From 9a00c904d4910f9239f2fac3936b5132ab42ae2d Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Wed, 24 Jun 2026 12:42:07 +0200
Subject: [PATCH 01/24] ship harp also for manual-install

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 manual-install/update-yaml.sh | 4 ----
 php/containers.json           | 3 +++
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/manual-install/update-yaml.sh b/manual-install/update-yaml.sh
index 9d966a9d..3b1a5a9d 100644
--- a/manual-install/update-yaml.sh
+++ b/manual-install/update-yaml.sh
@@ -27,8 +27,6 @@ OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "next
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-borgbackup"))')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-docker-socket-proxy"))')"
 OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-docker-socket-proxy"]) then del(.[index("nextcloud-aio-docker-socket-proxy")]) else . end else . end')"
-OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-harp"))')"
-OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-harp"]) then del(.[index("nextcloud-aio-harp")]) else . end else . end')"
 OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= map({ (.): { "condition": "service_started", "required": false } }) else . end' | jq '.services[] |= if has("depends_on") then .depends_on |= reduce .[] as $item ({}; . + $item) else . end')"
 
 sudo snap install yq
@@ -47,8 +45,6 @@ sed -i 's|- ip_binding: |- |' containers.yml
 sed -i '/AIO_TOKEN/d' containers.yml
 sed -i '/AIO_URL/d' containers.yml
 sed -i '/DOCKER_SOCKET_PROXY_ENABLED/d' containers.yml
-sed -i '/HARP_ENABLED/d' containers.yml
-sed -i '/HARP_HOST/d' containers.yml
 sed -i '/HP_SHARED_KEY/d' containers.yml
 sed -i '/ADDITIONAL_TRUSTED_PROXY/d' containers.yml
 sed -i '/TURN_DOMAIN/d' containers.yml
diff --git a/php/containers.json b/php/containers.json
index a63f5d16..d8900c45 100644
--- a/php/containers.json
+++ b/php/containers.json
@@ -970,6 +970,9 @@
       ],
       "cap_drop": [
         "NET_RAW"
+      ],
+      "profiles": [
+        "harp"
       ]
     },
     {

From c40cb1cffe891863c75a586940fd7aa981959862 Mon Sep 17 00:00:00 2001
From: szaimen <42591237+szaimen@users.noreply.github.com>
Date: Wed, 24 Jun 2026 10:45:12 +0000
Subject: [PATCH 02/24] Yaml updates

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 manual-install/latest.yml  | 29 +++++++++++++++++++++++++++++
 manual-install/sample.conf |  2 ++
 2 files changed, 31 insertions(+)

diff --git a/manual-install/latest.yml b/manual-install/latest.yml
index 0d1411d7..327f2680 100644
--- a/manual-install/latest.yml
+++ b/manual-install/latest.yml
@@ -19,6 +19,9 @@ services:
       nextcloud-aio-whiteboard:
         condition: service_started
         required: false
+      nextcloud-aio-harp:
+        condition: service_started
+        required: false
       nextcloud-aio-nextcloud:
         condition: service_started
         required: false
@@ -50,6 +53,7 @@ services:
       - APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME}
       - NOTIFY_PUSH_HOST=nextcloud-aio-notify-push
       - WHITEBOARD_HOST=nextcloud-aio-whiteboard
+      - HARP_HOST=nextcloud-aio-harp
     volumes:
       - nextcloud_aio_nextcloud:/var/www/html:ro
       - nextcloud_aio_apache:/mnt/data:rw
@@ -193,6 +197,7 @@ services:
       - IMAGINARY_SECRET
       - WHITEBOARD_SECRET
       - WHITEBOARD_ENABLED
+      - HARP_ENABLED
     stop_grace_period: 600s
     restart: unless-stopped
     shm_size: 134217728
@@ -504,6 +509,28 @@ services:
     cap_drop:
       - NET_RAW
 
+  nextcloud-aio-harp:
+    image: ghcr.io/nextcloud/nextcloud-appapi-harp:latest
+    init: true
+    expose:
+      - "8780"
+    environment:
+      - NC_INSTANCE_URL=https://${NC_DOMAIN}
+      - HP_FRP_DISABLE_TLS=true
+      - TZ=${TIMEZONE}
+    volumes:
+      - ${WATCHTOWER_DOCKER_SOCKET_PATH}:/var/run/docker.sock:ro
+      - nextcloud_aio_harp:/certs:rw
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /run/harp
+    cap_drop:
+      - NET_RAW
+    profiles:
+      - harp
+
   nextcloud-aio-whiteboard:
     image: ghcr.io/nextcloud-releases/aio-whiteboard:latest
     user: "65534"
@@ -549,6 +576,8 @@ volumes:
     name: nextcloud_aio_elasticsearch
   nextcloud_aio_eurooffice:
     name: nextcloud_aio_eurooffice
+  nextcloud_aio_harp:
+    name: nextcloud_aio_harp
   nextcloud_aio_nextcloud:
     name: nextcloud_aio_nextcloud
   nextcloud_aio_onlyoffice:
diff --git a/manual-install/sample.conf b/manual-install/sample.conf
index d4da3604..584d72ca 100644
--- a/manual-install/sample.conf
+++ b/manual-install/sample.conf
@@ -11,12 +11,14 @@ SIGNALING_SECRET=          # TODO! This needs to be a unique and good password!
 TALK_INTERNAL_SECRET=          # TODO! This needs to be a unique and good password!
 TIMEZONE=Europe/Berlin          # TODO! This is the timezone that your containers will use.
 TURN_SECRET=          # TODO! This needs to be a unique and good password!
+WATCHTOWER_DOCKER_SOCKET_PATH=          # TODO! This needs to be a unique and good password!
 WHITEBOARD_SECRET=          # TODO! This needs to be a unique and good password!
 
 CLAMAV_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 COLLABORA_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 EUROOFFICE_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 FULLTEXTSEARCH_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
+HARP_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 IMAGINARY_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 ONLYOFFICE_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 TALK_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.

From 45297ac60ea43df4a10a580911b0a324968c935a Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Wed, 24 Jun 2026 13:05:44 +0200
Subject: [PATCH 03/24] Make harp Kubernetes backend configurable in helm chart

When harp syncs over from the manual-install to the helm chart it needs
the Kubernetes backend (HP_K8S_*) instead of the docker backend. The
update-helm script now injects these env vars into the harp deployment,
templated to values.yaml, and the chart readme documents them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 nextcloud-aio-helm-chart/readme.md      | 17 ++++++++++++++++
 nextcloud-aio-helm-chart/update-helm.sh | 26 +++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/nextcloud-aio-helm-chart/readme.md b/nextcloud-aio-helm-chart/readme.md
index cb31e601..0fdc4f01 100755
--- a/nextcloud-aio-helm-chart/readme.md
+++ b/nextcloud-aio-helm-chart/readme.md
@@ -36,6 +36,23 @@ helm install nextcloud-aio nextcloud-aio/nextcloud-aio-helm-chart -f values.yaml
 
 And after a while, everything should be set up.
 
+## HaRP / AppAPI (ExApps) configuration
+
+When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
+
+> [!IMPORTANT]
+> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup.
+
+The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP:
+
+| Value | Default | Description |
+| --- | --- | --- |
+| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
+| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
+| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
+| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. |
+| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. |
+
 ## How to update?
 Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
 1. Stop all running pods
diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh
index 8c99fc21..ecb86564 100755
--- a/nextcloud-aio-helm-chart/update-helm.sh
+++ b/nextcloud-aio-helm-chart/update-helm.sh
@@ -343,6 +343,27 @@ EOL
 # shellcheck disable=SC1083
 find ./ -name '*talk-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-talk.config"  \{} \;
 
