desec-api-version-watch.yml is a scheduled workflow that watches the public
desec-stack "API Versions and Roadmap" table (no calls to the live deSEC API, so
it respects their ToS) and fails if it changes, prompting a review of the mock
and DesecManager against any new API version.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- desec-mock.mjs: a dependency-free Node mock of the deSEC API endpoints the code
uses, with the real status-code semantics (202 on account creation, 403 until
verified then 200 + token, 201/409 on domain creation) plus /__control hooks to
verify and reset state.
- desec-register.spec.js / desec-existing.spec.js drive the real AIO UI through
the register -> verify -> domain flow and the existing-account login flow;
desec-helpers.js holds the shared login helper. Each scenario ends by setting a
domain, so they run as separate CI steps with a re-seed in between.
- seed-desec-mock-config.php points desec_api_base / desec_update_url at the mock
(config key only, no env override, so production is unaffected) and seeds a
known master password, since seeding configuration.json makes AIO consider
itself already installed and /setup no longer shows a generated password.
- Both Playwright workflows start the mock, mount ./community-containers so the
caddy/dnsmasq definitions enabled by the flow are present, seed the config, and
run the two deSEC specs with a re-seed between them.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- caddy.json: pass DESEC_TOKEN to the caddy container so it can solve the DNS-01
challenge for the registered dedyn.io domain.
- community-containers.twig: when the domain was registered via deSEC, explain
that caddy and dnsmasq were enabled automatically and link the required dnsmasq
router change, with a caution to disable dnsmasq on publicly reachable hosts.
- compose.yaml: mention the built-in deSEC free domain option alongside Tailscale
in the reverse-proxy hint.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- includes/desec-register.twig renders the multi-step deSEC flow: enter email
(optionally an existing password), the awaiting-verification step, and the
account-registered step, with friendly messaging for the ambiguous "email
already registered" case (deSEC returns 202 either way to prevent enumeration).
- containers.twig includes the deSEC section under the domain-entry UI; index.php
passes the deSEC config/state (email, password, registered/awaiting flags) to
the view.
- Move the deSEC password reveal from an inline style to a CSS class (no inline
CSS/JS in templates) and bump the style.css cache-buster to v13 in layout.twig
and log.twig.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Add the server-side deSEC (dedyn.io) free dynamic-DNS flow so users without a
domain can obtain one from the AIO interface.
- DesecManager drives the full flow against the deSEC API, matching its real
semantics: account creation returns HTTP 202 + email verification (no token),
a token is obtained via /auth/login/ only after the email is verified, domain
registration handles 201/409, and a wildcard CNAME rrset is created for new
accounts. Existing accounts can be used by supplying a password.
- The "awaiting verification" step is derived from the stored credentials (email
+ generated password but no token and no domain yet), not a separate flag.
register() returns false for that state so the controller can re-render the
awaiting-verification UI instead of surfacing it as an error.
- DesecController exposes POST /api/desec/register; DependencyInjection wires the
manager; account credentials (email, generated password, token) are stored in
the AIO configuration and DESEC_TOKEN is exposed to the caddy container.
- The dynamic-DNS record is refreshed with the current public IP on container
start (DockerController) and via the cron path (Cron/UpdateDesecIp, cron.sh).
- Fix an undefined-variable bug in the desecToken/desecPassword config setters
that prevented credentials from being persisted.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
* Fix: prevent nginx proxy read timeout from blocking AIO container startup
When AIO runs behind an nginx reverse proxy and a user clicks Start,
image pulls produce no streaming output for minutes at a time. nginx's
proxy_read_timeout fires, drops the upstream connection, and PHP then
aborts on the next write attempt (ignore_user_abort defaults to false),
leaving all containers after the first one never started.
Two fixes:
1. startStreamingResponse(): add ignore_user_abort(true) so PHP never
terminates if the connection is already gone.
2. PullImage(): stream the Docker NDJSON pull response and write a
"Pulling image" heartbeat at most once every 5 s, keeping the nginx
connection alive. Also surfaces Docker-level stream errors that the
old buffered call silently ignored, guards against malformed
newline-free responses with a 1 MB buffer limit, and unifies the
duplicate catch-block retry logic.
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/4fd13605-63fb-4693-8a95-89ccec31f7d3
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
* As heartbeat send a dot regularly
Rather than repeating the message, send a "magic" dot, which gets
appended to the previous line.
Previously the heartbeats weren't sent regulary because reading the data
into a buffer caused a lag.
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Remove left-over constants
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Reduce timeout to stay within nginx's default timeout of 5s
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Fix duplicated library namespace inclusion
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Deal with preg_replace possibly returning null
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* update the version tag
Signed-off-by: Simon L. <szaimen@e.mail.de>
---------
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
Co-authored-by: Pablo Zmdl <pablo@nextcloud.com>
Co-authored-by: Simon L. <szaimen@e.mail.de>
* Add AzuraCast community container
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* Update Caddy readme to mention AzuraCast
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* azuracast: consolidate storage/* volumes into single storage volume
Replace seven granular mounts under /var/azuracast/storage with a single
nextcloud_aio_azuracast_storage volume, matching AzuraCast's official
docker-compose layout. Remove nextcloud_aio_azuracast_uploads from
backup_volumes (media files are captured via stations and AzuraCast's
own backup archives in /var/azuracast/backups).
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* azuracast: change HTTP/HTTPS ports to 10080/10443, expose on host
Use ports recommended by AzuraCast docs for reverse proxy deployments.
Expose port 10080 (HTTP) with %APACHE_IP_BINDING% following the vaultwarden
pattern, and port 10443 (HTTPS) on all interfaces for direct access.
Update readme accordingly.
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* azuracast: replace shared volume with %NEXTCLOUD_MOUNT%, document filesystem sharing
Replace the named volume nextcloud_aio_azuracast_shared with the AIO-native
%NEXTCLOUD_MOUNT% mechanism. The volume is silently skipped if NEXTCLOUD_MOUNT
is not configured in AIO.
Update readme.md:
- Document NEXTCLOUD_MOUNT as the advanced file sharing approach, with setup
instructions and a comparison to the SFTP approach
- Clarify default access behavior: files (mode 644) are world-readable by both
processes; some AzuraCast directories (mode 700) require intervention
- Document POSIX ACL commands for unlocking read-only or bidirectional access
on specific paths, with a note that they must be re-run after structural
changes by AzuraCast
- Minor wording and formatting improvements throughout
Tested on a live AzuraCast instance: rename and bidirectional move confirmed
working after ACL application; containers start correctly without UMASK override.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* Update community-containers/azuracast/azuracast.json
Do not expose internal HTTP port 10080 on host.
Co-authored-by: Simon L. <szaimen@e.mail.de>
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* azuracast: add to community containers overview diagram
Add AzuraCast entry to the Media group of the mermaid overview
diagram in community-containers/readme.md, as requested by szaimen.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
* fix the json
Signed-off-by: Simon L. <szaimen@e.mail.de>
* Apply suggestion from @szaimen
Signed-off-by: Simon L. <szaimen@e.mail.de>
* Apply suggestion from @szaimen
Signed-off-by: Simon L. <szaimen@e.mail.de>
---------
Signed-off-by: Nicolas Binette <biguenique@nuee.cc>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Simon L. <szaimen@e.mail.de>
Simon L.