Merge pull request #6902 from nextcloud/jtr/refactor-cont-nc-entrypoint

refactor(nextcloud): Tidy up entrypoint.sh error/log output

.github/workflows/helm-release.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Turnstyle
-        uses: softprops/turnstyle@bff843227669a0c34c7f791ebd53a4b7c2a3febd # v2
+        uses: softprops/turnstyle@9d692f15fa9f84928799bccac2dba6565e024bdf # v2
         with:
           continue-after-seconds: 180
         env:

Containers/apache/start.sh

@@ -66,6 +66,11 @@ caddy fmt --overwrite /tmp/Caddyfile
 # Add caddy path
 mkdir -p /mnt/data/caddy/
 
+# Fix caddy startup
+if [ -d "/mnt/data/caddy/locks" ]; then
+    rm -rf /mnt/data/caddy/locks/*
+fi
+
 # Fix apache startup
 rm -f /usr/local/apache2/logs/httpd.pid
 

Containers/collabora/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # From a file located probably somewhere here: https://github.com/CollaboraOnline/online/blob/master/docker/from-packages/Dockerfile
-FROM collabora/code:25.04.5.2.1
+FROM collabora/code:25.04.6.1.1
 
 USER root
 ARG DEBIAN_FRONTEND=noninteractive

Containers/docker-socket-proxy/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM haproxy:3.2.4-alpine
+FROM haproxy:3.2.6-alpine
 
 # hadolint ignore=DL3002
 USER root

Containers/fulltextsearch/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # Probably from here https://github.com/elastic/elasticsearch/blob/main/distribution/docker/src/docker/Dockerfile
-FROM elasticsearch:8.19.4
+FROM elasticsearch:8.19.5
 
 USER root
 

Containers/imaginary/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM golang:1.25.1-alpine3.22 AS go
+FROM golang:1.25.2-alpine3.22 AS go
 
 ENV IMAGINARY_HASH=1d4e251cfcd58ea66f8361f8721d7b8cc85002a3
 

Containers/mastercontainer/Dockerfile

@@ -1,12 +1,12 @@
 # syntax=docker/dockerfile:latest
 # Docker CLI is a requirement
-FROM docker:28.4.0-cli AS docker
+FROM docker:28.5.0-cli AS docker
 
 # Caddy is a requirement
 FROM caddy:2.10.2-alpine AS caddy
 
 # From https://github.com/docker-library/php/blob/master/8.4/alpine3.22/fpm/Dockerfile
-FROM php:8.4.12-fpm-alpine3.22
+FROM php:8.4.13-fpm-alpine3.22
 
 EXPOSE 80
 EXPOSE 8080

Containers/mastercontainer/start.sh

@@ -375,6 +375,11 @@ export TZ=Etc/UTC
 # Fix apache startup
 rm -f /var/run/apache2/httpd.pid
 
+# Fix caddy startup
+if [ -d "/mnt/docker-aio-config/caddy/locks" ]; then
+    rm -rf /mnt/docker-aio-config/caddy/locks/*
+fi
+
 # Fix the Caddyfile format
 caddy fmt --overwrite /Caddyfile
 

Containers/nextcloud/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM php:8.3.25-fpm-alpine3.22
+FROM php:8.3.26-fpm-alpine3.22
 
 ENV PHP_MEMORY_LIMIT=512M
 ENV PHP_UPLOAD_LIMIT=16G

Containers/nextcloud/config/postgres.config.php

@@ -0,0 +1,9 @@
+<?php
+if (getenv('NEXTCLOUD_TRUSTED_CERTIFICATES_POSTGRES')) {
+  $CONFIG = array(
+    'pgsql_ssl' => array(
+      'mode' => 'verify-ca',
+      'rootcert' => '/var/www/html/data/certificates/POSTGRES',
+    ),
+  );
+}

Containers/nextcloud/config/s3.config.php

@@ -4,8 +4,9 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
   $use_path = getenv('OBJECTSTORE_S3_USEPATH_STYLE');
   $use_legacyauth = getenv('OBJECTSTORE_S3_LEGACYAUTH');
   $autocreate = getenv('OBJECTSTORE_S3_AUTOCREATE');
+  $multibucket = getenv('OBJECTSTORE_S3_MULTIBUCKET');
   $CONFIG = array(
-    'objectstore' => array(
+    $multibucket === 'true' ? 'objectstore_multibucket' : 'objectstore' => array(
       'class' => '\OC\Files\ObjectStore\S3',
       'arguments' => array(
         'bucket' => getenv('OBJECTSTORE_S3_BUCKET'),
@@ -16,12 +17,12 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
         'port' => getenv('OBJECTSTORE_S3_PORT') ?: '',
         'storageClass' => getenv('OBJECTSTORE_S3_STORAGE_CLASS') ?: '',
         'objectPrefix' => getenv("OBJECTSTORE_S3_OBJECT_PREFIX") ? getenv("OBJECTSTORE_S3_OBJECT_PREFIX") : "urn:oid:",
-        'autocreate' => (strtolower($autocreate) === 'false' || $autocreate == false) ? false : true,
-        'use_ssl' => (strtolower($use_ssl) === 'false' || $use_ssl == false) ? false : true,
+        'autocreate' => strtolower($autocreate) !== 'false',
+        'use_ssl' => strtolower($use_ssl) !== 'false',
         // required for some non Amazon S3 implementations
-        'use_path_style' => $use_path == true && strtolower($use_path) !== 'false',
+        'use_path_style' => strtolower($use_path) === 'true',
         // required for older protocol versions
-        'legacy_auth' => $use_legacyauth == true && strtolower($use_legacyauth) !== 'false'
+        'legacy_auth' => strtolower($use_legacyauth) === 'true'
       )
     )
   );