+# Additional config for HaRP
+# The manual-install (docker) only configures HaRP with the docker backend. In the
+# helm chart HaRP needs to talk to the Kubernetes API instead, so we enable the
+# Kubernetes backend here and expose its settings via values.yaml.
+cat << EOL > /tmp/additional-harp.config
+            - name: HP_K8S_ENABLED
+              value: "true"
+            - name: HP_K8S_NAMESPACE
+              value: "{{ .Values.HARP_K8S_NAMESPACE }}"
+            - name: HP_K8S_STORAGE_CLASS
+              value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
+            - name: HP_K8S_DEFAULT_STORAGE_SIZE
+              value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
+            - name: HP_K8S_BEARER_TOKEN_FILE
+              value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}"
+            - name: HP_K8S_HOST_ALIASES
+              value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
+EOL
+# shellcheck disable=SC1083
+find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config"  \{} \;
+
 cat << EOL > templates/nextcloud-aio-networkpolicy.yaml
 {{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }}
 # https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md
@@ -443,6 +464,11 @@ MAIL_FROM_ADDRESS:         # (not set by default): Set the local-part for the 'f
 MAIL_DOMAIN:         # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
 TALK_MAX_STREAM_BITRATE: "1048576"         # This allows to adjust the max stream bitrate of the talk hpb
 TALK_MAX_SCREEN_BITRATE: "2097152"         # This allows to adjust the max stream bitrate of the talk hpb
+HARP_K8S_NAMESPACE: nextcloud-exapps        # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
+HARP_K8S_STORAGE_CLASS:        # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
+HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi        # The default size of the persistent volume claims that HaRP creates for ExApps.
+HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token        # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically.
+HARP_K8S_HOST_ALIASES:        # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases.
 ADDITIONAL_CONFIG
 
 mv /tmp/sample.conf ../helm-chart/values.yaml

From cea187d6cb2cf24d340160271990cf9ceee38cd3 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Wed, 24 Jun 2026 13:17:08 +0200
Subject: [PATCH 04/24] harp helm: drop redundant token file, add service
 account, fix host aliases docs

- Remove HARP_K8S_BEARER_TOKEN_FILE: HaRP already defaults it to the
  in-cluster service account token path, so templating it added nothing.
- Add HARP_SERVICE_ACCOUNT_NAME so the harp pod can run under a service
  account the user grants the required RBAC to, and document the setup.
- Correct the HARP_K8S_HOST_ALIASES docs: it is a comma-separated list of
  hostname:ip pairs, not JSON.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 nextcloud-aio-helm-chart/readme.md      | 11 ++++++++---
 nextcloud-aio-helm-chart/update-helm.sh | 16 ++++++++++++----
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/nextcloud-aio-helm-chart/readme.md b/nextcloud-aio-helm-chart/readme.md
index 0fdc4f01..583a5ec1 100755
--- a/nextcloud-aio-helm-chart/readme.md
+++ b/nextcloud-aio-helm-chart/readme.md
@@ -41,7 +41,12 @@ And after a while, everything should be set up.
 When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
 
 > [!IMPORTANT]
-> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup.
+> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
+> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists.
+> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod.
+> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
+>
+> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions.
 
 The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP:
 
@@ -50,8 +55,8 @@ The following values in `values.yaml` allow you to adjust the Kubernetes backend
 | `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
 | `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
 | `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
-| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. |
-| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. |
+| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. |
+| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
 
 ## How to update?
 Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh
index ecb86564..06f7ba89 100755
--- a/nextcloud-aio-helm-chart/update-helm.sh
+++ b/nextcloud-aio-helm-chart/update-helm.sh
@@ -356,13 +356,21 @@ cat << EOL > /tmp/additional-harp.config
               value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
             - name: HP_K8S_DEFAULT_STORAGE_SIZE
               value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
-            - name: HP_K8S_BEARER_TOKEN_FILE
-              value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}"
             - name: HP_K8S_HOST_ALIASES
               value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
 EOL
 # shellcheck disable=SC1083
 find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config"  \{} \;
+# HaRP authenticates against the Kubernetes API with the service account that is
+# mounted into its pod. Allow the service account name to be set via values.yaml
+# so that the user can grant it the required RBAC permissions (see the readme).
+cat << EOL > /tmp/additional-harp-sa.config
+      {{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
+      serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
+      {{- end }}
+EOL
+# shellcheck disable=SC1083
+find ./ -name '*harp-deployment.yaml' -exec sed -i "/^    spec:$/r /tmp/additional-harp-sa.config" \{} \;
 
 cat << EOL > templates/nextcloud-aio-networkpolicy.yaml
 {{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }}
@@ -467,8 +475,8 @@ TALK_MAX_SCREEN_BITRATE: "2097152"         # This allows to adjust the max strea
 HARP_K8S_NAMESPACE: nextcloud-exapps        # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
 HARP_K8S_STORAGE_CLASS:        # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
 HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi        # The default size of the persistent volume claims that HaRP creates for ExApps.
-HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token        # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically.
-HARP_K8S_HOST_ALIASES:        # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases.
+HARP_K8S_HOST_ALIASES:        # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
+HARP_SERVICE_ACCOUNT_NAME:        # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
 ADDITIONAL_CONFIG
 
 mv /tmp/sample.conf ../helm-chart/values.yaml

From 1eaf87b731e692263aa2e5ad10a8565cfbe2f2ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:45:11 +0000
Subject: [PATCH 05/24] build(deps): bump astral-sh/setup-uv in
 /.github/workflows

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/lint-yaml.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lint-yaml.yml b/.github/workflows/lint-yaml.yml
index ca394892..7bca2464 100644
--- a/.github/workflows/lint-yaml.yml
+++ b/.github/workflows/lint-yaml.yml
@@ -36,7 +36,7 @@ jobs:
             line-length: warning
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Check GitHub actions
         run: uvx zizmor --min-severity medium .github/workflows/*.yml

From 61c8ee3fe2c56d9a58260009da5de2e97e032ec7 Mon Sep 17 00:00:00 2001
From: Cooper Larson <cooper.a.larson@gmail.com>
Date: Wed, 29 Jul 2026 14:02:11 -0600
Subject: [PATCH 06/24] Update joplin-server.json

Added the restart unless stopped condition for the server and database containers.

Signed-off-by: Cooper Larson <cooper.a.larson@gmail.com>
---
 community-containers/joplin-server/joplin-server.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/community-containers/joplin-server/joplin-server.json b/community-containers/joplin-server/joplin-server.json
index d33f306c..5e57ba0a 100644
--- a/community-containers/joplin-server/joplin-server.json
+++ b/community-containers/joplin-server/joplin-server.json
@@ -6,6 +6,7 @@
             "display_name": "Joplin Server",
             "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/joplin-server",
             "image": "joplin/server",
+            "restart": "unless-stopped",
             "depends_on": [
                 "nextcloud-aio-joplin-database"
             ],
@@ -35,6 +36,7 @@
             "image_tag": "18",
             "display_name": "Joplin Database (PostgreSQL)",
             "image": "postgres",
+            "restart": "unless-stopped",
             "internal_port": "5432",
             "environment": [
                 "POSTGRES_PASSWORD=%JOPLIN_DB_PASSWORD%",
@@ -57,4 +59,4 @@
             ]
         }
     ]
-}
\ No newline at end of file
+}

From c975a254864d9609cb5f4798b6c20ab97457de99 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 04:07:16 +0000
Subject: [PATCH 07/24] build(deps): bump haproxy in
 /Containers/docker-socket-proxy

Bumps haproxy from 3.4.2-alpine to 3.4.3-alpine.

---
updated-dependencies:
- dependency-name: haproxy
  dependency-version: 3.4.3-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/docker-socket-proxy/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/docker-socket-proxy/Dockerfile b/Containers/docker-socket-proxy/Dockerfile
index 702e4032..11a6a78a 100644
--- a/Containers/docker-socket-proxy/Dockerfile
+++ b/Containers/docker-socket-proxy/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM haproxy:3.4.2-alpine
+FROM haproxy:3.4.3-alpine
 
 # hadolint ignore=DL3002
 USER root

From 5b74d4b3fd36e88e2286f8e623080b828e5ba0a3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 04:07:14 +0000
Subject: [PATCH 08/24] build(deps): bump collabora/code in
 /Containers/collabora

Bumps collabora/code from 26.04.2.1.1 to 26.04.2.4.1.

---
updated-dependencies:
- dependency-name: collabora/code
  dependency-version: 26.04.2.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/collabora/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/collabora/Dockerfile b/Containers/collabora/Dockerfile
index 5409360b..6f94afd6 100644
--- a/Containers/collabora/Dockerfile
+++ b/Containers/collabora/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # From a file located probably somewhere here: https://github.com/CollaboraOnline/online/blob/master/docker/from-packages/Dockerfile
-FROM collabora/code:26.04.2.1.1
+FROM collabora/code:26.04.2.4.1
 
 USER root
 ARG DEBIAN_FRONTEND=noninteractive

From 452567ed4357e9090ceb230e6dff02377a61d30e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 08:44:38 +0000
Subject: [PATCH 09/24] fix(Apache): disable mod_reqtimeout body rate limit to
 allow slow uploads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #8457 — large file uploads on slow connections were being
terminated by Apache's mod_reqtimeout MinRate=500 default for
request bodies. This adds an explicit RequestReadTimeout directive
that disables the body rate limit (body=0) while keeping the header
timeout for slowloris protection. The existing Timeout directive
(set to APACHE_MAX_TIME / NEXTCLOUD_MAX_TIME) remains as the
effective I/O timeout.

