Merge branch 'main' into enh/noid/overwrite

Signed-off-by: Jean-Yves <7360784+docjyJ@users.noreply.github.com>

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -1,6 +1,6 @@
 ---
-name: 🐛 Bug report - no questions and no support!
-about: Help us improving by reporting a bug - this category is not for questions and also not for support! Please use one of the options below for questions and support
+name: 🐛 Bug report
+about: Help us improving by reporting a bug
 labels: 0. Needs triage
 ---
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1,14 +1,14 @@
 blank_issues_enabled: false
 contact_links:
-    - name: ⛑️ General questions and support
-      url: https://help.nextcloud.com/tag/aio
-      about: For general questions, support and help
     - name: 💡 Suggest a new feature or discuss one
       url:  https://github.com/nextcloud/all-in-one/discussions/categories/ideas
       about: For new feature requests and discussion of existing ones
-    - name: ❓ Questions about Nextcloud AIO
+    - name: ❓ Questions on AIO
       url: https://github.com/nextcloud/all-in-one/discussions/categories/questions
-      about: For questions specifically about AIO
+      about: For questions regarding AIO
+    - name: ⛑️ Community Support and Help
+      url: https://help.nextcloud.com/tag/aio
+      about: For other types of questions
     - name: 💼 Nextcloud Enterprise
       url: https://portal.nextcloud.com/
       about: If you are a Nextcloud Enterprise customer, or need Professional support, so it can be resolved directly by our dedicated engineers more quickly

.github/dependabot.yml

@@ -6,17 +6,12 @@ updates:
     interval: "daily"
     time: "12:00"
   open-pull-requests-limit: 10
-  rebase-strategy: "disabled"
-  labels:
-  - 3. to review
-  - dependencies
 - package-ecosystem: composer
   directory: "/php/"
   schedule:
     interval: "daily"
     time: "12:00"
   open-pull-requests-limit: 10
-  rebase-strategy: "auto"
   labels:
   - 3. to review
   - dependencies
@@ -44,7 +39,6 @@ updates:
     interval: "daily"
     time: "04:00"
   open-pull-requests-limit: 10
-  rebase-strategy: "disabled"
   labels:
   - 3. to review
   - dependencies

.github/workflows/helm-release.yml

@@ -41,7 +41,7 @@ jobs:
           helm lint ./nextcloud-aio-helm-chart
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@v1.6.0
         with:
           mark_as_latest: false
           charts_dir: .

.github/workflows/json-validator.yml

@@ -1,37 +1,35 @@
-name: Json Validator
-
-on:
-  pull_request:
-    paths:
-      - '**.json'
-  push:
-    branches:
-      - main
-    paths:
-      - '**.json'
-
-jobs:
-  json-validator:
-    name: Json Validator
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Validate Json
-        run: |
-          sudo apt-get update
-          sudo apt-get install python3-venv -y --no-install-recommends
-          python3 -m venv venv
-          . venv/bin/activate
-          pip3 install json-spec
-          if ! json validate --schema-file=php/containers-schema.json --document-file=php/containers.json; then
-            exit 1
-          fi
-          JSON_FILES="$(find ./community-containers -name '*.json')"
-          mapfile -t JSON_FILES <<< "$JSON_FILES"
-          for file in "${JSON_FILES[@]}"; do
-            json validate --schema-file=php/containers-schema.json --document-file="$file" 2>&1 | tee -a ./json-validator.log
-          done
-          if grep -q "document does not validate with schema.\|invalid JSONFile" ./json-validator.log; then
-            exit 1
-          fi
+name: Json Validator
+
+on:
+  pull_request:
+    paths:
+      - '**.json'
+  push:
+    branches:
+      - main
+    paths:
+      - '**.json'
+
+jobs:
+  json-validator:
+    name: Json Validator
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Validate Json
+        run: |
+          sudo apt-get update
+          sudo apt-get install python3-pip -y --no-install-recommends
+          sudo pip3 install json-spec
+          if ! json validate --schema-file=php/containers-schema.json --document-file=php/containers.json; then
+            exit 1
+          fi
+          JSON_FILES="$(find ./community-containers -name '*.json')"
+          mapfile -t JSON_FILES <<< "$JSON_FILES"
+          for file in "${JSON_FILES[@]}"; do
+            json validate --schema-file=php/containers-schema.json --document-file="$file" 2>&1 | tee -a ./json-validator.log
+          done
+          if grep -q "document does not validate with schema.\|invalid JSONFile" ./json-validator.log; then
+            exit 1
+          fi

.github/workflows/nextcloud-update.yml

@@ -25,7 +25,7 @@ jobs:
             | sort -V \
             | tail -1
         )"
-        sed -i "s|\(pecl install[^;]*APCu-\)[0-9.]*|\1$apcu_version|" ./Containers/nextcloud/Dockerfile
+        sed -i "s|pecl install APCu.*\;|pecl install APCu-$apcu_version\;|" ./Containers/nextcloud/Dockerfile
         
         # Memcached
         memcached_version="$(
@@ -36,7 +36,7 @@ jobs:
             | sort -V \
             | tail -1
         )"
-        sed -i "s|\(pecl install[^;]*memcached-\)[0-9.]*|\1$memcached_version|" ./Containers/nextcloud/Dockerfile
+        sed -i "s|pecl install memcached.* |pecl install memcached-$memcached_version |" ./Containers/nextcloud/Dockerfile
         
         # Redis
         redis_version="$(
@@ -47,24 +47,18 @@ jobs:
             | sort -V \
             | tail -1
         )"
-        sed -i "s|\(pecl install[^;]*redis-\)[0-9.]*|\1$redis_version|" ./Containers/nextcloud/Dockerfile
+        sed -i "s|pecl install redis.* |pecl install redis-$redis_version |" ./Containers/nextcloud/Dockerfile
         
         # Imagick
         imagick_version="$(
-          git ls-remote --tags https://github.com/imagick/imagick.git \
+          git ls-remote --tags https://github.com/mkoppanen/imagick.git \
             | cut -d/ -f3 \
             | grep -viE '[a-z]' \
             | tr -d '^{}' \
             | sort -V \
             | tail -1
         )"
-        sed -i "s|\(pecl install[^;]*imagick-\)[0-9.]*|\1$imagick_version|" ./Containers/nextcloud/Dockerfile
-
-        # Imagick git-commit-hash from HEAD
-        imagick_commit_hash="$(
-          git ls-remote https://github.com/imagick/imagick.git HEAD | awk '{print $1}'
-        )"
-        sed -i "s/\(ARG IMAGICK_COMMIT_HASH=\)[a-fA-F0-9]*$/\1$imagick_commit_hash/" ./Containers/nextcloud/Dockerfile
+        sed -i "s|pecl install imagick.*\;|pecl install imagick-$imagick_version\;|" ./Containers/nextcloud/Dockerfile
 
         # Igbinary
         igbinary_version="$(
@@ -75,7 +69,7 @@ jobs:
             | sort -V \
             | tail -1
         )"
-        sed -i "s|\(pecl install[^;]*igbinary-\)[0-9.]*|\1$igbinary_version|" ./Containers/nextcloud/Dockerfile
+        sed -i "s|pecl install igbinary.*\;|pecl install igbinary-$igbinary_version\;|" ./Containers/nextcloud/Dockerfile
 
         # Nextcloud
         NC_MAJOR="$(grep "ENV NEXTCLOUD_VERSION" ./Containers/nextcloud/Dockerfile | grep -oP '[23][0-9]')"

.github/workflows/talk.yml

@@ -36,7 +36,7 @@ jobs:
         
         # Janus
         janus_version="$(
-          git ls-remote https://github.com/meetecho/janus-gateway v1.*.* \
+          git ls-remote https://github.com/meetecho/janus-gateway v0.*.* \
             | cut -d/ -f3 \
             | sort -V \
             | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+$" \

.github/workflows/update-copyright.yml

@@ -1,11 +0,0 @@
-name: Update Copyright
-
-on:
-  workflow_dispatch:
-
-jobs:
-  update-copyright:
-    name: update copyright
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4

Containers/apache/Caddyfile

@@ -40,7 +40,7 @@ https://{$ADDITIONAL_TRUSTED_DOMAIN}:443,
     route /onlyoffice/* {
         uri strip_prefix /onlyoffice
         reverse_proxy {$ONLYOFFICE_HOST}:80 {
-            header_up X-Forwarded-Host {http.request.hostport}/onlyoffice
+            header_up X-Forwarded-Host {http.request.host}/onlyoffice
             header_up X-Forwarded-Proto https
         }
     }

Containers/apache/Dockerfile

@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:latest
-FROM caddy:2.9.1-alpine AS caddy
+FROM caddy:2.8.4-alpine AS caddy
 
 # From https://github.com/docker-library/httpd/blob/master/2.4/alpine/Dockerfile
-FROM httpd:2.4.63-alpine3.21
+FROM httpd:2.4.62-alpine3.20
 
 COPY --from=caddy /usr/bin/caddy /usr/bin/caddy
 
@@ -81,7 +81,7 @@ RUN set -ex; \
     \
     echo "root:$(openssl rand -base64 12)" | chpasswd
 
-USER 33
+USER www-data
 
 ENTRYPOINT ["/start.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]

Containers/apache/healthcheck.sh

@@ -3,3 +3,7 @@
 nc -z "$NEXTCLOUD_HOST" 9000 || exit 0
 nc -z 127.0.0.1 8000 || exit 1
 nc -z 127.0.0.1 "$APACHE_PORT" || exit 1
+if ! nc -z "$NC_DOMAIN" 443; then
+    echo "Could not reach $NC_DOMAIN on port 443."
+    exit 1
+fi

Containers/apache/supervisord.conf

@@ -9,8 +9,8 @@ logfile_backups=10
 loglevel=error
 
 [program:apache]
-# Stdout logging is disabled as otherwise the logs are spammed
-stdout_logfile=NONE
+# stdout_logfile=/dev/stdout
+# stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 command=apachectl -DFOREGROUND

Containers/borgbackup/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 
 RUN set -ex; \
     \
@@ -11,13 +11,11 @@ RUN set -ex; \
         rsync \
         fuse \
         py3-llfuse \
-        jq \
-        openssh-client
+        jq
 
 VOLUME /root
 
 COPY --chmod=770 *.sh /
-COPY borg_excludes /
 
 ENTRYPOINT ["/start.sh"]
 # hadolint ignore=DL3002

Containers/borgbackup/backupscript.sh

@@ -34,23 +34,19 @@ for volume in "${DEFAULT_VOLUMES[@]}"; do
 done
 
 # Check if target is mountpoint
-if [ -z "$BORG_REMOTE_REPO" ] && ! mountpoint -q "$MOUNT_DIR"; then
-    echo "$MOUNT_DIR is not a mountpoint which is not allowed."
+if ! mountpoint -q /mnt/borgbackup; then
+    echo "/mnt/borgbackup is not a mountpoint which is not allowed."
     exit 1
 fi
 
-# Check if repo is uninitialized
-if [ "$BORG_MODE" != backup ] && [ "$BORG_MODE" != test ] && ! borg info > /dev/null; then
-    if [ -n "$BORG_REMOTE_REPO" ]; then
-        echo "The repository is uninitialized or cannot connect to remote. Cannot perform check or restore."
-    else
-        echo "The repository is uninitialized. Cannot perform check or restore."
-    fi
+# Check if target is empty
+if [ "$BORG_MODE" != backup ] && [ "$BORG_MODE" != test ] && ! [ -f "$BORG_BACKUP_DIRECTORY/config" ]; then
+    echo "The repository is empty. Cannot perform check or restore."
     exit 1
 fi
 
 # Do not continue if this file exists (needed for simple external blocking)
-if [ -z "$BORG_REMOTE_REPO" ] && [ -f "$BORG_BACKUP_DIRECTORY/aio-lockfile" ]; then
+if [ -f "$BORG_BACKUP_DIRECTORY/aio-lockfile" ]; then
     echo "Not continuing because aio-lockfile exists – it seems like a script is externally running which is locking the backup archive."
     echo "If this should not be the case, you can fix this by deleting the 'aio-lockfile' file from the backup archive directory."
     exit 1
@@ -61,15 +57,6 @@ if [ "$BORG_MODE" = backup ] || [ "$BORG_MODE" = restore ]; then
     touch "/nextcloud_aio_volumes/nextcloud_aio_database_dump/backup-is-running"
 fi
 
-if [ -n "$BORG_REMOTE_REPO" ] && ! [ -f "$BORGBACKUP_KEY" ]; then
-    echo "First run, creating borg ssh key"
-    ssh-keygen  -f "$BORGBACKUP_KEY" -N ""
-    echo "You should configure the remote to accept this public key"
-fi
-if [ -n "$BORG_REMOTE_REPO" ] && [ -f "$BORGBACKUP_KEY.pub" ]; then
-    echo "Your public ssh key for borgbackup is: $(cat "$BORGBACKUP_KEY.pub")"
-fi
-
 # Do the backup
 if [ "$BORG_MODE" = backup ]; then
 
@@ -113,22 +100,15 @@ if [ "$BORG_MODE" = backup ]; then
         exit 1
     fi
 
-    if [ -z "$BORG_REMOTE_REPO" ]; then
-        # Create backup folder
-        mkdir -p "$BORG_BACKUP_DIRECTORY"
-    fi
+    # Create backup folder
+    mkdir -p "$BORG_BACKUP_DIRECTORY"
 
-    # Initialize the repository if can't get info from target
-    if ! borg info > /dev/null; then
+    # Initialize the repository if the target is empty
+    if ! [ -f "$BORG_BACKUP_DIRECTORY/config" ]; then
         # Don't initialize if already initialized
         if [ -f "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/borg.config" ]; then
-            if [ -n "$BORG_REMOTE_REPO" ]; then
-                echo "Borg could not get info from the remote repo."
-                echo "This might be a failure to connect to the remote server. See the above borg info output for details."
-            else
-                echo "Borg could not get info from the targeted directory."
-                echo "This might happen if the targeted directory is located on an external drive and the drive not connected anymore. You should check this."
-            fi
+            echo "No borg config file was found in the targeted directory."
+            echo "This might happen if the targeted directory is located on an external drive and the drive not connected anymore. You should check this."
             echo "If you instead want to initialize a new backup repository, you may delete the 'borg.config' file that is stored in the mastercontainer volume manually, which will allow you to initialize a new borg repository in the chosen directory:"
             echo "sudo docker exec nextcloud-aio-mastercontainer rm /mnt/docker-aio-config/data/borg.config"
             exit 1
@@ -136,44 +116,28 @@ if [ "$BORG_MODE" = backup ]; then
 
         echo "Initializing repository..."
         NEW_REPOSITORY=1
-        if ! borg init --debug --encryption=repokey-blake2; then
+        if ! borg init --debug --encryption=repokey-blake2 "$BORG_BACKUP_DIRECTORY"; then
             echo "Could not initialize borg repository."
-            if [ -z "$BORG_REMOTE_REPO" ]; then
-                # Originally we checked for presence of the config file instead of calling `borg info`. Likely `borg info`
-                # will error on a partially initialized repo, so this line is probably no longer necessary
-                rm -f "$BORG_BACKUP_DIRECTORY/config"
-            fi
+            rm -f "$BORG_BACKUP_DIRECTORY/config"
             exit 1
         fi
+        borg config "$BORG_BACKUP_DIRECTORY" additional_free_space 2G
 
-        if [ -z "$BORG_REMOTE_REPO" ]; then
-            # borg config only works for local repos; it's up to the remote to ensure the disk isn't full
-            borg config :: additional_free_space 2G
+        # Fix too large Borg cache
+        # https://borgbackup.readthedocs.io/en/stable/faq.html#the-borg-cache-eats-way-too-much-disk-space-what-can-i-do
+        BORG_ID="$(borg config "$BORG_BACKUP_DIRECTORY" id)"
+        rm -r "/root/.cache/borg/$BORG_ID/chunks.archive.d"
+        touch "/root/.cache/borg/$BORG_ID/chunks.archive.d"
 
-            # Fix too large Borg cache
-            # https://borgbackup.readthedocs.io/en/stable/faq.html#the-borg-cache-eats-way-too-much-disk-space-what-can-i-do
-            BORG_ID="$(borg config :: id)"
-            rm -r "/root/.cache/borg/$BORG_ID/chunks.archive.d"
-            touch "/root/.cache/borg/$BORG_ID/chunks.archive.d"
-        fi
-
-        if ! borg info > /dev/null; then
-            echo "Borg can't get info from the repo it created. Something is wrong."
+        # Make a backup from the borg config file
+        if ! [ -f "$BORG_BACKUP_DIRECTORY/config" ]; then
+            echo "The borg config file wasn't created. Something is wrong."
             exit 1
         fi
-
         rm -f "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/borg.config"
-        if [ -n "$BORG_REMOTE_REPO" ]; then
-            # `borg config` does not support remote repos so instead create a dummy file and rely on the remote to avoid
-            # corruption of the config file (which contains the encryption key). We don't actually use the contents of
-            # this file anywhere, so a touch is all we need so we remember we already initialized the repo.
-            touch "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/borg.config"
-        else
-            # Make a backup from the borg config file
-            if ! cp "$BORG_BACKUP_DIRECTORY/config" "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/borg.config"; then
-                echo "Could not copy config file to second place. Cannot perform backup."
-                exit 1
-            fi
+        if ! cp "$BORG_BACKUP_DIRECTORY/config" "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/borg.config"; then
+            echo "Could not copy config file to second place. Cannot perform backup."
+            exit 1
         fi
 
         echo "Repository successfully initialized."
@@ -203,9 +167,9 @@ if [ "$BORG_MODE" = backup ]; then
     # Create the backup
     echo "Starting the backup..."
     get_start_time
-    if ! borg create "${BORG_OPTS[@]}" "${BORG_EXCLUDE[@]}" "::$CURRENT_DATE-nextcloud-aio" "/nextcloud_aio_volumes/" --exclude-from /borg_excludes; then
+    if ! borg create "${BORG_OPTS[@]}" "${BORG_EXCLUDE[@]}" "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-nextcloud-aio" "/nextcloud_aio_volumes/"; then
         echo "Deleting the failed backup archive..."
-        borg delete --stats "::$CURRENT_DATE-nextcloud-aio"
+        borg delete --stats "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-nextcloud-aio"
         echo "Backup failed!"
         echo "You might want to check the backup integrity via the AIO interface."
         if [ "$NEW_REPOSITORY" = 1 ]; then
@@ -224,14 +188,14 @@ if [ "$BORG_MODE" = backup ]; then
 
