daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-05-21 02:40:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

mastercontainer: replace apache with a second caddy (#7006)

Browse Source 
Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-authored-by: Simon L. <szaimen@e.mail.de>
This commit is contained in:
Zoey
2026-03-06 14:23:52 +01:00
committed by GitHub
parent 4b1c7286bc
commit b972c5703f
11 changed files with 129 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/dependency-updates.yml vendored
View File

@@ -43,6 +43,15 @@ jobs:
| tail -1
)"
sed -i "s|pecl install APCu.*\;|pecl install APCu-$apcu_version\;|" ./Containers/mastercontainer/Dockerfile
# CADDY_REMOTE_HOST_HASH
CADDY_REMOTE_HOST_HASH="$(
git ls-remote https://github.com/muety/caddy-remote-host master \
| cut -f1 \
| tail -1
)"
sed -i "s|^ARG CADDY_REMOTE_HOST_HASH.*$|ARG CADDY_REMOTE_HOST_HASH=$CADDY_REMOTE_HOST_HASH|" ./Containers/mastercontainer/Dockerfile
- name: Create Pull Request
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7
with:

37
Containers/mastercontainer/Caddyfile
View File

@@ -1,37 +0,0 @@
{
# auto_https will create redirects for https://{host}:8443 instead of https://{host}
# https redirects are added manually in the http://:80 block
auto_https disable_redirects
storage file_system {
root /mnt/docker-aio-config/caddy/
}
log {
level ERROR
}
servers {
protocols h1 h2 h2c
}
on_demand_tls {
ask http://127.0.0.1:9876/
}
}
http://:80 {
redir https://{host}{uri} permanent
}
https://:8443 {
reverse_proxy 127.0.0.1:8000
tls {
on_demand
issuer acme {
disable_tlsalpn_challenge
}
}
}