Also ensures mod_reqtimeout is explicitly loaded in the Dockerfile.

Assisted-by: GitHub Copilot:claude-sonnet-4
---
 Containers/apache/Dockerfile     | 1 +
 Containers/apache/nextcloud.conf | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/Containers/apache/Dockerfile b/Containers/apache/Dockerfile
index 755a161c..e0e32bef 100644
--- a/Containers/apache/Dockerfile
+++ b/Containers/apache/Dockerfile
@@ -48,6 +48,7 @@ RUN set -ex; \
             -e 's/^#\(LoadModule .*mod_alias.so\)/\1/' \
             -e 's/^#\(LoadModule .*mod_mpm_event.so\)/\1/' \
             -e 's/^#\(LoadModule .*mod_brotli.so\)/\1/' \
+            -e 's/^#\(LoadModule .*mod_reqtimeout.so\)/\1/' \
             -e 's/\(LoadModule .*mod_mpm_worker.so\)/#\1/' \
             -e 's/\(LoadModule .*mod_mpm_prefork.so\)/#\1/' \
             -e 's/\(ScriptAlias \)/#\1/' \
diff --git a/Containers/apache/nextcloud.conf b/Containers/apache/nextcloud.conf
index 968f8901..aa63d75b 100644
--- a/Containers/apache/nextcloud.conf
+++ b/Containers/apache/nextcloud.conf
@@ -49,6 +49,13 @@ Listen 8000
     # See https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxytimeout
     ProxyTimeout ${APACHE_MAX_TIME}
 
+    # See https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html
+    # Disable body rate limit so that large uploads on slow connections are not aborted.
+    # The Timeout directive above still applies as the overall I/O timeout.
+    <IfModule reqtimeout_module>
+        RequestReadTimeout header=20-40,MinRate=500 body=0
+    </IfModule>
+
     # See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable
     TraceEnable Off
 </VirtualHost>

From accd25fd6b496d01c9cf868bcd06c11b219bf55f Mon Sep 17 00:00:00 2001
From: deschoene <74868758+deschoene@users.noreply.github.com>
Date: Fri, 31 Jul 2026 10:54:19 +0200
Subject: [PATCH 10/24] Persist EuroOffice DATA_DIR as a volume

The euro-office image intends /var/www/euro-office/Data to be persistent
(its entrypoint stores the generated JWT secret and WOPI keys there and
prints 'Mount ${DATA_DIR} as a volume to persist it across restarts');
the generate-allfonts script also scans Data/custom-fonts for user-provided
fonts on every container start.

Without a volume, custom fonts and the generated secrets are lost whenever
the container is recreated on update. Mount a dedicated volume and include
it in backup_volumes (it is small: keys + fonts), unlike the reinstallable
documentserver volume.

The schema's path pattern is extended to allow capital letters because the
Data directory inside the image is capitalized.

Resolves the persistence gap discussed in #8493.

Signed-off-by: deschoene <74868758+deschoene@users.noreply.github.com>
---
 php/containers-schema.json | 2 +-
 php/containers.json        | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/php/containers-schema.json b/php/containers-schema.json
index fc0e03dc..e7b53708 100644
--- a/php/containers-schema.json
+++ b/php/containers-schema.json
@@ -216,7 +216,7 @@
 							"properties": {
 								"destination": {
 									"type": "string",
-									"pattern": "^((/[a-z_/.-]+)|(%[A-Z_]+%))$"
+									"pattern": "^((/[a-zA-Z_/.-]+)|(%[A-Z_]+%))$"
 								},
 								"source": {
 									"type": "string",
diff --git a/php/containers.json b/php/containers.json
index a63f5d16..99ab602d 100644
--- a/php/containers.json
+++ b/php/containers.json
@@ -795,8 +795,16 @@
           "source": "nextcloud_aio_eurooffice",
           "destination": "/var/lib/euro-office",
           "writeable": true
+        },
+        {
+          "source": "nextcloud_aio_eurooffice_data",
+          "destination": "/var/www/euro-office/Data",
+          "writeable": true
         }
       ],
+      "backup_volumes": [
+        "nextcloud_aio_eurooffice_data"
+      ],
       "secrets": [
         "EUROOFFICE_SECRET"
       ],

From 4f36f8a0af67829433cfc81ac97120d9a1a5c08d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:31:03 +0000
Subject: [PATCH 11/24] feat(borgbackup): add --noxattrs option to borg extract
 command

Extended attributes are not needed for the restore process and can cause
issues on filesystems that do not support them. Adding --noxattrs skips
restoring extended attributes during extraction.

Assisted-by: GitHub Copilot:claude-sonnet-4
---
 Containers/borgbackup/backupscript.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/borgbackup/backupscript.sh b/Containers/borgbackup/backupscript.sh
index 20d8596a..9fcb8a5b 100644
--- a/Containers/borgbackup/backupscript.sh
+++ b/Containers/borgbackup/backupscript.sh
@@ -436,7 +436,7 @@ if [ "$BORG_MODE" = restore ]; then
         #
         # Older backups may still contain files we've since excluded, so we have to exclude on extract as well.
         cd /  # borg extract has no destination arg and extracts to CWD
-        if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
+        if ! borg "$BORG_LOG_LEVEL_FLAG" extract "::$SELECTED_ARCHIVE" --progress --noxattrs --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
         then
             RESTORE_FAILED=1
             echo "Failed to extract backup archive."

From b03f28cb8eca707c417f0ca9c337055a9e17a51e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:37:54 +0000
Subject: [PATCH 12/24] fix(Mastercontainer): exit daily-backup.sh early if
 restore is running

If the backup container is currently running in restore mode, the daily
backup script now exits immediately instead of waiting indefinitely for
the container to stop. This prevents the daily backup cron from
interrupting long-running restores.

Fixes: #8414

Assisted-by: GitHub Copilot:claude-sonnet-4
---
 Containers/mastercontainer/daily-backup.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Containers/mastercontainer/daily-backup.sh b/Containers/mastercontainer/daily-backup.sh
index 99293b60..737a38c6 100644
--- a/Containers/mastercontainer/daily-backup.sh
+++ b/Containers/mastercontainer/daily-backup.sh
@@ -13,6 +13,15 @@ if ! [ -f "$CONFIG_FILE" ] || (! grep -q "wasStartButtonClicked.*1" "$CONFIG_FIL
     exit 0
 fi
 
+# Exit early if the backup container is currently running a restore
+if docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
+    if grep -q '"backup-mode".*"restore"' "$CONFIG_FILE"; then
+        echo "Backup container is running in restore mode. Exiting to not interrupt the restore..."
+        rm -f "/mnt/docker-aio-config/data/daily_backup_running"
+        exit 0
+    fi
+fi
+
 # Daily backup and backup check cannot be run at the same time
 if [ "$DAILY_BACKUP" = 1 ] && [ "$CHECK_BACKUP" = 1 ]; then
     echo "Daily backup and backup check cannot be run at the same time. Exiting..."

From c70e4b2ae4427c73a63e2bd7e1e3ac55f89a9522 Mon Sep 17 00:00:00 2001
From: Zoey <zoey@z0ey.de>
Date: Sun, 2 Aug 2026 17:32:32 +0200
Subject: [PATCH 13/24] replace sudo with su-exec

Signed-off-by: Zoey <zoey@z0ey.de>
---
 Containers/mastercontainer/Dockerfile        |  8 +++----
 Containers/mastercontainer/cron.sh           | 20 ++++++++--------
 Containers/mastercontainer/daily-backup.sh   | 18 +++++++--------
 Containers/mastercontainer/start.sh          | 24 ++++++++++----------
 Containers/nextcloud/Dockerfile              |  2 +-
 Containers/nextcloud/notify-all.sh           |  2 +-
 Containers/nextcloud/notify.sh               |  2 +-
 Containers/nextcloud/root.motd               |  2 +-
 Containers/nextcloud/start.sh                | 10 ++++----
 Containers/nextcloud/upgrade-latest-major.sh |  2 +-
 10 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile
index 02e29adb..49f287ed 100644
--- a/Containers/mastercontainer/Dockerfile
+++ b/Containers/mastercontainer/Dockerfile
@@ -31,7 +31,7 @@ COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf
 