     # Prune archives
     echo "Pruning the archives..."
-    if ! borg prune --stats --glob-archives '*_*-nextcloud-aio' "${BORG_PRUNE_OPTS[@]}"; then
+    if ! borg prune --stats --glob-archives '*_*-nextcloud-aio' "${BORG_PRUNE_OPTS[@]}" "$BORG_BACKUP_DIRECTORY"; then
         echo "Failed to prune archives!"
         exit 1
     fi
 
     # Compact archives
     echo "Compacting the archives..."
-    if ! borg compact; then
+    if ! borg compact "$BORG_BACKUP_DIRECTORY"; then
         echo "Failed to compact archives!"
         exit 1
     fi
@@ -248,19 +212,19 @@ if [ "$BORG_MODE" = backup ]; then
                 fi
             done
             echo "Starting the backup for additional volumes..."
-            if ! borg create "${BORG_OPTS[@]}" "::$CURRENT_DATE-additional-docker-volumes" "/docker_volumes/"; then
+            if ! borg create "${BORG_OPTS[@]}" "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-additional-docker-volumes" "/docker_volumes/"; then
                 echo "Deleting the failed backup archive..."
-                borg delete --stats "::$CURRENT_DATE-additional-docker-volumes"
+                borg delete --stats "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-additional-docker-volumes"
                 echo "Backup of additional docker-volumes failed!"
                 exit 1
             fi
             echo "Pruning additional volumes..."
-            if ! borg prune --stats --glob-archives '*_*-additional-docker-volumes' "${BORG_PRUNE_OPTS[@]}"; then
+            if ! borg prune --stats --glob-archives '*_*-additional-docker-volumes' "${BORG_PRUNE_OPTS[@]}" "$BORG_BACKUP_DIRECTORY"; then
                 echo "Failed to prune additional docker-volumes archives!"
                 exit 1
             fi
             echo "Compacting additional volumes..."
-            if ! borg compact; then
+            if ! borg compact "$BORG_BACKUP_DIRECTORY"; then
                 echo "Failed to compact additional docker-volume archives!"
                 exit 1
             fi
@@ -278,19 +242,19 @@ if [ "$BORG_MODE" = backup ]; then
                 EXCLUDE_DIRS+=(--exclude "/host_mounts/$directory/")
             done
             echo "Starting the backup for additional host mounts..."
-            if ! borg create "${BORG_OPTS[@]}" "${EXCLUDE_DIRS[@]}" "::$CURRENT_DATE-additional-host-mounts" "/host_mounts/"; then
+            if ! borg create "${BORG_OPTS[@]}" "${EXCLUDE_DIRS[@]}" "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-additional-host-mounts" "/host_mounts/"; then
                 echo "Deleting the failed backup archive..."
-                borg delete --stats "::$CURRENT_DATE-additional-host-mounts"
+                borg delete --stats "$BORG_BACKUP_DIRECTORY::$CURRENT_DATE-additional-host-mounts"
                 echo "Backup of additional host-mounts failed!"
                 exit 1
             fi
             echo "Pruning additional host mounts..."
-            if ! borg prune --stats --glob-archives '*_*-additional-host-mounts' "${BORG_PRUNE_OPTS[@]}"; then
+            if ! borg prune --stats --glob-archives '*_*-additional-host-mounts' "${BORG_PRUNE_OPTS[@]}" "$BORG_BACKUP_DIRECTORY"; then
                 echo "Failed to prune additional host-mount archives!"
                 exit 1
             fi
             echo "Compacting additional host mounts..."
-            if ! borg compact; then
+            if ! borg compact "$BORG_BACKUP_DIRECTORY"; then
                 echo "Failed to compact additional host-mount archives!"
                 exit 1
             fi
@@ -312,24 +276,17 @@ fi
 if [ "$BORG_MODE" = restore ]; then
     get_start_time
 
-    # Pick archive to restore
+    # Perform the restore
     if [ -n "$SELECTED_RESTORE_TIME" ]; then
-        SELECTED_ARCHIVE="$(borg list | grep "nextcloud-aio" | grep "$SELECTED_RESTORE_TIME" | awk -F " " '{print $1}' | head -1)"
+        SELECTED_ARCHIVE="$(borg list "$BORG_BACKUP_DIRECTORY" | grep "nextcloud-aio" | grep "$SELECTED_RESTORE_TIME" | awk -F " " '{print $1}' | head -1)"
     else
-        SELECTED_ARCHIVE="$(borg list | grep "nextcloud-aio" | awk -F " " '{print $1}' | sort -r | head -1)"
+        SELECTED_ARCHIVE="$(borg list "$BORG_BACKUP_DIRECTORY" | grep "nextcloud-aio" | awk -F " " '{print $1}' | sort -r | head -1)"
     fi
     echo "Restoring '$SELECTED_ARCHIVE'..."
-
-    # Exclude previews from restore if selected to speed up process
-    ADDITIONAL_RSYNC_EXCLUDES=()
-    ADDITIONAL_BORG_EXCLUDES=()
-    ADDITIONAL_FIND_EXCLUDES=()
-    if [ -n "$RESTORE_EXCLUDE_PREVIEWS" ]; then
-        # Keep these 3 in sync. Beware, the pattern syntax and the paths differ
-        ADDITIONAL_RSYNC_EXCLUDES=(--exclude "nextcloud_aio_nextcloud_data/appdata_*/preview/**")
-        ADDITIONAL_BORG_EXCLUDES=(--exclude "sh:nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/appdata_*/preview/**")
-        ADDITIONAL_FIND_EXCLUDES=(-o -regex 'nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/appdata_[^/]*/preview\(/.*\)?')
-        echo "Excluding previews from restore"
+    mkdir -p /tmp/borg
+    if ! borg mount "$BORG_BACKUP_DIRECTORY::$SELECTED_ARCHIVE" /tmp/borg; then
+        echo "Could not mount the backup!"
+        exit 1
     fi
 
     # Save Additional Backup dirs
@@ -342,12 +299,27 @@ if [ "$BORG_MODE" = restore ]; then
         DAILY_BACKUPTIME="$(cat /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/daily_backup_time)"
     fi
 
+    # Restore everything except the configuration file
+    if ! rsync --stats --archive --human-readable -vv --delete \
+    --exclude "nextcloud_aio_apache/caddy/**" \
+    --exclude "nextcloud_aio_mastercontainer/caddy/**" \
+    --exclude "nextcloud_aio_nextcloud/data/nextcloud.log*" \
+    --exclude "nextcloud_aio_nextcloud/data/audit.log" \
+    --exclude "nextcloud_aio_mastercontainer/certs/**" \
+    --exclude "nextcloud_aio_mastercontainer/data/configuration.json" \
+    --exclude "nextcloud_aio_mastercontainer/data/daily_backup_running" \
+    --exclude "nextcloud_aio_mastercontainer/data/session_date_file" \
+    --exclude "nextcloud_aio_mastercontainer/session/**" \
+    /tmp/borg/nextcloud_aio_volumes/ /nextcloud_aio_volumes/; then
+        RESTORE_FAILED=1
+        echo "Something failed while restoring from backup."
+    fi
+
     # Save current aio password
     AIO_PASSWORD="$(jq '.password' /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
 
-    # Save current backup location vars
+    # Save current path
     BORG_LOCATION="$(jq '.borg_backup_host_location' /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
-    REMOTE_REPO="$(jq '.borg_remote_repo' /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
 
     # Save current nextcloud datadir
     if grep -q '"nextcloud_datadir":' /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json; then
@@ -356,114 +328,21 @@ if [ "$BORG_MODE" = restore ]; then
         NEXTCLOUD_DATADIR='""'
     fi
 
-    if [ -z "$BORG_REMOTE_REPO" ]; then
-        mkdir -p /tmp/borg
-        if ! borg mount "::$SELECTED_ARCHIVE" /tmp/borg; then
-            echo "Could not mount the backup!"
-            exit 1
-        fi
-
-        # Restore everything except the configuration file
-        #
-        # These exclude patterns need to be kept in sync with the borg_excludes file and the find excludes in this file,
-        # which use a different syntax (patterns appear in 3 places in total)
-        if ! rsync --stats --archive --human-readable -vv --delete \
-        --exclude "nextcloud_aio_apache/caddy/**" \
-        --exclude "nextcloud_aio_mastercontainer/caddy/**" \
-        --exclude "nextcloud_aio_nextcloud/data/nextcloud.log*" \
-        --exclude "nextcloud_aio_nextcloud/data/audit.log" \
-        --exclude "nextcloud_aio_mastercontainer/certs/**" \
-        --exclude "nextcloud_aio_mastercontainer/data/configuration.json" \
-        --exclude "nextcloud_aio_mastercontainer/data/daily_backup_running" \
-        --exclude "nextcloud_aio_mastercontainer/data/session_date_file" \
-        --exclude "nextcloud_aio_mastercontainer/session/**" \
-        "${ADDITIONAL_RSYNC_EXCLUDES[@]}" \
-        /tmp/borg/nextcloud_aio_volumes/ /nextcloud_aio_volumes/; then
-            RESTORE_FAILED=1
-            echo "Something failed while restoring from backup."
-        fi
-
-        # Restore the configuration file
-        if ! rsync --archive --human-readable -vv \
-                /tmp/borg/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json \
-                /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json; then
-            RESTORE_FAILED=1
-            echo "Something failed while restoring the configuration.json."
-        fi
-
-        if ! umount /tmp/borg; then
-            echo "Failed to unmount the borg archive but should still be able to restore successfully"
-        fi
-    else
-        # Restore nearly everything
-        #
-        # borg mount is really slow for remote repos (did not check whether it's slow for local repos too),
-        # using extract to /tmp would require temporarily storing a second copy of the data.
-        # So instead extract directly on top of the destination with exclude patterns for the config, but
-        # then we do still need to delete local files which are not present in the archive.
-        #
-        # Older backups may still contain files we've since excluded, so we have to exclude on extract as well.
-        cd /  # borg extract has no destination arg and extracts to CWD
-        if ! borg extract "::$SELECTED_ARCHIVE" --progress --exclude-from /borg_excludes "${ADDITIONAL_BORG_EXCLUDES[@]}" --pattern '+nextcloud_aio_volumes/**'
-        then
-            RESTORE_FAILED=1
-            echo "Failed to extract backup archive."
-        else
-            # Delete files/dirs present locally, but not in the backup archive, excluding conf files
-            # https://unix.stackexchange.com/a/759341
-            # This comm does not support -z, but I doubt any file names would have \n in them
-            #
-            # These find patterns need to be kept in sync with the borg_excludes file and the rsync excludes in this
-            # file, which use a different syntax (patterns appear in 3 places in total)
-            echo "Deleting local files which do not exist in the backup"
-            if ! find nextcloud_aio_volumes \
-                    -not \( \
-                        -path nextcloud_aio_volumes/nextcloud_aio_apache/caddy \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_apache/caddy/*" \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_mastercontainer/caddy \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_mastercontainer/caddy/*" \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_mastercontainer/certs \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_mastercontainer/certs/*" \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_mastercontainer/session \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_mastercontainer/session/*" \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_nextcloud/data/nextcloud.log*" \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_nextcloud/data/audit.log \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/daily_backup_running \
-                        -o -path nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/session_date_file \
-                        -o -path "nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/id_borg*" \
-                        "${ADDITIONAL_FIND_EXCLUDES[@]}" \
-                    \) \
-                    | LC_ALL=C sort \
-                    | LC_ALL=C comm -23 - \
-                        <(borg list "::$SELECTED_ARCHIVE" --short --exclude-from /borg_excludes  --pattern '+nextcloud_aio_volumes/**' | LC_ALL=C sort) \
-                    > /tmp/local_files_not_in_backup
-            then
-                RESTORE_FAILED=1
-                echo "Failed to delete local files not in backup archive."
-            else
-                # More robust than e.g. xargs as I got a ~"args line too long" error while testing that, but it's slower
-                # https://stackoverflow.com/a/21848934
-                while IFS= read -r file
-                do rm -vrf -- "$file" || DELETE_FAILED=1
-                done < /tmp/local_files_not_in_backup
-
-                if [ "$DELETE_FAILED" = 1 ]; then
-                    RESTORE_FAILED=1
-                    echo "Failed to delete (some) local files not in backup archive."
-                fi
-            fi
-        fi
+    # Restore the configuration file
+    if ! rsync --archive --human-readable -vv \
+    /tmp/borg/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json \
+    /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json; then
+        RESTORE_FAILED=1
+        echo "Something failed while restoring the configuration.json."
     fi
 
     # Set backup-mode to restore since it was a restore
     CONTENTS="$(jq '."backup-mode" = "restore"' /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
     echo -E "${CONTENTS}" > /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json
 
-    # Reset the backup location vars to the currently used one
+    # Reset the backup path to the currently used one
     CONTENTS="$(jq ".borg_backup_host_location = $BORG_LOCATION" /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
     echo -E "${CONTENTS}" > /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json
-    CONTENTS="$(jq ".borg_remote_repo = $REMOTE_REPO" /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
-    echo -E "${CONTENTS}" > /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json
 
     # Reset the AIO password to the currently used one
     CONTENTS="$(jq ".password = $AIO_PASSWORD" /nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/configuration.json)"
@@ -487,6 +366,8 @@ if [ "$BORG_MODE" = restore ]; then
         chmod 770 "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/daily_backup_time"
     fi
 
+    umount /tmp/borg
+
     if [ "$RESTORE_FAILED" = 1 ]; then
         exit 1
     fi
@@ -503,12 +384,6 @@ if [ "$BORG_MODE" = restore ]; then
     touch "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/fingerprint.update"
     chmod 777 "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/fingerprint.update"
 
-    # Add file to Netcloud container to trigger a preview scan the next time it starts
-    if [ -n "$RESTORE_EXCLUDE_PREVIEWS" ]; then
-        touch "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/trigger-preview.scan"
-        chmod 777 "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data/trigger-preview.scan"
-    fi
-
     # Delete redis cache
     rm -f "/mnt/redis/dump.rdb"
 fi
@@ -519,9 +394,9 @@ if [ "$BORG_MODE" = check ]; then
     echo "Checking the backup integrity..."
 
     # Perform the check
-    if ! borg check -v --verify-data; then
+    if ! borg check -v --verify-data "$BORG_BACKUP_DIRECTORY"; then
         echo "Some errors were found while checking the backup integrity!"
-        echo "Check the AIO interface for advice on how to proceed now!"
+        echo "Check the AIO interface for advices on how to proceed now!"
         exit 1
     fi
 
@@ -537,7 +412,7 @@ if [ "$BORG_MODE" = "check-repair" ]; then
     echo "Checking the backup integrity and repairing it..."
 
     # Perform the check-repair
-    if ! echo YES | borg check -v --repair; then
+    if ! echo YES | borg check -v --repair "$BORG_BACKUP_DIRECTORY"; then
         echo "Some errors were found while checking and repairing the backup integrity!"
         exit 1
     fi
@@ -550,40 +425,24 @@ fi
 
 # Do the backup test
 if [ "$BORG_MODE" = test ]; then
-    if [ -n "$BORG_REMOTE_REPO" ]; then
-        if ! borg info > /dev/null; then
-            echo "Borg could not get info from the remote repo."
-            echo "See the above borg info output for details."
-            exit 1
-        fi
-    else
-        if ! [ -d "$BORG_BACKUP_DIRECTORY" ]; then
-            echo "No 'borg' directory in the given backup directory found!"
-            echo "Only the files/folders below have been found in the given directory."
-            ls -a "$MOUNT_DIR"
-            echo "Please adjust the directory so that the borg archive is positioned in a folder named 'borg' inside the given directory!"
-            exit 1
-        elif ! [ -f "$BORG_BACKUP_DIRECTORY/config" ]; then
-            echo "A 'borg' directory was found but could not find the borg archive."
-            echo "Only the files/folders below have been found in the borg directory."
-            ls -a "$BORG_BACKUP_DIRECTORY"
-            echo "The archive and most importantly the config file must be positioned directly in the 'borg' subfolder."
-            exit 1
-        fi
-    fi
-
-    if ! borg list >/dev/null; then
+    if ! [ -d "$BORG_BACKUP_DIRECTORY" ]; then
+        echo "No 'borg' directory in the given backup directory found!"
+        echo "Only the files/folders below have been found in the given directory."
+        ls -a "$MOUNT_DIR"
+        echo "Please adjust the directory so that the borg archive is positioned in a folder named 'borg' inside the given directory!"
+        exit 1
+    elif ! [ -f "$BORG_BACKUP_DIRECTORY/config" ]; then
+        echo "A 'borg' directory was found but could not find the borg archive."
+        echo "Only the files/folders below have been found in the borg directory."
+        ls -a "$BORG_BACKUP_DIRECTORY"
+        echo "The archive and most importantly the config file must be positioned directly in the 'borg' subfolder."
+        exit 1
+    elif ! borg list "$BORG_BACKUP_DIRECTORY"; then
         echo "The entered path seems to be valid but could not open the backup archive."
         echo "Most likely the entered password was wrong so please adjust it accordingly!"
         exit 1
     else
-        if ! borg list | grep "nextcloud-aio"; then
-            echo "The backup archive does not contain a valid Nextcloud AIO backup."
-            echo "Most likely was the archive not created via Nextcloud AIO."
-            exit 1
-        else
-            echo "Everything looks fine so feel free to continue!"
-            exit 0
-        fi
+        echo "Everything looks fine so feel free to continue!"
+        exit 0
     fi
 fi

Containers/borgbackup/borg_excludes

@@ -1,11 +0,0 @@
-# These patterns need to be kept in sync with rsync and find excludes in backupscript.sh,
-# which use a different syntax (patterns appear in 3 places in total)
-nextcloud_aio_volumes/nextcloud_aio_apache/caddy/
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/caddy/
-nextcloud_aio_volumes/nextcloud_aio_nextcloud/data/nextcloud.log*
-nextcloud_aio_volumes/nextcloud_aio_nextcloud/data/audit.log
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/certs/
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/daily_backup_running
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/session_date_file
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/session/
-nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/id_borg*

Containers/borgbackup/start.sh

@@ -2,7 +2,7 @@
 
 # Variables
 export MOUNT_DIR="/mnt/borgbackup"
-export BORG_BACKUP_DIRECTORY="$MOUNT_DIR/borg"  # necessary even when remote to store the aio-lockfile
+export BORG_BACKUP_DIRECTORY="$MOUNT_DIR/borg"
 