58
Containers/mastercontainer/Dockerfile
View File

@@ -2,8 +2,13 @@
# Docker CLI is a requirement
FROM docker:29.3.0-cli AS docker
ARG CADDY_REMOTE_HOST_HASH=b21775afa730ffb52a24ddff310c8a6d1fd37276
# Caddy is a requirement
FROM caddy:2.11.1-alpine AS caddy
FROM caddy:2.11.1-builder-alpine AS caddy
RUN set -ex; \
xcaddy build --with github.com/muety/caddy-remote-host@"$CADDY_REMOTE_HOST_HASH"; \
/usr/bin/caddy list-modules
# From https://github.com/docker-library/php/blob/master/8.5/alpine3.23/fpm/Dockerfile
FROM php:8.5.3-fpm-alpine3.23
@@ -21,9 +26,8 @@ COPY --from=docker /usr/local/bin/docker /usr/local/bin/docker
COPY community-containers /var/www/docker-aio/community-containers
COPY php /var/www/docker-aio/php
COPY --chmod=775 Containers/mastercontainer/*.sh /
COPY --chmod=664 Containers/mastercontainer/Caddyfile /Caddyfile
COPY --chmod=664 Containers/mastercontainer/*.Caddyfile /
COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf
COPY Containers/mastercontainer/mastercontainer.conf /etc/apache2/sites-available/mastercontainer.conf
WORKDIR /var/www/docker-aio
@@ -37,13 +41,8 @@ RUN set -ex; \
apk add --no-cache \
util-linux-misc \
ca-certificates \
wget \
bash \
apache2 \
apache2-proxy \
apache2-ssl \
supervisor \
openssl \
sudo \
netcat-openbsd \
curl \
@@ -67,11 +66,12 @@ RUN set -ex; \
sed -i 's/^pm = dynamic/pm = ondemand/' /usr/local/etc/php-fpm.d/www.conf; \
sed -i 's/^pm.max_children =.*/pm.max_children = 80/' /usr/local/etc/php-fpm.d/www.conf; \
sed -i 's|access.log = /proc/self/fd/2|access.log = /proc/self/fd/1|' /usr/local/etc/php-fpm.d/docker.conf; \
grep -q ';listen.allowed_clients' /usr/local/etc/php-fpm.d/www.conf; \
sed -i 's|;listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1|' /usr/local/etc/php-fpm.d/www.conf; \
grep -q '^listen =' /usr/local/etc/php-fpm.d/docker.conf; \
sed -i 's|listen =.*|listen = /run/php.sock|' /usr/local/etc/php-fpm.d/docker.conf; \
echo "listen.owner = www-data" | tee -a /usr/local/etc/php-fpm.d/docker.conf; \
\
apk add --no-cache git; \
wget https://getcomposer.org/installer -O - | php -- --install-dir=/usr/local/bin --filename=composer; \
curl https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer; \
chmod +x /usr/local/bin/composer; \
cd /var/www/docker-aio; \
rm -r ./php/tests; \
@@ -86,42 +86,6 @@ RUN set -ex; \
rm -r php/data; \
rm -r php/session; \
\
mkdir -p /etc/apache2/certs; \
cd /etc/apache2/certs; \
openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/C=DE/ST=BE/L=Local/O=Dev/CN=nextcloud.local" -keyout /etc/apache2/certs/ssl.key -out /etc/apache2/certs/ssl.crt; \
\
sed -i \
-e '/^Listen /d' \
-e 's/^LogLevel .*/LogLevel error/' \
-e 's|^ErrorLog .*|ErrorLog /proc/self/fd/2|' \
-e 's/User apache/User www-data/g' \
-e 's/Group apache/Group www-data/g' \
-e 's/^#\(LoadModule .*mod_rewrite.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_headers.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_env.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_mime.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_dir.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_authz_core.so\)/\1/' \
-e 's/^#\(LoadModule .*mod_mpm_event.so\)/\1/' \
-e 's/\(LoadModule .*mod_mpm_worker.so\)/#\1/' \
-e 's/\(LoadModule .*mod_mpm_prefork.so\)/#\1/' \
-e 's/\(ScriptAlias \)/#\1/' \
/etc/apache2/httpd.conf; \
mkdir -p /etc/apache2/logs; \
rm /etc/apache2/conf.d/ssl.conf; \
echo "ServerName localhost" | tee -a /etc/apache2/httpd.conf; \
grep -q '^LoadModule lbmethod_heartbeat_module' /etc/apache2/conf.d/proxy.conf; \
sed -i 's|^LoadModule lbmethod_heartbeat_module.*|#LoadModule lbmethod_heartbeat_module|' /etc/apache2/conf.d/proxy.conf; \
echo "SSLSessionCache nonenotnull" | tee -a /etc/apache2/httpd.conf; \
echo "LoadModule ssl_module modules/mod_ssl.so" | tee -a /etc/apache2/httpd.conf; \
echo "LoadModule socache_shmcb_module modules/mod_socache_shmcb.so" | tee -a /etc/apache2/httpd.conf; \
echo "Include /etc/apache2/sites-available/mastercontainer.conf" | tee -a /etc/apache2/httpd.conf; \
\
rm -f /etc/apache2/conf.d/default.conf \
/etc/apache2/conf.d/userdir.conf \
/etc/apache2/conf.d/info.conf; \
\
rm -rf /var/www/localhost/cgi-bin/; \
mkdir /var/log/supervisord; \
mkdir /var/run/supervisord;

4
Containers/mastercontainer/README.md
View File

@@ -12,8 +12,8 @@ The mastercontainer acts as the central orchestration service for the deployment
of all other containers in the Nextcloud All-in-One stack. It hosts:
- A dedicated PHP SAPI/backend (php-fpm) for AIO itself (not Nextcloud Server)
- An Apache service for accessing the AIO interface via a self-signed HTTPS VirtualHost on 8080/tcp
- A Caddy reverse proxy service enabling HTTPS access to the AIO frontend on port 8443/tcp.
- A Caddy server enabling self-signed HTTPS access to the AIO frontend on port 8080/tcp.
- A Caddy server enabling trusted HTTPS access to the AIO frontend on port 8443/tcp.
- Caddy will automatically issue a Let's Encrypt issued certificate if port 80 and 8443
is open/forwarded and a domain pointer is in place; then, simply open the Nextcloud AIO interface using the
domain (`https://your-domain-that-points-to-this-server.tld:8443`). The Let's Encrypt certificate request will