 WORKDIR /var/www/docker-aio
 
-# hadolint ignore=SC2086,DL3047,DL3003,DL3004
+# hadolint ignore=SC2086,DL3047,DL3003
 RUN set -ex; \
     apk upgrade --no-cache -a; \
     apk add --no-cache shadow; \
@@ -43,7 +43,7 @@ RUN set -ex; \
         ca-certificates \
         bash \
         supervisor \
-        sudo \
+        su-exec \
         netcat-openbsd \
         curl \
         grep; \
@@ -87,8 +87,8 @@ RUN set -ex; \
     rm -r ./php/tests; \
     chown www-data:www-data -R /var/www/docker-aio; \
     cd php; \
-    sudo -E -u www-data composer install --no-dev; \
-    sudo -E -u www-data composer clear-cache; \
+    su-exec www-data composer install --no-dev; \
+    su-exec www-data composer clear-cache; \
     cd ..; \
     rm -f /usr/local/bin/composer; \
     chmod -R 770 /var/www/docker-aio; \
diff --git a/Containers/mastercontainer/cron.sh b/Containers/mastercontainer/cron.sh
index 98ab9c54..912f17f2 100644
--- a/Containers/mastercontainer/cron.sh
+++ b/Containers/mastercontainer/cron.sh
@@ -51,33 +51,33 @@ while true; do
 
     # Check for updates and send notification if yes on saturdays
     if [ "$(date +%u)" = 6 ]; then
-        sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
+        su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php
     fi
 
     # Check if AIO is outdated
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php
 
     # Update deSEC DNS IP record (no-op when IP is unchanged or deSEC is not configured)
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateDesecIp.php
 
     # Remove sessions older than 24h
     find "/mnt/docker-aio-config/session/" -mindepth 1 -mmin +1440 -delete
 
     # Remove nextcloud-aio-domaincheck container
-    if sudo -E -u www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
-        sudo -E -u www-data docker container remove nextcloud-aio-domaincheck
+    if su-exec www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then
+        su-exec www-data docker container remove nextcloud-aio-domaincheck
     fi
 
     # Remove dangling images (support both deprecated label-schema and OCI standard vendor label)
-    sudo -E -u www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
-    sudo -E -u www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
+    su-exec www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force
+    su-exec www-data docker image prune --filter "label=org.opencontainers.image.vendor=Nextcloud" --force
 
     # Check for available free space
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php
 
     # Remove mastercontainer from default bridge network
-    if sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer  --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
-        sudo -E -u www-data docker network disconnect bridge nextcloud-aio-mastercontainer
+    if su-exec www-data docker inspect nextcloud-aio-mastercontainer  --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then
+        su-exec www-data docker network disconnect bridge nextcloud-aio-mastercontainer
     fi
 
     # Wait 60s so that the whole loop will not be executed again
diff --git a/Containers/mastercontainer/daily-backup.sh b/Containers/mastercontainer/daily-backup.sh
index 99293b60..9127efd6 100644
--- a/Containers/mastercontainer/daily-backup.sh
+++ b/Containers/mastercontainer/daily-backup.sh
@@ -24,7 +24,7 @@ fi
 if [ "$LOCK_FILE_PRESENT" = 0 ] || ! [ -f "/mnt/docker-aio-config/data/daily_backup_running" ]; then
     find "/mnt/docker-aio-config/session/" -mindepth 1 -delete
 fi
-sudo -E -u www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
+su-exec www-data touch "/mnt/docker-aio-config/data/daily_backup_running"
 
 # Check if apache is running/stopped, watchtower is stopped and backupcontainer is stopped
 LOCAL_APACHE_PORT="$(docker inspect nextcloud-aio-apache --format "{{.Config.Env}}" | grep -o 'APACHE_PORT=[0-9]\+' | grep -o '[0-9]\+' | head -1)"
@@ -54,7 +54,7 @@ done
 if [ "$AUTOMATIC_UPDATES" = 1 ]; then
     echo "Starting mastercontainer update..." 
     echo "(The script might get exited due to that. In order to update all the other containers correctly, you need to run this script with the same settings a second time.)"
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php
 fi
 
 # Wait for watchtower to stop
@@ -71,20 +71,20 @@ fi
 # Update container images to reduce downtime later on
 if [ "$AUTOMATIC_UPDATES" = 1 ]; then
     echo "Updating container images..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php
 fi
 
 # Stop containers if required
 # shellcheck disable=SC2235
 if [ "$CHECK_BACKUP" != 1 ] && ([ "$DAILY_BACKUP" != 1 ] || [ "$STOP_CONTAINERS" = 1 ]); then
     echo "Stopping containers..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php
 fi
 
 # Execute the backup itself and some related tasks (also stops the containers)
 if [ "$DAILY_BACKUP" = 1 ]; then
     echo "Creating daily backup..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php
     if ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then
         echo "Something seems to be wrong: the borg container should be started at this step."
     fi
@@ -97,17 +97,17 @@ fi
 # Execute backup check
 if [ "$CHECK_BACKUP" = 1 ]; then
     echo "Starting backup check..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php
 fi
 
 # Start and/or update containers
 if [ "$AUTOMATIC_UPDATES" = 1 ]; then
     echo "Starting and updating containers..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php
 else
     if [ "$START_CONTAINERS" = 1 ]; then
         echo "Starting containers without updating them..."
-        sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
+        su-exec www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php
     fi
 fi
 
@@ -131,7 +131,7 @@ if [ "$DAILY_BACKUP" = 1 ] && ([ "$AUTOMATIC_UPDATES" = 1 ] || [ "$START_CONTAIN
         done
     fi
     echo "Sending backup notification..."
-    sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
+    su-exec www-data php /var/www/docker-aio/php/src/Cron/BackupNotification.php
 fi
 
 echo "Daily backup script has finished"
diff --git a/Containers/mastercontainer/start.sh b/Containers/mastercontainer/start.sh
index 72260a4e..c7f130e4 100755
--- a/Containers/mastercontainer/start.sh
+++ b/Containers/mastercontainer/start.sh
@@ -55,7 +55,7 @@ elif mountpoint -q /var/www/docker-aio/php/containers.json; then
     echo "If you need to customize things, feel free to use https://github.com/nextcloud/all-in-one/tree/main/manual-install"
     echo "See https://github.com/nextcloud/all-in-one/blob/main/manual-install/latest.yml"
     exit 1
-elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
+elif ! su-exec www-data test -r /var/run/docker.sock; then
     echo "Trying to fix docker.sock permissions internally..."
     DOCKER_GROUP=$(stat -c '%G' /var/run/docker.sock)
     DOCKER_GROUP_ID=$(stat -c '%g' /var/run/docker.sock)
@@ -73,7 +73,7 @@ elif ! sudo -E -u www-data test -r /var/run/docker.sock; then
         groupadd -g "$DOCKER_GROUP_ID" docker
         usermod -aG docker www-data
     fi
-    if ! sudo -E -u www-data test -r /var/run/docker.sock; then
+    if ! su-exec www-data test -r /var/run/docker.sock; then
         print_red "Docker socket is not readable by the www-data user. Cannot continue."
         exit 1
     fi
@@ -108,8 +108,8 @@ fi
 FALLBACK_DOCKER_API_VERSION="1.41"
 
 # Check if docker info can be used
-if ! sudo -E -u www-data docker info &>/dev/null; then
-    if ! sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
+if ! su-exec www-data docker info &>/dev/null; then
+    if ! su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker info &>/dev/null; then
         print_red "Cannot connect to the docker socket. Cannot proceed."
         echo "Did you maybe remove group read permissions for the docker socket? AIO needs them in order to access the docker socket."
         echo "If SELinux is enabled on your host, see https://github.com/nextcloud/all-in-one#are-there-known-problems-when-selinux-is-enabled"
@@ -125,9 +125,9 @@ fi
 # Docker api version check
 # shellcheck disable=SC2001
 API_VERSION_NUMB="$(echo "$DOCKER_API_VERSION" | sed 's/\.//')"
-LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
+LOCAL_API_VERSION_NUMB="$(su-exec www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
 if [ -z "$LOCAL_API_VERSION_NUMB" ]; then
-    LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
+    LOCAL_API_VERSION_NUMB="$(su-exec www-data env DOCKER_API_VERSION="$FALLBACK_DOCKER_API_VERSION" docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')"
 fi
 if [ -n "$LOCAL_API_VERSION_NUMB" ] && [ -n "$API_VERSION_NUMB" ]; then
     if ! [ "$LOCAL_API_VERSION_NUMB" -ge "$API_VERSION_NUMB" ]; then
@@ -143,7 +143,7 @@ else
 fi
 
