io/nextcloud-releases/aio-redis:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
+1 -1
View File
@@ -56,7 +56,7 @@ spec:
value: "{{ .Values.TURN_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-talk:20260727_092405
image: ghcr.io/nextcloud-releases/aio-talk:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
+1 -1
View File
@@ -46,7 +46,7 @@ spec:
value: "{{ .Values.RECORDING_SECRET }}"
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-talk-recording:20260727_092405
image: ghcr.io/nextcloud-releases/aio-talk-recording:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
+1 -1
View File
@@ -52,7 +52,7 @@ spec:
value: redis
- name: TZ
value: "{{ .Values.TIMEZONE }}"
image: ghcr.io/nextcloud-releases/aio-whiteboard:20260727_092405
image: ghcr.io/nextcloud-releases/aio-whiteboard:20260805_083533
readinessProbe:
exec:
command:
nextcloud-aio-helm-chart/update-helm.sh
+36
View File
@@ -44,6 +44,7 @@ sed -i "s|- \${TALK_PORT}|- $TALK_PORT|" latest.yml
sed -i "s|\${NEXTCLOUD_DATADIR}|$NEXTCLOUD_DATADIR|" latest.yml
sed -i "s|\${ADDITIONAL_COLLABORA_OPTIONS}|ADDITIONAL_COLLABORA_OPTIONS_PLACEHOLDER|" latest.yml
sed -i "/name: nextcloud-aio/,$ d" latest.yml
sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" latest.yml
sed -i "/NEXTCLOUD_DATADIR/d" latest.yml
sed -i "/\${NEXTCLOUD_MOUNT}/d" latest.yml
sed -i "/^volumes:/a\ \ nextcloud_aio_nextcloud_trusted_cacerts:\n \ \ \ \ name: nextcloud_aio_nextcloud_trusted_cacerts" latest.yml
@@ -343,6 +344,35 @@ EOL
# shellcheck disable=SC1083
find ./ -name '*talk-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-talk.config" \{} \;
# Additional config for HaRP
# The manual-install (docker) only configures HaRP with the docker backend. In the
# helm chart HaRP needs to talk to the Kubernetes API instead, so we enable the
# Kubernetes backend here and expose its settings via values.yaml.
cat << EOL > /tmp/additional-harp.config
- name: HP_K8S_ENABLED
value: "true"
- name: HP_K8S_NAMESPACE
value: "{{ .Values.HARP_K8S_NAMESPACE }}"
- name: HP_K8S_STORAGE_CLASS
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
- name: HP_K8S_DEFAULT_STORAGE_SIZE
value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
- name: HP_K8S_HOST_ALIASES
value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \;
# HaRP authenticates against the Kubernetes API with the service account that is
# mounted into its pod. Allow the service account name to be set via values.yaml
# so that the user can grant it the required RBAC permissions (see the readme).
cat << EOL > /tmp/additional-harp-sa.config
{{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
{{- end }}
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^ spec:$/r /tmp/additional-harp-sa.config" \{} \;
cat << EOL > templates/nextcloud-aio-networkpolicy.yaml
{{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }}
# https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md
@@ -403,6 +433,7 @@ sed -i 's|= |: |' /tmp/sample.conf
sed -i '/^NEXTCLOUD_DATADIR/d' /tmp/sample.conf
sed -i '/^APACHE_IP_BINDING/d' /tmp/sample.conf
sed -i '/^NEXTCLOUD_MOUNT/d' /tmp/sample.conf
sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" /tmp/sample.conf
sed -i 's/ yes / "yes" /' /tmp/sample.conf
sed -i 's/ no / "no" /' /tmp/sample.conf
sed -i 's/"no" authentication/no authentication/' /tmp/sample.conf
@@ -443,6 +474,11 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f
MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb
TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
ADDITIONAL_CONFIG
mv /tmp/sample.conf ../helm-chart/values.yaml
php/containers-schema.json
+1 -1
View File
@@ -216,7 +216,7 @@
"properties": {
"destination": {
"type": "string",
"pattern": "^((/[a-z_/.-]+)|(%[A-Z_]+%))$"
"pattern": "^((/[a-zA-Z_/.-]+)|(%[A-Z_]+%))$"
},
"source": {
"type": "string",
php/containers.json
+21 -2
View File
@@ -795,8 +795,16 @@
"source": "nextcloud_aio_eurooffice",
"destination": "/var/lib/euro-office",
"writeable": true
},
{
"source": "nextcloud_aio_eurooffice_data",
"destination": "/var/www/euro-office/Data",
"writeable": true
}
],
"backup_volumes": [
"nextcloud_aio_eurooffice_data"
],
"secrets": [
"EUROOFFICE_SECRET"
],
@@ -933,14 +941,22 @@
},
{
"container_name": "nextcloud-aio-harp",
"image_tag": "release",
"image_tag": "%AIO_CHANNEL%",
"display_name": "HaRP",
"image": "ghcr.io/nextcloud/nextcloud-appapi-harp",
"image": "ghcr.io/nextcloud-releases/aio-harp",
"init": true,
"internal_port": "8780",
"expose": [
"8780"
],
"healthcheck": {
"start_period": "0s",
"test": "/healthcheck.sh",
"interval": "10s",
"timeout": "10s",
"start_interval": "5s",
"retries": 9
},
"environment": [
"HP_SHARED_KEY=%HP_SHARED_KEY%",
"NC_INSTANCE_URL=https://%NC_DOMAIN%",
@@ -970,6 +986,9 @@
],
"cap_drop": [
"NET_RAW"
],
"profiles": [
"harp"
]
},
{
php/src/Docker/DockerActionManager.php
+5 -2
View File
@@ -480,8 +480,11 @@ readonly class DockerActionManager {
}
// Special things for the scrutiny container which should not be exposed in the containers.json
} elseif ($container->identifier === 'nextcloud-aio-scrutiny') {
// Allow it to access block devices
$requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw"];
// Allow it to access block devices (e.g. /dev/sda for SATA drives) and
// character devices (needed for NVMe drives: smartctl reads their SMART data
// via admin passthrough ioctls on the NVMe controller character device
// /dev/nvme0 and not via the block device /dev/nvme0n1)
$requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw", "c *:* rmw"];
// Special things for the makemkv container which should not be exposed in the containers.json
} elseif ($container->identifier === 'nextcloud-aio-makemkv') {
// Allow it to access block devices
php/tests/Containers/composer/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM docker.io/library/composer:2@sha256:5946476338742b200bb9ff88f8be56275ddae4b3949c72305cb0dbf10cfcb760
FROM docker.io/library/composer:2@sha256:4d71c3c2109c61d5415544264b59ad4087e4c5b7244481723664138fd36d5040
RUN pecl bundle -d /usr/src/php/ext apcu \
&& docker-php-ext-install apcu
php/tests/compose.yaml
+2 -2
View File
@@ -59,14 +59,14 @@ services:
- local-code
desec-mock:
image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
image: docker.io/library/node:26@sha256:c31fbcbf4a7e94a36accd38fdf69882fdf7685039dcd41412245d3d1065c5cbc
volumes:
- ..:/app/php
working_dir: /app
command: node php/tests/desec-mock.mjs 8090 2>&1
npm-installer:
image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
image: docker.io/library/node:26@sha256:c31fbcbf4a7e94a36accd38fdf69882fdf7685039dcd41412245d3d1065c5cbc
volumes:
- ..:/app
working_dir: /app/tests