diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.env diff --git a/db/init/01-databases.sql b/db/init/01-databases.sql new file mode 100644 index 0000000..cb76f85 --- /dev/null +++ b/db/init/01-databases.sql @@ -0,0 +1,7 @@ +CREATE DATABASE IF NOT EXISTS `monica`; +# Nextcloud will automatically create a database on setup +#CREATE DATABASE IF NOT EXISTS `nextcloud`; + +GRANT ALL PRIVILEGES ON *.* TO 'chris'@'%'; +GRANT ALL ON `nextcloud`.* TO 'chris'@'%' ; +GRANT ALL PRIVILEGES ON *.* TO 'root'@'%'; diff --git a/docker-compose.yml b/docker-compose.yml index 9ba1f78..90371ef 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,6 +5,15 @@ services: build: ./monica image: monica env_file: ./monica/.env + environment: + - APP_URL=https://personel.${DOMAIN} + - DB_PASSWORD=${DB_PASSWORD} + - DB_USERNAME=${DB_USER} + - MAIL_FROM_ADDRESS=${MAIL_FROM} + - MAIL_HOST=${MAIL_HOST} + - MAIL_PORT=${MAIL_PORT} + - MAIL_USERNAME=${MAIL_USER} + - MAIL_PASSWORD=${MAIL_PASSWORD} volumes: - monica-data:/var/www/html/storage - monica-public:/var/www/html/public @@ -12,15 +21,44 @@ services: depends_on: - db + nextcloud: + build: ./nextcloud + image: nextcloud + restart: always + volumes: + - nextcloud:/var/www/html + environment: + - REDIS_HOST=redis + - MYSQL_HOST=db + - MYSQL_PASSWORD=${DB_PASSWORD} + - MYSQL_DATABASE=nextcloud + - MYSQL_USER=${DB_USER} + - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD} + - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER} + - MAIL_FROM=${MAIL_FROM} + - MAIL_HOST=${MAIL_HOST} + - MAIL_PORT=${MAIL_PORT} + - MAIL_USER=${MAIL_USER} + - MAIL_PASSWORD=${MAIL_PASSWORD} + - NEXTCLOUD_TRUSTED_DOMAINS=tower.${DOMAIN} + depends_on: + - db + - redis + db: image: mariadb + command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW environment: - - MYSQL_ROOT_PASSWORD=secret - - MYSQL_DATABASE=monica - - MYSQL_USER=homestead - - MYSQL_PASSWORD=secret + - MYSQL_ROOT_PASSWORD=${DB_PASSWORD} + - MYSQL_USER=${DB_USER} + - MYSQL_PASSWORD=${DB_PASSWORD} volumes: - db:/var/lib/mysql + - ./db/init:/docker-entrypoint-initdb.d + restart: always + + redis: + image: redis:alpine restart: always nginx: @@ -31,29 +69,44 @@ services: - ./nginx.conf:/etc/nginx/nginx.conf - monica-public:/var/www/html/monica/public:ro - monica-data:/var/www/html/monica/storage:ro + - nextcloud:/var/www/html/nextcloud:ro depends_on: - monica + - nextcloud ports: - 80:80 - 443:443 depends_on: - - omgwtfssl + - omgwtfssl-monica + - omgwtfssl-nextcloud - omgwtfssl: + omgwtfssl-monica: image: paulczar/omgwtfssl restart: "no" volumes: - certs:/certs environment: - - SSL_SUBJECT=personel.scarif.local - - CA_SUBJECT=chris@scarif.local - - SSL_KEY=/certs/personel.scarif.local.key - - SSL_CSR=/certs/personel.scarif.local.csr - - SSL_CERT=/certs/personel.scarif.local.crt + - SSL_SUBJECT=personel.${DOMAIN} + - CA_SUBJECT=chris@${DOMAIN} + - SSL_KEY=/certs/personel.${DOMAIN}.key + - SSL_CSR=/certs/personel.${DOMAIN}.csr + - SSL_CERT=/certs/personel.${DOMAIN}.crt + + omgwtfssl-nextcloud: + image: paulczar/omgwtfssl + restart: "no" + volumes: + - certs:/certs + environment: + - SSL_SUBJECT=tower.${DOMAIN} + - CA_SUBJECT=chris@${DOMAIN} + - SSL_KEY=/certs/tower.${DOMAIN}.key + - SSL_CSR=/certs/tower.${DOMAIN}.csr + - SSL_CERT=/certs/tower.