 # Check Storage drivers
-STORAGE_DRIVER="$(sudo -E -u www-data docker info | grep "Storage Driver")"
+STORAGE_DRIVER="$(su-exec www-data docker info | grep "Storage Driver")"
 # Check if vfs is used: https://github.com/nextcloud/all-in-one/discussions/1467
 if echo "$STORAGE_DRIVER" | grep -q vfs; then
     echo "$STORAGE_DRIVER"
@@ -154,26 +154,26 @@ elif echo "$STORAGE_DRIVER" | grep -q fuse-overlayfs; then
 fi
 
 # Check if snap install
-if sudo -E -u www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
+if su-exec www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then
     print_red "Warning: It looks like your installation uses docker installed via snap."
     print_red "This comes with some limitations and is disrecommended by the docker maintainers."
     print_red "See for example https://github.com/nextcloud/all-in-one/discussions/4890#discussioncomment-10386752"
 fi
 
 # Check if startup command was executed correctly
-if ! sudo -E -u www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
+if ! su-exec www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then
     print_red "It seems like you did not give the mastercontainer the correct name? (The 'nextcloud-aio-mastercontainer' container was not found.)
 Using a different name is not supported since mastercontainer updates will not work in that case!
 If you are on docker swarm and try to run AIO, see https://github.com/nextcloud/all-in-one#can-i-run-this-with-docker-swarm"
     exit 1
-elif sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
+elif su-exec www-data docker inspect nextcloud-aio-mastercontainer --format "{{.Config.Image}}" | grep -q '@'; then
     print_red "It seems like you used a hash for the mastercontainer image tag. This is not supported!"
     exit 1
-elif ! sudo -E -u www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
+elif ! su-exec www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then
     print_red "It seems like you did not give the mastercontainer volume the correct name? (The 'nextcloud_aio_mastercontainer' volume was not found.)
 Using a different name is not supported since the built-in backup solution will not work in that case!"
     exit 1
-elif ! sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
+elif ! su-exec www-data docker inspect nextcloud-aio-mastercontainer --format '{{.Mounts}}' | grep -q " nextcloud_aio_mastercontainer "; then
     print_red "It seems like you did not attach the 'nextcloud_aio_mastercontainer' volume to the mastercontainer?
 This is not supported since the built-in backup solution will not work in that case!"
     exit 1
diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile
index 7cb640d7..25a2788d 100644
--- a/Containers/nextcloud/Dockerfile
+++ b/Containers/nextcloud/Dockerfile
@@ -234,7 +234,7 @@ RUN set -ex; \
         git \
         postgresql-client \
         tzdata \
-        sudo \
+        su-exec \
         grep \
         nodejs \
         bind-tools \
diff --git a/Containers/nextcloud/notify-all.sh b/Containers/nextcloud/notify-all.sh
index 137abd2e..5f32bb47 100644
--- a/Containers/nextcloud/notify-all.sh
+++ b/Containers/nextcloud/notify-all.sh
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
 fi
 
 if [[ "$EUID" = 0 ]]; then
-    COMMAND=(sudo -E -u www-data php /var/www/html/occ)
+    COMMAND=(su-exec www-data php /var/www/html/occ)
 else
     COMMAND=(php /var/www/html/occ)
 fi
diff --git a/Containers/nextcloud/notify.sh b/Containers/nextcloud/notify.sh
index 5851c1ba..d540865e 100644
--- a/Containers/nextcloud/notify.sh
+++ b/Containers/nextcloud/notify.sh
@@ -5,7 +5,7 @@ if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
 fi
 
 if [[ "$EUID" = 0 ]]; then
-    COMMAND=(sudo -E -u www-data php /var/www/html/occ)
+    COMMAND=(su-exec www-data php /var/www/html/occ)
 else
     COMMAND=(php /var/www/html/occ)
 fi
diff --git a/Containers/nextcloud/root.motd b/Containers/nextcloud/root.motd
index 00cb4805..44ea0497 100644
--- a/Containers/nextcloud/root.motd
+++ b/Containers/nextcloud/root.motd
@@ -1,4 +1,4 @@
 Warning: You have logged in into the Nextcloud container as root user.
 See https://github.com/nextcloud/all-in-one#how-to-run-occ-commands if you want to run occ commands.
-Apart from that, you can use 'sudo -E -u www-data php occ <your-command>' in order to run occ commands.
+Apart from that, you can use 'su-exec www-data php occ <your-command>' in order to run occ commands.
 Of course <your-command> needs to be substituted with the command that you want to use.
diff --git a/Containers/nextcloud/start.sh b/Containers/nextcloud/start.sh
index d9b253c7..385605fe 100644
--- a/Containers/nextcloud/start.sh
+++ b/Containers/nextcloud/start.sh
@@ -12,7 +12,7 @@ fi
 # Only start container if database is accessible
 # POSTGRES_HOST must be set in the containers env vars and POSTGRES_PORT has a default above
 # shellcheck disable=SC2153
-while ! sudo -E -u www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
+while ! su-exec www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do
     echo "Waiting for database to start..."
     sleep 5
 done
@@ -29,7 +29,7 @@ fi
 # Fix false database connection on old instances
 if [ -f "/var/www/html/config/config.php" ]; then
     sleep 2
-    while ! sudo -E -u www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
+    while ! su-exec www-data env PGPASSWORD="$POSTGRES_PASSWORD" psql -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "select now()"; do
         echo "Waiting for the database to start..."
         sleep 5
     done
@@ -62,12 +62,12 @@ if [ "$AIO_LOG_LEVEL" != 'debug' ]; then
 fi
 
 # Check datadir permissions
-sudo -E -u www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
+su-exec www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null
 if ! [ -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" ]; then
     chown -R www-data:root "$NEXTCLOUD_DATA_DIR"
     chmod 750 -R "$NEXTCLOUD_DATA_DIR"
 fi
-sudo -E -u www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
+su-exec www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
 
 # Install additional dependencies
 if [ -n "$ADDITIONAL_APKS" ]; then
@@ -153,7 +153,7 @@ if [ -n "$ADDITIONAL_PHP_EXTENSIONS" ]; then
 fi
 
 # Run original entrypoint
-if ! sudo -E -u www-data bash /entrypoint.sh; then
+if ! su-exec www-data bash /entrypoint.sh; then
     exit 1
 fi
 
diff --git a/Containers/nextcloud/upgrade-latest-major.sh b/Containers/nextcloud/upgrade-latest-major.sh
index 52a87566..f066ac4a 100644
--- a/Containers/nextcloud/upgrade-latest-major.sh
+++ b/Containers/nextcloud/upgrade-latest-major.sh
@@ -2,7 +2,7 @@
 
 PHP_CLI="php"
 if [[ "$EUID" = 0 ]]; then
-    PHP_CLI="sudo -u www-data -E $PHP_CLI"
+    PHP_CLI="su-exec www-data $PHP_CLI"
 fi
 
 # shellcheck disable=SC2016

From 587c63497e8ed4f54fc3bafc913ace10276915c7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 04:08:57 +0000
Subject: [PATCH 14/24] build(deps): bump php in /Containers/mastercontainer

Bumps php from 8.5.8-fpm-alpine3.24 to 8.5.9-fpm-alpine3.24.

---
updated-dependencies:
- dependency-name: php
  dependency-version: 8.5.9-fpm-alpine3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/mastercontainer/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile
index 02e29adb..bf10a355 100644
--- a/Containers/mastercontainer/Dockerfile
+++ b/Containers/mastercontainer/Dockerfile
@@ -11,7 +11,7 @@ RUN set -ex; \
     /usr/bin/caddy list-modules
 
 # From https://github.com/docker-library/php/blob/master/8.5/alpine3.24/fpm/Dockerfile
-FROM php:8.5.8-fpm-alpine3.24
+FROM php:8.5.9-fpm-alpine3.24
 
 EXPOSE 80
 EXPOSE 8080

From 1ef47c296efe08295f50dce690d851080092435b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 04:09:11 +0000
Subject: [PATCH 15/24] build(deps): bump php in /Containers/nextcloud

Bumps php from 8.3.32-fpm-alpine3.24 to 8.3.33-fpm-alpine3.24.

---
updated-dependencies:
- dependency-name: php
  dependency-version: 8.3.33-fpm-alpine3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/nextcloud/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile
index 7cb640d7..3f02fc94 100644
--- a/Containers/nextcloud/Dockerfile
+++ b/Containers/nextcloud/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM php:8.3.32-fpm-alpine3.24
+FROM php:8.3.33-fpm-alpine3.24
 
 ENV PHP_MEMORY_LIMIT=512M
 ENV PHP_UPLOAD_LIMIT=16G

From b19336bcb63d7827a2ff42c5802864a8431978d8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 04:09:28 +0000
Subject: [PATCH 16/24] build(deps): bump nats in /Containers/talk

Bumps nats from 2.14.3-scratch to 2.14.4-scratch.