Containers/nextcloud/entrypoint.sh

@@ -25,31 +25,34 @@ if [ "$DATABASE_TYPE" = postgres ]; then
     export DATABASE_TYPE=pgsql
 fi
 
-# Only start container if redis is accessible
+# Only start container if Redis is accessible
 # shellcheck disable=SC2153
 while ! nc -z "$REDIS_HOST" "6379"; do
-    echo "Waiting for redis to start..."
+    echo "Waiting for Redis to start..."
     sleep 5
 done
 
 # Check permissions in ncdata
-touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
-if ! [ -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" ]; then
-    echo "The www-data user doesn't seem to have access rights in the datadir.
-Most likely are the files located on a drive that does not follow linux permissions.
-Please adjust the permissions like mentioned below.
-The found permissions are:
-$(stat -c "%u:%g %a" "$NEXTCLOUD_DATA_DIR")
-(userID:groupID permissions)
-but they should be:
-33:0 750
-(userID:groupID permissions)
-Also make sure that the parent directories on the host of the directory that you've chosen as datadir are publicly readable with e.g. 'sudo chmod +r /mnt' (adjust the command accordingly to your case) and the same for all subdirectories.
-Additionally, if you want to use a Fuse-mount as datadir, set 'allow_other' as additional mount option.
-For SMB/CIFS mounts as datadir, see https://github.com/nextcloud/all-in-one#can-i-use-a-cifssmb-share-as-nextclouds-datadir"
+test_file="$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
+touch "$test_file"
+if ! [ -f "$test_file" ]; then
+    echo "The www-data user does not appear to have access rights to the data directory."
+    echo "It is possible that the files are on a filesystem that does not support standard Linux permissions,"
+    echo "or the permissions simply need to be adjusted. Please change the permissions as described below."
+    echo "Current permissions are:"
+    stat -c "%u:%g %a" "$NEXTCLOUD_DATA_DIR"
+    echo "(userID:groupID permissions)"
+    echo "They should be:"
+    echo "33:0 750"
+    echo "(userID:groupID permissions)"
+    echo "Also, ensure that all parent directories on the host of your chosen data directory are publicly readable."
+    echo "For example: sudo chmod +r /mnt  (adjust this command as needed)."
+    echo "If you want to use a FUSE mount as the data directory, add 'allow_other' as an additional mount option."
+    echo "For SMB/CIFS mounts as the data directory, see:"
+    echo "  https://github.com/nextcloud/all-in-one#can-i-use-a-cifssmb-share-as-nextclouds-datadir"
     exit 1
 fi
-rm "$NEXTCLOUD_DATA_DIR/this-is-a-test-file"
+rm -f "$test_file"
 
 if [ -f /var/www/html/version.php ]; then
     # shellcheck disable=SC2016
@@ -71,26 +74,31 @@ fi
 
 # Don't start the container if Nextcloud is not compatible with the PHP version
 if [ -f "/var/www/html/lib/versioncheck.php" ] && ! php /var/www/html/lib/versioncheck.php; then
-    echo "It seems like your installed Nextcloud is not compatible with the by the container provided PHP version."
-    echo "This most likely happened because you tried to restore an old Nextcloud version from backup that is not compatible with the PHP version that comes with the container."
-    echo "Please try to restore a more recent backup which contains a Nextcloud version that is compatible with the PHP version that comes with the container."
-    echo "If you do not have a more recent backup, feel free to have a look at this documentation: https://github.com/nextcloud/all-in-one/blob/main/manual-upgrade.md"
+    echo "Your installed Nextcloud version is not compatible with the PHP version provided by this image."
+    echo "This typically occurs when you restore an older Nextcloud backup that does not support the"
+    echo "PHP version included in this image."
+    echo "Please restore a more recent backup that includes a compatible Nextcloud version."
+    echo "If you do not have a more recent backup, refer to the manual upgrade documentation:"
+    echo "  https://github.com/nextcloud/all-in-one/blob/main/manual-upgrade.md"
     exit 1
 fi
 
 # Do not start the container if the last update failed
 if [ -f "$NEXTCLOUD_DATA_DIR/update.failed" ]; then
     echo "The last Nextcloud update failed."
-    echo "Please restore from backup and try again!"
-    echo "If you do not have a backup in place, you can simply delete the update.failed file in the datadir which will allow the container to start again."
+    echo "Please restore from a backup and try again."
+    echo "If you do not have a backup, you can delete the update.failed file in the data directory"
+    echo "to allow the container to start again."
     exit 1
 fi
 
 # Do not start the container if the install failed
 if [ -f "$NEXTCLOUD_DATA_DIR/install.failed" ]; then
     echo "The initial Nextcloud installation failed."
-    echo "Please reset AIO properly and try again. For further clues what went wrong, check the logs above."
-    echo "See https://github.com/nextcloud/all-in-one#how-to-properly-reset-the-instance"
+    echo "For more information about what went wrong, check the logs above."
+    echo "Please reset AIO properly and try again."
+    echo "See:"
+    echo "  https://github.com/nextcloud/all-in-one#how-to-properly-reset-the-instance"
     exit 1
 fi
 
