The euro-office image intends /var/www/euro-office/Data to be persistent
(its entrypoint stores the generated JWT secret and WOPI keys there and
prints 'Mount ${DATA_DIR} as a volume to persist it across restarts');
the generate-allfonts script also scans Data/custom-fonts for user-provided
fonts on every container start.
Without a volume, custom fonts and the generated secrets are lost whenever
the container is recreated on update. Mount a dedicated volume and include
it in backup_volumes (it is small: keys + fonts), unlike the reinstallable
documentserver volume.
The schema's path pattern is extended to allow capital letters because the
Data directory inside the image is capitalized.
Resolves the persistence gap discussed in #8493.
Signed-off-by: deschoene <74868758+deschoene@users.noreply.github.com>
- Enable xpack.security in Elasticsearch (was explicitly disabled)
- Add ELASTIC_PASSWORD env var so the built-in elastic user gets the password
- Disable HTTP SSL to keep plain HTTP while still enforcing basic auth
- Disable transport SSL (single-node setup)
- Update healthcheck to authenticate with elastic credentials
- Replace TCP-only nc healthcheck with HTTP cluster health API check via curl,
so the container is only marked healthy when ES is actually ready (not just
when the TCP port is open during startup)
- Add indices.fielddata.cache.size=20% to cap field-data cache and prevent
unbounded heap growth / OOM kills on large datasets
- Add indices.memory.index_buffer_size=20% to improve bulk indexing throughput
by buffering more data in memory before flushing to disk
- Add thread_pool.write.queue_size=1000 to avoid rejected indexing requests
when Nextcloud's background jobs submit many files simultaneously
Changes applied to: Containers/fulltextsearch/healthcheck.sh,
php/containers.json, manual-install/latest.yml
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/a036678d-a9f5-4db3-8cc6-3e3d52f4e97f
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
We want a display-name for all containers in the overlay-log, but still want
to exclude some containers from the list on top of the web UI.
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
When NEXTCLOUD_TRUSTED_CACERTS_DIR is set on the mastercontainer,
the custom CA certificates are now also mounted into the Talk container.
Since the Talk container runs with a read-only root filesystem,
update-ca-certificates cannot be used. Instead, the startup script
copies the system CA bundle to /tmp (tmpfs), appends any custom
certificates from /usr/local/share/ca-certificates/, and sets
SSL_CERT_FILE to point Go's TLS stack at the extended bundle.
This allows the signaling server to verify TLS connections to
Nextcloud instances that use private/internal CA certificates,
without requiring skipverify=true.
Signed-off-by: Tomas <16553087+michnovka@users.noreply.github.com>
Simon L.