---
updated-dependencies:
- dependency-name: nats
  dependency-version: 2.14.4-scratch
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/talk/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/talk/Dockerfile b/Containers/talk/Dockerfile
index 08074d11..ef4e0691 100644
--- a/Containers/talk/Dockerfile
+++ b/Containers/talk/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM nats:2.14.3-scratch AS nats
+FROM nats:2.14.4-scratch AS nats
 FROM eturnal/eturnal:1.12.2-alpine AS eturnal
 FROM strukturag/nextcloud-spreed-signaling:2.1.1 AS signaling
 FROM alpine:3.24.1 AS janus

From b6bc227d2839c949fa1ef5c21f01f6600f72f55b Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Mon, 3 Aug 2026 15:25:42 +0200
Subject: [PATCH 17/24] scrutiny: fix access to nvme drives

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 php/src/Docker/DockerActionManager.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php
index 539f01db..a7666d34 100644
--- a/php/src/Docker/DockerActionManager.php
+++ b/php/src/Docker/DockerActionManager.php
@@ -480,8 +480,11 @@ readonly class DockerActionManager {
             }
         // Special things for the scrutiny container which should not be exposed in the containers.json
         } elseif ($container->identifier === 'nextcloud-aio-scrutiny') {
-            // Allow it to access block devices
-            $requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw"];
+            // Allow it to access block devices (e.g. /dev/sda for SATA drives) and
+            // character devices (needed for NVMe drives: smartctl reads their SMART data
+            // via admin passthrough ioctls on the NVMe controller character device
+            // /dev/nvme0 and not via the block device /dev/nvme0n1)
+            $requestBody['HostConfig']['DeviceCgroupRules'] = ["b *:* rmw", "c *:* rmw"];
         // Special things for the makemkv container which should not be exposed in the containers.json
         } elseif ($container->identifier === 'nextcloud-aio-makemkv') {
             // Allow it to access block devices

From d91810e9d24dc3bfe2c33a424e2718109eaebaa5 Mon Sep 17 00:00:00 2001
From: derStephan <derStephan@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:31:55 +0200
Subject: [PATCH 18/24] Add instructions on how to test community containers in
 real live

fixes #8503

Signed-off-by: derStephan <derStephan@users.noreply.github.com>
---
 community-containers/readme.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/community-containers/readme.md b/community-containers/readme.md
index c4b2156f..005277e6 100644
--- a/community-containers/readme.md
+++ b/community-containers/readme.md
@@ -68,7 +68,16 @@ Starting with v11 of AIO, the management of Community Containers is done via the
 ⚠️⚠️⚠️ Please review the folder for documentation on each of the containers before adding them! Not reviewing the documentation for each of them first might break starting the AIO containers because some containers are not compatible with each other and more.
 
 ## How to add containers?
-Simply submit a PR by creating a new folder in this directory: https://github.com/nextcloud/all-in-one/tree/main/community-containers with the name of your container. It must include a json file with the same name and with correct syntax and a readme.md with additional information. You might get inspired by caddy, fail2ban, local-ai, libretranslate, plex, pi-hole or vaultwarden (subfolders in this directory). For a full-blown example of the json file, see https://github.com/nextcloud/all-in-one/blob/main/php/containers.json. The json-schema that it validates against can be found here: https://github.com/nextcloud/all-in-one/blob/main/php/containers-schema.json.
+Simply submit a PR by creating a new folder in this directory: https://github.com/nextcloud/all-in-one/tree/main/community-containers with the name of your container. It must include a json file with the same name and with correct syntax and a readme.md with additional information. You might get inspired by caddy, fail2ban, local-ai, libretranslate, plex, pi-hole or vaultwarden (subfolders in this directory). For a full-blown example of the json file, see https://github.com/nextcloud/all-in-one/blob/main/php/containers.json. 
+
+### How to test new or changed containers in your own installation?
+
+1. Validate your JSON file against standard validators as well as the specific json-schema: https://github.com/nextcloud/all-in-one/blob/main/php/containers-schema.json
+2. create a folder with all files somewhere, e.g. /root
+3. put your container's folder there, e.g. `new-container`
+4. copy this folder to your container: `docker cp /root/new-container nextcloud-aio-mastercontainer:/var/www/docker-aio/community-containers/`
+5. restart mastercontainer `docker restart nextcloud-aio-mastercontainer`
+6. open you AIO interface and you should see your community container
 
 ### Is there a list of ideas for new community containers?
 Yes, see [this list](https://github.com/nextcloud/all-in-one/issues/5251) for already existing ideas for new community containers. Feel free to pick one up and add it to this folder by following the instructions above.

From 560554ca565545110e73fec6efb56df670b27dae Mon Sep 17 00:00:00 2001
From: derStephan <derStephan@users.noreply.github.com>
Date: Mon, 3 Aug 2026 17:29:48 +0200
Subject: [PATCH 19/24] Update community-containers/readme.md

Co-authored-by: Simon L. <szaimen@e.mail.de>
Signed-off-by: derStephan <derStephan@users.noreply.github.com>
---
 community-containers/readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/community-containers/readme.md b/community-containers/readme.md
index 005277e6..20850771 100644
--- a/community-containers/readme.md
+++ b/community-containers/readme.md
@@ -70,7 +70,7 @@ Starting with v11 of AIO, the management of Community Containers is done via the
 ## How to add containers?
 Simply submit a PR by creating a new folder in this directory: https://github.com/nextcloud/all-in-one/tree/main/community-containers with the name of your container. It must include a json file with the same name and with correct syntax and a readme.md with additional information. You might get inspired by caddy, fail2ban, local-ai, libretranslate, plex, pi-hole or vaultwarden (subfolders in this directory). For a full-blown example of the json file, see https://github.com/nextcloud/all-in-one/blob/main/php/containers.json. 
 
-### How to test new or changed containers in your own installation?
+### How to test new containers in your own installation?
 
 1. Validate your JSON file against standard validators as well as the specific json-schema: https://github.com/nextcloud/all-in-one/blob/main/php/containers-schema.json
 2. create a folder with all files somewhere, e.g. /root

From 015147b2e7346c5932d094635e9f2582d8f45b97 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 04:07:22 +0000
Subject: [PATCH 20/24] build(deps): bump docker in /Containers/mastercontainer

Bumps docker from 29.6.2-cli to 29.7.0-cli.

---
updated-dependencies:
- dependency-name: docker
  dependency-version: 29.7.0-cli
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Containers/mastercontainer/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile
index 02e29adb..d8ada4de 100644
--- a/Containers/mastercontainer/Dockerfile
+++ b/Containers/mastercontainer/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # Docker CLI is a requirement
-FROM docker:29.6.2-cli AS docker
+FROM docker:29.7.0-cli AS docker
 
 ARG CADDY_REMOTE_HOST_HASH=e80a9931765a8dbcbb47db415863387f0df0e1b3
 

From ab45f17aeed80a9e1a27cc88421a536466b3e326 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Tue, 4 Aug 2026 13:38:39 +0200
Subject: [PATCH 21/24] some additional changes

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 .github/dependabot.yml                  |  1 +
 Containers/harp/Dockerfile              | 17 +++++++++++++++++
 manual-install/update-yaml.sh           |  1 +
 nextcloud-aio-helm-chart/update-helm.sh |  2 ++
 php/containers.json                     | 12 ++++++++++--
 5 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 Containers/harp/Dockerfile

