Merge pull request #327 from nextcloud/enh/271/add-docs-for-datadir

add docs for changing the datadir

.github/workflows/create-psalm-container.yml

@@ -0,0 +1,54 @@
+name: Create Psalm Container
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '5 4 * * *'
+
+jobs:
+  push_to_registry:
+    runs-on: ubuntu-latest
+
+    name: Create Psalm Container
+
+    permissions:
+      packages: write
+      contents: read
+
+    steps:
+      - name: Check out the repo
+        run: |
+          git clone https://github.com/psalm/psalm-github-actions.git
+      
+      - name: Modify the Dockerfile
+        run: |
+          set -x
+          sed -i 's|FROM php:7.4-alpine|FROM php:8.0-alpine|' "psalm-github-actions/Dockerfile"
+          cat << APCU >> "psalm-github-actions/Dockerfile"
+          RUN mkdir -p /usr/src/php/ext/apcu && \
+            curl -fsSL https://pecl.php.net/get/apcu | tar xvz -C "/usr/src/php/ext/apcu" --strip 1 && \
+            docker-php-ext-install apcu
+          APCU
+
+      - name: Log in to GitHub Docker Registry
+        uses: docker/login-action@v1
+        with:
+          registry: docker.pkg.github.com
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build container image
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          context: 'psalm-github-actions'
+          file: 'psalm-github-actions/Dockerfile'
+          tags: |
+            ghcr.io/nextcloud/all-in-one-psalm:latest

.github/workflows/psalm-analysis.yml

@@ -0,0 +1,18 @@
+name: Psalm Analysis
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  psalm:
+    name: Psalm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Psalm
+        uses: docker://ghcr.io/nextcloud/all-in-one-psalm
+        with:
+          composer_ignore_platform_reqs: false
+          relative_dir: php

.github/workflows/psalm-security.yml

@@ -0,0 +1,25 @@
+name: Psalm Security Analysis
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  psalm:
+    name: Psalm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Psalm
+        uses: docker://ghcr.io/nextcloud/all-in-one-psalm
+        with:
+          relative_dir: php
+          security_analysis: true
+          composer_ignore_platform_reqs: false
+          report_file: results.sarif
+      - name: Upload Security Analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: php/results.sarif

.github/workflows/psalm-update-baseline.yml

@@ -0,0 +1,48 @@
+name: Update Psalm baseline
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '5 4 * * *'
+
+jobs:
+  update-psalm-baseline:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set up php8.0
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.0
+          extensions: apcu
+          coverage: none
+
+      - name: Run script
+        run: |
+          set -x
+          cd php
+          composer global require vimeo/psalm --prefer-dist --no-progress --dev
+          composer install
+          composer run psalm -- --monochrome --no-progress --output-format=text --update-baseline
+          git clean -f lib/composer
+          git checkout composer.json composer.lock lib/composer
+        continue-on-error: true
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{ secrets.COMMAND_BOT_PAT }}
+          commit-message: Update psalm baseline
+          committer: GitHub <noreply@github.com>
+          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
+          signoff: true
+          branch: automated/noid/psalm-baseline-update
+          # Make sure we can open multiple PRs
+          branch-suffix: timestamp
+          title: '[Automated] Update psalm-baseline.xml'
+          body: |
+            Auto-generated update psalm-baseline.xml with fixed psalm warnings
+          labels: |
+            3. to review

Containers/apache/Caddyfile

@@ -6,7 +6,7 @@
     }
 }
 
-https://{$NC_DOMAIN}:443 {
+{$PROTOCOL}://{$NC_DOMAIN}:{$APACHE_PORT} {
 
     # Notify Push
     route /push/* {
@@ -22,25 +22,13 @@ https://{$NC_DOMAIN}:443 {
 
     # Collabora
     route /browser/* {
-        reverse_proxy https://{$COLLABORA_HOST}:9980 {
-            transport http {
-                tls_insecure_skip_verify
-            }
-        }
+        reverse_proxy {$COLLABORA_HOST}:9980
     }
     route /hosting/* {
-        reverse_proxy https://{$COLLABORA_HOST}:9980 {
-            transport http {
-                tls_insecure_skip_verify
-            }
-        }
+        reverse_proxy {$COLLABORA_HOST}:9980
     }
     route /cool/* {
-        reverse_proxy https://{$COLLABORA_HOST}:9980 {
-            transport http {
-                tls_insecure_skip_verify
-            }
-        }
+        reverse_proxy {$COLLABORA_HOST}:9980
     }
 
     # Nextcloud

Containers/apache/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:bullseye-20220125-slim
+FROM debian:bullseye-20220228-slim
 
 EXPOSE 80
 
@@ -59,7 +59,8 @@ COPY start.sh /usr/bin/
 COPY supervisord.conf /
 RUN chmod +x /usr/bin/start.sh; \
     chmod +r /supervisord.conf; \
-    chmod +r /Caddyfile;
+    chmod a+w /Caddyfile; \
+    chmod a+w /
 
 # Give root a random password
 RUN echo "root:$(openssl rand -base64 12)" | chpasswd

Containers/apache/start.sh

@@ -23,6 +23,19 @@ while ! nc -z "$COLLABORA_HOST" 9980; do
     sleep 5
 done
 
+if [ -z "$APACHE_PORT" ]; then
+    export APACHE_PORT="443"
+fi
+
+if [ "$APACHE_PORT" != '443' ]; then
+    export PROTOCOL="http"
+    export NC_DOMAIN=""
+    sed -i 's|auto_https.*|auto_https off|' /Caddyfile
+else
+    export PROTOCOL="https"
+    sed -i 's|auto_https.*|auto_https disable_redirects|' /Caddyfile
+fi
+
 # Add caddy path
 mkdir -p /mnt/data/caddy/
 

Containers/collabora/Dockerfile

@@ -1,2 +1,2 @@
 # From a file located probably somewhere here: https://github.com/CollaboraOnline/online/tree/master/docker
-FROM collabora/code:21.11.2.2.1
+FROM collabora/code:21.11.2.4.1

Containers/domaincheck/lighttpd.conf

@@ -1,6 +1,6 @@
 server.document-root = "/var/www/domaincheck/" 
 
-server.port = 443
+server.port = env.APACHE_PORT
 
 server.username = "www-data" 
 server.groupname = "www-data" 

Containers/domaincheck/start.sh

@@ -7,6 +7,10 @@ fi
 
 echo "$INSTANCE_ID" > /var/www/domaincheck/index.html
 
+if [ -z "$APACHE_PORT" ]; then
+    export APACHE_PORT="443"
+fi
+
 # Check config file
 lighttpd -tt -f /etc/lighttpd/lighttpd.conf
 

Containers/mastercontainer/cron.sh

@@ -6,5 +6,7 @@ while true; do
     sudo -u www-data php /var/www/docker-aio/php/src/Cron/cron.php
     # Remove dangling images
     sudo -u www-data docker image prune -f
+    # Remove sessions older than 24h
+    find "/mnt/docker-aio-config/session/" -mindepth 1 -mmin +1440 -delete
     sleep 1d
 done

Containers/mastercontainer/start.sh

@@ -6,6 +6,14 @@ print_green() {
     printf "%b%s%b\n" "\e[0;92m" "$TEXT" "\e[0m"
 }
 
+# Function to check if number was provided
+check_if_number() {
+case "${1}" in
+    ''|*[!0-9]*) return 1 ;;
+    *) return 0 ;;
+esac
+}
+
 # Check if socket is available and readable
 if ! [ -a "/var/run/docker.sock" ]; then
     echo "Docker socket is not available. Cannot continue."
@@ -54,7 +62,29 @@ else
     sleep 10
 fi
 
+# Check if startup command was executed correctly
+if ! docker ps | grep -q "nextcloud-aio-mastercontainer"; then
+    echo "It seems like you did not give the mastercontainer the correct name?"
+    exit 1
+elif ! docker volume ls | grep -q "nextcloud_aio_mastercontainer"; then
+    echo "It seems like you did not give the mastercontainer volume the correct name?"
+    exit 1
+fi
+
 # Check for other options
+if [ -n "$NEXTCLOUD_DATADIR" ]; then
+    if ! echo "$NEXTCLOUD_DATADIR" | grep -q "^/mnt/" \
+    && ! echo "$NEXTCLOUD_DATADIR" | grep -q "^/media/"
+    then
+        echo "You've set NEXTCLOUD_DATADIR but not to an allowed value.
+The string must start with '/mnt/' or '/media/'. E.g. '/mnt/ncdata'"
+        exit 1
+    elif [ "$NEXTCLOUD_DATADIR" = "/mnt/" ] || [ "$NEXTCLOUD_DATADIR" = "/media/" ]; then
+        echo "You've set NEXTCLOUD_DATADIR but not to an allowed value.
+The string must start with '/mnt/' or '/media/' and not be equal to these."
+        exit 1
+    fi
+fi
 if [ -n "$NEXTCLOUD_MOUNT" ]; then
     if ! echo "$NEXTCLOUD_MOUNT" | grep -q "^/mnt/" \
     && ! echo "$NEXTCLOUD_MOUNT" | grep -q "^/media/" \
@@ -68,6 +98,21 @@ The string must be equal to/start with '/mnt/' or '/media/' or be equal to '/var
         exit 1
     fi
 fi
+if [ -n "$NEXTCLOUD_DATADIR" ] && [ -n "$NEXTCLOUD_MOUNT" ]; then
+    if [ "$NEXTCLOUD_DATADIR" = "$NEXTCLOUD_MOUNT" ]; then
+        echo "NEXTCLOUD_DATADIR and NEXTCLOUD_MOUNT are not allowed to be equal."
+        exit 1
+    fi
+fi
+if [ -n "$APACHE_PORT" ]; then
+    if ! check_if_number "$APACHE_PORT"; then
+        echo "You provided an Apache port but did not only use numbers"
+        exit 1
+    elif ! [ "$APACHE_PORT" -le 65535 ] || ! [ "$APACHE_PORT" -ge 1 ]; then
+        echo "The provided Apache port is invalid. It must be between 1 and 65535"
+        exit 1
+    fi
+fi
 
 # Add important folders
 mkdir -p /mnt/docker-aio-config/data/

Containers/nextcloud/entrypoint.sh

@@ -21,6 +21,15 @@ redis.session.lock_retries = -1
 redis.session.lock_wait_time = 10000
 REDIS_CONF
 
+# Check permissions in ncdata
+touch "/mnt/ncdata/this-is-a-test-file"
+if ! [ -f "/mnt/ncdata/this-is-a-test-file" ]; then
+    echo "The www-data user doesn't seem to have access rights in /mnt/ncdata.
+Did you maybe change the datadir and did forget to apply the correct permissions?"
+    exit 1
+fi
+rm "/mnt/ncdata/this-is-a-test-file"
+
 if [ -f /var/www/html/version.php ]; then
     # shellcheck disable=SC2016
     installed_version="$(php -r 'require "/var/www/html/version.php"; echo implode(".", $OC_Version);')"
@@ -223,6 +232,13 @@ if ! [ -f "/mnt/ncdata/skip.update" ]; then
     fi
 fi
 
+# Check if appdata is present
+# If not, something broke (e.g. changing ncdatadir after aio was first started)
+if [ -z "$(find "/mnt/ncdata/" -maxdepth 1 -mindepth 1 -type d -name "appdata_*")" ]; then
+    echo "Appdata is not present. Did you maybe change the datadir after aio was first started?"
+    exit 1
+fi
+
 # Apply one-click-instance settings
 echo "Applying one-click-instance settings..."
 php /var/www/html/occ config:system:set one-click-instance --value=true --type=bool

Containers/postgresql/Dockerfile

@@ -1,5 +1,5 @@
 # From https://github.com/docker-library/postgres/blob/master/13/alpine/Dockerfile
-FROM postgres:13.6-alpine3.15
+FROM postgres:14.2-alpine3.15
 
 RUN apk add --update --no-cache bash openssl shadow netcat-openbsd
 

Containers/talk/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:focal-20220113
+FROM ubuntu:focal-20220302
 
 EXPOSE 3478
 

php/composer.json

@@ -17,5 +17,9 @@
         "slim/twig-view": "^3.2",
         "slim/csrf": "^1.2",
         "ext-apcu": "*"
-    }
+    },
+    "scripts": {
+		"psalm": "psalm --threads=1",
+		"psalm:update-baseline": "psalm --threads=1 --update-baseline"
+	}
 }

php/composer.lock

@@ -465,12 +465,12 @@
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Opis\\Closure\\": "src/"
-                },
                 "files": [
                     "functions.php"
-                ]
+                ],
+                "psr-4": {
+                    "Opis\\Closure\\": "src/"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -1437,7 +1437,7 @@
         },
         {
             "name": "symfony/polyfill-ctype",
-            "version": "v1.24.0",
+            "version": "v1.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-ctype.git",
@@ -1469,12 +1469,12 @@
                 }
             },
             "autoload": {
-                "psr-4": {
-                    "Symfony\\Polyfill\\Ctype\\": ""
-                },
                 "files": [
                     "bootstrap.php"
-                ]
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Ctype\\": ""
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
@@ -1499,7 +1499,7 @@
                 "portable"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.24.0"
+                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.25.0"
             },
             "funding": [
                 {
@@ -1519,7 +1519,7 @@
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.24.0",
+            "version": "v1.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
@@ -1582,7 +1582,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.24.0"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.25.0"
             },
             "funding": [
                 {
@@ -1602,7 +1602,7 @@
         },
         {
             "name": "symfony/polyfill-php81",
-            "version": "v1.24.0",
+            "version": "v1.25.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php81.git",
@@ -1661,7 +1661,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php81/tree/v1.24.0"
+                "source": "https://github.com/symfony/polyfill-php81/tree/v1.25.0"
             },
             "funding": [
                 {

php/containers.json

@@ -10,17 +10,18 @@
       "displayName": "Apache",
       "containerName": "nextcloud/aio-apache",
       "ports": [
-        "443/tcp"
+        "%APACHE_PORT%/tcp"
       ],
       "internalPorts": [
-        "443"
+        "%APACHE_PORT%"
       ],
       "secrets": [],
       "environmentVariables": [
         "NC_DOMAIN=%NC_DOMAIN%",
         "NEXTCLOUD_HOST=nextcloud-aio-nextcloud",
         "COLLABORA_HOST=nextcloud-aio-collabora",
-        "TALK_HOST=nextcloud-aio-talk"
+        "TALK_HOST=nextcloud-aio-talk",
+        "APACHE_PORT=%APACHE_PORT%"
       ],
       "volumes": [
         {
@@ -95,7 +96,7 @@
           "writeable": true
         },
         {
-          "name": "nextcloud_aio_nextcloud_data",
+          "name": "%NEXTCLOUD_DATADIR%",
           "location": "/mnt/ncdata",
           "writeable": true
         },
@@ -155,7 +156,8 @@
         "9980"
       ],
       "environmentVariables": [
-        "domain=%NC_DOMAIN%"
+        "domain=%NC_DOMAIN%",
+        "extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:logging.level=warning"
       ],
       "volumes": [],
       "secrets": [],
@@ -213,7 +215,7 @@
           "writeable": true
         },
         {
-          "name": "nextcloud_aio_nextcloud_data",
+          "name": "%NEXTCLOUD_DATADIR%",
           "location": "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data",
           "writeable": true
         },
@@ -276,11 +278,12 @@
       "displayName": "Domaincheck",
       "containerName": "nextcloud/aio-domaincheck",
       "ports": [
-        "443/tcp"
+        "%APACHE_PORT%/tcp"
       ],
       "internalPorts": [],
       "environmentVariables": [
-        "INSTANCE_ID=%INSTANCE_ID%"
+        "INSTANCE_ID=%INSTANCE_ID%",
+        "APACHE_PORT=%APACHE_PORT%"
       ],
       "volumes": [],
       "secrets": [

php/psalm-baseline.xml

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<files psalm-version="4.22.0@fc2c6ab4d5fa5d644d8617089f012f3bb84b8703">
+  <file src="public/index.php">
+    <MissingClosureParamType occurrences="10">
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$request</code>
+      <code>$request</code>
+      <code>$request</code>
+      <code>$response</code>
+      <code>$response</code>
+      <code>$response</code>
+    </MissingClosureParamType>
+  </file>
+  <file src="src/Controller/ConfigurationController.php">
+    <MissingParamType occurrences="1">
+      <code>$args</code>
+    </MissingParamType>
+    <PossiblyInvalidArrayAccess occurrences="2">
+      <code>$request-&gt;getParsedBody()['borg_backup_host_location']</code>
+      <code>$request-&gt;getParsedBody()['domain']</code>
+    </PossiblyInvalidArrayAccess>
+    <PossiblyNullArgument occurrences="2">
+      <code>$request-&gt;getParsedBody()['borg_backup_host_location']</code>
+      <code>$request-&gt;getParsedBody()['domain']</code>
+    </PossiblyNullArgument>
+    <PossiblyNullArrayAccess occurrences="2">
+      <code>$request-&gt;getParsedBody()['borg_backup_host_location']</code>
+      <code>$request-&gt;getParsedBody()['domain']</code>
+    </PossiblyNullArrayAccess>
+  </file>
+  <file src="src/Controller/DockerController.php">
+    <MissingParamType occurrences="7">
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+    </MissingParamType>
+    <PossiblyInvalidArrayAccess occurrences="1">
+      <code>$request-&gt;getParsedBody()['selected_restore_time']</code>
+    </PossiblyInvalidArrayAccess>
+    <PossiblyNullArgument occurrences="1">
+      <code>$container</code>
+    </PossiblyNullArgument>
+    <PossiblyNullArrayAccess occurrences="1">
+      <code>$request-&gt;getParsedBody()['selected_restore_time']</code>
+    </PossiblyNullArrayAccess>
+    <PossiblyNullReference occurrences="5">
+      <code>GetDependsOn</code>
+      <code>GetDependsOn</code>
+      <code>GetIdentifier</code>
+      <code>GetIdentifier</code>
+      <code>GetRunningState</code>
+    </PossiblyNullReference>
+  </file>
+  <file src="src/Controller/LoginController.php">
+    <MissingParamType occurrences="3">
+      <code>$args</code>
+      <code>$args</code>
+      <code>$args</code>
+    </MissingParamType>
+    <PossiblyInvalidArrayAccess occurrences="1">
+      <code>$request-&gt;getParsedBody()['password']</code>
+    </PossiblyInvalidArrayAccess>
+    <PossiblyNullArgument occurrences="1">
+      <code>$password</code>
+    </PossiblyNullArgument>
+    <PossiblyNullArrayAccess occurrences="1">
+      <code>$request-&gt;getParsedBody()['password']</code>
+    </PossiblyNullArrayAccess>
+  </file>
+  <file src="src/Cron/cron.php">
+    <PossiblyNullArgument occurrences="2">
+      <code>$nextcloudContainer</code>
+      <code>$nextcloudContainer</code>
+    </PossiblyNullArgument>
+  </file>
+  <file src="src/Docker/DockerActionManager.php">
+    <InvalidReturnType occurrences="1">
+      <code>IContainerState</code>
+    </InvalidReturnType>
+    <InvalidScalarArgument occurrences="1">
+      <code>$internalPort</code>
+    </InvalidScalarArgument>
+    <PossiblyFalseOperand occurrences="1">
+      <code>strpos($fullDigest, "@")</code>
+    </PossiblyFalseOperand>
+    <PossiblyNullArgument occurrences="1">
+      <code>$apacheContainer</code>
+    </PossiblyNullArgument>
+    <PossiblyNullReference occurrences="1">
+      <code>GetUpdateState</code>
+    </PossiblyNullReference>
+    <RedundantCondition occurrences="1">
+      <code>$container-&gt;GetInternalPorts() !== null</code>
+    </RedundantCondition>
+  </file>
+  <file src="src/Middleware/AuthMiddleware.php">
+    <UndefinedInterfaceMethod occurrences="1">
+      <code>withStatus</code>
+    </UndefinedInterfaceMethod>
+  </file>
+  <file src="src/Twig/ClassExtension.php">
+    <MissingParamType occurrences="1">
+      <code>$object</code>
+    </MissingParamType>
+  </file>
+</files>

php/psalm.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<psalm
+	errorLevel="2"
+	resolveFromConfigFile="true"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns="https://getpsalm.org/schema/config"
+	xsi:schemaLocation="https://getpsalm.org/schema/config"
+    errorBaseline="psalm-baseline.xml"
+>
+	<projectFiles>
+		<directory name="templates"/>
+		<directory name="src"/>
+		<file name="public/index.php"/>
+	</projectFiles>
+</psalm>

php/public/index.php

@@ -22,11 +22,6 @@ ini_set('session.save_path', $dataConst->GetSessionDirectory());
 // Auto logout on browser close
 ini_set('session.cookie_lifetime', '0');
 
-// Make sure to delete all stale sessions after at least one day
-ini_set('session.gc_maxlifetime', '86400');
-ini_set('session.gc_probability', '1');
-ini_set('session.gc_divisor', '1');
-
 // Create app
 AppFactory::setContainer($container);
 $app = AppFactory::create();
@@ -88,6 +83,7 @@ $app->get('/containers', function ($request, $response, $args) use ($container)
         'has_update_available' => $dockerActionManger->isAnyUpdateAvailable(),
         'last_backup_time' => $configurationManager->GetLastBackupTime(),
         'backup_times' => $configurationManager->GetBackupTimes(),
+        'current_channel' => $dockerActionManger->GetCurrentChannel(),
     ]);
 })->setName('profile');
 $app->get('/login', function ($request, $response, $args) use ($container) {

php/public/style.css

@@ -136,7 +136,7 @@ input {
     padding: 20px;
     max-width: 100%;
     word-break: break-word;
-    max-width: 450px;
+    max-width: 470px;
     margin: 0 auto;
 }
 

php/src/Container/ContainerVolumes.php

@@ -6,7 +6,7 @@ class ContainerVolumes {
     /** @var ContainerVolume[] */
     private array $volumes = [];
 
-    public function AddVolume(ContainerVolume $volume) {
+    public function AddVolume(ContainerVolume $volume) : void {
         $this->volumes[] = $volume;
     }
 

php/src/ContainerDefinitionFetcher.php

@@ -51,11 +51,17 @@ class ContainerDefinitionFetcher
         foreach ($data['production'] as $entry) {
             $ports = new ContainerPorts();
             foreach ($entry['ports'] as $port) {
+                if($port === '%APACHE_PORT%/tcp') {
+                    $port = $this->configurationManager->GetApachePort() . '/tcp';
+                }
                 $ports->AddPort($port);
             }
 
             $internalPorts = new ContainerInternalPorts();
             foreach ($entry['internalPorts'] as $internalPort) {
+                if($internalPort === '%APACHE_PORT%') {
+                    $internalPort = $this->configurationManager->GetApachePort();
+                }
                 $internalPorts->AddInternalPort($internalPort);
             }
 
@@ -72,6 +78,11 @@ class ContainerDefinitionFetcher
                     if($value['name'] === '') {
                         continue;
                     }
+                } elseif ($value['name'] === '%NEXTCLOUD_DATADIR%') {
+                    $value['name'] = $this->configurationManager->GetNextcloudDatadirMount();
+                    if ($value['name'] === '') {
+                        continue;
+                    }
                 }
                 if($value['location'] === '%NEXTCLOUD_MOUNT%') {
                     $value['location'] = $this->configurationManager->GetNextcloudMount();

php/src/Controller/ConfigurationController.php

@@ -25,6 +25,12 @@ class ConfigurationController
                 $this->configurationManager->SetDomain($request->getParsedBody()['domain']);
             }
 
+            if (isset($request->getParsedBody()['current-master-password']) || isset($request->getParsedBody()['new-master-password'])) {
+                $currentMasterPassword = $request->getParsedBody()['current-master-password'] ?? '';
+                $newMasterPassword = $request->getParsedBody()['new-master-password'] ?? '';
+                $this->configurationManager->ChangeMasterPassword($currentMasterPassword, $newMasterPassword);
+            }
+
             if (isset($request->getParsedBody()['borg_backup_host_location'])) {
                 $this->configurationManager->SetBorgBackupHostLocation($request->getParsedBody()['borg_backup_host_location']);
             }

php/src/Controller/DockerController.php

@@ -26,7 +26,7 @@ class DockerController
         $this->configurationManager = $configurationManager;
     }
 
-    private function PerformRecursiveContainerStart(string $id) {
+    private function PerformRecursiveContainerStart(string $id) : void {
         $container = $this->containerDefinitionFetcher->GetContainerById($id);
 
         foreach($container->GetDependsOn() as $dependency) {
@@ -126,7 +126,7 @@ class DockerController
         return $response->withStatus(201)->withHeader('Location', '/');
     }
 
-    private function PerformRecursiveContainerStop(string $id)
+    private function PerformRecursiveContainerStop(string $id) : void
     {
         $container = $this->containerDefinitionFetcher->GetContainerById($id);
         foreach($container->GetDependsOn() as $dependency) {
@@ -146,7 +146,7 @@ class DockerController
         return $response->withStatus(201)->withHeader('Location', '/');
     }
 
-    public function StartDomaincheckContainer()
+    public function StartDomaincheckContainer() : void
     {
         # Don't start if domain is already set
         if ($this->configurationManager->GetDomain() != '') {
@@ -167,7 +167,7 @@ class DockerController
         $this->PerformRecursiveContainerStart($id);
     }
 
-    private function StopDomaincheckContainer()
+    private function StopDomaincheckContainer() : void
     {
         $id = 'nextcloud-aio-domaincheck';
         $this->PerformRecursiveContainerStop($id);

php/src/Data/ConfigurationManager.php

@@ -46,7 +46,7 @@ class ConfigurationManager
         return $config['secrets'][$secretId];
     }
 
-    private function DoubleSafeBackupSecret(string $borgBackupPassword) {
+    private function DoubleSafeBackupSecret(string $borgBackupPassword) : void {
         file_put_contents(DataConst::GetBackupSecretFile(), $borgBackupPassword);
     }
 
@@ -101,10 +101,6 @@ class ConfigurationManager
                 $backupTimes[] = $backupTimesTemp[1];     
             }
         }
-        
-        if (!is_array($backupTimes)) {
-            return [];
-        }
 
         return $backupTimes;
     }
@@ -121,8 +117,8 @@ class ConfigurationManager
      * @throws InvalidSettingConfigurationException
      */
     public function SetDomain(string $domain) : void {
-        // Validate URL
-        if (!filter_var('http://' . $domain, FILTER_VALIDATE_URL)) {
+        // Validate domain
+        if (!filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME)) {
             throw new InvalidSettingConfigurationException("Domain is not in a valid format!");
         }
 
@@ -148,15 +144,23 @@ class ConfigurationManager
         // Get Instance ID
         $instanceID = $this->GetSecret('INSTANCE_ID');
 
+        // set protocol
+        $port = $this->GetApachePort();
+        if ($port !== '443') {
+            $protocol = 'https://';
+        } else {
+            $protocol = 'http://';
+        }
+
         $ch = curl_init();
-        curl_setopt($ch, CURLOPT_URL,'http://' . $domain . ':443');
+        curl_setopt($ch, CURLOPT_URL, $protocol . $domain . ':443');
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        $response = curl_exec($ch);
+        $response = (string)curl_exec($ch);
         # Get rid of trailing \n
         $response = str_replace("\n", "", $response);
 
         if($response !== $instanceID) {
-            throw new InvalidSettingConfigurationException("Domain does not point to this server.");
+            throw new InvalidSettingConfigurationException("Domain does not point to this server or reverse proxy not configured correctly.");
         }
 
         // Write domain
@@ -232,6 +236,57 @@ class ConfigurationManager
         $this->WriteConfig($config);
     }
 
+    /**
+     * @throws InvalidSettingConfigurationException
+     */
+    public function ChangeMasterPassword(string $currentPassword, string $newPassword) : void {
+        if ($currentPassword === '') {
+            throw new InvalidSettingConfigurationException("Please enter your current password.");
+        }
+
+        if ($currentPassword !== $this->GetPassword()) {
+            throw new InvalidSettingConfigurationException("The entered current password is not correct.");
+        }
+
+        if ($newPassword === '') {
+            throw new InvalidSettingConfigurationException("Please enter a new password.");
+        }
+
+        if (strlen($newPassword) < 24) {
+            throw new InvalidSettingConfigurationException("New passwords must be >= 24 digits.");
+        }
+
+        if (!preg_match("#^[a-zA-Z0-9 ]+$#", $newPassword)) {
+            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');
+        }
+
+        // All checks pass so set the password
+        $this->SetPassword($newPassword);
+    }
+
+    public function GetApachePort() : string {
+        $port = getenv('APACHE_PORT');
+        if ($port === false) {
+            $config = $this->GetConfig();
+            if (!isset($config['apache_port']) || $config['apache_port'] === '') {
+                $config['apache_port'] = '443';
+            }
+            return $config['apache_port'];
+        } else {
+            if(file_exists(DataConst::GetConfigFile())) {
+                $config = $this->GetConfig();
+                if (!isset($config['apache_port'])) {
+                    $config['apache_port'] = '';
+                }
+                if ($port !== $config['apache_port']) {
+                    $config['apache_port'] = $port;
+                    $this->WriteConfig($config);
+                }
+            }
+            return $port;
+        }
+    }
+
     /**
      * @throws InvalidSettingConfigurationException
      */
@@ -282,4 +337,27 @@ class ConfigurationManager
             return $mount;
         }
     }
+
+    public function GetNextcloudDatadirMount() : string {
+        $mount = getenv('NEXTCLOUD_DATADIR');
+        if ($mount === false) {
+            $config = $this->GetConfig();
+            if (!isset($config['nextcloud_datadir']) || $config['nextcloud_datadir'] === '') {
+                $config['nextcloud_datadir'] = 'nextcloud_aio_nextcloud_data';
+            }
+            return $config['nextcloud_datadir'];
+        } else {
+            if(file_exists(DataConst::GetConfigFile())) {
+                $config = $this->GetConfig();
+                if (!isset($config['nextcloud_datadir'])) {
+                    $config['nextcloud_datadir'] = '';
+                }
+                if ($mount !== $config['nextcloud_datadir']) {
+                    $config['nextcloud_datadir'] = $mount;
+                    $this->WriteConfig($config);
+                }
+            }
+            return $mount;
+        }
+    }
 }

php/src/Docker/DockerActionManager.php

@@ -77,7 +77,7 @@ class DockerActionManager
         $runningDigest = $this->GetRepoDigestOfContainer($container->GetIdentifier());
         $remoteDigest = $this->dockerHubManager->GetLatestDigestOfTag($container->GetContainerName(), $tag);
 
-        if ($runningDigest === $remoteDigest) {
+        if ($runningDigest === $remoteDigest || $remoteDigest === null || $runningDigest === null) {
             return new VersionEqualState();
         } else {
             return new VersionDifferentState();
@@ -109,7 +109,7 @@ class DockerActionManager
         }
     }
 
-    public function DeleteContainer(Container $container) {
+    public function DeleteContainer(Container $container) : void {
         $url = $this->BuildApiUrl(sprintf('containers/%s?v=true', urlencode($container->GetIdentifier())));
         try {
             $this->guzzleClient->delete($url);
@@ -142,12 +142,12 @@ class DockerActionManager
         return $response;
     }
 
-    public function StartContainer(Container $container) {
+    public function StartContainer(Container $container) : void {
         $url = $this->BuildApiUrl(sprintf('containers/%s/start', urlencode($container->GetIdentifier())));
         $this->guzzleClient->post($url);
     }
 
-    public function CreateVolumes(Container $container)
+    public function CreateVolumes(Container $container): void
     {
         $url = $this->BuildApiUrl('volumes/create');
         foreach($container->GetVolumes()->GetVolumes() as $volume) {
@@ -170,7 +170,7 @@ class DockerActionManager
         }
     }
 
-    public function CreateContainer(Container $container) {
+    public function CreateContainer(Container $container) : void {
         $volumes = [];
         foreach($container->GetVolumes()->GetVolumes() as $volume) {
             $volumeEntry = $volume->name . ':' . $volume->mountPoint;
@@ -214,6 +214,8 @@ class DockerActionManager
                     $replacements[1] = $this->configurationManager->GetAIOURL();
                 } elseif ($out[1] === 'SELECTED_RESTORE_TIME') {
                     $replacements[1] = $this->configurationManager->GetSelectedRestoreTime();
+                } elseif ($out[1] === 'APACHE_PORT') {
+                    $replacements[1] = $this->configurationManager->GetApachePort();
                 } else {
                     $replacements[1] = $this->configurationManager->GetSecret($out[1]);
                 }
@@ -257,13 +259,21 @@ class DockerActionManager
         );
     }
 
-    public function PullContainer(Container $container)
+    public function PullContainer(Container $container) : void
     {
-        $url = $this->BuildApiUrl(sprintf('images/create?fromImage=%s', urlencode($this->BuildImageName($container))));
-        try {
-            $this->guzzleClient->post($url);
-        } catch (RequestException $e) {
-            throw $e;
+        $pullcontainer = true;
+        if ($container->GetIdentifier() === 'nextcloud-aio-database') {
+            if ($this->GetDatabasecontainerExitCode() > 0) {
+                $pullcontainer = false;
+            }
+        }
+        if ($pullcontainer) {
+            $url = $this->BuildApiUrl(sprintf('images/create?fromImage=%s', urlencode($this->BuildImageName($container))));
+            try {
+                $this->guzzleClient->post($url);
+            } catch (RequestException $e) {
+                throw $e;
+            }
         }
     }
 
@@ -281,10 +291,9 @@ class DockerActionManager
         return $updateAvailable;
     }
 
-    public function isAnyUpdateAvailable() {
+    public function isAnyUpdateAvailable() : bool {
         $id = 'nextcloud-aio-apache';
 
-
         if ($this->isContainerUpdateAvailable($id) !== "") {
             return true;
         } else {
@@ -345,14 +354,14 @@ class DockerActionManager
         $runningDigest = $this->GetRepoDigestOfContainer($containerName);
         $remoteDigest = $this->dockerHubManager->GetLatestDigestOfTag($imageName, $tag);
 
-        if ($remoteDigest === $runningDigest) {
+        if ($remoteDigest === $runningDigest || $remoteDigest === null || $runningDigest === null) {
             return false;
         } else {
             return true;
         }
     }
 
-    public function sendNotification(Container $container, string $subject, string $message)
+    public function sendNotification(Container $container, string $subject, string $message) : void
     {
         if ($this->GetContainerStartingState($container) instanceof RunningState) {
 
@@ -398,7 +407,7 @@ class DockerActionManager
         }
     }
 
-    public function DisconnectContainerFromNetwork(Container $container)
+    public function DisconnectContainerFromNetwork(Container $container) : void
     {
 
         $url = $this->BuildApiUrl(
@@ -419,7 +428,7 @@ class DockerActionManager
         }
     }
 
-    private function ConnectContainerIdToNetwork(string $id)
+    private function ConnectContainerIdToNetwork(string $id) : void
     {
         $url = $this->BuildApiUrl('networks/create');
         try {
@@ -462,17 +471,17 @@ class DockerActionManager
         }
     }
 
-    public function ConnectMasterContainerToNetwork()
+    public function ConnectMasterContainerToNetwork() : void
     {
         $this->ConnectContainerIdToNetwork('nextcloud-aio-mastercontainer');
     }
 
-    public function ConnectContainerToNetwork(Container $container)
+    public function ConnectContainerToNetwork(Container $container) : void
     {
       $this->ConnectContainerIdToNetwork($container->GetIdentifier());
     }
 
-    public function StopContainer(Container $container) {
+    public function StopContainer(Container $container) : void {
         $url = $this->BuildApiUrl(sprintf('containers/%s/stop?t=%s', urlencode($container->GetIdentifier()), $container->GetMaxShutdownTime()));
         try {
             $this->guzzleClient->post($url);
@@ -506,6 +515,29 @@ class DockerActionManager
         }
     }
 
+    public function GetDatabasecontainerExitCode() : int
+    {
+        $containerName = 'nextcloud-aio-database';
+        $url = $this->BuildApiUrl(sprintf('containers/%s/json', urlencode($containerName)));
+        try {
+            $response = $this->guzzleClient->get($url);
+        } catch (RequestException $e) {
+            if ($e->getCode() === 404) {
+                return -1;
+            }
+            throw $e;
+        }
+
+        $responseBody = json_decode((string)$response->getBody(), true);
+
+        $exitCode = $responseBody['State']['ExitCode'];
+        if (is_int($exitCode)) {
+            return $exitCode;
+        } else {
+            return -1;
+        }
+    }
+
     public function isLoginAllowed() : bool {
         $id = 'nextcloud-aio-apache';
         $apacheContainer = $this->containerDefinitionFetcher->GetContainerById($id);

php/templates/containers.twig

@@ -16,7 +16,7 @@
     </header>
 
     <div class="content">
-        <h1>Nextcloud AIO Beta v0.5.0</h1>
+        <h1>Nextcloud AIO Beta v0.7.0</h1>
         This is beta software and not production ready.<br><br>
 
         {% set isAnyRunning = false %}
@@ -77,6 +77,7 @@
 
                 {% if isAnyRunning == true %}
                     {% if isApacheStarting != true %}
+                        Your initial Nextcloud credentials:<br><br />
                         Initial Nextcloud username: admin<br />
                         Initial Nextcloud password: {{ nextcloud_password }}<br /><br/>
                         <a href="https://{{ domain }}" class="button" target="_blank" rel="noopener">Open your Nextcloud ↗</a><br/>
@@ -159,24 +160,43 @@
                     {% endif %}
                 {% endif %}
 
-                {% if is_mastercontainer_update_available == true %}
-                    {% if isBackupOrRestoreRunning == false %}
-                        <h2>Mastercontainer update</h2>
-                        {% if isAnyRunning == false %}
-                            ⚠ A mastercontainer update is available. Please click on the button below to update it.<br><br>
-                            <form method="POST" action="/api/docker/watchtower" class="xhr">
-                                <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
-                                <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
-                                <input class="button" type="submit" value="Update mastercontainer" />
-                            </form>
-                        {% else %}
-                            ⚠ A mastercontainer update is available. Please stop your containers in order to be able to update the mastercontainer.
-                        {% endif %}
-                    {% endif %}
-                {% endif %}
-
                 {% if was_start_button_clicked == true %}
                     
+                    {% if isBackupOrRestoreRunning == false %}
+                        <h2>Mastercontainer</h2>
+                        You are currently running the {{ current_channel }} channel.<br><br>
+
+                        {% if is_mastercontainer_update_available == true %}
+                            {% if isAnyRunning == false %}
+                                ⚠ A mastercontainer update is available. Please click on the button below to update it.<br><br>
+                                <form method="POST" action="/api/docker/watchtower" class="xhr">
+                                    <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
+                                    <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
+                                    <input class="button" type="submit" value="Update mastercontainer" />
+                                </form>
+                            {% else %}
+                                ⚠ A mastercontainer update is available. Please stop your containers in order to be able to update the mastercontainer.<br><br>
+                            {% endif %}
+                            {% if current_channel starts with 'latest' %}
+                                You can find the changelog <a href="https://github.com/nextcloud/all-in-one/releases/latest">here</a><br><br>
+                            {% elseif current_channel starts with 'beta' %}
+                                You can find the changelog <a href="https://github.com/nextcloud/all-in-one/releases">here</a><br><br>
+                            {% elseif current_channel starts with 'develop' %}
+                                You can find all changes <a href="https://github.com/nextcloud-releases/all-in-one/commits/main">here</a><br><br>
+                            {% endif %}
+                        {% endif %}
+                        {% if isApacheStarting == false %} 
+                            You can change your AIO password below:<br><br />
+                            <form method="POST" action="/api/configuration" class="xhr">
+                                <input type="text" autocomplete="current-password" name="current-master-password" placeholder="your current aio password"/>
+                                <input type="text" autocomplete="new-password" name="new-master-password" placeholder="your new aio password"/>
+                                <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
+                                <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
+                                <input class="button" type="submit" value="Submit" />
+                            </form>
+                            The new password needs to be at least 24 characters long. Allowed characters are the <a href="https://en.wikipedia.org/wiki/Latin_alphabet#/media/File:Abecedarium.png">latin characters</a> 'a-z', 'A-Z', '0-9' and spaces.<br><br>
+                        {% endif %}
+                    {% endif %}
 
                     {% if isBackupOrRestoreRunning == false and borg_backup_host_location == "" and isApacheStarting != true %}
                         <h2>Backup and restore</h2>
@@ -210,6 +230,7 @@
                             Backed up will get all important data of your Nextcloud AIO instance like the database, your files and configuration files of the mastercontainer and else. <br /><br/>
                             The backup itself will use a tool that is called <a href="https://github.com/borgbackup/borg#what-is-borgbackup">BorgBackup<a/> which is a well-known server backup tool that efficiently backs up your files and encrypts them on the fly. <br /><br/>
                             Backups get created in the following directory on the host: {{ borg_backup_host_location }}/borg <br /><br/>
+                            Be aware that this solution does not back up files and folders that are mounted into Nextcloud using the external storage app. <br /><br/>
 
                             {% if isApacheStarting != true %}
                                 <form method="POST" action="/api/docker/backup" class="xhr">
@@ -246,6 +267,10 @@
                         {% endif %}
                     {% endif %}
                 {% endif %}
+                <h2>Optional</h2>
+                In this section, you will find optional addons in the future.
+                It will disable the ability to change them when any containers are running and allow to change them when they are stopped.
+                Also, it will display possible sections for optional addons. (which itself will be displayed when enabled and running).
             {% endif %}
         {% endif %}
 

readme.md

@@ -66,28 +66,28 @@ Included are:
     </details>
 
 4. After the initial startup, you should be able to open the Nextcloud AIO Interface now on port 8080 of this server.<br>
-E.g. https://internal.ip.of.this.server:8080<br>
+E.g. `https://internal.ip.of.this.server:8080`<br>
 If your server has port 80 and 8443 open and you point a domain to your server, you can get a valid certificate automatially by opening the Nextcloud AIO Interface via:<br>
-https://your-domain-that-points-to-this-server.tld:8443
+`https://your-domain-that-points-to-this-server.tld:8443`
+5. Please do not forget to open port `3478/TCP` and `3478/UDP` for the Talk container!
 
 ## FAQ
 ### How does it work?
 Nextcloud AIO is inspired by projects like Portainer that allow to manage the docker daemon by talking to the docker socket directly. This concept allows to install only one container with a single command that does the heavy lifting of creating and managing all containers that are needed in order to provide a Nextcloud installation with most features included. It also makes updating a breeze and is not bound to the host system (and its slow updates) anymore as everything is in containers. Additionally, it is very easy to handle from a user perspective because a simple interface for managing your Nextcloud AIO installation is provided.
 
 ### Are reverse proxies supported?
-Reverse proxies are currently because of the above mentioned architecture not supported.<br>
-You might investigate yourself though how it could made work behind reverse proxies. If you open a PR with that we might consider it then :)
+Yes. Please refer to the following documentation on this: [reverse-proxy.md](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md)
 
 ### Which ports are mandatory to be open?
 Only those (if you acces the Mastercontainer Interface internally via port 8080):
-- `443/TCP` for the Nextcloud container
+- `443/TCP` for the Apache container
 - `3478/TCP` and `3478/UDP` for the Talk container
 
 ### Explanation of used ports:
 - `8080/TCP`: Mastercontainer Interface with self-signed certificate (works always, also if only access via IP-address is possible, e.g. `https://internal.ip.address:8080/`)
 - `80/TCP`: redirects to Nextcloud (is used for getting the certificate via ACME http-challenge for the Mastercontainer)
 - `8443/TCP`: Mastercontainer Interface with valid certificate (only works if port 80 and 8443 are open and you point a domain to your server. It generates a valid certificate then automatically and access via e.g. `https://public.domain.com:8443/` is possible.)
-- `443/TCP`: will be used by the Nextcloud container later on and needs to be open
+- `443/TCP`: will be used by the Apache container later on and needs to be open
 - `3478/TCP` and `3478/UDP`: will be used by the Turnserver inside the Talk container and needs to be open
 
 ### How to run `occ` commands?
@@ -117,11 +117,19 @@ Backups can be created and restored in the AIO interface using the buttons `Crea
 
 The backups itself get encrypted with an encryption key that gets shown to you in the AIO interface. Please save that at a safe place as you will not be able to restore from backup without this key.
 
+Be aware that this solution does not back up files and folders that are mounted into Nextcloud using the external storage app.
+
 Note that this implementation does not provide remote backups, for this you can use the [backup app](https://apps.nextcloud.com/apps/backup).
 
 ---
 
-**Pro-tip**: you can open the BorgBackup archives on your host by following these steps:<br>
+#### Failure of the backup container in LXC containers
+If you are running AIO in a LXC container, you need to make sure that FUSE is enabled in the LXC container settings. Otherwise the backup container will not be able to start as FUSE is required for it to work.
+
+---
+
+#### Pro-tip: Backup archives access
+You can open the BorgBackup archives on your host by following these steps:<br>
 (instructions for Ubuntu Desktop)
 ```bash
 # Install borgbackup on the host
@@ -139,8 +147,114 @@ xhost +si:localuser:root && sudo nautilus /tmp/borg
 sudo umount /tmp/borg
 ```
 