@@ -143,7 +151,7 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
         if [ "$installed_version" != "0.0.0.0" ]; then
 # Check connection to appstore start # Do not remove or change this line!
             while true; do
-                echo -e "Checking connection to appstore"
+                echo -e "Checking connection to the app store..."
                 APPSTORE_URL="https://apps.nextcloud.com/api/v1"
                 if grep -q appstoreurl /var/www/html/config/config.php; then
                     set -x
@@ -154,10 +162,10 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
                 CURL_STATUS="$(curl -LI "$APPSTORE_URL"/apps.json -o /dev/null -w '%{http_code}\n' -s)"
                 if [[ "$CURL_STATUS" = "200" ]]
                 then
-                    echo "Appstore is reachable"
+                    echo "App store is reachable."
                     break
                 else
-                    echo "Curl didn't produce a 200 status, is appstore reachable?"
+                    echo "Curl did not return a 200 status. Is the app store reachable?"
                     sleep 5
                 fi
             done
@@ -167,21 +175,21 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
 
             php /var/www/html/occ maintenance:mode --off
 
-            echo "Getting and backing up the status of apps for later, this might take a while..."
+            echo "Getting and backing up the status of apps for later; this might take a while..."
             NC_APPS="$(find /var/www/html/custom_apps/ -type d -maxdepth 1 -mindepth 1 | sed 's|/var/www/html/custom_apps/||g')"
             if [ -z "$NC_APPS" ]; then
-                echo "No apps detected, aborting export of app status..."
+                echo "No apps detected. Aborting export of app status..."
                 APPSTORAGE="no-export-done"
             else
                 mapfile -t NC_APPS_ARRAY <<< "$NC_APPS"
                 declare -Ag APPSTORAGE
-                echo "Disabling apps before the update in order to make the update procedure more safe. This can take a while..."
+                echo "Disabling apps before the update to make the update procedure safer. This can take a while..."
                 for app in "${NC_APPS_ARRAY[@]}"; do
                     if APPSTORAGE[$app]="$(php /var/www/html/occ config:app:get "$app" enabled)"; then
                         php /var/www/html/occ app:disable "$app"
                     else
                         APPSTORAGE[$app]=""
-                        echo "Not disabling $app because the occ command to get the enabled state was failing."
+                        echo "Not disabling $app because the occ command to get its enabled state failed."
                     fi
                 done
             fi
@@ -195,8 +203,13 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
             run_upgrade_if_needed_due_to_app_update
         fi
 
-        echo "Initializing nextcloud $image_version ..."
-        rsync -rlD --delete --exclude-from=/upgrade.exclude "$SOURCE_LOCATION/" /var/www/html/
+        echo "Initializing Nextcloud $image_version ..."
+
+        # Copy over initial data from Nextcloud archive
+        rsync -rlD --delete \
+            --exclude-from=/upgrade.exclude \
+            "$SOURCE_LOCATION/" \
+            /var/www/html/
 
         # Copy custom_apps from Nextcloud archive
         if ! directory_empty "$SOURCE_LOCATION/custom_apps"; then
@@ -204,22 +217,47 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
             for app in "$SOURCE_LOCATION/custom_apps"/*; do
                 app_id="$(basename "$app")"
                 mkdir -p "/var/www/html/custom_apps/$app_id"
-                rsync -rlD --delete --include "/$app_id/" --exclude '/*' "$SOURCE_LOCATION/custom_apps/" /var/www/html/custom_apps/
+                rsync -rlD --delete \
+                    --include "/$app_id/" \
+                    --exclude '/*' \
+                    "$SOURCE_LOCATION/custom_apps/" \
+                    /var/www/html/custom_apps/
             done
             set +x
         fi
 
-        # Copy over initial data from Nextcloud archive
+        # Copy these from Nextcloud archive if they don't exist yet (i.e. new install)
         for dir in config data custom_apps themes; do
             if [ ! -d "/var/www/html/$dir" ] || directory_empty "/var/www/html/$dir"; then
-                rsync -rlD --include "/$dir/" --exclude '/*' "$SOURCE_LOCATION/" /var/www/html/
+                rsync -rlD \
+                    --include "/$dir/" \
+                    --exclude '/*' \
+                    "$SOURCE_LOCATION/" \
+                    /var/www/html/
             fi
         done
-        rsync -rlD --delete --include '/config/' --exclude '/*' --exclude '/config/CAN_INSTALL' --exclude '/config/config.sample.php' --exclude '/config/config.php' "$SOURCE_LOCATION/" /var/www/html/
-        rsync -rlD --include '/version.php' --exclude '/*' "$SOURCE_LOCATION/" /var/www/html/
+
+        rsync -rlD --delete \
+            --include '/config/' \
+            --exclude '/*' \
+            --exclude '/config/CAN_INSTALL' \
+            --exclude '/config/config.sample.php' \
+            --exclude '/config/config.php' \
+            "$SOURCE_LOCATION/" \
+            /var/www/html/
+
+        rsync -rlD \
+            --include '/version.php' \
+            --exclude '/*' \
+            "$SOURCE_LOCATION/" \
+            /var/www/html/
+
         echo "Initializing finished"
 
-        #install
+        ################
+        # Fresh Install
+        ################
+        
         if [ "$installed_version" = "0.0.0.0" ]; then
             echo "New Nextcloud instance."
 