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 44679462..f9026f28 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,6 +33,7 @@ updates:
     - "/Containers/domaincheck"
     - "/Containers/eurooffice"
     - "/Containers/fulltextsearch"
+    - "/Containers/harp"
     - "/Containers/imaginary"
     - "/Containers/mastercontainer"
     - "/Containers/nextcloud"
diff --git a/Containers/harp/Dockerfile b/Containers/harp/Dockerfile
new file mode 100644
index 00000000..0a931846
--- /dev/null
+++ b/Containers/harp/Dockerfile
@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:latest
+FROM ghcr.io/nextcloud/nextcloud-appapi-harp:v0.4.3
+
+# USER root is probably used
+
+LABEL com.centurylinklabs.watchtower.enable="false" \
+    wud.watch="false" \
+    dockhand.update="false" \
+    org.opencontainers.image.title="Nextcloud AppAPI HARP for Nextcloud AIO" \
+    org.opencontainers.image.description="Nextcloud AppAPI HARP for Nextcloud All-in-One" \
+    org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \
+    org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
+    org.opencontainers.image.vendor="Nextcloud" \
+    org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
+
+# Copied from upstream
+HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh
diff --git a/manual-install/update-yaml.sh b/manual-install/update-yaml.sh
index 3b1a5a9d..88e5b3ab 100644
--- a/manual-install/update-yaml.sh
+++ b/manual-install/update-yaml.sh
@@ -92,6 +92,7 @@ sed -i 's|NEXTCLOUD_TRUSTED_CACERTS_DIR=|NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/loca
 sed -i 's|UPDATE_NEXTCLOUD_APPS=|UPDATE_NEXTCLOUD_APPS="no"          # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.|' sample.conf
 sed -i 's|APACHE_PORT=|APACHE_PORT=443          # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).|' sample.conf
 sed -i 's|APACHE_IP_BINDING=|APACHE_IP_BINDING=0.0.0.0          # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect|' sample.conf
+sed -i 's|WATCHTOWER_DOCKER_SOCKET_PATH=|WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock          # This can be changed depending on where the docker socket is located on your host|' sample.conf
 sed -i 's|TALK_PORT=|TALK_PORT=3478          # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!|' sample.conf
 sed -i 's|NC_DOMAIN=|NC_DOMAIN=yourdomain.com          # TODO! Needs to be changed to the domain that you want to use for Nextcloud.|' sample.conf
 sed -i 's|NEXTCLOUD_PASSWORD=|NEXTCLOUD_PASSWORD=          # TODO! This is the password of the initially created Nextcloud admin with username "admin".|' sample.conf
diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh
index 06f7ba89..9e4d9a6a 100755
--- a/nextcloud-aio-helm-chart/update-helm.sh
+++ b/nextcloud-aio-helm-chart/update-helm.sh
@@ -44,6 +44,7 @@ sed -i "s|- \${TALK_PORT}|- $TALK_PORT|" latest.yml
 sed -i "s|\${NEXTCLOUD_DATADIR}|$NEXTCLOUD_DATADIR|" latest.yml
 sed -i "s|\${ADDITIONAL_COLLABORA_OPTIONS}|ADDITIONAL_COLLABORA_OPTIONS_PLACEHOLDER|" latest.yml
 sed -i "/name: nextcloud-aio/,$ d" latest.yml
+sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" latest.yml
 sed -i "/NEXTCLOUD_DATADIR/d" latest.yml
 sed -i "/\${NEXTCLOUD_MOUNT}/d" latest.yml
 sed -i "/^volumes:/a\ \ nextcloud_aio_nextcloud_trusted_cacerts:\n \ \ \ \ name: nextcloud_aio_nextcloud_trusted_cacerts" latest.yml
@@ -432,6 +433,7 @@ sed -i 's|= |: |' /tmp/sample.conf
 sed -i '/^NEXTCLOUD_DATADIR/d' /tmp/sample.conf
 sed -i '/^APACHE_IP_BINDING/d' /tmp/sample.conf
 sed -i '/^NEXTCLOUD_MOUNT/d' /tmp/sample.conf
+sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" /tmp/sample.conf
 sed -i 's/ yes / "yes" /' /tmp/sample.conf
 sed -i 's/ no / "no" /' /tmp/sample.conf
 sed -i 's/"no" authentication/no authentication/' /tmp/sample.conf
diff --git a/php/containers.json b/php/containers.json
index d8900c45..8284777e 100644
--- a/php/containers.json
+++ b/php/containers.json
@@ -933,14 +933,22 @@
     },
     {
       "container_name": "nextcloud-aio-harp",
-      "image_tag": "release",
+      "image_tag": "%AIO_CHANNEL%",
       "display_name": "HaRP",
-      "image": "ghcr.io/nextcloud/nextcloud-appapi-harp",
+      "image": "ghcr.io/nextcloud-releases/aio-harp",
       "init": true,
       "internal_port": "8780",
       "expose": [
         "8780"
       ],
+      "healthcheck": {
+        "start_period": "0s",
+        "test": "/healthcheck.sh",
+        "interval": "10s",
+        "timeout": "10s",
+        "start_interval": "5s",
+        "retries": 9
+      },
       "environment": [
         "HP_SHARED_KEY=%HP_SHARED_KEY%",
         "NC_INSTANCE_URL=https://%NC_DOMAIN%",

From 553ce89fc3cfa8a98599117bd94cbf37b81ccdeb Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Tue, 4 Aug 2026 13:38:55 +0200
Subject: [PATCH 22/24] Revert "Yaml updates"

This reverts commit c40cb1cffe891863c75a586940fd7aa981959862.

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 manual-install/latest.yml  | 29 -----------------------------
 manual-install/sample.conf |  2 --
 2 files changed, 31 deletions(-)

diff --git a/manual-install/latest.yml b/manual-install/latest.yml
index 327f2680..0d1411d7 100644
--- a/manual-install/latest.yml
+++ b/manual-install/latest.yml
@@ -19,9 +19,6 @@ services:
       nextcloud-aio-whiteboard:
         condition: service_started
         required: false
-      nextcloud-aio-harp:
-        condition: service_started
-        required: false
       nextcloud-aio-nextcloud:
         condition: service_started
         required: false
@@ -53,7 +50,6 @@ services:
       - APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME}
       - NOTIFY_PUSH_HOST=nextcloud-aio-notify-push
       - WHITEBOARD_HOST=nextcloud-aio-whiteboard
-      - HARP_HOST=nextcloud-aio-harp
     volumes:
       - nextcloud_aio_nextcloud:/var/www/html:ro
       - nextcloud_aio_apache:/mnt/data:rw
@@ -197,7 +193,6 @@ services:
       - IMAGINARY_SECRET
       - WHITEBOARD_SECRET
       - WHITEBOARD_ENABLED
-      - HARP_ENABLED
     stop_grace_period: 600s
     restart: unless-stopped
     shm_size: 134217728
@@ -509,28 +504,6 @@ services:
     cap_drop:
       - NET_RAW
 
-  nextcloud-aio-harp:
-    image: ghcr.io/nextcloud/nextcloud-appapi-harp:latest
-    init: true
-    expose:
-      - "8780"
-    environment:
-      - NC_INSTANCE_URL=https://${NC_DOMAIN}
-      - HP_FRP_DISABLE_TLS=true
-      - TZ=${TIMEZONE}
-    volumes:
-      - ${WATCHTOWER_DOCKER_SOCKET_PATH}:/var/run/docker.sock:ro
-      - nextcloud_aio_harp:/certs:rw
-    restart: unless-stopped
-    read_only: true
-    tmpfs:
-      - /tmp
-      - /run/harp
-    cap_drop:
-      - NET_RAW
-    profiles:
-      - harp
-
   nextcloud-aio-whiteboard:
     image: ghcr.io/nextcloud-releases/aio-whiteboard:latest
     user: "65534"
@@ -576,8 +549,6 @@ volumes:
     name: nextcloud_aio_elasticsearch
   nextcloud_aio_eurooffice:
     name: nextcloud_aio_eurooffice
-  nextcloud_aio_harp:
-    name: nextcloud_aio_harp
   nextcloud_aio_nextcloud:
     name: nextcloud_aio_nextcloud
   nextcloud_aio_onlyoffice:
diff --git a/manual-install/sample.conf b/manual-install/sample.conf
index 584d72ca..d4da3604 100644
--- a/manual-install/sample.conf
+++ b/manual-install/sample.conf
@@ -11,14 +11,12 @@ SIGNALING_SECRET=          # TODO! This needs to be a unique and good password!
 TALK_INTERNAL_SECRET=          # TODO! This needs to be a unique and good password!
 TIMEZONE=Europe/Berlin          # TODO! This is the timezone that your containers will use.
 TURN_SECRET=          # TODO! This needs to be a unique and good password!
-WATCHTOWER_DOCKER_SOCKET_PATH=          # TODO! This needs to be a unique and good password!
 WHITEBOARD_SECRET=          # TODO! This needs to be a unique and good password!
 
 CLAMAV_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 COLLABORA_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 EUROOFFICE_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 FULLTEXTSEARCH_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
-HARP_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 IMAGINARY_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 ONLYOFFICE_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 TALK_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.