+---
+
+#### Delete backup archives manually
+You can delete BorgBackup archives on your host manually by following these steps:<br>
+(instructions for Debian based OS' like Ubuntu)
+```bash
+# Install borgbackup on the host
+sudo apt update && sudo apt install borgbackup
+
+# List all archives (if you are using the default backup location /mnt/backup/borg)
+sudo borg list "/mnt/backup/borg"
+
+# After entering your repository key successfully, you should now see a list of all backup archives
+# An example backup archive might be called 20220223_174237-nextcloud-aio
+# Then you can simply delete the archive with:
+sudo borg delete --stats --progress "/mnt/backup/borg::20220223_174237-nextcloud-aio"
+```
+
+After doing so, make sure to update the backup archives list in the AIO interface!<br>
+You can do so by clicking on the `Check backup integrity` button or `Create backup` button.
+
+---
+
+#### Sync the backup regularly to another drive
+For increased backup security, you might consider syncing the backup repository regularly to another drive.
+
+To do that, first add the drive to `/etc/fstab` so that it is able to get automatically mounted and then create a script that does all the things automatically. Here is an example for such a script:
+
+<details>
+<summary>Click here to expand</summary>
+
+```bash
+#!/bin/bash
+
+# Please modify all variables below to your needings:
+SOURCE_DIRECTORY="/mnt/backup/borg"
+DRIVE_MOUNTPOINT="/mnt/backup-drive"
+TARGET_DIRECTORY="/mnt/backup-drive/borg"
+
+########################################
+# Please do NOT modify anything below! #
+########################################
+
+if [ "$EUID" -ne 0 ]; then 
+    echo "Please run as root"
+    exit 1
+fi
+
+if ! [ -d "$SOURCE_DIRECTORY" ]; then
+    echo "The source directory does not exist."
+    exit 1
+fi
+
+if ! [ -d "$DRIVE_MOUNTPOINT" ]; then
+    echo "The drive mountpoint must be an existing directory"
+    exit 1
+fi
+
+if ! grep -q " $DRIVE_MOUNTPOINT " /etc/fstab; then
+    echo "Could not find the drive mountpoint in the fstab file. Did you add it there?"
+    exit 1
+fi
+
+if ! mountpoint -q "$DRIVE_MOUNTPOINT"; then
+    mount "$DRIVE_MOUNTPOINT"
+    if ! mountpoint -q "$DRIVE_MOUNTPOINT"; then
+        echo "Could not mount the drive. Is it connected?"
+        exit 1
+    fi
+fi
+
+if [ -f "$SOURCE_DIRECTORY/lock.roster" ]; then
+    echo "Cannot run the script as the backup archive is currently changed. Please try again later."
+    exit 1
+fi
+
+mkdir -p "$TARGET_DIRECTORY"
+if ! [ -d "$TARGET_DIRECTORY" ]; then
+    echo "Could not create target directory"
+    exit 1
+fi
+
+if ! rsync --stats --archive --human-readable --delete "$SOURCE_DIRECTORY/" "$TARGET_DIRECTORY"; then
+    echo "Failed to sync the backup repository to the target directory."
+    exit 1
+fi
+
+umount "$DRIVE_MOUNTPOINT"
+if mountpoint -q "$DRIVE_MOUNTPOINT"; then
+    echo "Synced the backup repository successfully but failed to unmount the target drive."
+    exit 0
+fi
+
+echo "Synced the backup repository successfully and unmounted the target drive."
+exit 0
+```
+
+</details>
+
+You can simply copy and past the script into a file e.g. named `backup-script.sh` e.g. here: `/root/backup-script.sh`. Do not forget to modify the variables to your needings though!
+
+Afterwards apply the correct permissions with `sudo chown root:root /root/backup-script.sh` and `sudo chmod 700 /root/backup-script.sh`. Then you can create a cronjob that runs e.g. at `20:00` each week on sundays like this: `crontab -u root -l | { cat; echo "0 20 * * 7 /root/backup-script.sh"; } | crontab -u root -`. Make sure that it does not collidate with the daily backups from AIO (if configured) since the target backup repository might get into an inconsistent state. (There is no check in place that checks this.)
+
+### How to change the default location of Nextcloud's Datadir?
+You can configure the Nextcloud container to use a specific directory on your host as data directory. You can do so by adding the environmental variable `NEXTCLOUD_DATADIR` to the initial startup of the mastercontainer. Allowed values for that variable are strings that start with `/mnt/` or `/media/`. An example for this is `-e NEXTCLOUD_DATADIR="/mnt/ncdata"`. Please make sure to apply the correct permissions to the chosen directory before starting Nextcloud the first time. In this example would the command for this be: `sudo chown -R 33:0 /mnt/ncdata`. **Attention:** It is very important to change the datadir **before** Nextcloud is installed/started the first time and not to change it afterwards!
+
 ### How to allow the Nextcloud container to access directories on the host?
-By default, the Nextcloud container is confined and cannot access directories on the host OS. You might want to change this when you are planning to use local external storage in Nextcloud to store some files outside the data directory and can do so by adding the environmental variable `NEXTCLOUD_MOUNT` to the initial startup of the mastercontainer. Allowed values for that variable are strings that are equal to or start with `/mnt/` or `/media/` or are equal to `/var/backups` and unequal to `/mnt/ncdata`. Two examples for this are: `-e NEXTCLOUD_MOUNT="/mnt/"` or `-e NEXTCLOUD_MOUNT="/media/"`. After doing so, please make sure to apply the correct permissions to the directories that you want to use in Nextcloud. E.g. `sudo chown -R 33:0 /mnt/your-drive-mountpoint` should make it work. You can then navigate to the apps management page, activate the external storage app, navigate to `https://your-nc-domain.com/settings/admin/externalstorages` and add a local external storage directory that will be accessible inside the container at the same place that you've entered. E.g. `/mnt/your-drive-mountpoint` will be mounted to `/mnt/your-drive-mountpoint` inside the container, etc.
+By default, the Nextcloud container is confined and cannot access directories on the host OS. You might want to change this when you are planning to use local external storage in Nextcloud to store some files outside the data directory and can do so by adding the environmental variable `NEXTCLOUD_MOUNT` to the initial startup of the mastercontainer. Allowed values for that variable are strings that are equal to or start with `/mnt/` or `/media/` or are equal to `/var/backups` and unequal to `/mnt/ncdata`. Two examples for this are: `-e NEXTCLOUD_MOUNT="/mnt/"` or `-e NEXTCLOUD_MOUNT="/media/"`. After doing so, please make sure to apply the correct permissions to the directories that you want to use in Nextcloud. E.g. `sudo chown -R 33:0 /mnt/your-drive-mountpoint` should make it work. You can then navigate to the apps management page, activate the external storage app, navigate to `https://your-nc-domain.com/settings/admin/externalstorages` and add a local external storage directory that will be accessible inside the container at the same place that you've entered. E.g. `/mnt/your-drive-mountpoint` will be mounted to `/mnt/your-drive-mountpoint` inside the container, etc. Be aware though that these locations will not be covered by the built-in backup solution!
 
 ### Huge docker logs
 When your containers run for a few days without a restart, the container logs that you can view from the AIO interface can get really huge. You can limit the loge sizes by enabling logrotate for docker container logs. Feel free to enable this by following those instructions: https://sandro-keil.de/blog/logrotate-for-docker-container/

reverse-proxy.md

@@ -0,0 +1,68 @@
+## Reverse Proxy Config
+
+Basically, you need to specify the port that the apache container shall use and modify the startup command a bit.
+
+All examples below will use port `11000` as example apache port. Also it is supposed that the reverse proxy runs on the same server like AIO, hence `localhost` is used and not an internal ip-address to point to the AIO instance. Modify both to your needings.
+
+### Caddy reverse proxy config example
+
+Add this to your Caddyfile:
+
+```
+https://<your-nc-domain>:443 {
+    header Strict-Transport-Security max-age=31536000;
+    reverse_proxy localhost:11000
+}
+```
+
+Of course you need to modify `<your-nc-domain>` to the domain on which you want to run Nextcloud.
+
+### Startup command
+
+```
+# For x64 CPUs:
+sudo docker run -it \
+--name nextcloud-aio-mastercontainer \
+--restart always \
+-p 8080:8080 \
+-e APACHE_PORT=11000 \
+--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+--volume /var/run/docker.sock:/var/run/docker.sock:ro \
+nextcloud/all-in-one:latest
+```
+
+<details>
+
+<summary>Command for arm64 CPUs like the Raspberry Pi 4</summary>
+
+```
+# For arm64 CPUs:
+sudo docker run -it \
+--name nextcloud-aio-mastercontainer \
+--restart always \
+-p 8080:8080 \
+-e APACHE_PORT=11000 \
+--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+--volume /var/run/docker.sock:/var/run/docker.sock:ro \
+nextcloud/all-in-one:latest-arm64
+```
+
+</details>
+
+After doing so, you should be able to access the AIO Interface via `https://internal.ip.of.this.server:8080`. Enter your domain that you've entered in the reverse proxy config and you should be done. Please do not forget to open port `3478/TCP` and `3478/UDP` for the Talk container!
+
+### Optional
+
+If you want to also access your AIO interface publicly with a valid certificate, you can add e.g. the following config to your Caddyfile:
+
+```
+https://<your-nc-domain>:8443 {
+    reverse_proxy https://localhost:8080 {
+        transport http {
+            tls_insecure_skip_verify
+        }
+    }
+}
+```
+
+Of course you also need to modify `<your-nc-domain>` to the domain that you want to use. Afterwards should the AIO interface be accessible via `https://<your-nc-domain>:8443`.