49
Containers/mastercontainer/acme.Caddyfile Normal file
View File

@@ -0,0 +1,49 @@
{
admin off
# auto_https will create redirects for https://{host}:8443 instead of https://{host}
# https redirects are added manually in the http://:80 block
auto_https disable_redirects
storage file_system {
root /mnt/docker-aio-config/caddy/
}
log {
level ERROR
# We need to exclude the remote-host plugin from logging as it would spam the logs
# See https://github.com/nextcloud/all-in-one/pull/7006#issuecomment-4003238239
exclude http.matchers.remote_host
}
servers {
protocols h1 h2 h2c
}
on_demand_tls {
ask http://127.0.0.1:9876/
}
skip_install_trust
}
http://:80 {
redir https://{host}{uri} permanent
}
https://:8443 {
@denied remote_host nextcloud-aio-nextcloud
abort @denied
root * /var/www/docker-aio/php/public
encode
php_fastcgi unix//run/php.sock
file_server
tls {
on_demand
issuer acme {
disable_tlsalpn_challenge
}
}
}

3
Containers/mastercontainer/healthcheck.sh
View File

@@ -2,9 +2,8 @@
if [ -f "/mnt/docker-aio-config/data/configuration.json" ]; then
nc -z 127.0.0.1 80 || exit 1
nc -z 127.0.0.1 8000 || exit 1
nc -z 127.0.0.1 8080 || exit 1
nc -z 127.0.0.1 8443 || exit 1
nc -z 127.0.0.1 9000 || exit 1
[ -f /run/php.sock ] || exit 1
nc -z 127.0.0.1 9876 || exit 1
fi

35
Containers/mastercontainer/internal.Caddyfile Normal file
View File

@@ -0,0 +1,35 @@
{
admin off
storage file_system {
root /mnt/docker-aio-config/caddy/
}
log {
level ERROR
# We need to exclude the remote-host plugin from logging as it would spam the logs
# See https://github.com/nextcloud/all-in-one/pull/7006#issuecomment-4003238239
exclude http.matchers.remote_host
}
servers {
protocols h1 h2
}
skip_install_trust
}
https://:8080 {
@denied remote_host nextcloud-aio-nextcloud
abort @denied
root * /var/www/docker-aio/php/public
encode
php_fastcgi unix//run/php.sock
file_server
tls {
on_demand
issuer internal
}
}

67
Containers/mastercontainer/mastercontainer.conf
View File

@@ -1,67 +0,0 @@
Listen 127.0.0.1:8000
Listen 8080 https
# Deny access to .ht files
<Files ".ht*">
Require all denied
</Files>
# Http host
<VirtualHost 127.0.0.1:8000>
ServerName 127.0.0.1
# Add error log
CustomLog /proc/self/fd/1 proxy
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
ErrorLog /proc/self/fd/2
ErrorLogFormat "[%t] [%l] [%E] [client: %{X-Forwarded-For}i] [%M] [%{User-Agent}i]"
LogLevel warn
# PHP match
<FilesMatch "\.php$">
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>
# Disable output buffering to enable streaming responses.
<Proxy "fcgi://127.0.0.1:9000/" flushpackets=on>
</Proxy>
# Master dir
DocumentRoot /var/www/docker-aio/php/public/
<Directory /var/www/docker-aio/php/public/>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [QSA,L]
Options Indexes FollowSymLinks
Require all granted
AllowOverride All
Options FollowSymLinks MultiViews
Satisfy Any
<IfModule mod_dav.c>
Dav off
</IfModule>
</Directory>
</VirtualHost>
# Https host
<VirtualHost *:8080>
# Proxy to https
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
ProxyPreserveHost On
# SSL
SSLCertificateKeyFile /etc/apache2/certs/ssl.key
SSLCertificateFile /etc/apache2/certs/ssl.crt
SSLEngine on
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
</VirtualHost>
# Increase timeout in case e.g. the initial download takes a long time
Timeout 7200
ProxyTimeout 7200
# See https://httpd.apache.org/docs/trunk/mod/core.html#traceenable
TraceEnable Off

