- includes/desec-register.twig renders the multi-step deSEC flow: enter email
(optionally an existing password), the awaiting-verification step, and the
account-registered step, with friendly messaging for the ambiguous "email
already registered" case (deSEC returns 202 either way to prevent enumeration).
- containers.twig includes the deSEC section under the domain-entry UI; index.php
passes the deSEC config/state (email, password, registered/awaiting flags) to
the view.
- Move the deSEC password reveal from an inline style to a CSS class (no inline
CSS/JS in templates) and bump the style.css cache-buster to v13 in layout.twig
and log.twig.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Add the server-side deSEC (dedyn.io) free dynamic-DNS flow so users without a
domain can obtain one from the AIO interface.
- DesecManager drives the full flow against the deSEC API, matching its real
semantics: account creation returns HTTP 202 + email verification (no token),
a token is obtained via /auth/login/ only after the email is verified, domain
registration handles 201/409, and a wildcard CNAME rrset is created for new
accounts. Existing accounts can be used by supplying a password.
- The "awaiting verification" step is derived from the stored credentials (email
+ generated password but no token and no domain yet), not a separate flag.
register() returns false for that state so the controller can re-render the
awaiting-verification UI instead of surfacing it as an error.
- DesecController exposes POST /api/desec/register; DependencyInjection wires the
manager; account credentials (email, generated password, token) are stored in
the AIO configuration and DESEC_TOKEN is exposed to the caddy container.
- The dynamic-DNS record is refreshed with the current public IP on container
start (DockerController) and via the cron path (Cron/UpdateDesecIp, cron.sh).
- Fix an undefined-variable bug in the desecToken/desecPassword config setters
that prevented credentials from being persisted.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
* Fix: prevent nginx proxy read timeout from blocking AIO container startup
When AIO runs behind an nginx reverse proxy and a user clicks Start,
image pulls produce no streaming output for minutes at a time. nginx's
proxy_read_timeout fires, drops the upstream connection, and PHP then
aborts on the next write attempt (ignore_user_abort defaults to false),
leaving all containers after the first one never started.
Two fixes:
1. startStreamingResponse(): add ignore_user_abort(true) so PHP never
terminates if the connection is already gone.
2. PullImage(): stream the Docker NDJSON pull response and write a
"Pulling image" heartbeat at most once every 5 s, keeping the nginx
connection alive. Also surfaces Docker-level stream errors that the
old buffered call silently ignored, guards against malformed
newline-free responses with a 1 MB buffer limit, and unifies the
duplicate catch-block retry logic.
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/4fd13605-63fb-4693-8a95-89ccec31f7d3
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
* As heartbeat send a dot regularly
Rather than repeating the message, send a "magic" dot, which gets
appended to the previous line.
Previously the heartbeats weren't sent regulary because reading the data
into a buffer caused a lag.
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Remove left-over constants
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Reduce timeout to stay within nginx's default timeout of 5s
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Fix duplicated library namespace inclusion
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Deal with preg_replace possibly returning null
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* update the version tag
Signed-off-by: Simon L. <szaimen@e.mail.de>
---------
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
Co-authored-by: Pablo Zmdl <pablo@nextcloud.com>
Co-authored-by: Simon L. <szaimen@e.mail.de>
and 'no' result in an empty env value, which the entrypoint's [ "$INSTALL_LATEST_MAJOR" = yes ] check treats as disabled, while any other value (e.g. the '34' set by the start button or upgrade button) still maps to yes.
Assisted-by: Claude
Flips isEuroofficeEnabled default to true and isCollaboraEnabled
default to false in ConfigurationManager.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: James Manuel <moodyjmz@users.noreply.github.com>
Fixes two issues from #8089:
- Add background-color to overlay-log so the container is visible
before text starts appearing
- Use monospace font in overlay iframe content for better log readability
- Bump CSS cache version to v12
- Enable xpack.security in Elasticsearch (was explicitly disabled)
- Add ELASTIC_PASSWORD env var so the built-in elastic user gets the password
- Disable HTTP SSL to keep plain HTTP while still enforcing basic auth
- Disable transport SSL (single-node setup)
- Update healthcheck to authenticate with elastic credentials
Simon L.