 # Validate BORG_PASSWORD
 if [ -z "$BORG_PASSWORD" ] && [ -z "$BACKUP_RESTORE_PASSWORD" ]; then
@@ -18,18 +18,6 @@ else
 fi
 export BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
 export BORG_RELOCATED_REPO_ACCESS_IS_OK=yes
-if [ -n "$BORG_REMOTE_REPO" ]; then
-    export BORG_REPO="$BORG_REMOTE_REPO"
-
-    # Location to create the borg ssh pub/priv key
-    export BORGBACKUP_KEY="/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/id_borg"
-
-    # Accept any host key the first time connecting to the remote. Strictly speaking should be provided by user but you'd
-    # have to be very unlucky to get MitM'ed on your first connection.
-    export BORG_RSH="ssh -o StrictHostKeyChecking=accept-new -i $BORGBACKUP_KEY"
-else
-    export BORG_REPO="$BORG_BACKUP_DIRECTORY"
-fi
 
 # Validate BORG_MODE
 if [ "$BORG_MODE" != backup ] && [ "$BORG_MODE" != restore ] && [ "$BORG_MODE" != check ] && [ "$BORG_MODE" != "check-repair" ] && [ "$BORG_MODE" != test ]; then
@@ -48,8 +36,8 @@ fi
 rm -f "/nextcloud_aio_volumes/nextcloud_aio_database_dump/backup-is-running"
 
 # Get a list of all available borg archives
-if borg list &>/dev/null; then
-    borg list | grep "nextcloud-aio" | awk -F " " '{print $1","$3,$4}' > "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/backup_archives.list"
+if borg list "$BORG_BACKUP_DIRECTORY" &>/dev/null; then
+    borg list "$BORG_BACKUP_DIRECTORY" | grep "nextcloud-aio" | awk -F " " '{print $1","$3,$4}' > "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/backup_archives.list"
 else
     echo "" > "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer/data/backup_archives.list"
 fi

Containers/clamav/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # Probably from this file: https://github.com/Cisco-Talos/clamav-docker/blob/main/clamav/1.3/alpine/Dockerfile
-FROM clamav/clamav:1.4.2-24
+FROM clamav/clamav:1.4.1-5
 
 COPY clamav.conf /clamav.conf
 COPY --chmod=775 start.script /start.script
@@ -19,10 +19,8 @@ RUN set -ex; \
 
 VOLUME /var/lib/clamav
 
-USER 100
+USER clamav
 
 LABEL com.centurylinklabs.watchtower.enable="false"
 
-HEALTHCHECK --start-period=60s --retries=9 CMD clamdcheck.sh
-
 ENTRYPOINT ["/init-unprivileged"]

Containers/clamav/clamav.conf

@@ -1,5 +1,5 @@
 # AIO settings
 MaxDirectoryRecursion 30
-MaxFileSize 16G
-PCREMaxFileSize 16G
-StreamMaxLength 16G
+MaxFileSize 10G
+PCREMaxFileSize 10G
+StreamMaxLength 10G

Containers/clamav/start.script

@@ -1,4 +1,4 @@
 # Adjust settings
 cat /etc/clamav/clamd.conf > /tmp/clamd.conf
-CLAMAV_FILE="$(sed "s|16G|$MAX_SIZE|" /clamav.conf)"
+CLAMAV_FILE="$(sed "s|10G|$MAX_SIZE|" /clamav.conf)"
 echo "$CLAMAV_FILE" >> /tmp/clamd.conf

Containers/collabora/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # From a file located probably somewhere here: https://github.com/CollaboraOnline/online/tree/master/docker
-FROM collabora/code:24.04.12.1.1
+FROM collabora/code:24.04.7.2.1
 
 USER root
 ARG DEBIAN_FRONTEND=noninteractive
@@ -10,15 +10,12 @@ RUN set -ex; \
     \
     apt-get update; \
     apt-get install -y --no-install-recommends \
-#        # Disable because seems to be failing currently
-#        # tzdata \
+        tzdata \
         netcat-openbsd \
     ; \
     rm -rf /var/lib/apt/lists/*;
 
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
-
 USER 100
 
-HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
+HEALTHCHECK CMD nc -z 127.0.0.1 9980 || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/collabora/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-nc -z 127.0.0.1 9980 || exit 1

Containers/docker-socket-proxy/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM haproxy:3.1.2-alpine
+FROM haproxy:3.0.5-alpine
 
 # hadolint ignore=DL3002
 USER root

Containers/docker-socket-proxy/haproxy.cfg

@@ -22,12 +22,7 @@ frontend http
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/((start)|(stop)) } METH_POST
     # container rm: DELETE containers/%s
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+ } METH_DELETE
-    # container update/exec: POST containers/%s/update containers/%s/exec
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/((update)|(exec)) } METH_POST
-    # container put: PUT containers/%s/archive
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/archive } METH_PUT
-    # run exec instance: POST exec/%s
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec/[a-zA-Z0-9_.-]+/start } METH_POST
+
 
     # container create: POST containers/create?name=%s
     # ACL to restrict container name to nc_app_[a-zA-Z0-9_.-]+

Containers/domaincheck/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 RUN set -ex; \
     apk upgrade --no-cache -a; \
     apk add --no-cache bash lighttpd netcat-openbsd; \

Containers/fulltextsearch/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # Probably from here https://github.com/elastic/elasticsearch/blob/main/distribution/docker/src/docker/Dockerfile
-FROM elasticsearch:8.17.1
+FROM elasticsearch:8.15.1
 
 USER root
 
@@ -14,11 +14,10 @@ RUN set -ex; \
     apt-get install -y --no-install-recommends \
         tzdata \
     ; \
-    rm -rf /var/lib/apt/lists/*;
-
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
+    rm -rf /var/lib/apt/lists/*; \
+    elasticsearch-plugin install --batch ingest-attachment
 
 USER 1000:0
 
-HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD /healthcheck.sh
+HEALTHCHECK CMD nc -z 127.0.0.1 9200 || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/fulltextsearch/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-nc -z 127.0.0.1 9200 || exit 1

Containers/imaginary/Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:latest
-FROM golang:1.23.5-alpine3.21 AS go
+FROM golang:1.23.1-alpine3.20 AS go
 
-ENV IMAGINARY_HASH=1d4e251cfcd58ea66f8361f8721d7b8cc85002a3
+ENV IMAGINARY_HASH=6cd9edd1d3fb151eb773c14552886e4fc8e50138
 
 RUN set -ex; \
     apk add --no-cache \
@@ -13,7 +13,7 @@ RUN set -ex; \
         build-base; \
     go install github.com/h2non/imaginary@"$IMAGINARY_HASH";
 
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 RUN set -ex; \
     apk upgrade --no-cache -a; \
     apk add --no-cache \
@@ -30,15 +30,14 @@ RUN set -ex; \
 
 COPY --from=go /go/bin/imaginary /usr/local/bin/imaginary
 COPY --chmod=775 start.sh /start.sh
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
 
 ENV PORT=9000
 
-USER 65534
+USER nobody
 
 # https://github.com/h2non/imaginary#memory-issues
 ENV MALLOC_ARENA_MAX=2
 ENTRYPOINT ["/start.sh"]
 
-HEALTHCHECK CMD /healthcheck.sh
+HEALTHCHECK CMD nc -z 127.0.0.1 "$PORT" || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/imaginary/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-nc -z 127.0.0.1 "$PORT" || exit 1

Containers/mastercontainer/Dockerfile

@@ -1,12 +1,12 @@
 # syntax=docker/dockerfile:latest
 # Docker CLI is a requirement
-FROM docker:27.5.1-cli AS docker
+FROM docker:27.3.1-cli AS docker
 
 # Caddy is a requirement
-FROM caddy:2.9.1-alpine AS caddy
+FROM caddy:2.8.4-alpine AS caddy
 
-# From https://github.com/docker-library/php/blob/master/8.3/alpine3.21/fpm/Dockerfile
-FROM php:8.3.16-fpm-alpine3.21
+# From https://github.com/docker-library/php/blob/master/8.3/alpine3.20/fpm/Dockerfile
+FROM php:8.3.11-fpm-alpine3.20
 
 EXPOSE 80
 EXPOSE 8080

Containers/mastercontainer/start.sh

@@ -137,7 +137,7 @@ It is set to '$NEXTCLOUD_DATADIR'."
 fi
 if [ -n "$NEXTCLOUD_MOUNT" ]; then
     if ! echo "$NEXTCLOUD_MOUNT" | grep -q "^/" || [ "$NEXTCLOUD_MOUNT" = "/" ]; then
-        print_red "You've set NEXTCLOUD_MOUNT but not to an allowed value.
+        print_red "You've set NEXCLOUD_MOUNT but not to an allowed value.
 The string must start with '/' and must not be equal to '/'.
 It is set to '$NEXTCLOUD_MOUNT'."
         exit 1
@@ -193,14 +193,6 @@ It is set to '$APACHE_IP_BINDING'."
         exit 1
     fi
 fi
-if [ -n "$APACHE_ADDITIONAL_NETWORK" ]; then
-    if ! echo "$APACHE_ADDITIONAL_NETWORK" | grep -q "^[a-zA-Z0-9._-]\+$"; then
-        print_red "You've set APACHE_ADDITIONAL_NETWORK but not to an allowed value.
-It needs to be a string with letters, numbers, hyphens and underscores.
-It is set to '$APACHE_ADDITIONAL_NETWORK'."
-        exit 1
-    fi
-fi
 if [ -n "$TALK_PORT" ]; then
     if ! check_if_number "$TALK_PORT"; then
         print_red "You provided an Talk port but did not only use numbers.
@@ -283,15 +275,6 @@ if [ "$?" = 6 ]; then
     exit 1
 fi
 
-# Check if auth.docker.io is reachable
-# Solves issues like https://github.com/nextcloud/all-in-one/discussions/5268
-if ! curl https://auth.docker.io/token 2>&1 | grep -q token; then
-    print_red "Could not reach https://auth.docker.io."
-    echo "Most likely is something blocking access to it."
-    echo "You should be able to fix this by using https://github.com/nextcloud/all-in-one/tree/main/manual-install"
-    exit 1
-fi
-
 # Check that no changes have been made to timezone settings since AIO only supports running in Etc/UTC timezone
 if [ -n "$TZ" ]; then
     print_red "The environmental variable TZ has been set which is not supported by AIO since it only supports running in the default Etc/UTC timezone!"

Containers/mastercontainer/supervisord.conf

@@ -9,16 +9,16 @@ loglevel=error
 user=root
 
 [program:php-fpm]
-# Stdout logging is disabled as otherwise the logs are spammed
-stdout_logfile=NONE
+# stdout_logfile=/dev/stdout
+# stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 command=php-fpm
 user=root
 
 [program:apache]
-# Stdout logging is disabled as otherwise the logs are spammed
-stdout_logfile=NONE
+# stdout_logfile=/dev/stdout
+# stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 command=httpd -DFOREGROUND
@@ -58,7 +58,9 @@ user=root
 
 [program:domain-validator]
 # Logging is disabled as otherwise all attempts will be logged which spams the logs
-stdout_logfile=NONE
-stderr_logfile=NONE
+# stdout_logfile=/dev/stdout
+# stdout_logfile_maxbytes=0
+# stderr_logfile=/dev/stderr
+# stderr_logfile_maxbytes=0
 command=php -S 127.0.0.1:9876 /var/www/docker-aio/php/domain-validator.php
 user=www-data

Containers/nextcloud/Dockerfile

@@ -1,21 +1,18 @@
 # syntax=docker/dockerfile:latest
-FROM php:8.3.16-fpm-alpine3.21
+FROM php:8.2.23-fpm-alpine3.20
 
 ENV PHP_MEMORY_LIMIT=512M
-ENV PHP_UPLOAD_LIMIT=16G
+ENV PHP_UPLOAD_LIMIT=10G
 ENV PHP_MAX_TIME=3600
 ENV SOURCE_LOCATION=/usr/src/nextcloud
 ENV REDIS_DB_INDEX=0
 
 # AIO settings start # Do not remove or change this line!
-ENV NEXTCLOUD_VERSION=30.0.5
+ENV NEXTCLOUD_VERSION=29.0.7
 ENV AIO_TOKEN=123456
 ENV AIO_URL=localhost
 # AIO settings end # Do not remove or change this line!
 
-# Define the commit hash for imagick as a variable
-ARG IMAGICK_COMMIT_HASH=28f27044e435a2b203e32675e942eb8de620ee58
-
 COPY --chmod=775 *.sh /
 COPY --chmod=774 upgrade.exclude /upgrade.exclude
 COPY config/*.php /
@@ -81,24 +78,13 @@ RUN set -ex; \
     ; \
     \
 # pecl will claim success even if one install fails, so we need to perform each install separately
-    pecl install -o igbinary-3.2.16; \
+    pecl install igbinary-3.2.16; \ 
     pecl install APCu-5.1.24; \
-    pecl install -D 'enable-memcached-igbinary="yes"' memcached-3.3.0; \
-    pecl install -oD 'enable-redis-igbinary="yes" enable-redis-zstd="yes" enable-redis-lz4="yes"' redis-6.1.0; \
-#    pecl install -o imagick-3.7.0; \
-# Begin workaround ->
-# The master version on the imagick repository is compatible with PHP 8.3. However, the PECL version is not updated yet.
-# As soon as it will get updated, we can switch back to the PECL version, instead of having this workaround.
-    apk add --no-cache --virtual .git-build-deps git \
-    && git clone https://github.com/imagick/imagick.git --depth 1 /tmp/imagick \
-    && cd /tmp/imagick \
-    && git fetch --depth 1 origin ${IMAGICK_COMMIT_HASH} \
-    && git checkout ${IMAGICK_COMMIT_HASH} \
-    && sed -i "s/@PACKAGE_VERSION@/git-${IMAGICK_COMMIT_HASH:0:7}/" php_imagick.h \
-    && phpize && ./configure && make && make install; \
-    apk del .git-build-deps; \
-    cd && rm -r /tmp/imagick; \
-# <- End workaround
+    pecl install memcached-3.2.0 \
+        --configureoptions 'enable-memcached-igbinary="yes"'; \
+    pecl install redis-6.0.2 \
+        --configureoptions 'enable-redis-igbinary="yes" enable-redis-zstd="yes" enable-redis-lz4="yes"'; \
+    pecl install imagick-3.7.0; \
     \
     docker-php-ext-enable \
         igbinary \
@@ -125,7 +111,6 @@ RUN set -ex; \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
     { \
-        echo 'opcache.max_accelerated_files=10000'; \
         echo 'opcache.memory_consumption=256'; \
         echo 'opcache.interned_strings_buffer=64'; \
         echo 'opcache.save_comments=1'; \
@@ -147,11 +132,10 @@ RUN set -ex; \
     \
     { \
         echo 'session.save_handler = redis'; \
-        echo 'session.save_path = "tcp://${REDIS_HOST}:6379?database=${REDIS_DB_INDEX}${REDIS_USER_AUTH}&auth[]=${REDIS_HOST_PASSWORD}"'; \
+        echo 'session.save_path = "tcp://${REDIS_HOST}:6379/${REDIS_DB_INDEX}?auth=${REDIS_HOST_PASSWORD}"'; \
         echo 'redis.session.locking_enabled = 1'; \
         echo 'redis.session.lock_retries = -1'; \
         echo 'redis.session.lock_wait_time = 10000'; \
-        echo 'session.gc_maxlifetime = 86400'; \
     } > /usr/local/etc/php/conf.d/redis-session.ini; \
     \
     mkdir -p /var/www/data; \
@@ -239,7 +223,6 @@ RUN set -ex; \
         sudo \
         grep \
         nodejs \
-        libreoffice \
         bind-tools \
         imagemagick \
         imagemagick-svg \
@@ -273,12 +256,15 @@ RUN set -ex; \
     \
     mkdir -p /nc-updater; \
     chown -R www-data:www-data /nc-updater; \
-    chmod -R 770 /nc-updater
+    chmod -R 770 /nc-updater; \
+    \
+# Give root a random password
+    echo "root:$(openssl rand -base64 12)" | chpasswd
 
 # hadolint ignore=DL3002
 USER root
 ENTRYPOINT ["/start.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
 
-HEALTHCHECK CMD /healthcheck.sh
+HEALTHCHECK --start-period=60s CMD sudo -E -u www-data bash /healthcheck.sh
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/nextcloud/config/redis.config.php

@@ -18,8 +18,4 @@ if (getenv('REDIS_HOST')) {
   if (getenv('REDIS_DB_INDEX')) {
     $CONFIG['redis']['dbindex'] = (int) getenv('REDIS_DB_INDEX');
   }
-
-  if (getenv('REDIS_USER_AUTH') !== false) {
-    $CONFIG['redis']['user'] = str_replace("&auth[]=", "", getenv('REDIS_USER_AUTH'));
-  }
 }

Containers/nextcloud/config/s3.config.php

@@ -11,6 +11,7 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
         'bucket' => getenv('OBJECTSTORE_S3_BUCKET'),
         'key' => getenv('OBJECTSTORE_S3_KEY') ?: '',
         'secret' => getenv('OBJECTSTORE_S3_SECRET') ?: '',
+        'sse_c_key' => getenv('OBJECTSTORE_S3_SSE_C_KEY') ?: '',
         'region' => getenv('OBJECTSTORE_S3_REGION') ?: '',
         'hostname' => getenv('OBJECTSTORE_S3_HOST') ?: '',
         'port' => getenv('OBJECTSTORE_S3_PORT') ?: '',
@@ -25,9 +26,4 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
       )
     )
   );
-
-  $sse_c_key = getenv('OBJECTSTORE_S3_SSE_C_KEY');
-  if ($sse_c_key) {
-    $CONFIG['objectstore']['arguments']['sse_c_key'] = $sse_c_key;
-  }
 } 

Containers/nextcloud/entrypoint.sh

@@ -20,11 +20,6 @@ run_upgrade_if_needed_due_to_app_update() {
     fi
 }
 
-# Adjust DATABASE_TYPE to by Nextcloud supported value
-if [ "$DATABASE_TYPE" = postgres ]; then
-    export DATABASE_TYPE=pgsql
-fi
-
 # Only start container if redis is accessible
 # shellcheck disable=SC2153
 while ! nc -z "$REDIS_HOST" "6379"; do
@@ -148,23 +143,16 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
             rm -r /usr/src/tmp
             rm -r /usr/src/temp-nextcloud
             # shellcheck disable=SC2016
-            image_version="$(php -r "require '$SOURCE_LOCATION/version.php'; echo implode('.', \$OC_Version);")"
+            image_version="$(php -r "require $SOURCE_LOCATION/version.php; echo implode('.', \$OC_Version);")"
             IMAGE_MAJOR="${image_version%%.*}"
             set +ex
 # Do not skip major versions end # Do not remove or change this line!
         fi
 
         if [ "$installed_version" != "0.0.0.0" ]; then
-# Check connection to appstore start # Do not remove or change this line!
             while true; do
                 echo -e "Checking connection to appstore"
-                APPSTORE_URL="https://apps.nextcloud.com/"
-                if grep -q appstoreurl /var/www/html/config/config.php; then
-                    set -x
-                    APPSTORE_URL="$(grep appstoreurl /var/www/html/config/config.php | grep -oP 'https://.*v[0-9]+')"
-                    set +x
-                fi
-                CURL_STATUS="$(curl -LI "$APPSTORE_URL" -o /dev/null -w '%{http_code}\n' -s)"
+                CURL_STATUS="$(curl -LI "https://apps.nextcloud.com/" -o /dev/null -w '%{http_code}\n' -s)"
                 if [[ "$CURL_STATUS" = "200" ]]
                 then
                     echo "Appstore is reachable"
@@ -174,7 +162,6 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
                     sleep 5
                 fi
             done
-# Check connection to appstore end # Do not remove or change this line!
 
