The deSEC entry <details> was moved up above the domain submit form, but the
#desec-modal container and desec-modal.js were left behind inside the
skip_domain_validation block. Move them up to sit directly after the entry
block so the open button, modal, and wiring script are always rendered
together (and present even when domain validation is skipped). This restores
the modal flow the Playwright tests drive via #desec-frame.
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Hide the "Your deSEC login credentials" block during the in-flight
register/verify steps — the credentials are still shown in the dedicated
"deSEC account credentials" section once the domain is registered.
Extract the deSEC domain info/dnsmasq-caution notice into a reusable include
and also show it at the top of the initial-install flow, directly above the
"download and start containers" explanation, while keeping it in the
Community Containers section where it already appeared.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
The email input was unstyled because input[type="email"] was missing from
the text/password input rules, and the deSEC form's inline-block inputs
flowed side by side. Add the email type to the input styling rules and lay
the deSEC modal form out as a vertical stack with full-width inputs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Move the deSEC "register a free domain" flow out of the inline containers
page form and into a modal backed by a dedicated /desec view loaded in an
iframe. The multi-step register -> verify -> domain process now re-renders
inside the modal, so the user can adjust the details and complete email
verification without reloading the whole page each step. Only once the
domain is fully registered does the view reload the parent containers page.
- add /desec route + desec.twig standalone view
- add desec-modal.js (open/close, backdrop + Escape) and desec-done.js
(parent reload on completion)
- redirect register POST to the /desec view so steps stay in the modal
- drop the redundant <details> wrapper in desec-register.twig, add heading
- style the modal and let <button class="button"> pick up button styles
- drive the modal iframe in the Playwright specs and update the QA checklist
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- desec-mock.mjs: a dependency-free Node mock of the deSEC API endpoints the code
uses, with the real status-code semantics (202 on account creation, 403 until
verified then 200 + token, 201/409 on domain creation) plus /__control hooks to
verify and reset state.
- desec-register.spec.js / desec-existing.spec.js drive the real AIO UI through
the register -> verify -> domain flow and the existing-account login flow;
desec-helpers.js holds the shared login helper. Each scenario ends by setting a
domain, so they run as separate CI steps with a re-seed in between.
- seed-desec-mock-config.php points desec_api_base / desec_update_url at the mock
(config key only, no env override, so production is unaffected) and seeds a
known master password, since seeding configuration.json makes AIO consider
itself already installed and /setup no longer shows a generated password.
- Both Playwright workflows start the mock, mount ./community-containers so the
caddy/dnsmasq definitions enabled by the flow are present, seed the config, and
run the two deSEC specs with a re-seed between them.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- caddy.json: pass DESEC_TOKEN to the caddy container so it can solve the DNS-01
challenge for the registered dedyn.io domain.
- community-containers.twig: when the domain was registered via deSEC, explain
that caddy and dnsmasq were enabled automatically and link the required dnsmasq
router change, with a caution to disable dnsmasq on publicly reachable hosts.
- compose.yaml: mention the built-in deSEC free domain option alongside Tailscale
in the reverse-proxy hint.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
- includes/desec-register.twig renders the multi-step deSEC flow: enter email
(optionally an existing password), the awaiting-verification step, and the
account-registered step, with friendly messaging for the ambiguous "email
already registered" case (deSEC returns 202 either way to prevent enumeration).
- containers.twig includes the deSEC section under the domain-entry UI; index.php
passes the deSEC config/state (email, password, registered/awaiting flags) to
the view.
- Move the deSEC password reveal from an inline style to a CSS class (no inline
CSS/JS in templates) and bump the style.css cache-buster to v13 in layout.twig
and log.twig.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Add the server-side deSEC (dedyn.io) free dynamic-DNS flow so users without a
domain can obtain one from the AIO interface.
- DesecManager drives the full flow against the deSEC API, matching its real
semantics: account creation returns HTTP 202 + email verification (no token),
a token is obtained via /auth/login/ only after the email is verified, domain
registration handles 201/409, and a wildcard CNAME rrset is created for new
accounts. Existing accounts can be used by supplying a password.
- The "awaiting verification" step is derived from the stored credentials (email
+ generated password but no token and no domain yet), not a separate flag.
register() returns false for that state so the controller can re-render the
awaiting-verification UI instead of surfacing it as an error.
- DesecController exposes POST /api/desec/register; DependencyInjection wires the
manager; account credentials (email, generated password, token) are stored in
the AIO configuration and DESEC_TOKEN is exposed to the caddy container.
- The dynamic-DNS record is refreshed with the current public IP on container
start (DockerController) and via the cron path (Cron/UpdateDesecIp, cron.sh).
- Fix an undefined-variable bug in the desecToken/desecPassword config setters
that prevented credentials from being persisted.
Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
* Fix: prevent nginx proxy read timeout from blocking AIO container startup
When AIO runs behind an nginx reverse proxy and a user clicks Start,
image pulls produce no streaming output for minutes at a time. nginx's
proxy_read_timeout fires, drops the upstream connection, and PHP then
aborts on the next write attempt (ignore_user_abort defaults to false),
leaving all containers after the first one never started.
Two fixes:
1. startStreamingResponse(): add ignore_user_abort(true) so PHP never
terminates if the connection is already gone.
2. PullImage(): stream the Docker NDJSON pull response and write a
"Pulling image" heartbeat at most once every 5 s, keeping the nginx
connection alive. Also surfaces Docker-level stream errors that the
old buffered call silently ignored, guards against malformed
newline-free responses with a 1 MB buffer limit, and unifies the
duplicate catch-block retry logic.
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/4fd13605-63fb-4693-8a95-89ccec31f7d3
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
* As heartbeat send a dot regularly
Rather than repeating the message, send a "magic" dot, which gets
appended to the previous line.
Previously the heartbeats weren't sent regulary because reading the data
into a buffer caused a lag.
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Remove left-over constants
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Reduce timeout to stay within nginx's default timeout of 5s
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Fix duplicated library namespace inclusion
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* Deal with preg_replace possibly returning null
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
* update the version tag
Signed-off-by: Simon L. <szaimen@e.mail.de>
---------
Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
Co-authored-by: Pablo Zmdl <pablo@nextcloud.com>
Co-authored-by: Simon L. <szaimen@e.mail.de>
and 'no' result in an empty env value, which the entrypoint's [ "$INSTALL_LATEST_MAJOR" = yes ] check treats as disabled, while any other value (e.g. the '34' set by the start button or upgrade button) still maps to yes.
Assisted-by: Claude
Flips isEuroofficeEnabled default to true and isCollaboraEnabled
default to false in ConfigurationManager.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: James Manuel <moodyjmz@users.noreply.github.com>
Fixes two issues from #8089:
- Add background-color to overlay-log so the container is visible
before text starts appearing
- Use monospace font in overlay iframe content for better log readability
- Bump CSS cache version to v12
Simon L.