From 693932ae1932b1b0ae07df9f694207a6ebdc32f8 Mon Sep 17 00:00:00 2001
From: pabzm <57864086+pabzm@users.noreply.github.com>
Date: Wed, 5 Aug 2026 06:19:01 +0000
Subject: [PATCH 23/24] chore(tests): update test container image references

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 php/tests/Containers/composer/Dockerfile | 2 +-
 php/tests/compose.yaml                   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/php/tests/Containers/composer/Dockerfile b/php/tests/Containers/composer/Dockerfile
index b5b708b7..00dc79a9 100644
--- a/php/tests/Containers/composer/Dockerfile
+++ b/php/tests/Containers/composer/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/library/composer:2@sha256:5946476338742b200bb9ff88f8be56275ddae4b3949c72305cb0dbf10cfcb760
+FROM docker.io/library/composer:2@sha256:4d71c3c2109c61d5415544264b59ad4087e4c5b7244481723664138fd36d5040
 
 RUN pecl bundle -d /usr/src/php/ext apcu \
  && docker-php-ext-install apcu
\ No newline at end of file
diff --git a/php/tests/compose.yaml b/php/tests/compose.yaml
index 7f2d19d0..a8818601 100644
--- a/php/tests/compose.yaml
+++ b/php/tests/compose.yaml
@@ -59,14 +59,14 @@ services:
       - local-code
 
   desec-mock:
-    image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
+    image: docker.io/library/node:26@sha256:c31fbcbf4a7e94a36accd38fdf69882fdf7685039dcd41412245d3d1065c5cbc
     volumes:
       - ..:/app/php
     working_dir: /app
     command: node php/tests/desec-mock.mjs 8090 2>&1
           
   npm-installer:
-    image: docker.io/library/node:26@sha256:0473e7dc433a1310f436edee02aa79737ec78a4b345433ab0963d4a256f9ad85
+    image: docker.io/library/node:26@sha256:c31fbcbf4a7e94a36accd38fdf69882fdf7685039dcd41412245d3d1065c5cbc
     volumes:
       - ..:/app
     working_dir: /app/tests

From 58d2480cf6302dee39b23beead562f93b6f2610a Mon Sep 17 00:00:00 2001
From: szaimen <42591237+szaimen@users.noreply.github.com>
Date: Wed, 5 Aug 2026 09:06:38 +0000
Subject: [PATCH 24/24] Helm Chart updates

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 nextcloud-aio-helm-chart/Chart.yaml                           | 2 +-
 .../templates/nextcloud-aio-apache-deployment.yaml            | 2 +-
 .../templates/nextcloud-aio-clamav-deployment.yaml            | 4 ++--
 .../templates/nextcloud-aio-collabora-deployment.yaml         | 2 +-
 .../templates/nextcloud-aio-database-deployment.yaml          | 4 ++--
 .../templates/nextcloud-aio-eurooffice-deployment.yaml        | 4 ++--
 .../templates/nextcloud-aio-fulltextsearch-deployment.yaml    | 4 ++--
 .../templates/nextcloud-aio-imaginary-deployment.yaml         | 2 +-
 .../templates/nextcloud-aio-nextcloud-deployment.yaml         | 4 ++--
 .../templates/nextcloud-aio-notify-push-deployment.yaml       | 2 +-
 .../templates/nextcloud-aio-onlyoffice-deployment.yaml        | 4 ++--
 .../templates/nextcloud-aio-redis-deployment.yaml             | 2 +-
 .../templates/nextcloud-aio-talk-deployment.yaml              | 2 +-
 .../templates/nextcloud-aio-talk-recording-deployment.yaml    | 2 +-
 .../templates/nextcloud-aio-whiteboard-deployment.yaml        | 2 +-
 15 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/nextcloud-aio-helm-chart/Chart.yaml b/nextcloud-aio-helm-chart/Chart.yaml
index 5e8a08ed..b9c317be 100755
--- a/nextcloud-aio-helm-chart/Chart.yaml
+++ b/nextcloud-aio-helm-chart/Chart.yaml
@@ -1,6 +1,6 @@
 name: nextcloud-aio-helm-chart
 description: A generated Helm Chart for Nextcloud AIO from Skippbox Kompose
-version: 13.4.0
+version: 13.4.1
 apiVersion: v2
 keywords:
   - latest
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
index bcd3e453..0154e571 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml
@@ -65,7 +65,7 @@ spec:
               value: "{{ .Values.TIMEZONE }}"
             - name: WHITEBOARD_HOST
               value: nextcloud-aio-whiteboard
-          image: ghcr.io/nextcloud-releases/aio-apache:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-apache:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
index 0253fe54..7d446260 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml
@@ -36,7 +36,7 @@ spec:
         {{- end }}
       initContainers:
         - name: init-subpath
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - mkdir
             - "-p"
@@ -61,7 +61,7 @@ spec:
               value: "{{ .Values.NEXTCLOUD_UPLOAD_LIMIT }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-clamav:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-clamav:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml
index c259cf08..2f52d42f 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml
@@ -37,7 +37,7 @@ spec:
               value: --o:ssl.enable=false --o:ssl.termination=true --o:logging.disable_server_audit=true --o:welcome.enable=false --o:fetch_update_check=0 --o:allow_update_popup=false --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+
             - name: server_name
               value: "{{ .Values.NC_DOMAIN }}"
-          image: ghcr.io/nextcloud-releases/aio-collabora:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-collabora:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
index 53e9796f..5d3c2544 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-database-deployment.yaml
@@ -35,7 +35,7 @@ spec:
         {{- end }}
       initContainers:
         - name: init-subpath
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - mkdir
             - "-p"
@@ -66,7 +66,7 @@ spec:
               value: nextcloud
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-postgresql:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-postgresql:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml
index f1ecb05d..2388c53b 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-eurooffice-deployment.yaml
@@ -24,7 +24,7 @@ spec:
     spec:
       initContainers:
         - name: init-volumes
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - chmod
             - "777"
@@ -46,7 +46,7 @@ spec:
               value: "{{ .Values.AIO_LOG_LEVEL }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-eurooffice:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-eurooffice:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml
index 5679a669..64457492 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-fulltextsearch-deployment.yaml
@@ -24,7 +24,7 @@ spec:
     spec:
       initContainers:
         - name: init-volumes
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - chmod
             - "777"
@@ -64,7 +64,7 @@ spec:
               value: "false"
             - name: xpack.security.transport.ssl.enabled
               value: "false"
-          image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-fulltextsearch:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
index 526347aa..281b1d91 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-imaginary-deployment.yaml
@@ -40,7 +40,7 @@ spec:
               value: "{{ .Values.IMAGINARY_SECRET }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-imaginary:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-imaginary:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
index e35decbb..6a6657c4 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-nextcloud-deployment.yaml
@@ -38,7 +38,7 @@ spec:
 # AIO settings start # Do not remove or change this line!
       initContainers:
         - name: init-volumes
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - chmod
             - "777"
@@ -198,7 +198,7 @@ spec:
               value: "{{ .Values.WHITEBOARD_ENABLED }}"
             - name: WHITEBOARD_SECRET
               value: "{{ .Values.WHITEBOARD_SECRET }}"
-          image: ghcr.io/nextcloud-releases/aio-nextcloud:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-nextcloud:20260805_083533
           {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }} # AIO-config - do not change this comment!
           securityContext:
             # The items below only work in container context
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
index 4d9331f3..2cfb2733 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-notify-push-deployment.yaml
@@ -41,7 +41,7 @@ spec:
               value: nextcloud-aio-nextcloud
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-notify-push:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-notify-push:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml
index 65483408..abcf53b2 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-onlyoffice-deployment.yaml
@@ -24,7 +24,7 @@ spec:
     spec:
       initContainers:
         - name: init-volumes
-          image: ghcr.io/nextcloud-releases/aio-alpine:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-alpine:20260805_083533
           command:
             - chmod
             - "777"
@@ -46,7 +46,7 @@ spec:
               value: "{{ .Values.AIO_LOG_LEVEL }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-onlyoffice:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
index eb6f8dba..8251d858 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-redis-deployment.yaml
@@ -41,7 +41,7 @@ spec:
               value: "{{ .Values.REDIS_PASSWORD }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-redis:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-redis:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
index ab7d82f3..4e9746dd 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-deployment.yaml
@@ -56,7 +56,7 @@ spec:
               value: "{{ .Values.TURN_SECRET }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-talk:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-talk:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
index 96db7bdb..e225f54f 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-talk-recording-deployment.yaml
@@ -46,7 +46,7 @@ spec:
               value: "{{ .Values.RECORDING_SECRET }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-talk-recording:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-talk-recording:20260805_083533
           readinessProbe:
             exec:
               command:
diff --git a/nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml b/nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
index a502e096..755ffbbd 100755
--- a/nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
+++ b/nextcloud-aio-helm-chart/templates/nextcloud-aio-whiteboard-deployment.yaml
@@ -52,7 +52,7 @@ spec:
               value: redis
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: ghcr.io/nextcloud-releases/aio-whiteboard:20260727_092405
+          image: ghcr.io/nextcloud-releases/aio-whiteboard:20260805_083533
           readinessProbe:
             exec:
               command: