Skip to content
Commits on Source (63)
Hide whitespace changes
Inline Side-by-side
.gitignore
View file @ 33eb86ae
.env .env
data data
mysql mysql
\ No newline at end of file docker-compose.override.yml
Dockerfile deleted 100644 → 0
View file @ 8af9ec3c
FROM nextcloud:12-fpm
COPY mail.config.php /usr/src/nextcloud/config/
README.md
View file @ 33eb86ae
...@@ -2,43 +2,11 @@ ...@@ -2,43 +2,11 @@
A safe home for all your data. Access & share your files, calendars, contacts, mail & more from any device, on your terms. A safe home for all your data. Access & share your files, calendars, contacts, mail & more from any device, on your terms.
# How to use this image
The easiest is to use our `docker-compose.yml`.
Make sure you have [docker-compose](http://docs.docker.com/compose/install/) installed. And then:
```bash
git clone https://github.com/indiehosters/nextcloud.git
cd nextcloud
MYSQL_ROOT_PASSWORD=mystrongpassword docker-compose up
```
You can now access your instance on the port 80 of the IP of your machine (not recommended for production).
## Access it from Internet
We recommend the usage of TLS, so the easiest is to use a TLS capable reverse proxy.
Here are 2 examples:
- [haproxy](https://github.com/indiehosters/haproxy)
- [nginx](https://github.com/indiehosters/nginx)
You can also modify manually the nginx configuration file and map the TLS port of the host to the container.
## Installation ## Installation
Once started, you'll arrive at the configuration wizard. Once started with libre.sh , You get to the login screen , the password is generated in your env file
At the `Database Setup` step, please enter the following:
- Database Server: `db`
- Login: `root`
- Password: MYSQL_ROOT_PASSWORD
- Database Name: nextcloud (or you can choose)
And leave the rest as default.
Then you can continue the installation with the super user.
## Backup ## Backup
...@@ -48,4 +16,4 @@ In order to backup, just run the `./pre-backup` script. And copy all the data to ...@@ -48,4 +16,4 @@ In order to backup, just run the `./pre-backup` script. And copy all the data to
Pull requests are very welcome! Pull requests are very welcome!
We'd love to hear your feedback and suggestions in the issue tracker: [github.com/indiehosters/nextcloud/issues](https://github.com/indiehosters/nextcloud/issues). We'd love to hear your feedback and suggestions in the issue tracker: [https://lab.libreho.st/libre.sh/compose/nextcloud/issues](https://lab.libreho.st/libre.sh/compose/nextcloud/issues).
docker-compose.yml
View file @ 33eb86ae
version: '2' version: '2.4'
networks: networks:
lb_web: lb_web:
external: true external: true
...@@ -23,7 +23,7 @@ services: ...@@ -23,7 +23,7 @@ services:
- back - back
- lb_web - lb_web
app: app:
build: . image: libresh/nextcloud:${NEXTCLOUD_VERSION:-latest}
links: links:
- db - db
volumes: volumes:
...@@ -32,16 +32,25 @@ services: ...@@ -32,16 +32,25 @@ services:
- ./data/config:/var/www/html/config - ./data/config:/var/www/html/config
- ./data/data:/var/www/html/data - ./data/data:/var/www/html/data
environment: environment:
- MYSQL_DATABASE=nextcloud - SMTP_HOST
- MYSQL_HOST=db - SMTP_SECURE
- MYSQL_USER=root - SMTP_AUTHTYPE
- SMTP_PASSWORD
- SMTP_PORT
- SMTP_NAME
- URL
- MAIL_DOMAIN
- MYSQL_DATABASE
- MYSQL_HOST
- MYSQL_USER
- MYSQL_PASSWORD - MYSQL_PASSWORD
- NEXTCLOUD_ADMIN_USER
- NEXTCLOUD_ADMIN_PASSWORD - NEXTCLOUD_ADMIN_PASSWORD
- NEXTCLOUD_ADMIN_USER=indie - NEXTCLOUD_TRUSTED_DOMAINS
networks: networks:
- back - back
db: db:
image: mysql image: mariadb:${MYSQL_VERSION:-5.7}
volumes: volumes:
- ./mysql/runtime:/var/lib/mysql - ./mysql/runtime:/var/lib/mysql
environment: environment:
...@@ -49,7 +58,7 @@ services: ...@@ -49,7 +58,7 @@ services:
networks: networks:
- back - back
cron: cron:
image: nextcloud:12-fpm image: libresh/nextcloud:${NEXTCLOUD_VERSION:-latest}
links: links:
- db - db
volumes_from: volumes_from:
......
env-sample
View file @ 33eb86ae
MYSQL_ROOT_PASSWORD= MYSQL_ROOT_PASSWORD=
MYSQL_PASSWORD= MYSQL_PASSWORD=
NEXTCLOUD_ADMIN_PASSWORD=
SUBNET= SUBNET=
MAIL_DOMAIN=
URL=
MAIL_HOST=
MAIL_PORT=
MAIL_PASS=
MAIL_FROM=
SMTP_NAME=
NEXTCLOUD_ADMIN_USER=
NEXTCLOUD_ADMIN_PASSWORD=
nginx.conf
View file @ 33eb86ae
...@@ -12,15 +12,19 @@ http { ...@@ -12,15 +12,19 @@ http {
default_type application/octet-stream; default_type application/octet-stream;
server { server {
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
real_ip_header X-Forwarded-For;
listen 80; listen 80;
# Add headers to serve security related headers # Add headers to serve security related headers
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; add_header X-Robots-Tag none;
add_header X-Download-Options noopen; add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
root /var/www/html; root /var/www/html;
...@@ -31,37 +35,36 @@ http { ...@@ -31,37 +35,36 @@ http {
} }
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 https://$host/remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 https://$host/remote.php/dav;
} }
client_max_body_size 1G; client_max_body_size 16G;
fastcgi_buffers 64 4K; fastcgi_buffers 64 4K;
gzip off; gzip off; # handled at haproxy level
index index.php;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
location / { location / {
rewrite ^ /index.php$uri; rewrite ^ /index.php;
} }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all; deny all;
} }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all; deny all;
} }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) { location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
include fastcgi_params;
fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_split_path_info ^(.+\.php)(/.*)$;
try_files $fastcgi_script_name =404;
set $path_info $fastcgi_path_info;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on; fastcgi_param HTTPS on;
#Avoid sending the security headers twice #Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true; fastcgi_param modHeadersAvailable true;
...@@ -71,16 +74,16 @@ http { ...@@ -71,16 +74,16 @@ http {
fastcgi_request_buffering off; fastcgi_request_buffering off;
} }
location ~ ^/(?:updater|ocs-provider)(?:$|/) { location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404; try_files $uri/ =404;
index index.php; index index.php;
} }
# Adding the cache control header for js and css files # Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block # Make sure it is BELOW the PHP block
location ~* \.(?:css|js)$ { location ~ \.(?:css|js|woff2?|svg|gif|map|mjs)$ {
try_files $uri /index.php$uri$is_args$args; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=7200"; add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to # Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above) # have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into # Before enabling Strict-Transport-Security headers please read into
...@@ -93,12 +96,13 @@ http { ...@@ -93,12 +96,13 @@ http {
add_header X-Robots-Tag none; add_header X-Robots-Tag none;
add_header X-Download-Options noopen; add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none; add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
# Optional: Don't log access to assets # Optional: Don't log access to assets
access_log off; access_log off;
} }
location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ { location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$uri$is_args$args; try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets # Optional: Don't log access to other assets
access_log off; access_log off;
} }
......
scripts/install
View file @ 33eb86ae
#!/bin/bash -eux #!/bin/bash -eux
source /etc/environment
NEXTCLOUD_VERSION=24-fpm-eki
MYSQL_ROOT_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs` MYSQL_ROOT_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs`
NEXTCLOUD_ADMIN_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs` NEXTCLOUD_ADMIN_PASSWORD=`tr -dc A-Za-z0-9_ < /dev/urandom | head -c 20 | xargs`
var=$(for folder in `ls /data/domains`; do cat /data/domains/$folder/.env | grep SUBNET | cut -d"=" -f2; done | sort | tail -n1)
var=$(for folder in `ls /data/domains`; do cat /data/domains/$folder/.env | grep SUBNET | cut -d"=" -f2; done | sort -n | tail -n1)
SUBNET=$(($var +1)) SUBNET=$(($var +1))
echo "MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}" > .env
echo "MYSQL_PASSWORD=${MYSQL_ROOT_PASSWORD}" >> .env
echo "NEXTCLOUD_ADMIN_PASSWORD={NEXTCLOUD_ADMIN_PASSWORD}" >> .env
echo "SUBNET=${SUBNET}" >> .env echo "SUBNET=${SUBNET}" >> .env
cat > mail.config.php <<EOF echo "URL=${URL}" >> .env
<?php
\$CONFIG = array ( #echo "VIRTUAL_HOST=${URL}" >> .env
'mail_domain' => '${MAIL_DOMAIN}',
'mail_from_address' => 'noreply.${URL}', echo "MAIL_DOMAIN=${MAIL_DOMAIN}" >> .env
'mail_smtpmode' => 'smtp', echo "SMTP_HOST=${MAIL_HOST}" >> .env
'mail_smtphost' => '${MAIL_HOST}', echo "SMTP_PORT=${MAIL_PORT}" >> .env
'mail_smtpport' => '${MAIL_PORT}', echo "SMTP_PASSWORD=${MAIL_PASS}" >> .env
'mail_smtpauth' => 1, echo "MAIL_FROM_ADDRESS=${MAIL_USER}" >> .env
'mail_smtpauthtype' => 'LOGIN', echo "SMTP_NAME=${MAIL_USER}" >> .env
'mail_smtpname' => 'noreply.${URL}@${MAIL_DOMAIN}', echo "SMTP_SECURE=ssl" >> .env
'mail_smtppassword' => '${MAIL_PASS}',
'mail_smtpsecure' => 'tls', echo "NEXTCLOUD_ADMIN_USER=admin" >> .env
); echo "NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}" >> .env
EOF echo "NEXTCLOUD_TRUSTED_DOMAINS=${URL}" >> .env
echo "NEXTCLOUD_VERSION=${NEXTCLOUD_VERSION}" >> .env
echo "MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}" >> .env
echo "MYSQL_PASSWORD=${MYSQL_ROOT_PASSWORD}" >> .env
echo "MYSQL_USER=root" >> .env
echo "MYSQL_DATABASE=nextcloud" >> .env
echo "MYSQL_HOST=db" >> .env
echo "MYSQL_VERSION=10.5" >> .env
scripts/pre-backup
View file @ 33eb86ae
#!/bin/bash -eux #!/bin/bash -eux
URL=${PWD##*/}
db_container_name=`echo ${URL}_db_1 | sed "s/\.//g" | sed "s/-//g"`; \
docker exec $db_container_name bash -c 'mysqldump --all-databases --events -uroot -p$MYSQL_ROOT_PASSWORD' > ./mysql/dump.sql docker-compose exec -T db bash -c 'mysqldump --all-databases --events -uroot -p$MYSQL_ROOT_PASSWORD' > ./mysql/dump.sql