             run_upgrade_if_needed_due_to_app_update
 
@@ -250,12 +237,12 @@ if ! [ -f "$NEXTCLOUD_DATA_DIR/skip.update" ]; then
 );
 DATADIR_PERMISSION_CONF
 
-            echo "Installing with $DATABASE_TYPE database"
+            echo "Installing with PostgreSQL database"
             # Set a default value for POSTGRES_PORT
             if [ -z "$POSTGRES_PORT" ]; then
               POSTGRES_PORT=5432
             fi
-            INSTALL_OPTIONS+=(--database "$DATABASE_TYPE" --database-name "$POSTGRES_DB" --database-user "$POSTGRES_USER" --database-pass "$POSTGRES_PASSWORD" --database-host "$POSTGRES_HOST" --database-port "$POSTGRES_PORT")
+            INSTALL_OPTIONS+=(--database pgsql --database-name "$POSTGRES_DB" --database-user "$POSTGRES_USER" --database-pass "$POSTGRES_PASSWORD" --database-host "$POSTGRES_HOST" --database-port "$POSTGRES_PORT")
 
             echo "Starting Nextcloud installation..."
             if ! php /var/www/html/occ maintenance:install "${INSTALL_OPTIONS[@]}"; then
@@ -503,12 +490,6 @@ if [ -f "$NEXTCLOUD_DATA_DIR/fingerprint.update" ]; then
     rm "$NEXTCLOUD_DATA_DIR/fingerprint.update"
 fi
 
-# Perform preview scan if previews were excluded from restore
-if [ -f "$NEXTCLOUD_DATA_DIR/trigger-preview.scan" ]; then
-    php /var/www/html/occ files:scan-app-data preview -vvv
-    rm "$NEXTCLOUD_DATA_DIR/trigger-preview.scan"
-fi
-
 # AIO one-click settings start # Do not remove or change this line!
 # Apply one-click-instance settings
 echo "Applying one-click-instance settings..."
@@ -550,7 +531,6 @@ php /var/www/html/occ config:system:set allow_local_remote_servers --type=bool -
 php /var/www/html/occ config:system:set davstorage.request_timeout --value="$PHP_MAX_TIME" --type=int
 php /var/www/html/occ config:system:set trusted_domains 1 --value="$NC_DOMAIN"
 php /var/www/html/occ config:system:set overwrite.cli.url --value="https://$NC_DOMAIN/"
-php /var/www/html/occ config:system:set documentation_url.server_logs --value="https://github.com/nextcloud/all-in-one/discussions/5425"
 php /var/www/html/occ config:system:set htaccess.RewriteBase --value="/"
 php /var/www/html/occ maintenance:update:htaccess
 
@@ -600,17 +580,12 @@ if [ -n "$ADDITIONAL_TRUSTED_PROXY" ]; then
     php /var/www/html/occ config:system:set trusted_proxies 2 --value="$ADDITIONAL_TRUSTED_PROXY"
 fi
 
-# Get ipv4-address of Nextcloud
-if [ -z "$NEXTCLOUD_HOST" ]; then
-    export NEXTCLOUD_HOST="nextcloud-aio-nextcloud"
-fi
-IPv4_ADDRESS="$(dig "$NEXTCLOUD_HOST" A +short +search | head -1)" 
+# Get ipv4-address of Nextcloud 
+IPv4_ADDRESS="$(dig nextcloud-aio-nextcloud A +short +search | head -1)" 
 # Bring it in CIDR notation 
 # shellcheck disable=SC2001
 IPv4_ADDRESS="$(echo "$IPv4_ADDRESS" | sed 's|[0-9]\+$|0/16|')" 
-if [ -n "$IPv4_ADDRESS" ]; then
-    php /var/www/html/occ config:system:set trusted_proxies 10 --value="$IPv4_ADDRESS"
-fi
+php /var/www/html/occ config:system:set trusted_proxies 10 --value="$IPv4_ADDRESS"
 
 if [ -n "$ADDITIONAL_TRUSTED_DOMAIN" ]; then
     php /var/www/html/occ config:system:set trusted_domains 2 --value="$ADDITIONAL_TRUSTED_DOMAIN"
@@ -792,7 +767,6 @@ fi
 # Imaginary
 if [ "$IMAGINARY_ENABLED" = 'yes' ]; then
     php /var/www/html/occ config:system:set enabledPreviewProviders 0 --value="OC\\Preview\\Imaginary"
-    php /var/www/html/occ config:system:set enabledPreviewProviders 23 --value="OC\\Preview\\ImaginaryPDF"
     php /var/www/html/occ config:system:set preview_imaginary_url --value="http://$IMAGINARY_HOST:9000"
     php /var/www/html/occ config:system:set preview_imaginary_key --value="$IMAGINARY_SECRET"
 else
@@ -802,7 +776,6 @@ else
         php /var/www/html/occ config:system:delete enabledPreviewProviders 20
         php /var/www/html/occ config:system:delete enabledPreviewProviders 21
         php /var/www/html/occ config:system:delete enabledPreviewProviders 22
-        php /var/www/html/occ config:system:delete enabledPreviewProviders 23
     fi
 fi
 
@@ -864,20 +837,17 @@ else
 fi
 
 # Docker socket proxy
-# app_api is a shipped app
-if [ -d "/var/www/html/custom_apps/app_api" ]; then
-    php /var/www/html/occ app:disable app_api
-    rm -r "/var/www/html/custom_apps/app_api"
-fi
 if [ "$DOCKER_SOCKET_PROXY_ENABLED" = 'yes' ]; then
-    if [ "$(php /var/www/html/occ config:app:get app_api enabled)" != "yes" ]; then
+    if ! [ -d "/var/www/html/custom_apps/app_api" ]; then
+        php /var/www/html/occ app:install app_api
+    elif [ "$(php /var/www/html/occ config:app:get app_api enabled)" != "yes" ]; then
         php /var/www/html/occ app:enable app_api
+    elif [ "$SKIP_UPDATE" != 1 ]; then
+        php /var/www/html/occ app:update app_api
     fi
 else
-    if [ "$REMOVE_DISABLED_APPS" = yes ]; then
-        if [ "$(php /var/www/html/occ config:app:get app_api enabled)" != "no" ]; then
-            php /var/www/html/occ app:disable app_api
-        fi
+    if [ "$REMOVE_DISABLED_APPS" = yes ] && [ -d "/var/www/html/custom_apps/app_api" ]; then
+        php /var/www/html/occ app:remove app_api
     fi
 fi
 

Containers/nextcloud/notify-all.sh

@@ -20,7 +20,7 @@ mapfile -t NC_USERS <<< "$NC_USERS"
 for user in "${NC_USERS[@]}"
 do
     echo "Posting '$SUBJECT' to: $user"
-    "${COMMAND[@]}" notification:generate "$user" "$NC_DOMAIN: $SUBJECT" -l "$MESSAGE" --object-type='update' --object-id="$SUBJECT"
+    "${COMMAND[@]}" notification:generate "$user" "$NC_DOMAIN: $SUBJECT" -l "$MESSAGE"
 done
 
 echo "Done!"

Containers/nextcloud/notify.sh

@@ -28,7 +28,7 @@ done
 for admin in "${NC_ADMIN_USER[@]}"
 do
     echo "Posting '$SUBJECT' to: $admin"
-    "${COMMAND[@]}" notification:generate "$admin" "$NC_DOMAIN: $SUBJECT" -l "$MESSAGE" --object-type='update' --object-id="$SUBJECT"
+    "${COMMAND[@]}" notification:generate "$admin" "$NC_DOMAIN: $SUBJECT" -l "$MESSAGE"
 done
 
 echo "Done!"

Containers/nextcloud/run-exec-commands.sh

@@ -1,10 +1,7 @@
 #!/bin/bash
 
-# Wait until the apache container is ready
-while ! nc -z "$APACHE_HOST" "$APACHE_PORT"; do
-    echo "Waiting for Apache to become available..."
-    sleep 15
-done
+# Wait 15s for domain to be reachable
+sleep 15
 
 if [ -n "$NEXTCLOUD_EXEC_COMMANDS" ]; then
     echo "#!/bin/bash" > /tmp/nextcloud-exec-commands

Containers/nextcloud/start.sh

@@ -17,11 +17,6 @@ done
 POSTGRES_USER="oc_$POSTGRES_USER"
 export POSTGRES_USER
 
-# Check that db type is not empty
-if [ -z "$DATABASE_TYPE" ]; then
-    export DATABASE_TYPE=postgres
-fi
-
 # Fix false database connection on old instances
 if [ -f "/var/www/html/config/config.php" ]; then
     sleep 2

Containers/notify-push/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:latest
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 
 COPY --chmod=775 start.sh /start.sh
 COPY --chmod=775 healthcheck.sh /healthcheck.sh

Containers/notify-push/start.sh

@@ -1,13 +1,13 @@
 #!/bin/bash
 
 if [ -z "$NEXTCLOUD_HOST" ]; then
-    echo "NEXTCLOUD_HOST needs to be provided. Exiting!"
+    echo "NEXTCLOUD_HOST need to be provided. Exiting!"
     exit 1
 elif [ -z "$POSTGRES_HOST" ]; then
-    echo "POSTGRES_HOST needs to be provided. Exiting!"
+    echo "POSTGRES_HOST need to be provided. Exiting!"
     exit 1
 elif [ -z "$REDIS_HOST" ]; then
-    echo "REDIS_HOST needs to be provided. Exiting!"
+    echo "REDIS_HOST need to be provided. Exiting!"
     exit 1
 fi
 
@@ -52,17 +52,10 @@ fi
 if [ -z "$REDIS_DB_INDEX" ]; then
     REDIS_DB_INDEX=0
 fi
-# Set a default for db type
-if [ -z "$DATABASE_TYPE" ]; then
-    DATABASE_TYPE=postgres
-elif [ "$DATABASE_TYPE" != postgres ] && [ "$DATABASE_TYPE" != mysql ]; then
-    echo "DB type must be either postgres or mysql"
-    exit 1
-fi
 
 # Set sensitive values as env
-export DATABASE_URL="$DATABASE_TYPE://oc_$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB"
-export REDIS_URL="redis://$REDIS_USER:$REDIS_HOST_PASSWORD@$REDIS_HOST/$REDIS_DB_INDEX"
+export DATABASE_URL="postgres://oc_$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB"
+export REDIS_URL="redis://:$REDIS_HOST_PASSWORD@$REDIS_HOST/$REDIS_DB_INDEX"
 
 # Run it
 /nextcloud/custom_apps/notify_push/bin/"$CPU_ARCH"/notify_push \

Containers/onlyoffice/Dockerfile

@@ -1,10 +1,8 @@
 # syntax=docker/dockerfile:latest
 # From https://github.com/ONLYOFFICE/Docker-DocumentServer/blob/master/Dockerfile
-FROM onlyoffice/documentserver:8.2.2.1
+FROM onlyoffice/documentserver:8.1.3.2
 
 # USER root is probably used
 
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
-
-HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
+HEALTHCHECK CMD nc -z 127.0.0.1 80 || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/onlyoffice/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-nc -z 127.0.0.1 80 || exit 1

Containers/postgresql/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
-# From https://github.com/docker-library/postgres/blob/master/16/alpine3.21/Dockerfile
-FROM postgres:16.6-alpine
+# From https://github.com/docker-library/postgres/blob/master/16/alpine3.20/Dockerfile
+FROM postgres:16.4-alpine
 
 COPY --chmod=775 start.sh /start.sh
 COPY --chmod=775 healthcheck.sh /healthcheck.sh
@@ -39,7 +39,7 @@ RUN set -ex; \
 
 VOLUME /mnt/data
 
-USER 999
+USER postgres
 ENTRYPOINT ["/start.sh"]
 
 HEALTHCHECK CMD /healthcheck.sh

Containers/postgresql/healthcheck.sh

@@ -2,6 +2,4 @@
 
 test -f "/mnt/data/backup-is-running" && exit 0
 
-psql -d "postgresql://oc_$POSTGRES_USER:$POSTGRES_PASSWORD@127.0.0.1:11000/$POSTGRES_DB" -c "select now()" && exit 0
-
 psql -d "postgresql://oc_$POSTGRES_USER:$POSTGRES_PASSWORD@127.0.0.1:5432/$POSTGRES_DB" -c "select now()" || exit 1

Containers/redis/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:latest
 # From https://github.com/docker-library/redis/blob/master/7.2/alpine/Dockerfile
-FROM redis:7.2.7-alpine
+FROM redis:7.2.5-alpine
 
 COPY --chmod=775 start.sh /start.sh
 
@@ -14,10 +14,8 @@ RUN set -ex; \
 # Get rid of unused binaries
     rm -f /usr/local/bin/gosu;
 
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
-
-USER 999
+USER redis
 ENTRYPOINT ["/start.sh"]
 
-HEALTHCHECK CMD /healthcheck.sh
+HEALTHCHECK CMD redis-cli -a $REDIS_HOST_PASSWORD PING || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/redis/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-redis-cli -a "$REDIS_HOST_PASSWORD" PING || exit 1

Containers/talk-recording/Dockerfile

@@ -1,8 +1,7 @@
 # syntax=docker/dockerfile:latest
-FROM python:3.13.1-alpine3.21
+FROM python:3.12.6-alpine3.20
 
 COPY --chmod=775 start.sh /start.sh
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
 
 ENV RECORDING_VERSION=v0.1
 ENV ALLOW_ALL=false
@@ -29,7 +28,7 @@ RUN set -ex; \
         build-base \
         linux-headers \
         geckodriver; \
-    useradd -d /tmp --system recording -u 122; \
+    useradd -d /tmp --system recording; \
 # Give root a random password
     echo "root:$(openssl rand -base64 12)" | chpasswd; \
     git clone --recursive https://github.com/nextcloud/nextcloud-talk-recording --depth=1 --single-branch --branch "$RECORDING_VERSION" /src; \
@@ -49,11 +48,10 @@ RUN set -ex; \
         build-base \
         linux-headers;
 
-VOLUME /tmp
 WORKDIR /tmp
-USER 122
+USER recording
 ENTRYPOINT ["/start.sh"]
 CMD ["python", "-m", "nextcloud.talk.recording", "--config", "/conf/recording.conf"]
 
-HEALTHCHECK CMD /healthcheck.sh
+HEALTHCHECK CMD nc -z 127.0.0.1 1234 || exit 1
 LABEL com.centurylinklabs.watchtower.enable="false"

Containers/talk-recording/healthcheck.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-nc -z 127.0.0.1 1234 || exit 1

Containers/talk-recording/start.sh

@@ -16,9 +16,6 @@ if [ -z "$HPB_DOMAIN" ]; then
     export HPB_DOMAIN="$NC_DOMAIN"
 fi
 
-# Delete all contents on startup to start fresh
-rm -fr /tmp/{*,.*}
-
 cat << RECORDING_CONF > "/conf/recording.conf"
 [logs]
 # 30 means Warning

Containers/talk/Dockerfile

@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:latest
-FROM nats:2.10.25-scratch AS nats
-FROM eturnal/eturnal:1.12.1 AS eturnal
-FROM strukturag/nextcloud-spreed-signaling:2.0.2 AS signaling
-FROM alpine:3.21.2 AS janus
+FROM nats:2.10.20-scratch AS nats
+FROM eturnal/eturnal:1.12.0 AS eturnal
+FROM strukturag/nextcloud-spreed-signaling:2.0.0 AS signaling
+FROM alpine:3.20.3 AS janus
 
-ARG JANUS_VERSION=v1.3.0
+ARG JANUS_VERSION=v0.14.4
 WORKDIR /src
 RUN set -ex; \
     apk add --no-cache \
@@ -34,7 +34,7 @@ RUN set -ex; \
     make configs; \
     rename -v ".jcfg.sample" ".jcfg" /usr/local/etc/janus/*.jcfg.sample
 
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 ENV ETURNAL_ETC_DIR="/conf"
 COPY --from=janus     --chmod=777 --chown=1000:1000 /usr/local                          /usr/local
 COPY --from=eturnal   --chmod=777 --chown=1000:1000 /opt/eturnal                        /opt/eturnal
@@ -99,7 +99,7 @@ RUN set -ex; \
     ln -s /opt/eturnal/bin/stun /usr/local/bin/stun; \
     ln -s /opt/eturnal/bin/eturnalctl /usr/local/bin/eturnalctl
 
-USER 1000
+USER eturnal
 ENTRYPOINT ["/start.sh"]
 CMD ["supervisord", "-c", "/supervisord.conf"]
 

Containers/talk/start.sh

@@ -30,23 +30,14 @@ if [ -n "$IPv4_ADDRESS_TALK" ] && [ "$IPv4_ADDRESS_TALK_RELAY" = "$IPv4_ADDRESS_
     IPv4_ADDRESS_TALK=""
 fi
 
-set -x
-IP_BINDING="::"
-if grep -q "1" /sys/module/ipv6/parameters/disable \
-|| grep -q "1" /proc/sys/net/ipv6/conf/all/disable_ipv6 \
-|| grep -q "1" /proc/sys/net/ipv6/conf/default/disable_ipv6; then
-    IP_BINDING="0.0.0.0"
-fi
-set +x
-
 # Turn
 cat << TURN_CONF > "/conf/eturnal.yml"
 eturnal:
   listen:
-    - ip: "$IP_BINDING"
+    - ip: "::"
       port: $TALK_PORT
       transport: udp
-    - ip: "$IP_BINDING"
+    - ip: "::"
       port: $TALK_PORT
       transport: tcp
   log_dir: stdout