@@ -233,22 +271,37 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
                 INSTALL_OPTIONS+=(--data-dir "$NEXTCLOUD_DATA_DIR")
             fi
 
-            # We do our own permission check so the permission check is not needed
-            cat << DATADIR_PERMISSION_CONF > /var/www/html/config/datadir.permission.config.php
+        # Skip the default permission check (we do our own)
+        cat > /var/www/html/config/datadir.permission.config.php <<'EOF'
 <?php
-    \$CONFIG = array (
-    'check_data_directory_permissions' => false
-);
-DATADIR_PERMISSION_CONF
+    $CONFIG = array (
+        'check_data_directory_permissions' => false
+    );
+EOF
+
+            # Write out postgres root cert
+            if [ -n "$NEXTCLOUD_TRUSTED_CERTIFICATES_POSTGRES" ]; then
+                mkdir /var/www/html/data/certificates
+                echo "$NEXTCLOUD_TRUSTED_CERTIFICATES_POSTGRES" > "/var/www/html/data/certificates/POSTGRES"
+            fi
 
             echo "Installing with $DATABASE_TYPE database"
             # Set a default value for POSTGRES_PORT
             if [ -z "$POSTGRES_PORT" ]; then
-              POSTGRES_PORT=5432
+                POSTGRES_PORT=5432
             fi
-            # shellcheck disable=SC2153
-            INSTALL_OPTIONS+=(--database "$DATABASE_TYPE" --database-name "$POSTGRES_DB" --database-user "$POSTGRES_USER" --database-pass "$POSTGRES_PASSWORD" --database-host "$POSTGRES_HOST" --database-port "$POSTGRES_PORT")
 
+            # Add database options to INSTALL_OPTIONS
+            # shellcheck disable=SC2153
+            INSTALL_OPTIONS+=(
+                --database "$DATABASE_TYPE"
+                --database-name "$POSTGRES_DB"
+                --database-user "$POSTGRES_USER"
+                --database-pass "$POSTGRES_PASSWORD"
+                --database-host "$POSTGRES_HOST"
+                --database-port "$POSTGRES_PORT"
+            )
+            
             echo "Starting Nextcloud installation..."
             if ! php /var/www/html/occ maintenance:install "${INSTALL_OPTIONS[@]}"; then
                 echo "Installation of Nextcloud failed!"
@@ -270,7 +323,7 @@ DATADIR_PERMISSION_CONF
 
                 if [ "$try" -ge "$max_retries" ]; then
                     echo "Installation of Nextcloud failed!"
-                    echo "Install errors: $(cat /var/www/html/data/nextcloud.log)"
+                    echo "Installation errors: $(cat /var/www/html/data/nextcloud.log)"
                     touch "$NEXTCLOUD_DATA_DIR/install.failed"
                     exit 1
                 fi
@@ -306,10 +359,12 @@ DATADIR_PERMISSION_CONF
                 installed_version="$(php -r 'require "/var/www/html/version.php"; echo implode(".", $OC_Version);')"
                 INSTALLED_MAJOR="${installed_version%%.*}"
                 IMAGE_MAJOR="${image_version%%.*}"
+                # If a valid upgrade path, trigger the Nextcloud built-in Updater
                 if ! [ "$INSTALLED_MAJOR" -gt "$IMAGE_MAJOR" ]; then
                     php /var/www/html/updater/updater.phar --no-interaction --no-backup
                     if ! php /var/www/html/occ -V || php /var/www/html/occ status | grep maintenance | grep -q 'true'; then
                         echo "Installation of Nextcloud failed!"
+                        # TODO: Add a hint here about what to do / where to look / updater.log? 
                         touch "$NEXTCLOUD_DATA_DIR/install.failed"
                         exit 1
                     fi
@@ -386,11 +441,11 @@ DATADIR_PERMISSION_CONF
         #upgrade
         else
             touch "$NEXTCLOUD_DATA_DIR/update.failed"
-            echo "Upgrading nextcloud from $installed_version to $image_version..."
+            echo "Upgrading Nextcloud from $installed_version to $image_version..."
             php /var/www/html/occ config:system:delete integrity.check.disabled
             if ! php /var/www/html/occ upgrade || ! php /var/www/html/occ -V; then
                 echo "Upgrade failed. Please restore from backup."
-                bash /notify.sh "Nextcloud update to $image_version failed!" "Please restore from backup!"
+                bash /notify.sh "Nextcloud update to $image_version failed!" "Please restore from backup."
                 exit 1
             fi
 
@@ -398,7 +453,7 @@ DATADIR_PERMISSION_CONF
             installed_version="$(php -r 'require "/var/www/html/version.php"; echo implode(".", $OC_Version);')"
 
             rm "$NEXTCLOUD_DATA_DIR/update.failed"
-            bash /notify.sh "Nextcloud update to $image_version successful!" "Feel free to inspect the Nextcloud container logs for more info."
+            bash /notify.sh "Nextcloud update to $image_version successful!" "You may inspect the Nextcloud container logs for more information."
 
             php /var/www/html/occ app:update --all
 
@@ -406,7 +461,7 @@ DATADIR_PERMISSION_CONF
 
             # Restore app status
             if [ "${APPSTORAGE[0]}" != "no-export-done" ]; then
-                echo "Restoring the status of apps. This can take a while..."
+                echo "Restoring app statuses. This may take a while..."
                 for app in "${!APPSTORAGE[@]}"; do
                     if [ -n "${APPSTORAGE[$app]}" ]; then
                         if [ "${APPSTORAGE[$app]}" != "no" ]; then
@@ -418,13 +473,13 @@ DATADIR_PERMISSION_CONF
                                     php /var/www/html/occ maintenance:mode --off
                                 fi
                                 run_upgrade_if_needed_due_to_app_update
-                                echo "The $app app could not get enabled. Probably because it is not compatible with the new Nextcloud version."
+                                echo "The $app app could not be re-enabled, probably because it is not compatible with the new Nextcloud version."
                                 if [ "$app" = apporder ]; then
                                     CUSTOM_HINT="The apporder app was deprecated. A possible replacement is the side_menu app, aka 'Custom menu'."
                                 else
-                                    CUSTOM_HINT="Most likely because it is not compatible with the new Nextcloud version."
+                                    CUSTOM_HINT="Most likely, it is not compatible with the new Nextcloud version."
                                 fi
-                                bash /notify.sh "Could not enable the $app app after the Nextcloud update!" "$CUSTOM_HINT Feel free to look at the Nextcloud update logs and force-enable the app again from the app-store UI."
+                                bash /notify.sh "Could not re-enable the $app app after the Nextcloud update!" "$CUSTOM_HINT Feel free to review the Nextcloud update logs and force-enable the app again if you wish."
                                 continue
                             fi
                             # Only restore the group settings, if the app was enabled (and is thus compatible with the new NC version)
@@ -446,7 +501,7 @@ DATADIR_PERMISSION_CONF
             php /var/www/html/occ config:app:set updatenotification notify_groups --value="[]"
 