42
Containers/mastercontainer/start.sh
View File

@@ -364,7 +364,6 @@ fi
mkdir -p /mnt/docker-aio-config/data/
mkdir -p /mnt/docker-aio-config/session/
mkdir -p /mnt/docker-aio-config/caddy/
mkdir -p /mnt/docker-aio-config/certs/
# Adjust permissions for all instances
chmod 770 -R /mnt/docker-aio-config
@@ -372,37 +371,6 @@ chmod 777 /mnt/docker-aio-config
chown www-data:www-data -R /mnt/docker-aio-config/data/
chown www-data:www-data -R /mnt/docker-aio-config/session/
chown www-data:www-data -R /mnt/docker-aio-config/caddy/
chown root:root -R /mnt/docker-aio-config/certs/
# Don't allow access to the AIO interface from the Nextcloud container
# Probably more cosmetic than anything but at least an attempt
if ! grep -q '# nextcloud-aio-block' /etc/apache2/httpd.conf; then
cat << APACHE_CONF >> /etc/apache2/httpd.conf
# nextcloud-aio-block-start
<Location />
order allow,deny
deny from nextcloud-aio-nextcloud.nextcloud-aio
allow from all
</Location>
# nextcloud-aio-block-end
APACHE_CONF
fi
# Adjust certs
GENERATED_CERTS="/mnt/docker-aio-config/certs"
TMP_CERTS="/etc/apache2/certs"
mkdir -p "$GENERATED_CERTS"
cd "$GENERATED_CERTS" || exit 1
if ! [ -f ./ssl.crt ] && ! [ -f ./ssl.key ]; then
openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/C=DE/ST=BE/L=Local/O=Dev/CN=nextcloud.local" -keyout ./ssl.key -out ./ssl.crt
fi
if [ -f ./ssl.crt ] && [ -f ./ssl.key ]; then
cd "$TMP_CERTS" || exit 1
rm ./ssl.crt
rm ./ssl.key
cp "$GENERATED_CERTS/ssl.crt" ./
cp "$GENERATED_CERTS/ssl.key" ./
fi
print_green "Initial startup of Nextcloud All-in-One complete!
You should be able to open the Nextcloud AIO Interface now on port 8080 of this server!
@@ -415,8 +383,11 @@ https://your-domain-that-points-to-this-server.tld:8443"
# Set the timezone to Etc/UTC
export TZ=Etc/UTC
# Fix apache startup
rm -f /var/run/apache2/httpd.pid
# Remove unused certs
rm -vrf /mnt/docker-aio-config/certs
# Remove the php socket as safeguard
rm -vf /run/php.sock
# Fix caddy startup
if [ -d "/mnt/docker-aio-config/caddy/locks" ]; then
@@ -424,7 +395,8 @@ if [ -d "/mnt/docker-aio-config/caddy/locks" ]; then
fi
# Fix the Caddyfile format
caddy fmt --overwrite /Caddyfile
caddy fmt --overwrite /acme.Caddyfile
caddy fmt --overwrite /internal.Caddyfile
# Fix caddy log
chmod 777 /root

20
Containers/mastercontainer/supervisord.conf
View File

@@ -16,20 +16,20 @@ stderr_logfile_maxbytes=0
command=php-fpm
user=root
[program:apache]
# Stdout logging is disabled as otherwise the logs are spammed
stdout_logfile=NONE
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=httpd -DFOREGROUND
user=root
[program:caddy]
[program:caddy-internal]
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=/usr/bin/caddy run --config /Caddyfile
command=/usr/bin/caddy run --config /internal.Caddyfile
user=www-data
[program:caddy-acme]
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
command=/usr/bin/caddy run --config /acme.Caddyfile
user=www-data
[program:cron]

10
php/domain-validator.php
View File

@@ -7,15 +7,15 @@ if (isset($_GET['domain']) && is_string($_GET['domain'])) {
}
if (!str_contains($domain, '.')) {
http_response_code(400);
http_response_code(400);
} elseif (str_contains($domain, '/')) {
http_response_code(400);
http_response_code(400);
} elseif (str_contains($domain, ':')) {
http_response_code(400);
http_response_code(400);
} elseif (filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false) {
http_response_code(400);
http_response_code(400);
} elseif (filter_var($domain, FILTER_VALIDATE_IP)) {
http_response_code(400);
http_response_code(400);
} else {
// Commented because logging is disabled as otherwise all attempts will be logged which spams the logs
// error_log($domain . ' was accepted as valid domain.');