Containers/watchtower/Dockerfile

@@ -2,7 +2,7 @@
 # From https://github.com/containrrr/watchtower/blob/main/dockerfiles/Dockerfile.self-contained
 FROM containrrr/watchtower:1.7.1 AS watchtower
 
-FROM alpine:3.21.2
+FROM alpine:3.20.3
 
 RUN set -ex; \
     apk upgrade --no-cache -a; \

Containers/whiteboard/Dockerfile

@@ -1,19 +1,13 @@
 # syntax=docker/dockerfile:latest
-# Probably from this file: https://github.com/nextcloud/whiteboard/blob/main/Dockerfile
-FROM ghcr.io/nextcloud-releases/whiteboard:v1.0.5
+FROM ghcr.io/nextcloud-releases/whiteboard:v1.0.2
 
 USER root
 RUN set -ex; \
     apk upgrade --no-cache -a; \
     apk add --no-cache bash
-USER 65534
+USER nobody
 
 COPY --chmod=775 start.sh /start.sh
-COPY --chmod=775 healthcheck.sh /healthcheck.sh
-
-HEALTHCHECK CMD /healthcheck.sh
-
-WORKDIR /tmp
 
 ENTRYPOINT ["/start.sh"]
 

Containers/whiteboard/healthcheck.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-nc -z "$REDIS_HOST" 6379 || exit 0
-nc -z 127.0.0.1 3002 || exit 1

Containers/whiteboard/start.sh

@@ -11,7 +11,7 @@ if [ -z "$REDIS_DB_INDEX" ]; then
     REDIS_DB_INDEX=0
 fi
 
-export REDIS_URL="redis://$REDIS_USER:$REDIS_HOST_PASSWORD@$REDIS_HOST/$REDIS_DB_INDEX"
+export REDIS_URL="redis://:$REDIS_HOST_PASSWORD@$REDIS_HOST/$REDIS_DB_INDEX"
 
 # Run it
-exec npm --prefix /app run server:start
+exec npm run server:start

app/appinfo/info.xml

@@ -5,7 +5,7 @@
 	<name>Nextcloud All-in-One</name>
 	<summary>Provides a login link for admins.</summary>
 	<description>Add a link to the admin settings that gives access to the Nextcloud All-in-One admin interface</description>
-	<version>0.7.0</version>
+	<version>0.6.0</version>
 	<licence>agpl</licence>
 	<author>Azul</author>
 	<namespace>AllInOne</namespace>
@@ -13,7 +13,7 @@
 	<category>monitoring</category>
 	<bugs>https://github.com/nextcloud/all-in-one/issues</bugs>
 	<dependencies>
-		<nextcloud min-version="29" max-version="30"/>
+		<nextcloud min-version="28" max-version="29"/>
 	</dependencies>
 
 	<settings>

community-containers/borgbackup-viewer/borgbackup-viewer.json

@@ -1,71 +0,0 @@
-{
-    "aio_services_v1": [
-        {
-            "container_name": "nextcloud-aio-borgbackup-viewer",
-            "image_tag": "v1",
-            "display_name": "Borg Backup Viewer",
-            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/borgbackup-viewer",
-            "image": "szaimen/aio-borgbackup-viewer",
-            "internal_port": "5801",
-            "ports": [
-                {
-                  "ip_binding": "",
-                  "port_number": "5801",
-                  "protocol": "tcp"
-                }
-            ],
-            "environment": [
-                "BORG_HOST_ID=nextcloud-aio-borgbackup-viewer",
-                "WEB_AUTHENTICATION_USERNAME=nextcloud",
-                "WEB_AUTHENTICATION_PASSWORD=%BORGBACKUP_VIEWER_PASSWORD%",
-                "WEB_LISTENING_PORT=5801",
-                "BORG_PASSPHRASE=%BORGBACKUP_PASSWORD%",
-                "BORG_REPO=/mnt/borgbackup/borg"
-            ],
-            "secrets": [
-                "BORGBACKUP_VIEWER_PASSWORD",
-                "BORGBACKUP_PASSWORD"
-            ],
-            "ui_secret": "BORGBACKUP_VIEWER_PASSWORD",
-            "volumes": [
-            {
-                "source": "nextcloud_aio_backup_cache",
-                "destination": "/root",
-                "writeable": true
-            },
-            {
-                "source": "%NEXTCLOUD_DATADIR%",
-                "destination": "/nextcloud_aio_volumes/nextcloud_aio_nextcloud_data",
-                "writeable": true
-            },
-            {
-                "source": "nextcloud_aio_mastercontainer",
-                "destination": "/nextcloud_aio_volumes/nextcloud_aio_mastercontainer",
-                "writeable": true
-            },
-            {
-                "source": "%BORGBACKUP_HOST_LOCATION%",
-                "destination": "/mnt/borgbackup",
-                "writeable": true
-            },
-            {
-                "source": "nextcloud_aio_elasticsearch",
-                "destination": "/nextcloud_aio_volumes/nextcloud_aio_elasticsearch",
-                "writeable": true
-            },
-            {
-                "source": "nextcloud_aio_redis",
-                "destination": "/mnt/redis",
-                "writeable": true
-            }
-            ],
-            "devices": [
-                "/dev/fuse"
-            ],
-            "cap_add": [
-                "SYS_ADMIN"
-            ],
-            "apparmor_unconfined": true
-        }
-    ]
-}

community-containers/borgbackup-viewer/readme.md

@@ -1,17 +0,0 @@
-## Borgbackup Viewer
-This container allows to view the local borg repository in a web session. It also allows you to restore files and folders from the backup by using desktop programs in a web browser.
-
-### Notes
-- After adding and starting the container, you need to visit `https://ip.address.of.this.server:5801` in order to log in with the user `nextcloud` and the password that you can see next to the container in the AIO interface. (The web page uses a self-signed certificate, so you need to accept the warning).
-- Then, you should see a terminal. There type in `borg mount /mnt/borgbackup/borg /tmp/borg` to mount the backup archive at `/tmp/borg` inside the container. Afterwards type in `nautilus /tmp/borg` which will show a file explorer and allows you to see all the files. You can then copy files and folders back to their initial mountpoints inside `/nextcloud_aio_volumes/`, `/host_mounts/` and `/docker_volumes/`. ⚠️ Be very carefully while doing that as can break your instance!
-- After you are done with the operation, click on the terminal in the background and press `[CTRL]+[c]` multiple times to close any open application. Then run `umount /tmp/borg` to unmount the mountpoint correctly.
-- You can also delete specific archives by running `borg list`,  delete a specific archive e.g. via `borg delete --stats --progress "::20220223_174237-nextcloud-aio"` and compact the archives via `borg compact`. After doing so, make sure to update the backup archives list in the AIO interface! You can do so by clicking on the `Check backup integrity` button or `Create backup` button.
-- ⚠️ After you are done doing your operations, remove the container for better security again from the stack: https://github.com/nextcloud/all-in-one/tree/main/community-containers#how-to-remove-containers-from-aios-stack
-- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
-
-### Repository
-https://github.com/szaimen/aio-borgbackup-viewer
-
-### Maintainer
-https://github.com/szaimen
-

community-containers/caddy/readme.md

@@ -9,7 +9,6 @@ This container bundles caddy and auto-configures it for you. It also covers http
 - If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyfin, make sure that you point `media.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for jellyfin.
 - If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/lldap, make sure that you point `ldap.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for lldap.
 - If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/nocodb, make sure that you point `tables.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for nocodb.
-- If you want to use this with https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr, make sure that you point `requests.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for jellyseerr.
 - After the container was started the first time, you should see a new `nextcloud-aio-caddy` folder and inside there an `allowed-countries.txt` file when you open the files app with the default `admin` user. In there you can adjust the allowed country codes for caddy by adding them to the first line, e.g. `IT FR` would allow access from italy and france. Private ip-ranges are always allowed. Additionally, in order to activate this config, you need to get an account at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data and download the `GeoLite2-Country.mmdb` and upload it with this exact name into the `nextcloud-aio-caddy` folder. Afterwards restart all containers from the AIO interface and your new config should be active!
 - You can add your own Caddy configurations in `/data/caddy-imports/` inside the Caddy container (`sudo docker exec -it nextcloud-aio-caddy bash`). These will be imported on container startup.
 - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack

community-containers/calcardbackup/calcardbackup.json

@@ -1,37 +0,0 @@
-{
-    "aio_services_v1": [
-        {
-            "container_name": "nextcloud-aio-calcardbackup",
-            "display_name": "Calendar and contacts backup",
-            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/calcardbackup",
-            "image": "waja/calcardbackup",
-            "image_tag": "latest",
-            "restart": "unless-stopped",
-            "environment": [
-                "CRON_TIME=0 0 * * *",
-                "INIT_BACKUP=yes",
-                "BACKUP_DIR=/backup",
-                "NC_DIR=/nextcloud",
-                "NC_HOST=%NC_DOMAIN%",
-                "DB_HOST=nextcloud-aio-database",
-                "DB_PORT=5432",
-                "CALCARD_OPTS=-ltm 5"
-            ],
-            "volumes": [
-                {
-                    "source": "nextcloud_aio_calcardbackup",
-                    "destination": "/backup",
-                    "writeable": true
-                },
-                {
-                    "source": "nextcloud_aio_nextcloud",
-                    "destination": "/nextcloud",
-                    "writeable": false
-                }
-            ],
-            "backup_volumes": [
-                "nextcloud_aio_calcardbackup"
-            ]
-        }
-    ]
-}

community-containers/calcardbackup/readme.md

@@ -1,15 +0,0 @@
-## calcardbackup  
-This container packages calcardbackup which is a tool that exports calendars and addressbooks from Nextcloud to .ics and .vcf files and saves them to a compressed file.
-  
-### Notes  
-- Backups will be created at 00:00 CEST every day. Make sure that this does not conflict with the configured daily backups inside AIO.
-- All the exports will be included in AIOs backup solution
-- You can find the exports in the nextcloud_aio_calcardbackup volume
-- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack  
-  
-### Repository  
-https://github.com/waja/docker-calcardbackup
-
-### Maintainer
-https://github.com/pailloM
-  

community-containers/facerecognition/facerecognition.json

@@ -16,7 +16,6 @@
             "aio_variables": [
                 "nextcloud_memory_limit=2048M"
             ],
-            "enable_nvidia_gpu": false,
             "nextcloud_exec_commands": [
                 "php /var/www/html/occ app:install facerecognition",
                 "php /var/www/html/occ app:enable facerecognition", 

community-containers/facerecognition/readme.md

@@ -3,7 +3,6 @@ This container bundles the external model of facerecognition and auto-configures
 
 ### Notes
 - This container needs imaginary in order to analyze modern file format images. Make sure to enable imaginary in the AIO interface before adding this container.
-- The image analysis is currently set to fixed value of `1G`. See [this](https://github.com/search?q=repo%3Anextcloud%2Fall-in-one+1G+path%3A%2F%5Ecommunity-containers%5C%2Ffacerecognition%5C%2F%2F&type=code)
 - Facerecognition is by default disabled for all users, if you want to enable facerecognition for all users, you can run the following before adding this container:
     ```bash
     # Go into the container

community-containers/fail2ban/fail2ban.json

@@ -25,16 +25,6 @@
                     "source": "nextcloud_aio_vaultwarden_logs",
                     "destination": "/vaultwarden",
                     "writeable": false
-                },
-                {
-                    "source": "nextcloud_aio_jellyfin",
-                    "destination": "/jellyfin",
-                    "writeable": false
-                },
-                {
-                    "source": "nextcloud_aio_jellyseerr",
-                    "destination": "/jellyseerr",
-                    "writeable": false
                 }
             ]
         }

community-containers/fail2ban/readme.md

@@ -1,5 +1,5 @@
 ## Fail2ban
-This container bundles fail2ban and auto-configures it for you in order to block ip-addresses automatically. It also covers https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden, https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyfin, and https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr, if installed.
+This container bundles fail2ban and auto-configures it for you in order to block ip-addresses automatically. It also covers https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden, if installed.
 
 ### Notes
 - If you get an error like `"ip6tables v1.8.9 (legacy): can't initialize ip6tables table filter': Table does not exist (do you need to insmod?)"`, you need to enable ip6tables on your host via `sudo modprobe ip6table_filter`.

community-containers/jellyfin/jellyfin.json

@@ -31,7 +31,6 @@
             "devices": [
                 "/dev/dri"
             ],
-            "enable_nvidia_gpu": true,
             "backup_volumes": [
                 "nextcloud_aio_jellyfin"
             ]

community-containers/jellyfin/readme.md

@@ -8,7 +8,6 @@ This container bundles Jellyfin and auto-configures it for you.
 - In order to access your Jellyfin outside the local network, you have to set up your own reverse proxy. You can set up a reverse proxy following [these instructions](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md) and [Jellyfin's networking documentation](https://jellyfin.org/docs/general/networking/#running-jellyfin-behind-a-reverse-proxy), OR use the [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container that will automatically configure `media.$NC_DOMAIN` to redirect to your Jellyfin.
 - ⚠️ After the initial start, Jellyfin shows a configuration page to set up the root password, etc. **Be careful to initialize your Jellyfin before adding the DNS record.**
 - If you have a firewall like ufw configured, you might need to open all Jellyfin ports in there first in order to make it work. Especially port 8096 is important!
-- If you want to secure the installation with fail2ban, you might want to check out https://github.com/nextcloud/all-in-one/tree/main/community-containers/fail2ban
 - The data of Jellyfin will be automatically included in AIO's backup solution!
 - See [here](https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers) how to add it to the AIO stack.
 

community-containers/jellyseerr/jellyseerr.json

@@ -1,34 +0,0 @@
-{
-    "aio_services_v1": [
-        {
-            "container_name": "nextcloud-aio-jellyseerr",
-            "display_name": "Jellyseerr",
-            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/jellyseerr",
-            "image": "fallenbagel/jellyseerr",
-            "image_tag": "latest",
-            "internal_port": "5055",
-            "restart": "unless-stopped",
-            "ports": [
-                {
-                    "ip_binding": "%APACHE_IP_BINDING%",
-                    "port_number": "5055",
-                    "protocol": "tcp"
-                }
-            ],
-            "environment": [
-                "PORT=5055",
-                "TZ=%TIMEZONE%"
-            ],
-            "volumes": [
-                {
-                    "source": "nextcloud_aio_jellyseerr",
-                    "destination": "/app/config",
-                    "writeable": true
-                }
-            ],
-            "backup_volumes": [
-                "nextcloud_aio_jellyseerr"
-            ]
-        }
-    ]
-}

community-containers/jellyseerr/readme.md

@@ -1,16 +0,0 @@
-## Jellyseerr
-This container bundles Jellyseerr and auto-configures it for you.
-
-### Notes
-- This container is only intended to be used inside home networks as it uses http for its management page by default.
-- After adding and starting the container, you can directly visit `http://ip.address.of.server:5055` and access your new Jellyseerr instance, which can be used to manage Plex, Jellyfin, and Emby.
-- In order to access your Jellyseerr outside the local network, you have to set up your own reverse proxy. You can set up a reverse proxy following [these instructions](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md) and [Jellyseerr's reverse proxy documentation.](https://docs.jellyseerr.dev/extending-jellyseerr/reverse-proxy), OR use the Caddy community container that will automatically configure requests.$NC_DOMAIN to redirect to your Jellyseerr.
-- If you want to secure the installation with fail2ban, you might want to check out https://github.com/nextcloud/all-in-one/tree/main/community-containers/fail2ban
-- The config of Jellyseerr will be automatically included in AIO's backup solution!
-- See [here](https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers) how to add it to the AIO stack.
-
-### Repository
-https://github.com/Fallenbagel/jellyseerr
-
-### Maintainer
-https://github.com/Anvil5465

community-containers/lldap/lldap.json

@@ -27,7 +27,6 @@
         "LLDAP_JWT_SECRET",
         "LLDAP_LDAP_USER_PASS"
       ],
-      "ui_secret": "LLDAP_JWT_SECRET",
       "volumes": [
         {
           "source": "nextcloud_aio_lldap",

community-containers/lldap/readme.md

@@ -3,7 +3,7 @@ This container bundles LLDAP server and auto-configures your Nextcloud instance
 
 ### Notes
 - In order to access your LLDAP web interface outside the local network, you have to set up your own reverse proxy. You can set up a reverse proxy following [these instructions](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md) OR use the [Caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container that will automatically configure `ldap.$NC_DOMAIN` to redirect to your Lldap. You need to point the reverse proxy at port 17170 of this server.
-- After adding and starting the container, you can log in to the lldap web interface by using the username `admin` and the secret that you can see next to the container in the AIO interface.
+- After adding and starting the container, you can log in to the lldap web interface by using the username `admin` and the password that you can retrieve via `sudo docker inspect nextcloud-aio-lldap | grep LLDAP_JWT_SECRET`.
 - To configure Nextcloud, you can use the generic configuration proposed below.
 - For advanced configurations, see how to configure a client with lldap https://github.com/lldap/lldap#client-configuration
 - Also, see how Nextcloud's LDAP application works https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html

community-containers/local-ai/local-ai.json

@@ -29,7 +29,6 @@
                     "writeable": false
                 }
             ],
-            "enable_nvidia_gpu": false,
             "nextcloud_exec_commands": [
                 "mkdir '/mnt/ncdata/admin/files/nextcloud-aio-local-ai'",
                 "touch '/mnt/ncdata/admin/files/nextcloud-aio-local-ai/models.yaml'",

community-containers/local-ai/readme.md

@@ -3,15 +3,22 @@ This container bundles Local AI and auto-configures it for you.
 
 ### Notes
 - Make sure to have enough storage space available. This container alone needs ~7GB storage. Every model that you add to `models.yaml` will of course use additional space which adds up quite fast.
-- After the container was started the first time, you should see a new `nextcloud-aio-local-ai` folder when you open the files app with the default `admin` user. In there you should see a `models.yaml` config file. You can now add models in there. Please refer [here](https://github.com/mudler/LocalAI/blob/master/gallery/index.yaml) where you can get further urls that you can put in there. Afterwards restart all containers from the AIO interface and the models should automatically get downloaded by the local-ai container and activated.
+- After the container was started the first time, you should see a new `nextcloud-aio-local-ai` folder when you open the files app with the default `admin` user. In there you should see a `models.yaml` config file. You can now add models in there. Please refer [here](https://github.com/go-skynet/model-gallery/blob/main/index.yaml) where you can get further urls that you can put in there. Afterwards restart all containers from the AIO interface and the models should automatically get downloaded by the local-ai container and activated.
 - Example for content of `models.yaml` (if you add all of them, it takes around 10GB additional space):
 ```yaml
 # Stable Diffusion in NCNN with c++, supported txt2img and img2img 
-- url: github:mudler/LocalAI/blob/master/gallery/stablediffusion.yaml
+- url: github:go-skynet/model-gallery/stablediffusion.yaml
   name: Stable_diffusion
+
+# Port of OpenAI's Whisper model in C/C++ 
+- url: github:go-skynet/model-gallery/whisper-base.yaml
+  name: whisper-1
+
+# A commercially licensable model based on GPT-J and trained by Nomic AI on the v0 GPT4All dataset.
+- url: github:go-skynet/model-gallery/gpt4all-j.yaml
+  name: gpt4all-j
 ```
 -  To make it work, you first need to browse `https://your-nc-domain.com/settings/admin/ai` and enable or disable specific features for your models in the openAI settings. Afterwards using the Nextcloud Assistant should work.
-- See [this guide](https://github.com/nextcloud/all-in-one/discussions/5430) for how to improve AI task pickup speed
 - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
 
 ### Repository

community-containers/makemkv/makemkv.json

@@ -1,59 +0,0 @@
-{
-    "aio_services_v1": [
-        {
-            "container_name": "nextcloud-aio-makekv",
-            "display_name": "MakeMKV",
-            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/makemkv",
-            "image": "jlesage/makemkv",
-            "image_tag": "latest",
-            "internal_port": "5802",
-            "restart": "unless-stopped",
-            "ports": [
-                {
-                    "ip_binding": "",
-                    "port_number": "5802",
-                    "protocol": "tcp"
-                }
-            ],
-            "volumes": [
-                {
-                    "source": "nextcloud_aio_makemkv",
-                    "destination": "/config",
-                    "writeable": true
-                },
-                {
-                    "source": "%NEXTCLOUD_DATADIR%",
-                    "destination": "/storage",
-                    "writeable": false
-                },
-                {
-                    "source": "%NEXTCLOUD_MOUNT%",
-                    "destination": "/output",
-                    "writeable": true
-                },
-                {
-                    "source": "/dev",
-                    "destination": "/dev",
-                    "writeable": false
-                }
-            ],
-            "environment": [
-                "TZ=%TIMEZONE%",
-                "SECURE_CONNECTION=1",
-                "WEB_AUTHENTICATION=1",
-                "USER_ID=33",
-                "GROUP_ID=33",
-                "WEB_AUTHENTICATION_USERNAME=makemkv",
-                "WEB_AUTHENTICATION_PASSWORD=%MAKEMKV_PASSWORD%",
-                "WEB_LISTENING_PORT=5802"
-            ],
-            "secrets": [
-                "MAKEMKV_PASSWORD"
-            ],
-            "ui_secret": "MAKEMKV_PASSWORD",
-            "backup_volumes": [
-                "nextcloud_aio_makemkv"
-            ]
-        }
-    ]
-}

community-containers/makemkv/readme.md

@@ -1,20 +0,0 @@
-## MakeMKV
-This container bundles MakeMKV and auto-configures it for you.
-
-### Notes
-- This container should only be run in home networks
-- ⚠️ This container mounts all devices from the host inside the container in order to be able to access the external DVD/Blu-ray drives which is a security issue. However no better solution was found for the time being.
-- This container only works on Linux and not on Docker-Desktop.
-- This container requires the [`NEXTCLOUD_MOUNT` variable in AIO to be set](https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host). Otherwise the output will not be saved correctly..
-- After adding and starting the container, you need to visit `https://internal.ip.of.server:5802` in order to log in with the `makemkv` user and the password that you can see next to the container in the AIO interface. (The web page uses a self-signed certificate, so you need to accept the warning).
-- After the first login, you can adjust the `/output` directory in the MakeMKV settings to a subdirectory of the root of your chosen `NEXTCLOUD_MOUNT`. (by default `NEXTCLOUD_MOUNT` is mounted to `/output` inside the container. Thus all data is written to the root of it)
-- The configured `NEXTCLOUD_DATADIR` is getting mounted to `/storage` inside the container.
-- The config data of MakeMKV will be automatically included in AIOs backup solution!
-- ⚠️ After you are done doing your operations, remove the container for better security again from the stack: https://github.com/nextcloud/all-in-one/tree/main/community-containers#how-to-remove-containers-from-aios-stack
-- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
-
-### Repository
-https://github.com/jlesage/docker-makemkv
-
-### Maintainer
-https://github.com/szaimen

community-containers/memories/memories.json

@@ -17,17 +17,11 @@
                     "source": "%NEXTCLOUD_DATADIR%",
                     "destination": "/mnt/ncdata",
                     "writeable": false
-                },
-                { 
-                    "source": "%NEXTCLOUD_MOUNT%", 
-                    "destination": "%NEXTCLOUD_MOUNT%", 
-                    "writeable": false 
                 }
             ],
             "devices": [
                 "/dev/dri"
             ],
-            "enable_nvidia_gpu": true,
             "nextcloud_exec_commands": [
                 "php /var/www/html/occ app:install memories",
                 "php /var/www/html/occ app:enable memories",

community-containers/memories/readme.md

@@ -2,7 +2,7 @@
 This container bundles the hardware-transcoding container of memories and auto-configures it for you.
 
 ### Notes
-- In order to actually enable the hardware transcoding, you need to add the following flag to AIO apart from adding this container: https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud
+- In order to actually enable the hardware transcoding, you need to add the following flag to AIO apart from adding this container: https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
 - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
 
 ### Repository

community-containers/nocodb/nocodb.json

@@ -28,7 +28,6 @@
                 "NOCODB_JWT_SECRET",
                 "NOCODB_USER_PASS"
             ],
-            "ui_secret": "NOCODB_USER_PASS",
             "volumes": [
                 {
                     "source": "nextcloud_aio_nocodb",

community-containers/nocodb/readme.md

@@ -17,7 +17,7 @@ This is an alternative of **Airtable**.
 - You need to configure a reverse proxy in order to run this container since nocodb needs a dedicated (sub)domain! For that, you might have a look at https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy.
 - Currently, only `tables.$NC_DOMAIN` is supported as subdomain! So if Nextcloud is using `your-domain.com`, nocodb will use `tables.your-domain.com`.
 - The data of NocoDb will be automatically included in AIOs backup solution!
-- After adding and starting the container, you can log in to the web interface at `https://tables.$NC_DOMAIN/#/signin` with the username `admin@noco.db` and the password that you can see in the AIO interface next to the container. 
+- After adding and starting the container, you need to run `docker inspect nextcloud-aio-nocodb  | grep NC_ADMIN_PASS` to obtain the system administrator password (username: `admin@noco.db`). With this information, you can log in to the web interface at `https://tables.$NC_DOMAIN/#/signin`
 - See https://docs.nocodb.com/ for usage of NocoDb
 - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
 

community-containers/npmplus/readme.md

@@ -3,14 +3,15 @@ This container contains a fork of the Nginx Proxy Manager, which is a WebUI for
 
 ### Notes
 - This container is incompatible with the [caddy](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) community container. So make sure that you do not enable both at the same time!
+- You can ignore the NPM configuration of the reverse-proxy.md. The NPMplus fork already contains the changes of the advanced tab.
 - Make sure that no other service is using port `443 (tcp/upd)` or `81 (tcp)` on your host as otherwise the containers will fail to start. You can check this with `sudo netstat -tulpn | grep "443\|81"` before installing AIO.
 - Please change the default login data first, after you can read inside the logs that the default config for AIO is created and there are no errors.
 - After the container was started the first time, please check the logs for errors. Then you can open NPMplus on `https://<ip>:81` and change the password. 
-- The default password is `iArhP1j7p1P6TA92FA2FMbbUGYqwcYzxC4AVEe12Wbi94FY9gNN62aKyF1shrvG4NycjjX9KfmDQiwkLZH1ZDR9xMjiG2QmoHXi` and the default email is `admin@example.org`
+- The default password is `iArhP1j7p1P6TA92FA2FMbbUGYqwcYzxC4AVEe12Wbi94FY9gNN62aKyF1shrvG4NycjjX9KfmDQiwkLZH1ZDR9xMjiG2QmoHXi` and the default email is `admin@example.com`
 - If you want to use NPMplus behind a domain and outside localhost just create a new proxy host inside the NPMplus which proxies to `https`, `127.0.0.1` and port `81` - all other settings should be the same as for the AIO host.
 - If you want to set env options from this [compose.yaml](https://github.com/ZoeyVid/NPMplus/blob/develop/compose.yaml), please set them inside the `.env` file which you can find in the `nextcloud_aio_npmplus` volume
 - The data (certs, configs, etc.) of NPMplus will be automatically included in AIOs backup solution!
-- **Important:** you always need to enable https for your hosts, since `DISABLE_HTTP` is set to true by default
+- **Important:** you always need to enable https for your hosts, since `DISABLE_HTTP` is set to true
 - See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
 
 ### Repository and Documentation

community-containers/plex/plex.json

@@ -33,7 +33,6 @@
             "devices": [
                 "/dev/dri"
             ],
-            "enable_nvidia_gpu": true,
             "backup_volumes": [
                 "nextcloud_aio_plex"
             ]

community-containers/scrutiny/readme.md

@@ -1,15 +0,0 @@
-## Scrutiny
-This container bundles Scrutiny and auto-configures it for you.
-
-### Notes
-- This container should only be run in home networks
-- ⚠️ This container mounts all devices from the host inside the container in order to be able to access the drives and smartctl stats which is a security issue. However no better solution was found for the time being.
-- This container only works on Linux and not on Docker-Desktop.
-- After adding and starting the container, you need to visit `http://internal.ip.of.server:8000` which will show the dashboard for your drives.
-- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
-
-### Repository
-https://github.com/szaimen/aio-scrutiny
-
-### Maintainer
-https://github.com/szaimen

community-containers/scrutiny/scrutiny.json

@@ -1,56 +0,0 @@
-{
-    "aio_services_v1": [
-        {
-            "container_name": "nextcloud-aio-scrutiny",
-            "display_name": "Scrutiny",
-            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/scrutiny",
-            "image": "szaimen/aio-scrutiny",
-            "image_tag": "v1",
-            "internal_port": "8000",
-            "init": false,
-            "restart": "unless-stopped",
-            "ports": [
-                {
-                  "ip_binding": "",
-                  "port_number": "8000",
-                  "protocol": "tcp"
-                }
-            ],
-            "cap_add": [
-                "SYS_RAWIO",
-                "SYS_ADMIN"
-            ],
-            "environment": [
-                "TZ=%TIMEZONE%",
-                "SCRUTINY_WEB_LISTEN_PORT=8000",
-                "COLLECTOR_API_ENDPOINT=http://127.0.0.1:8000"
-            ],
-            "volumes": [
-                {
-                    "source": "nextcloud_aio_scrutiny",
-                    "destination": "/opt/scrutiny/config",
-                    "writeable": true
-                },
-                {
-                    "source": "nextcloud_aio_scrutiny_db",
-                    "destination": "/opt/scrutiny/influxdb",
-                    "writeable": true
-                },
-                {
-                    "source": "/run/udev",
-                    "destination": "/run/udev",
-                    "writeable": false
-                },
-                {
-                    "source": "/dev",
-                    "destination": "/dev",
-                    "writeable": false
-                }
-            ],
-            "backup_volumes": [
-                "nextcloud_aio_scrutiny",
-                "nextcloud_aio_scrutiny_db"
-            ]
-        }
-    ]
-}

community-containers/stalwart/stalwart.json

@@ -53,7 +53,6 @@
             "secrets": [
                 "STALWART_USER_PASS"
             ],
-            "ui_secret": "STALWART_USER_PASS",
             "volumes": [
                 {
                     "source": "nextcloud_aio_stalwart",

compose.yaml

@@ -14,58 +14,41 @@ services:
       - 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
     # environment: # Is needed when using any of the options below
       # AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
-      # AIO_COMMUNITY_CONTAINERS: # With this variable, you can add community containers very easily. See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers
       # APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       # APACHE_IP_BINDING: 127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      # APACHE_ADDITIONAL_NETWORK: frontend_net # (Optional) Connect the apache container to an additional docker network. Needed when behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) running in a different docker network on same server. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
       # BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
       # COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
       # NEXTCLOUD_DATADIR: /mnt/ncdata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
       # NEXTCLOUD_MOUNT: /mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
-      # NEXTCLOUD_UPLOAD_LIMIT: 16G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
+      # NEXTCLOUD_UPLOAD_LIMIT: 10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
       # NEXTCLOUD_MAX_TIME: 3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
       # NEXTCLOUD_MEMORY_LIMIT: 512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
-      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nextcloud container (Useful e.g. for LDAPS) See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
+      # NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
       # NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
       # NEXTCLOUD_ADDITIONAL_APKS: imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
       # NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
-      # NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device for containers that profit from it. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud
-      # NEXTCLOUD_ENABLE_NVIDIA_GPU: true # This allows to enable the NVIDIA runtime and GPU access for containers that profit from it. ⚠️⚠️⚠️ Warning: this only works if an NVIDIA gpu is installed on the server. See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-acceleration-for-nextcloud.
+      # NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device in the Nextcloud container. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
       # NEXTCLOUD_KEEP_DISABLED_APPS: false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
-      # SKIP_DOMAIN_VALIDATION: false # This should only be set to true if things are correctly configured. See https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-skip-the-domain-validation
-      # TALK_PORT: 3478 # This allows to adjust the port that the talk container is using which is exposed on the host. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
+      # DISABLE_OVERWRITE_URL: true # Setting this to true will disable the ability to overwrite the URL in the AIO interface. See https://github.com/nextcloud/all-in-one#can-i-use-aio-with-multiple-domains
+      # TALK_PORT: 3478 # This allows to adjust the port that the talk container is using. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
       # WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
     # security_opt: ["label:disable"] # Is needed when using SELinux
 
-#   # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/discussions/575
-#   # Alternatively, use Tailscale if you don't have a domain yet. See https://github.com/nextcloud/all-in-one/discussions/5439
-#   # Hint: You need to uncomment APACHE_PORT: 11000 above, adjust cloud.example.com to your domain and uncomment the necessary docker volumes at the bottom of this file in order to make it work
-#   # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588
-#   caddy:
-#     image: caddy:alpine
-#     restart: always
-#     container_name: caddy
-#     volumes:
-#       - caddy_certs:/certs
-#       - caddy_config:/config
-#       - caddy_data:/data
-#       - caddy_sites:/srv
-#     network_mode: "host"
-#     configs:
-#       - source: Caddyfile
-#         target: /etc/caddy/Caddyfile
-# configs:
-#   Caddyfile:
-#     content: |
-#       # Adjust cloud.example.com to your domain below
-#       https://cloud.example.com:443 {
-#         reverse_proxy localhost:11000
-#       }
+  # # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
+  # # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588
+  # caddy:
+  #   image: caddy:alpine
+  #   restart: always
+  #   container_name: caddy
+  #   volumes:
+  #     - ./Caddyfile:/etc/caddy/Caddyfile
+  #     - ./certs:/certs
+  #     - ./config:/config
+  #     - ./data:/data
+  #     - ./sites:/srv
+  #   network_mode: "host"
 
 volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
   nextcloud_aio_mastercontainer:
     name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
-  # caddy_certs:
-  # caddy_config:
-  # caddy_data:
-  # caddy_sites:
+

docker-rootless.md

@@ -18,8 +18,7 @@ You can run AIO with docker rootless by following the steps below.
 Almost all commands in this project's documentation use `sudo docker ...`. Since `sudo` is not needed in case of docker rootless, you simply remove `sudo` from the commands and they should work. 
 
 ### Note regarding permissions
-All files outside the containers get created, written to and accessed as the user that is running the docker daemon or a subuid of it. So for the built-in backup to work you need to allow this user to write to the target directory. E.g. with `sudo chown -R USERNAME:GROUPNAME /mnt/backup`. The same applies when changing Nextcloud's datadir via NEXTCLOUD_DATADIR. E.g. `sudo chown -R USERNAME:GROUPNAME /mnt/ncdata`. When you want to use the NEXTCLOUD_MOUNT option for local external storage, you need to adjust the permissions of the chosen folders to be accessible/writeable by the userid `100032:100032` (if running `grep ^$(whoami): /etc/subuid` as the user that is running the docker daemon returns 100000 as first value). 
-
+All files outside the containers get created, written to and accessed as the user that is running the docker daemon or a subuid of it. So for the built-in backup to work you need to allow this user to write to the target directory. E.g. with `sudo chown -R USERNAME:GROUPNAME /mnt/backup`. The same applies when changing Nextcloud's datadir. E.g. `sudo chown -R USERNAME:GROUPNAME /mnt/ncdata`. When you want to use the NEXTCLOUD_MOUNT option for local external storage, you need to adjust the permissions of the chosen folders to be accessible/writeable by the userid `100032:100032` (if running `grep ^$(whoami): /etc/subuid` as the user that is running the docker daemon returns 100000 as first value). 
 
 ### Note regarding docker network driver
 By default rootless docker uses the `slirp4netns` IP driver and the `builtin` port driver. As mentioned in [the documentation](https://docs.docker.com/engine/security/rootless/#networking-errors), this combination doesn't provide "Source IP propagation". This means that Apache and Nextcloud will see all connections as coming from the docker gateway (e.g 172.19.0.1), which can lead to the Nextcloud brute force protection blocking all connection attempts. To expose the correct source IP, you will need to configure docker to also use `slirp4netns` as the port driver (see also [this guide](https://rootlesscontaine.rs/getting-started/docker/#changing-the-port-forwarder)).
@@ -30,10 +29,9 @@ As stated in the documentation, this change will likely lead to decreased networ
   with the following content:
   ```
   [Service]
-  Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns"
   Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns"
   ```
 * Restart the docker daemon
   ```
   systemctl --user restart docker
-  ```
+  ```

local-instance.md

@@ -1,31 +1,19 @@
 # Local instance
-It is possible due to several reasons that you do not want or cannot open Nextcloud to the public internet. Perhaps you were hoping to access AIO directly from an `ip.add.r.ess` (unsupported) or without a valid domain.  However, AIO requires a valid certificate to work correctly. Below is discussed how you can achieve both: Having a valid certificate for Nextcloud and only using it locally.
+It is possible due to several reasons that you do not want or cannot open Nextcloud to the public internet. However AIO requires a valid certificate to work correctly. Below is discussed how you can achieve both: Having a valid certificate for Nextcloud and only using it locally.
 
-### Content
-- [1. Tailscale](#1-tailscale)
-- [2. The normal way](#2-the-normal-way)
-- [3. Use the ACME DNS-challenge](#3-use-the-acme-dns-challenge)
-- [4. Use Cloudflare](#4-use-cloudflare)
-- [5. Buy a certificate and use that](#5-buy-a-certificate-and-use-that)
-
-## 1. Tailscale
-This is the recommended way. For a reverse proxy example guide for Tailscale, see this guide by @flll: https://github.com/nextcloud/all-in-one/discussions/5439
-
-## 2. The normal way
-The normal way is the following:
+## 1. The recommended way
+The recommended way is the following:
 1. Set up your domain correctly to point to your home network
 1. Set up a reverse proxy by following the [reverse proxy documentation](./reverse-proxy.md) but only open port 80 (which is needed for the ACME challenge to work - however no real traffic will use this port).
 1. Set up a local DNS-server like a pi-hole and configure it to be your local DNS-server for the whole network. Then in the Pi-hole interface, add a custom DNS-record for your domain and overwrite the A-record (and possibly the AAAA-record, too) to point to the private ip-address of your reverse proxy (see https://github.com/nextcloud/all-in-one#how-can-i-access-nextcloud-locally)
 1. Enter the ip-address of your local dns-server in the daemon.json file for docker so that you are sure that all docker containers use the correct local dns-server.
 1. Now, entering the domain in the AIO-interface should work as expected and should allow you to continue with the setup
 
-**Hint:** You may have a look at [this video](https://youtu.be/zk-y2wVkY4c) for a more complete but possibly outdated example.
-
-## 3. Use the ACME DNS-challenge
+## 2. Use the ACME DNS-challenge
 You can alternatively use the ACME DNS-challenge to get a valid certificate for Nextcloud. Here is described how to set it up: https://github.com/nextcloud/all-in-one#how-to-get-nextcloud-running-using-the-acme-dns-challenge
 
-## 4. Use Cloudflare
+## 3. Use Cloudflare
 If you do not have any control over the network, you may think about using Cloudflare Tunnel to get a valid certificate for your Nextcloud. However it will be opened to the public internet then. See https://github.com/nextcloud/all-in-one#how-to-run-nextcloud-behind-a-cloudflare-tunnel how to set this up.
 
-## 5. Buy a certificate and use that
+## 4. Buy a certificate and use that
 If none of the above ways work for you, you may simply buy a certificate from an issuer for your domain. You then download the certificate onto your server, configure AIO in [reverse proxy mode](./reverse-proxy.md) and use the certificate for your domain in your reverse proxy config.

manual-install/latest.yml

@@ -20,28 +20,20 @@ services:
         condition: service_started
         required: false
     image: nextcloud/aio-apache:latest
-    user: "33"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     ports:
       - ${APACHE_IP_BINDING}:${APACHE_PORT}:${APACHE_PORT}/tcp
       - ${APACHE_IP_BINDING}:${APACHE_PORT}:${APACHE_PORT}/udp
     environment:
-      - NC_DOMAIN
+      - NC_DOMAIN=${NC_DOMAIN}
       - NEXTCLOUD_HOST=nextcloud-aio-nextcloud
       - APACHE_HOST=nextcloud-aio-apache
       - COLLABORA_HOST=nextcloud-aio-collabora
       - TALK_HOST=nextcloud-aio-talk
-      - APACHE_PORT
+      - APACHE_PORT=${APACHE_PORT}
       - ONLYOFFICE_HOST=nextcloud-aio-onlyoffice
       - TZ=${TIMEZONE}
-      - APACHE_MAX_SIZE
+      - APACHE_MAX_SIZE=${APACHE_MAX_SIZE}
       - APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME}
       - NOTIFY_PUSH_HOST=nextcloud-aio-notify-push
       - WHITEBOARD_HOST=nextcloud-aio-whiteboard
@@ -49,6 +41,8 @@ services:
       - nextcloud_aio_nextcloud:/var/www/html:ro
       - nextcloud_aio_apache:/mnt/data:rw
     restart: unless-stopped
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
       - /var/log/supervisord
@@ -61,15 +55,7 @@ services:
 
   nextcloud-aio-database:
     image: nextcloud/aio-postgresql:latest
-    user: "999"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "5432"
     volumes:
@@ -84,6 +70,8 @@ services:
     stop_grace_period: 1800s
     restart: unless-stopped
     shm_size: 268435456
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
       - /var/run/postgresql
@@ -112,13 +100,6 @@ services:
         required: false
     image: nextcloud/aio-nextcloud:latest
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "9000"
       - "9001"
@@ -128,7 +109,6 @@ services:
       - ${NEXTCLOUD_MOUNT}:${NEXTCLOUD_MOUNT}:rw
       - ${NEXTCLOUD_TRUSTED_CACERTS_DIR}:/usr/local/share/ca-certificates:ro
     environment:
-      - NEXTCLOUD_HOST=nextcloud-aio-nextcloud
       - POSTGRES_HOST=nextcloud-aio-database
       - POSTGRES_PORT=5432
       - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
@@ -136,71 +116,64 @@ services:
       - POSTGRES_USER=nextcloud
       - REDIS_HOST=nextcloud-aio-redis
       - REDIS_HOST_PASSWORD=${REDIS_PASSWORD}
-      - APACHE_HOST=nextcloud-aio-apache
-      - APACHE_PORT
-      - NC_DOMAIN
+      - NC_DOMAIN=${NC_DOMAIN}
       - ADMIN_USER=admin
       - ADMIN_PASSWORD=${NEXTCLOUD_PASSWORD}
       - NEXTCLOUD_DATA_DIR=/mnt/ncdata
       - OVERWRITEHOST=${NC_DOMAIN}
       - OVERWRITEPROTOCOL=https
-      - TURN_SECRET
-      - SIGNALING_SECRET
-      - ONLYOFFICE_SECRET
-      - NEXTCLOUD_MOUNT
-      - CLAMAV_ENABLED
+      - TURN_SECRET=${TURN_SECRET}
+      - SIGNALING_SECRET=${SIGNALING_SECRET}
+      - ONLYOFFICE_SECRET=${ONLYOFFICE_SECRET}
+      - NEXTCLOUD_MOUNT=${NEXTCLOUD_MOUNT}
+      - CLAMAV_ENABLED=${CLAMAV_ENABLED}
       - CLAMAV_HOST=nextcloud-aio-clamav
-      - ONLYOFFICE_ENABLED
-      - COLLABORA_ENABLED
+      - ONLYOFFICE_ENABLED=${ONLYOFFICE_ENABLED}
+      - COLLABORA_ENABLED=${COLLABORA_ENABLED}
       - COLLABORA_HOST=nextcloud-aio-collabora
-      - TALK_ENABLED
+      - TALK_ENABLED=${TALK_ENABLED}
       - ONLYOFFICE_HOST=nextcloud-aio-onlyoffice
-      - UPDATE_NEXTCLOUD_APPS
+      - UPDATE_NEXTCLOUD_APPS=${UPDATE_NEXTCLOUD_APPS}
       - TZ=${TIMEZONE}
-      - TALK_PORT
-      - IMAGINARY_ENABLED
+      - TALK_PORT=${TALK_PORT}
+      - IMAGINARY_ENABLED=${IMAGINARY_ENABLED}
       - IMAGINARY_HOST=nextcloud-aio-imaginary
       - CLAMAV_MAX_SIZE=${APACHE_MAX_SIZE}
       - PHP_UPLOAD_LIMIT=${NEXTCLOUD_UPLOAD_LIMIT}
       - PHP_MEMORY_LIMIT=${NEXTCLOUD_MEMORY_LIMIT}
-      - FULLTEXTSEARCH_ENABLED
+      - FULLTEXTSEARCH_ENABLED=${FULLTEXTSEARCH_ENABLED}
       - FULLTEXTSEARCH_HOST=nextcloud-aio-fulltextsearch
       - PHP_MAX_TIME=${NEXTCLOUD_MAX_TIME}
       - TRUSTED_CACERTS_DIR=${NEXTCLOUD_TRUSTED_CACERTS_DIR}
       - STARTUP_APPS=${NEXTCLOUD_STARTUP_APPS}
       - ADDITIONAL_APKS=${NEXTCLOUD_ADDITIONAL_APKS}
       - ADDITIONAL_PHP_EXTENSIONS=${NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS}
-      - INSTALL_LATEST_MAJOR
-      - TALK_RECORDING_ENABLED
-      - RECORDING_SECRET
+      - INSTALL_LATEST_MAJOR=${INSTALL_LATEST_MAJOR}
+      - TALK_RECORDING_ENABLED=${TALK_RECORDING_ENABLED}
+      - RECORDING_SECRET=${RECORDING_SECRET}
       - TALK_RECORDING_HOST=nextcloud-aio-talk-recording
-      - FULLTEXTSEARCH_PASSWORD
-      - REMOVE_DISABLED_APPS
-      - IMAGINARY_SECRET
-      - WHITEBOARD_SECRET
-      - WHITEBOARD_ENABLED
+      - FULLTEXTSEARCH_PASSWORD=${FULLTEXTSEARCH_PASSWORD}
+      - REMOVE_DISABLED_APPS=${REMOVE_DISABLED_APPS}
+      - APACHE_PORT=${APACHE_PORT}
+      - IMAGINARY_SECRET=${IMAGINARY_SECRET}
+      - WHITEBOARD_SECRET=${WHITEBOARD_SECRET}
+      - WHITEBOARD_ENABLED=${WHITEBOARD_ENABLED}
     stop_grace_period: 600s
     restart: unless-stopped
+    networks:
+      - nextcloud-aio
     cap_drop:
       - NET_RAW
 
   nextcloud-aio-notify-push:
     image: nextcloud/aio-notify-push:latest
-    user: "33"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "7867"
     volumes:
       - nextcloud_aio_nextcloud:/nextcloud:ro
     environment:
-      - NC_DOMAIN
+      - NC_DOMAIN=${NC_DOMAIN}
       - NEXTCLOUD_HOST=nextcloud-aio-nextcloud
       - REDIS_HOST=nextcloud-aio-redis
       - REDIS_HOST_PASSWORD=${REDIS_PASSWORD}
@@ -210,21 +183,15 @@ services:
       - POSTGRES_DB=nextcloud_database
       - POSTGRES_USER=nextcloud
     restart: unless-stopped
+    networks:
+      - nextcloud-aio
     read_only: true
     cap_drop:
       - NET_RAW
 
   nextcloud-aio-redis:
     image: nextcloud/aio-redis:latest
-    user: "999"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "6379"
     environment:
@@ -233,6 +200,8 @@ services:
     volumes:
       - nextcloud_aio_redis:/data:rw
     restart: unless-stopped
+    networks:
+      - nextcloud-aio
     read_only: true
     cap_drop:
       - NET_RAW
@@ -240,18 +209,11 @@ services:
   nextcloud-aio-collabora:
     image: nextcloud/aio-collabora:latest
     init: true
-    healthcheck:
-      start_period: 60s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 9
     expose:
       - "9980"
     environment:
       - aliasgroup1=https://${NC_DOMAIN}:443
-      - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:home_mode.enable=true ${COLLABORA_SECCOMP_POLICY} --o:remote_font_config.url=https://${NC_DOMAIN}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+
+      - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:home_mode.enable=true ${COLLABORA_SECCOMP_POLICY} --o:remote_font_config.url=https://${NC_DOMAIN}/apps/richdocuments/settings/fonts.json
       - dictionaries=${COLLABORA_DICTIONARIES}
       - TZ=${TIMEZONE}
       - server_name=${NC_DOMAIN}
@@ -259,6 +221,8 @@ services:
     restart: unless-stopped
     profiles:
       - collabora
+    networks:
+      - nextcloud-aio
     cap_add:
       - MKNOD
       - SYS_ADMIN
@@ -267,32 +231,26 @@ services:
 
   nextcloud-aio-talk:
     image: nextcloud/aio-talk:latest
-    user: "1000"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     ports:
       - ${TALK_PORT}:${TALK_PORT}/tcp
       - ${TALK_PORT}:${TALK_PORT}/udp
     expose:
       - "8081"
     environment:
-      - NC_DOMAIN
+      - NC_DOMAIN=${NC_DOMAIN}
       - TALK_HOST=nextcloud-aio-talk
-      - TURN_SECRET
-      - SIGNALING_SECRET
+      - TURN_SECRET=${TURN_SECRET}
+      - SIGNALING_SECRET=${SIGNALING_SECRET}
       - TZ=${TIMEZONE}
-      - TALK_PORT
+      - TALK_PORT=${TALK_PORT}
       - INTERNAL_SECRET=${TALK_INTERNAL_SECRET}
     restart: unless-stopped
     profiles:
       - talk
       - talk-recording
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
       - /var/log/supervisord
@@ -305,45 +263,30 @@ services:
 
   nextcloud-aio-talk-recording:
     image: nextcloud/aio-talk-recording:latest
-    user: "122"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "1234"
     environment:
-      - NC_DOMAIN
+      - NC_DOMAIN=${NC_DOMAIN}
       - TZ=${TIMEZONE}
-      - RECORDING_SECRET
+      - RECORDING_SECRET=${RECORDING_SECRET}
       - INTERNAL_SECRET=${TALK_INTERNAL_SECRET}
-    volumes:
-      - nextcloud_aio_talk_recording:/tmp:rw
     shm_size: 2147483648
     restart: unless-stopped
     profiles:
       - talk-recording
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
+      - /tmp
       - /conf
     cap_drop:
       - NET_RAW
 
   nextcloud-aio-clamav:
     image: nextcloud/aio-clamav:latest
-    user: "100"
     init: false
-    healthcheck:
-      start_period: 60s
-      test: clamdcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 9
     expose:
       - "3310"
     environment:
@@ -355,6 +298,8 @@ services:
     restart: unless-stopped
     profiles:
       - clamav
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
       - /var/lock
@@ -366,13 +311,6 @@ services:
   nextcloud-aio-onlyoffice:
     image: nextcloud/aio-onlyoffice:latest
     init: true
-    healthcheck:
-      start_period: 60s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 9
     expose:
       - "80"
     environment:
@@ -385,25 +323,19 @@ services:
     restart: unless-stopped
     profiles:
       - onlyoffice
+    networks:
+      - nextcloud-aio
     cap_drop:
       - NET_RAW
 
   nextcloud-aio-imaginary:
     image: nextcloud/aio-imaginary:latest
-    user: "65534"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "9000"
     environment:
       - TZ=${TIMEZONE}
-      - IMAGINARY_SECRET
+      - IMAGINARY_SECRET=${IMAGINARY_SECRET}
     restart: unless-stopped
     cap_add:
       - SYS_NICE
@@ -411,6 +343,8 @@ services:
       - NET_RAW
     profiles:
       - imaginary
+    networks:
+      - nextcloud-aio
     read_only: true
     tmpfs:
       - /tmp
@@ -418,13 +352,6 @@ services:
   nextcloud-aio-fulltextsearch:
     image: nextcloud/aio-fulltextsearch:latest
     init: false
-    healthcheck:
-      start_period: 60s
-      test: /healthcheck.sh
-      interval: 10s
-      timeout: 5s
-      start_interval: 5s
-      retries: 5
     expose:
       - "9200"
     environment:
@@ -437,26 +364,20 @@ services:
       - http.port=9200
       - xpack.license.self_generated.type=basic
       - xpack.security.enabled=false
-      - FULLTEXTSEARCH_PASSWORD
+      - FULLTEXTSEARCH_PASSWORD=${FULLTEXTSEARCH_PASSWORD}
     volumes:
       - nextcloud_aio_elasticsearch:/usr/share/elasticsearch/data:rw
     restart: unless-stopped
     profiles:
       - fulltextsearch
+    networks:
+      - nextcloud-aio
     cap_drop:
       - NET_RAW
 
   nextcloud-aio-whiteboard:
     image: nextcloud/aio-whiteboard:latest
-    user: "65534"
     init: true
-    healthcheck:
-      start_period: 0s
-      test: /healthcheck.sh
-      interval: 30s
-      timeout: 30s
-      start_interval: 5s
-      retries: 3
     expose:
       - "3002"
     environment:
@@ -470,6 +391,8 @@ services:
     profiles:
       - whiteboard
     read_only: true
+    networks:
+      - nextcloud-aio
     cap_drop:
       - NET_RAW
 
@@ -490,11 +413,9 @@ volumes:
     name: nextcloud_aio_onlyoffice
   nextcloud_aio_redis:
     name: nextcloud_aio_redis
-  nextcloud_aio_talk_recording:
-    name: nextcloud_aio_talk_recording
   nextcloud_aio_nextcloud_data:
     name: nextcloud_aio_nextcloud_data
 
 networks:
-  default:
-    driver: bridge
+  nextcloud-aio:
+    name: nextcloud-aio

manual-install/readme.md

@@ -6,13 +6,11 @@ You can run the containers that are build for AIO with docker-compose. This come
 - You can run it without a container having access to the docker socket
 - You can modify all values on your own
 - You can run the containers with docker swarm
-- You can run this in environments where access to docker.io is not possible. See [this issue](https://github.com/nextcloud/all-in-one/discussions/5268).
 
 ### Disadvantages
 - You lose the AIO interface
 - You lose update notifications and automatic updates
 - You lose all AIO backup and restore features
-- You lose the built-in [Docker Socket Proxy container](https://github.com/nextcloud/docker-socket-proxy#readme) (needed for [Nextcloud App API](https://github.com/nextcloud/app_api#nextcloud-appapi))
 - You lose all community containers: https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers
 - **You need to know what you are doing, especially when modifying the compose.yaml file**
 - For updating, you need to strictly follow the at the bottom described update routine
@@ -25,7 +23,7 @@ git clone https://github.com/nextcloud/all-in-one.git
 cd all-in-one/manual-install
 ```
 Then copy the sample.conf to default environment file, e.g. `cp sample.conf .env`, open the new conf file, e.g. with `nano .env`, edit all values that are marked with `# TODO!`, close and save the file. (Note: there is no clamav image for arm64).<br>
-⚠️ **Warning**: Do not use the symbols `@` and `:` in your passwords. These symbols are used to build database connection strings. You will experience issues when using these symbols! Also please note that values inside the latest.yaml that are not exposed as variables are not officially supported to be changed. See for example [this report](https://github.com/nextcloud/all-in-one/issues/5612).
+⚠️ **Warning**: Do not use the symbols `@` and `:` in your passwords. These symbols are used to build database connection strings. You will experience issues when using these symbols!
 
 Now copy the provided yaml file to a compose.yaml file by running `cp latest.yml compose.yaml`.
 

manual-install/sample.conf

@@ -22,7 +22,7 @@ TALK_RECORDING_ENABLED="no"          # Setting this to "yes" (with quotes) enabl
 WHITEBOARD_ENABLED="no"          # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.
 
 APACHE_IP_BINDING=0.0.0.0          # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect
-APACHE_MAX_SIZE=17179869184          # This needs to be an integer and in sync with NEXTCLOUD_UPLOAD_LIMIT
+APACHE_MAX_SIZE=10737418240          # This needs to be an integer and in sync with NEXTCLOUD_UPLOAD_LIMIT
 APACHE_PORT=443          # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).
 COLLABORA_DICTIONARIES="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru"        # You can change this in order to enable other dictionaries for collabora
 COLLABORA_SECCOMP_POLICY=--o:security.seccomp=true          # Changing the value to false allows to disable the seccomp feature of the Collabora container.
@@ -35,7 +35,7 @@ NEXTCLOUD_MEMORY_LIMIT=512M          # This allows to change the PHP memory limi
 NEXTCLOUD_MOUNT=/mnt/          # This allows the Nextcloud container to access directories on the host. It must never be equal to the value of NEXTCLOUD_DATADIR!
 NEXTCLOUD_STARTUP_APPS="deck twofactor_totp tasks calendar contacts notes"        # Allows to modify the Nextcloud apps that are installed on starting AIO the first time
 NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates/my-custom-ca          # Nextcloud container will trust all the Certification Authorities, whose certificates are included in the given directory.
-NEXTCLOUD_UPLOAD_LIMIT=16G          # This allows to change the upload limit of the Nextcloud container
+NEXTCLOUD_UPLOAD_LIMIT=10G          # This allows to change the upload limit of the Nextcloud container
 REMOVE_DISABLED_APPS=yes        # Setting this to no keep Nextcloud apps that are disabled via their switch and not uninstall them if they should be installed in Nextcloud.
-TALK_PORT=3478          # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!
+TALK_PORT=3478          # This allows to adjust the port that the talk container is using.
 UPDATE_NEXTCLOUD_APPS="no"          # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.

manual-install/update-yaml.sh

@@ -1,6 +1,6 @@
-#!/bin/bash -ex
+#!/bin/bash
 
-type {jq,sudo} || { echo "Commands not found. Please install them"; exit 127; }
+set -ex
 
 jq -c . ./php/containers.json > /tmp/containers.json
 sed -i 's|aio_services_v1|services|g' /tmp/containers.json
@@ -14,14 +14,10 @@ cat /tmp/containers.json
 OUTPUT="$(cat /tmp/containers.json)"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].internal_port)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].secrets)')"
-OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].ui_secrets)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].devices)')"
-OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].enable_nvidia_gpu)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].backup_volumes)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].nextcloud_exec_commands)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].image_tag)')"
-OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].networks)')"
-OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[].documentation)')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-watchtower"))')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-domaincheck"))')"
 OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-borgbackup"))')"
@@ -29,7 +25,7 @@ OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "next
 OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-docker-socket-proxy"]) then del(.[index("nextcloud-aio-docker-socket-proxy")]) else . end else . end')"
 OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= map({ (.): { "condition": "service_started", "required": false } }) else . end' | jq '.services[] |= if has("depends_on") then .depends_on |= reduce .[] as $item ({}; . + $item) else . end')"
 
-sudo snap install yq
+snap install yq
 mkdir -p ./manual-install
 echo "$OUTPUT" | yq -P > ./manual-install/containers.yml
 
@@ -80,15 +76,15 @@ sed -i 's|COLLABORA_ENABLED=no|COLLABORA_ENABLED="yes"|' sample.conf
 sed -i 's|COLLABORA_DICTIONARIES=|COLLABORA_DICTIONARIES="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru"        # You can change this in order to enable other dictionaries for collabora|' sample.conf
 sed -i 's|NEXTCLOUD_DATADIR=|NEXTCLOUD_DATADIR=nextcloud_aio_nextcloud_data          # You can change this to e.g. "/mnt/ncdata" to map it to a location on your host. It needs to be adjusted before the first startup and never afterwards!|' sample.conf
 sed -i 's|NEXTCLOUD_MOUNT=|NEXTCLOUD_MOUNT=/mnt/          # This allows the Nextcloud container to access directories on the host. It must never be equal to the value of NEXTCLOUD_DATADIR!|' sample.conf
-sed -i 's|NEXTCLOUD_UPLOAD_LIMIT=|NEXTCLOUD_UPLOAD_LIMIT=16G          # This allows to change the upload limit of the Nextcloud container|' sample.conf
+sed -i 's|NEXTCLOUD_UPLOAD_LIMIT=|NEXTCLOUD_UPLOAD_LIMIT=10G          # This allows to change the upload limit of the Nextcloud container|' sample.conf
 sed -i 's|NEXTCLOUD_MEMORY_LIMIT=|NEXTCLOUD_MEMORY_LIMIT=512M          # This allows to change the PHP memory limit of the Nextcloud container|' sample.conf
-sed -i 's|APACHE_MAX_SIZE=|APACHE_MAX_SIZE=17179869184          # This needs to be an integer and in sync with NEXTCLOUD_UPLOAD_LIMIT|' sample.conf
+sed -i 's|APACHE_MAX_SIZE=|APACHE_MAX_SIZE=10737418240          # This needs to be an integer and in sync with NEXTCLOUD_UPLOAD_LIMIT|' sample.conf
 sed -i 's|NEXTCLOUD_MAX_TIME=|NEXTCLOUD_MAX_TIME=3600          # This allows to change the upload time limit of the Nextcloud container|' sample.conf
 sed -i 's|NEXTCLOUD_TRUSTED_CACERTS_DIR=|NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/local/share/ca-certificates/my-custom-ca          # Nextcloud container will trust all the Certification Authorities, whose certificates are included in the given directory.|' sample.conf
 sed -i 's|UPDATE_NEXTCLOUD_APPS=|UPDATE_NEXTCLOUD_APPS="no"          # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.|' sample.conf
 sed -i 's|APACHE_PORT=|APACHE_PORT=443          # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).|' sample.conf
 sed -i 's|APACHE_IP_BINDING=|APACHE_IP_BINDING=0.0.0.0          # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect|' sample.conf
-sed -i 's|TALK_PORT=|TALK_PORT=3478          # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!|' sample.conf
+sed -i 's|TALK_PORT=|TALK_PORT=3478          # This allows to adjust the port that the talk container is using.|' sample.conf
 sed -i 's|NC_DOMAIN=|NC_DOMAIN=yourdomain.com          # TODO! Needs to be changed to the domain that you want to use for Nextcloud.|' sample.conf
 sed -i 's|NEXTCLOUD_PASSWORD=|NEXTCLOUD_PASSWORD=          # TODO! This is the password of the initially created Nextcloud admin with username "admin".|' sample.conf
 sed -i 's|TIMEZONE=|TIMEZONE=Europe/Berlin          # TODO! This is the timezone that your containers will use.|' sample.conf
@@ -143,12 +139,13 @@ done
 cat << NETWORK >> containers.yml
 
 networks:
-  default:
-    driver: bridge
+  nextcloud-aio:
+    name: nextcloud-aio
 NETWORK
 
-mv containers.yml latest.yml
+cat containers.yml > latest.yml
 sed -i "/image:/s/$/:latest/" latest.yml
-sed -i 's/\( *- \(\w*\)\)=\${\2\}/\1/' latest.yml
+
+rm containers.yml
 
 set +ex

migration.md

@@ -1,6 +1,6 @@
 # How to migrate from an already existing Nextcloud installation to Nextcloud AIO?
 
-There are basically three ways how to migrate from an already existing Nextcloud installation to Nextcloud AIO (if you ran AIO on the former installation already, you can follow [these steps](https://github.com/nextcloud/all-in-one#how-to-migrate-from-aio-to-aio)):
+There are basically three ways how to migrate from an already existing Nextcloud installation to Nextcloud AIO:
 
 1. Migrate only the files which is the easiest way (this excludes all calendar data for example)
 1. Migrate the files and the database which is much more complicated (and doesn't work on former snap installations)
@@ -14,7 +14,7 @@ The procedure for migrating only the files works like this:
 1. Install Nextcloud AIO on a new server/linux installation, enter your domain and wait until all containers are running
 1. Recreate all users that were present on your former installation
 1. Take a backup using Nextcloud AIO's built-in backup solution (so that you can easily restore to this state again) (Note: this will stop all containers and is expected: don't start the container again at this point!)
-1. Restore the datadirectory of your former instance: for `/path/to/old/nextcloud/data/` run `sudo docker cp --follow-link /path/to/old/nextcloud/data/. nextcloud-aio-nextcloud:/mnt/ncdata/` Note: the `/.` and `/` at the end are necessary.
+1. Restore the datadirectory of your former instance: for `/path/to/nextcloud/data/` run `sudo docker cp --follow-link /path/to/nextcloud/data/. nextcloud-aio-nextcloud:/mnt/ncdata/` Note: the `/.` and `/` at the end are necessary.
 1. Next, run `sudo docker run --rm --volume nextcloud_aio_nextcloud_data:/mnt/ncdata:rw alpine chown -R 33:0 /mnt/ncdata/` and `sudo docker run --rm --volume nextcloud_aio_nextcloud_data:/mnt/ncdata:rw alpine chmod -R 750 /mnt/ncdata/` to apply the correct permissions. (Or if `NEXTCLOUD_DATADIR` was provided, apply `chown -R 33:0` and `chmod -R 750` to the chosen path.)
 1. Start the containers again and wait until all containers are running
 1. Run `sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ files:scan-app-data && sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ files:scan --all` in order to scan all files in the datadirectory.

nextcloud-aio-helm-chart/Chart.yaml

@@ -1,6 +1,6 @@
 name: nextcloud-aio-helm-chart
 description: A generated Helm Chart for Nextcloud AIO from Skippbox Kompose
-version: 10.4.0
+version: 9.6.0
 apiVersion: v2
 keywords:
   - latest

nextcloud-aio-helm-chart/readme.md

@@ -1,8 +1,5 @@
 # Nextcloud AIO Helm-chart
 
-> [!NOTE]
-> For an enterprise-ready and scalable deployment method based on Helm Charts (also available for Podman), please [contact Nextcloud GmbH](https://nextcloud.com/enterprise/).
-
 You can run the containers that are build for AIO with Kubernetes using this Helm chart. This comes with a few downsides, that are discussed below.
 
 ### Advantages

nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-deployment.yaml

@@ -2,7 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    kompose.version: 1.35.0 (9532ceef3)
+    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+    kompose.version: 1.34.0 (cbf2835db)
   labels:
     io.kompose.service: nextcloud-aio-apache
   name: nextcloud-aio-apache
@@ -17,22 +18,24 @@ spec:
   template:
     metadata:
       annotations:
-        kompose.version: 1.35.0 (9532ceef3)
+        kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+        kompose.version: 1.34.0 (cbf2835db)
       labels:
         io.kompose.service: nextcloud-aio-apache
     spec:
-      securityContext:
-        # The items below only work in pod context
-        fsGroup: 33
-        fsGroupChangePolicy: "OnRootMismatch"
-        # The items below work in both contexts
-        runAsUser: 33
-        runAsGroup: 33
-        runAsNonRoot: true
-        {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
-        seccompProfile:
-          type: RuntimeDefault
-        {{- end }}
+      initContainers:
+        - name: init-volumes
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.ALPINE_IMAGE_ORG }}alpine"
+          command:
+            - chmod
+            - "777"
+            - /nextcloud-aio-nextcloud
+            - /nextcloud-aio-apache
+          volumeMounts:
+            - name: nextcloud-aio-apache
+              mountPath: /nextcloud-aio-apache
+            - name: nextcloud-aio-nextcloud
+              mountPath: /nextcloud-aio-nextcloud
       containers:
         - env:
             - name: ADDITIONAL_TRUSTED_DOMAIN
@@ -61,21 +64,7 @@ spec:
               value: "{{ .Values.TIMEZONE }}"
             - name: WHITEBOARD_HOST
               value: nextcloud-aio-whiteboard
-          image: nextcloud/aio-apache:20250122_091948
-          readinessProbe:
-            exec:
-              command:
-                - /healthcheck.sh
-            failureThreshold: 3
-            periodSeconds: 30
-            timeoutSeconds: 30
-          livenessProbe:
-            exec:
-              command:
-                - /healthcheck.sh
-            failureThreshold: 3
-            periodSeconds: 30
-            timeoutSeconds: 30
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.NEXTCLOUD_IMAGE_ORG }}/aio-apache:20240925_080419"
           name: nextcloud-aio-apache
           ports:
             - containerPort: {{ .Values.APACHE_PORT }}
@@ -83,15 +72,9 @@ spec:
             - containerPort: {{ .Values.APACHE_PORT }}
               protocol: UDP
           securityContext:
-            # The items below only work in container context
-            allowPrivilegeEscalation: false
             capabilities:
-              {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
-              drop: ["ALL"]
-              {{- else }}
-              drop: ["NET_RAW"]
-              {{- end }}
-              add: ["NET_BIND_SERVICE"]
+              drop:
+                - NET_RAW
           volumeMounts:
             - mountPath: /var/www/html
               name: nextcloud-aio-nextcloud

nextcloud-aio-helm-chart/templates/nextcloud-aio-apache-service.yaml

@@ -2,7 +2,8 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    kompose.version: 1.35.0 (9532ceef3)
+    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+    kompose.version: 1.34.0 (cbf2835db)
   labels:
     io.kompose.service: nextcloud-aio-apache
   name: nextcloud-aio-apache

nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml

@@ -3,7 +3,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    kompose.version: 1.35.0 (9532ceef3)
+    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+    kompose.version: 1.34.0 (cbf2835db)
   labels:
     io.kompose.service: nextcloud-aio-clamav
   name: nextcloud-aio-clamav
@@ -18,41 +19,32 @@ spec:
   template:
     metadata:
       annotations:
-        kompose.version: 1.35.0 (9532ceef3)
+        kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+        kompose.version: 1.34.0 (cbf2835db)
       labels:
         io.kompose.service: nextcloud-aio-clamav
     spec:
-      securityContext:
-        # The items below only work in pod context
-        fsGroup: 100
-        fsGroupChangePolicy: "OnRootMismatch"
-        # The items below work in both contexts
-        runAsUser: 100
-        runAsGroup: 100
-        runAsNonRoot: true
-        {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
-        seccompProfile:
-          type: RuntimeDefault
-        {{- end }}
       initContainers:
         - name: init-subpath
-          image: "alpine:3.20"
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.ALPINE_IMAGE_ORG }}alpine"
           command:
             - mkdir
             - "-p"
             - /nextcloud-aio-clamav/data
+            - /nextcloud-aio-clamav
+          volumeMounts:
+            - name: nextcloud-aio-clamav
+              mountPath: /nextcloud-aio-clamav
+        - name: init-volumes
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.ALPINE_IMAGE_ORG }}alpine"
+          command:
+            - chown
+            - 100:100
+            - "-R"
+            - /nextcloud-aio-clamav
           volumeMounts:
             - name: nextcloud-aio-clamav
               mountPath: /nextcloud-aio-clamav
-          securityContext:
-            # The items below only work in container context
-            allowPrivilegeEscalation: false
-            capabilities:
-              {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
-              drop: ["ALL"]
-              {{- else }}
-              drop: ["NET_RAW"]
-              {{- end }}
       containers:
         - env:
             - name: CLAMD_STARTUP_TIMEOUT
@@ -61,36 +53,15 @@ spec:
               value: "{{ .Values.NEXTCLOUD_UPLOAD_LIMIT }}"
             - name: TZ
               value: "{{ .Values.TIMEZONE }}"
-          image: nextcloud/aio-clamav:20250122_091948
-          readinessProbe:
-            exec:
-              command:
-                - clamdcheck.sh
-            failureThreshold: 9
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 30
-          livenessProbe:
-            exec:
-              command:
-                - clamdcheck.sh
-            failureThreshold: 9
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 30
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.NEXTCLOUD_IMAGE_ORG }}/aio-clamav:20240925_080419"
           name: nextcloud-aio-clamav
           ports:
             - containerPort: 3310
               protocol: TCP
           securityContext:
-            # The items below only work in container context
-            allowPrivilegeEscalation: false
             capabilities:
-              {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
-              drop: ["ALL"]
-              {{- else }}
-              drop: ["NET_RAW"]
-              {{- end }}
+              drop:
+                - NET_RAW
           volumeMounts:
             - mountPath: /var/lib/clamav
               subPath: data

nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-service.yaml

@@ -3,7 +3,8 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    kompose.version: 1.35.0 (9532ceef3)
+    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+    kompose.version: 1.34.0 (cbf2835db)
   labels:
     io.kompose.service: nextcloud-aio-clamav
   name: nextcloud-aio-clamav

nextcloud-aio-helm-chart/templates/nextcloud-aio-collabora-deployment.yaml

@@ -3,7 +3,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    kompose.version: 1.35.0 (9532ceef3)
+    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+    kompose.version: 1.34.0 (cbf2835db)
   labels:
     io.kompose.service: nextcloud-aio-collabora
   name: nextcloud-aio-collabora
@@ -16,7 +17,8 @@ spec:
   template:
     metadata:
       annotations:
-        kompose.version: 1.35.0 (9532ceef3)
+        kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
+        kompose.version: 1.34.0 (cbf2835db)
       labels:
         io.kompose.service: nextcloud-aio-collabora
     spec:
@@ -31,26 +33,10 @@ spec:
             - name: dictionaries
               value: "{{ .Values.COLLABORA_DICTIONARIES }}"
             - name: extra_params
-              value: --o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:home_mode.enable=true {{ .Values.COLLABORA_SECCOMP_POLICY }} --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+
+              value: --o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:home_mode.enable=true {{ .Values.COLLABORA_SECCOMP_POLICY }} --o:remote_font_config.url=https://{{ .Values.NC_DOMAIN }}/apps/richdocuments/settings/fonts.json
             - name: server_name
               value: "{{ .Values.NC_DOMAIN }}"
-          image: nextcloud/aio-collabora:20250122_091948
-          readinessProbe:
-            exec:
-              command:
-                - /healthcheck.sh
-            failureThreshold: 9
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 30
-          livenessProbe:
-            exec:
-              command:
-                - /healthcheck.sh
-            failureThreshold: 9
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 30
+          image: "{{ .Values.IMAGE_MIRROR_PREFIX }}{{ .Values.NEXTCLOUD_IMAGE_ORG }}/aio-collabora:20240925_080419"
           name: nextcloud-aio-collabora
           ports:
             - containerPort: 9980
@@ -59,5 +45,7 @@ spec:
             capabilities:
               add:
                 - MKNOD
-                - CAP_SYS_ADMIN
+                - SYS_ADMIN
+              drop:
+                - NET_RAW
 {{- end }}