             # Apply optimization
-            echo "Doing some optimizations..."
+            echo "Performing some optimizations..."
             if [ "$NEXTCLOUD_SKIP_DATABASE_OPTIMIZATION" != yes ]; then
                 php /var/www/html/occ maintenance:repair --include-expensive
                 php /var/www/html/occ db:add-missing-indices
@@ -477,10 +532,10 @@ if [ -z "$OBJECTSTORE_S3_BUCKET" ] && [ -z "$OBJECTSTORE_SWIFT_URL" ]; then
     # Check if appdata is present
     # If not, something broke (e.g. changing ncdatadir after aio was first started)
     if [ -z "$(find "$NEXTCLOUD_DATA_DIR/" -maxdepth 1 -mindepth 1 -type d -name "appdata_*")" ]; then
-        echo "Appdata is not present. Did you maybe change the datadir after the initial Nextcloud installation? This is not supported!"
+        echo "Appdata is not present. Did you change the datadir after the initial Nextcloud installation? This is not supported!"
         echo "See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir"
-        echo "If you adjusted the datadir to be located on an external drive, make sure that the drive is still mounted!"
-        echo "In the datadir was found:"
+        echo "If you moved the datadir to an external drive, make sure that the drive is still mounted."
+        echo "The following was found in the datadir:"
         ls -la "$NEXTCLOUD_DATA_DIR/"
         exit 1
     fi
@@ -672,7 +727,7 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
             fi
         fi
     else
-        echo "Warning: No ipv4-address found for $COLLABORA_HOST."
+        echo "Warning: No IPv4 address found for $COLLABORA_HOST."
     fi
     if [ -n "$COLLABORA_IPv6_ADDRESS" ]; then
         if ! echo "$COLLABORA_ALLOW_LIST" | grep -q "$COLLABORA_IPv6_ADDRESS"; then
@@ -683,7 +738,7 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
             fi
         fi
     else
-        echo "No ipv6-address found for $COLLABORA_HOST."
+        echo "No IPv6 address found for $COLLABORA_HOST."
     fi
     if [ -n "$COLLABORA_ALLOW_LIST" ]; then
         PRIVATE_IP_RANGES='127.0.0.1/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,fd00::/8,::1'
@@ -697,7 +752,7 @@ if [ "$COLLABORA_ENABLED" = 'yes' ]; then
         fi
         php /var/www/html/occ config:app:set richdocuments wopi_allowlist --value="$COLLABORA_ALLOW_LIST"
     else
-        echo "Warning: wopi_allowlist is empty which should not be the case!"
+        echo "Warning: wopi_allowlist is empty; this should not be the case!"
     fi
 else
     if [ "$REMOVE_DISABLED_APPS" = yes ] && [ -d "/var/www/html/custom_apps/richdocuments" ]; then
@@ -707,15 +762,20 @@ fi
 
 # OnlyOffice
 if [ "$ONLYOFFICE_ENABLED" = 'yes' ]; then
+    # Determine OnlyOffice port based on host pattern
     if echo "$ONLYOFFICE_HOST" | grep -q "nextcloud-.*-onlyoffice"; then
         ONLYOFFICE_PORT=80
     else
         ONLYOFFICE_PORT=443
     fi
+
+    # Wait for OnlyOffice to become available
     while ! nc -z "$ONLYOFFICE_HOST" "$ONLYOFFICE_PORT"; do
-        echo "waiting for OnlyOffice to become available..."
+        echo "Waiting for OnlyOffice to become available..."
         sleep 5
     done
+
+    # Install or enable OnlyOffice app as needed
     if ! [ -d "/var/www/html/custom_apps/onlyoffice" ]; then
         php /var/www/html/occ app:install onlyoffice
     elif [ "$(php /var/www/html/occ config:app:get onlyoffice enabled)" != "yes" ]; then
@@ -723,16 +783,25 @@ if [ "$ONLYOFFICE_ENABLED" = 'yes' ]; then
     elif [ "$SKIP_UPDATE" != 1 ]; then
         php /var/www/html/occ app:update onlyoffice
     fi
+
+    # Set OnlyOffice configuration
     php /var/www/html/occ config:system:set onlyoffice jwt_secret --value="$ONLYOFFICE_SECRET"
     php /var/www/html/occ config:app:set onlyoffice jwt_secret --value="$ONLYOFFICE_SECRET"
     php /var/www/html/occ config:system:set onlyoffice jwt_header --value="AuthorizationJwt"
+
+    # Adjust the OnlyOffice host if using internal pattern
     if echo "$ONLYOFFICE_HOST" | grep -q "nextcloud-.*-onlyoffice"; then
         ONLYOFFICE_HOST="$NC_DOMAIN/onlyoffice"
         export ONLYOFFICE_HOST
     fi
+
     php /var/www/html/occ config:app:set onlyoffice DocumentServerUrl --value="https://$ONLYOFFICE_HOST"
 else
-    if [ "$REMOVE_DISABLED_APPS" = yes ] && [ -d "/var/www/html/custom_apps/onlyoffice" ] && [ -n "$ONLYOFFICE_SECRET" ] && [ "$(php /var/www/html/occ config:system:get onlyoffice jwt_secret)" = "$ONLYOFFICE_SECRET" ]; then
+    # Remove OnlyOffice app if disabled and removal is requested
+    if [ "$REMOVE_DISABLED_APPS" = yes ] && \
+       [ -d "/var/www/html/custom_apps/onlyoffice" ] && \
+       [ -n "$ONLYOFFICE_SECRET" ] && \
+       [ "$(php /var/www/html/occ config:system:get onlyoffice jwt_secret)" = "$ONLYOFFICE_SECRET" ]; then
         php /var/www/html/occ app:remove onlyoffice
     fi
 fi
@@ -778,7 +847,7 @@ fi
 if [ -d "/var/www/html/custom_apps/spreed" ]; then
     if [ "$TALK_RECORDING_ENABLED" = 'yes' ]; then
         while ! nc -z "$TALK_RECORDING_HOST" 1234; do
-            echo "waiting for Talk Recording to become available..."
+            echo "Waiting for Talk Recording to become available..."
             sleep 5
         done
         # TODO: migrate to occ command if that becomes available
@@ -793,12 +862,12 @@ fi
 if [ "$CLAMAV_ENABLED" = 'yes' ]; then
     count=0
     while ! nc -z "$CLAMAV_HOST" 3310 && [ "$count" -lt 90 ]; do
-        echo "waiting for clamav to become available..."
+        echo "Waiting for ClamAV to become available..."
         count=$((count+5))
         sleep 5
     done
     if [ "$count" -ge 90 ]; then
-        echo "Clamav did not start in time. Skipping initialization and disabling files_antivirus app."
+        echo "ClamAV did not start in time. Skipping initialization and disabling files_antivirus app."
         php /var/www/html/occ app:disable files_antivirus
     else
         if ! [ -d "/var/www/html/custom_apps/files_antivirus" ]; then
@@ -814,6 +883,9 @@ if [ "$CLAMAV_ENABLED" = 'yes' ]; then
         php /var/www/html/occ config:app:set files_antivirus av_stream_max_length --value="$CLAMAV_MAX_SIZE"
         php /var/www/html/occ config:app:set files_antivirus av_max_file_size --value="$CLAMAV_MAX_SIZE"
         php /var/www/html/occ config:app:set files_antivirus av_infected_action --value="only_log"
+        if [ -n "$CLAMAV_BLOCKLISTED_DIRECTORIES" ]; then
+            php /var/www/html/occ config:app:set files_antivirus av_blocklisted_directories --value="$CLAMAV_BLOCKLISTED_DIRECTORIES"
+        fi
     fi
 else
     if [ "$REMOVE_DISABLED_APPS" = yes ] && [ -d "/var/www/html/custom_apps/files_antivirus" ]; then
@@ -842,7 +914,7 @@ fi
 if [ "$FULLTEXTSEARCH_ENABLED" = 'yes' ]; then
     count=0
     while ! nc -z "$FULLTEXTSEARCH_HOST" "$FULLTEXTSEARCH_PORT" && [ "$count" -lt 90 ]; do
-        echo "waiting for Fulltextsearch to become available..."
+        echo "Waiting for Fulltextsearch to become available..."
         count=$((count+5))
         sleep 5
     done
@@ -879,14 +951,14 @@ if [ "$FULLTEXTSEARCH_ENABLED" = 'yes' ]; then
 
         # Do the index
         if ! [ -f "$NEXTCLOUD_DATA_DIR/fts-index.done" ]; then
-            echo "Waiting 10s before activating FTS..."
+            echo "Waiting 10 seconds before activating fulltextsearch..."
             sleep 10
             echo "Activating fulltextsearch..."
             if php /var/www/html/occ fulltextsearch:test && php /var/www/html/occ fulltextsearch:index "{\"errors\": \"reset\"}" --no-readline; then
                 touch "$NEXTCLOUD_DATA_DIR/fts-index.done"
             else
                 echo "Fulltextsearch failed. Could not index."
-                echo "Feel free to follow https://github.com/nextcloud/all-in-one/discussions/1709 if you want to skip the indexing in the future."
+                echo "If you want to skip indexing in the future, see https://github.com/nextcloud/all-in-one/discussions/1709"
             fi
         fi
     fi

Containers/notify-push/start.sh

@@ -66,8 +66,13 @@ if [ "$POSTGRES_USER" = nextcloud ]; then
     export POSTGRES_USER
 fi
 
+# Postgres root cert
+if [ -f "/nextcloud/data/certificates/POSTGRES" ]; then
+    POSTGRES_CERT="?sslmode=verify-ca&sslrootcert=/nextcloud/data/certificates/POSTGRES"
+fi
+
 # Set sensitive values as env
-export DATABASE_URL="$DATABASE_TYPE://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB"
+export DATABASE_URL="$DATABASE_TYPE://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB$POSTGRES_CERT"
 export REDIS_URL="redis://$REDIS_USER:$REDIS_HOST_PASSWORD@$REDIS_HOST/$REDIS_DB_INDEX"
 
 # Run it

Containers/redis/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # From https://github.com/docker-library/redis/blob/master/7.2/alpine/Dockerfile
-FROM redis:7.2.10-alpine
+FROM redis:7.2.11-alpine
 
 COPY --chmod=775 start.sh /start.sh
 

Containers/talk-recording/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM python:3.13.7-alpine3.22
+FROM python:3.14.0-alpine3.22
 
 COPY --chmod=775 start.sh /start.sh
 COPY --chmod=775 healthcheck.sh /healthcheck.sh

Containers/talk/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
-FROM nats:2.11.9-scratch AS nats
-FROM eturnal/eturnal:1.12.1 AS eturnal
+FROM nats:2.12.0-scratch AS nats
+FROM eturnal/eturnal:1.12.2-alpine AS eturnal
 FROM strukturag/nextcloud-spreed-signaling:2.0.4 AS signaling
 FROM alpine:3.22.1 AS janus
 

Containers/watchtower/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM ghcr.io/nicholas-fedor/watchtower:1.11.8 AS watchtower
+FROM ghcr.io/nicholas-fedor/watchtower:1.12.1 AS watchtower
 
 FROM alpine:3.22.1
 

Containers/whiteboard/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # Probably from this file: https://github.com/nextcloud/whiteboard/blob/main/Dockerfile
-FROM ghcr.io/nextcloud-releases/whiteboard:v1.2.0
+FROM ghcr.io/nextcloud-releases/whiteboard:v1.2.1
 
 USER root
 RUN set -ex; \

community-containers/lldap/lldap.json

@@ -27,7 +27,7 @@
         "LLDAP_JWT_SECRET",
         "LLDAP_LDAP_USER_PASS"
       ],
-      "ui_secret": "LLDAP_JWT_SECRET",
+      "ui_secret": "LLDAP_LDAP_USER_PASS",
       "volumes": [
         {
           "source": "nextcloud_aio_lldap",

community-containers/lldap/readme.md

@@ -18,10 +18,7 @@ Functionality with this configuration:
 
 > For simplicity, this configuration is done via the command line (don't worry, it's very simple).
 
-First, you need to retrieve the LLDAP admin password, this will be used later on. Which you need to type in or copy and paste:
-```bash
-sudo docker inspect nextcloud-aio-lldap | grep LLDAP_LDAP_USER_PASS
-```
+First, you need to retrieve the LLDAP admin password that you can see next to the container in the AIO interface. There you can configure smtp first and then invite users via mail.
 
 Now go into the Nextcloud container:<br>
 **Please note:** If you do not have CLI access to the server, you can now run docker commands via a web session by using this community container: https://github.com/nextcloud/all-in-one/tree/main/community-containers/container-management. This script below can be run from inside the container-management container via `bash /lldap.sh`.

community-containers/minio/minio.json

@@ -0,0 +1,41 @@
+{
+    "aio_services_v1": [
+        {
+            "container_name": "nextcloud-aio-minio",
+            "image_tag": "v1",
+            "display_name": "Minio S3 Storage",
+            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/minio",
+            "image": "ghcr.io/szaimen/aio-minio",
+            "internal_port": "9000",
+            "environment": [
+                "MINIO_ROOT_USER=nextcloud",
+                "MINIO_ROOT_PASSWORD=%MINIO_ROOT_PASSWORD%"
+            ],
+            "secrets": [
+                "MINIO_ROOT_PASSWORD"
+            ],
+            "volumes": [
+            {
+                "source": "nextcloud_aio_minio",
+                "destination": "/data",
+                "writeable": true
+            }
+            ],
+            "backup_volumes": [
+                "nextcloud_aio_minio"
+            ],
+            "nextcloud_exec_commands": [
+                "php /var/www/html/occ config:system:set objectstore class --value 'OC\\Files\\ObjectStore\\S3'",
+                "php /var/www/html/occ config:system:set objectstore arguments autocreate --value true --type bool",
+                "php /var/www/html/occ config:system:set objectstore arguments use_path_style --value true --type bool",
+                "php /var/www/html/occ config:system:set objectstore arguments use_ssl --value false --type bool",
+                "php /var/www/html/occ config:system:set objectstore arguments region --value ''",
+                "php /var/www/html/occ config:system:set objectstore arguments bucket --value nextcloud",
+                "php /var/www/html/occ config:system:set objectstore arguments key --value nextcloud",
+                "php /var/www/html/occ config:system:set objectstore arguments secret --value %MINIO_ROOT_PASSWORD%",
+                "php /var/www/html/occ config:system:set objectstore arguments port --value 9000",
+                "php /var/www/html/occ config:system:set objectstore arguments hostname --value nextcloud-aio-minio"
+            ]
+        }
+    ]
+}

community-containers/minio/readme.md

@@ -0,0 +1,18 @@
+## Minio
+This container bundles minio s3 storage and auto-configures it for you.
+
+>[!WARNING]
+> Enabling this container will remove access to all the files formerly written to the data directory.
+> So only enable this on a clean instance directly after installing AIO.
+> All additional users that are added via Nextcloud afterwards are going to work correctly.
+> Also, after enabling and using it, make sure to not disable the container as you cannot migrate from s3 to local storage anymore and s3 is a critical part of your infrastructure from then on.
+
+### Notes
+- The data of Minio will be automatically included in AIOs backup solution!
+- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
+
+### Repository
+https://github.com/szaimen/aio-minio
+
+### Maintainer
+https://github.com/szaimen

php/composer.lock

@@ -391,16 +391,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.0.4",
+            "version": "v2.0.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "b352cf0534aa1ae6b4d825d1e762e35d43f8a841"
+                "reference": "3832547db6e0e2f8bb03d4093857b378c66eceed"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/b352cf0534aa1ae6b4d825d1e762e35d43f8a841",
-                "reference": "b352cf0534aa1ae6b4d825d1e762e35d43f8a841",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/3832547db6e0e2f8bb03d4093857b378c66eceed",
+                "reference": "3832547db6e0e2f8bb03d4093857b378c66eceed",
                 "shasum": ""
             },
             "require": {
@@ -448,7 +448,7 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2025-03-19T13:51:03+00:00"
+            "time": "2025-09-22T17:29:40+00:00"
         },
         {
             "name": "nikic/fast-route",
@@ -3883,16 +3883,16 @@
         },
         {
             "name": "symfony/console",
-            "version": "v6.4.25",
+            "version": "v6.4.26",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "273fd29ff30ba0a88ca5fb83f7cf1ab69306adae"
+                "reference": "492de6dfd93910d7d7a729c5a04ddcd2b9e99c4f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/273fd29ff30ba0a88ca5fb83f7cf1ab69306adae",
-                "reference": "273fd29ff30ba0a88ca5fb83f7cf1ab69306adae",
+                "url": "https://api.github.com/repos/symfony/console/zipball/492de6dfd93910d7d7a729c5a04ddcd2b9e99c4f",
+                "reference": "492de6dfd93910d7d7a729c5a04ddcd2b9e99c4f",
                 "shasum": ""
             },
             "require": {
@@ -3957,7 +3957,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v6.4.25"
+                "source": "https://github.com/symfony/console/tree/v6.4.26"
             },
             "funding": [
                 {
@@ -3977,7 +3977,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-08-22T10:21:53+00:00"
+            "time": "2025-09-26T12:13:46+00:00"
         },
         {
             "name": "symfony/filesystem",
@@ -4449,16 +4449,16 @@
         },
         {
             "name": "symfony/string",
-            "version": "v7.3.3",
+            "version": "v7.3.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/string.git",
-                "reference": "17a426cce5fd1f0901fefa9b2a490d0038fd3c9c"
+                "reference": "f96476035142921000338bad71e5247fbc138872"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/17a426cce5fd1f0901fefa9b2a490d0038fd3c9c",
-                "reference": "17a426cce5fd1f0901fefa9b2a490d0038fd3c9c",
+                "url": "https://api.github.com/repos/symfony/string/zipball/f96476035142921000338bad71e5247fbc138872",
+                "reference": "f96476035142921000338bad71e5247fbc138872",
                 "shasum": ""
             },
             "require": {
@@ -4473,7 +4473,6 @@
             },
             "require-dev": {
                 "symfony/emoji": "^7.1",
-                "symfony/error-handler": "^6.4|^7.0",
                 "symfony/http-client": "^6.4|^7.0",
                 "symfony/intl": "^6.4|^7.0",
                 "symfony/translation-contracts": "^2.5|^3.0",
@@ -4516,7 +4515,7 @@
                 "utf8"
             ],
             "support": {
-                "source": "https://github.com/symfony/string/tree/v7.3.3"
+                "source": "https://github.com/symfony/string/tree/v7.3.4"
             },
             "funding": [
                 {
@@ -4536,7 +4535,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-08-25T06:35:40+00:00"
+            "time": "2025-09-11T14:36:48+00:00"
         },
         {
             "name": "vimeo/psalm",

php/templates/containers.twig

@@ -17,7 +17,7 @@
 
     <div class="container">
         <main>
-            <h1>Nextcloud AIO v11.9.0</h1>
+            <h1>Nextcloud AIO v11.10.0</h1>
 
             {# Add 2nd tab warning #}
             <script type="text/javascript" src="second-tab-warning.js"></script>

readme.md

@@ -52,7 +52,8 @@ Included are:
 - Possibility included to [pass the needed device for hardware transcoding](https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud) to the Nextcloud container
 - Possibility included to [store all docker related files on a separate drive](https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive)
 - [LDAP can be used as user backend for Nextcloud](https://github.com/nextcloud/all-in-one/tree/main#ldap)
-- Migration from any former Nextcloud installation to AIO is possible. See [this documentation](https://github.com/nextcloud/all-in-one/blob/main/migration.md)
+- Migration from any former Nextcloud installation to AIO is possible. See [this documentation](https://github.com/nextcloud/all-in-one/blob/main/migration.md). 
+- Migration in the other direction (e.g. from AIO to a VM-based installation) is also possible.
 - [Fail2Ban can be added](https://github.com/nextcloud/all-in-one#fail2ban)
 - [phpMyAdmin, Adminer or pgAdmin can be added](https://github.com/nextcloud/all-in-one#phpmyadmin-adminer-or-pgadmin)
 - [Mail server can be added](https://github.com/nextcloud/all-in-one#mail-server)
@@ -523,7 +524,11 @@ The Fulltextsearch Java options are by default set to `-Xms512M -Xmx512M` which
 ## Guides
 
 ### How to run AIO on macOS?
-On macOS, there is only one thing different in comparison to Linux: instead of using `--volume /var/run/docker.sock:/var/run/docker.sock:ro`, you need to use `--volume /var/run/docker.sock.raw:/var/run/docker.sock:ro` to run it after you installed [Docker Desktop](https://www.docker.com/products/docker-desktop/) (and don't forget to [enable ipv6](https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md) if you should need that). Apart from that it should work and behave the same like on Linux.
+
+> [!NOTE]
+> On macOS, it is recommended to use OrbStack instead of Docker Desktop which has much better compatibility with docker for Linux compared to Docker Desktop. See https://orbstack.dev/
+
+Generally, on macOS, there is only one thing different for the docker run command in comparison to Linux: instead of using `--volume /var/run/docker.sock:/var/run/docker.sock:ro`, you need to use `--volume /var/run/docker.sock.raw:/var/run/docker.sock:ro` to run it after you installed [Docker Desktop](https://www.docker.com/products/docker-desktop/) (and don't forget to [enable ipv6](https://github.com/nextcloud/all-in-one/blob/main/docker-ipv6-support.md) if you should need that). Apart from that it should work and behave the same like on Linux.
 
 Also, you may be interested in adjusting Nextcloud's Datadir to store the files on the host system. See [this documentation](https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir) on how to do it.