${DOMAIN}.crt volumes: db: - certs: monica-public: monica-data: - + nextcloud: + certs: diff --git a/monica/.env b/monica/.env index 1bc32ae..3bd6ee0 100644 --- a/monica/.env +++ b/monica/.env @@ -22,7 +22,7 @@ HASH_SALT=YIfc5Go7H1TNxwnS7Uza HASH_LENGTH=18 # The URL of your application. -APP_URL=https://personel.scarif.local +#APP_URL= # Force using APP_URL as base url of your application. # You should not need this, unless you are using subdirectory config. @@ -37,8 +37,8 @@ DB_PORT=3306 # You can use mysql unix socket if available, it overrides DB_HOST and DB_PORT values. #DB_UNIX_SOCKET=/var/run/mysqld/mysqld.sock DB_DATABASE=monica -DB_USERNAME=chris -DB_PASSWORD=secret +#DB_USERNAME= +#DB_PASSWORD= DB_PREFIX= DB_TEST_HOST=127.0.0.1 DB_TEST_DATABASE=monica_test @@ -51,13 +51,13 @@ DB_USE_UTF8MB4=true # Mail credentials used to send emails from the application. MAIL_MAILER=smtp -MAIL_HOST=smtp.mailtrap.io -MAIL_PORT=2525 -MAIL_USERNAME=f41fa47f889c25 -MAIL_PASSWORD=9a13972ad70a6a -MAIL_ENCRYPTION= +#MAIL_HOST= +#MAIL_PORT= +#MAIL_USERNAME= +#MAIL_PASSWORD= +MAIL_ENCRYPTION=ssl # Outgoing emails will be sent with these identity -MAIL_FROM_ADDRESS=chris@scarif.local +#MAIL_FROM_ADDRESS= MAIL_FROM_NAME="Scarif" # New registration notification sent to this email APP_EMAIL_NEW_USERS_NOTIFICATION= diff --git a/monica/entrypoint.sh b/monica/entrypoint.sh index 3d390de..29c5eb0 100644 --- a/monica/entrypoint.sh +++ b/monica/entrypoint.sh @@ -26,7 +26,7 @@ waitfordb() { sleep 3 } -if expr "$1" : "apache" 1>/dev/null || [ "$1" = "php-fpm" ]; then +if [ "$1" = "/init" ]; then MONICADIR=/var/www/html ARTISAN="php ${MONICADIR}/artisan" diff --git a/nextcloud/Dockerfile b/nextcloud/Dockerfile new file mode 100644 index 0000000..0b6e32d --- /dev/null +++ b/nextcloud/Dockerfile @@ -0,0 +1,46 @@ +FROM nextcloud:fpm-alpine + +RUN set -ex; \ + \ + apk add --no-cache \ + ffmpeg \ + imagemagick \ + procps \ + supervisor \ + libreoffice \ + ; + +RUN set -ex; \ + \ + apk add --no-cache --virtual .build-deps \ + $PHPIZE_DEPS \ + krb5-dev \ + openssl-dev \ + bzip2-dev \ + ; \ + \ + docker-php-ext-install \ + bz2 \ + ; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --virtual .nextcloud-phpext-rundeps $runDeps; \ + apk del .build-deps + +RUN mkdir -p \ + /var/log/supervisord \ + /var/run/supervisord \ +; + +COPY --chown=www-data:root config /var/www/html/config + +COPY supervisord.conf / + +ENV NEXTCLOUD_UPDATE=1 + +CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"] diff --git a/nextcloud/config/CAN_INSTALL b/nextcloud/config/CAN_INSTALL new file mode 100755 index 0000000..e69de29 diff --git a/nextcloud/config/config.backup.php b/nextcloud/config/config.backup.php new file mode 100755 index 0000000..ecccbc1 --- /dev/null +++ b/nextcloud/config/config.backup.php @@ -0,0 +1,168 @@ + is deprecated + */ +'trusted_domains' => + [ + 'tower.scarif.local', + ], + +/** + * Identifies the database used with this installation. See also config option + * ``supportedDatabases`` + * + * Available: + * - sqlite3 (SQLite3) + * - mysql (MySQL/MariaDB) + * - pgsql (PostgreSQL) + * + * Defaults to ``sqlite3`` + */ +'dbtype' => 'mysql', + +/** + * Your host server name, for example ``localhost``, ``hostname``, + * ``hostname.example.com``, or the IP address. To specify a port use + * ``hostname:####``; to specify a Unix socket use + * ``localhost:/path/to/socket``. + */ +'dbhost' => getenv('MYSQL_HOST'), + +/** + * The name of the Nextcloud database, which is set during installation. You + * should not need to change this. + */ +'dbname' => getenv('MYSQL_DATABASE'), + +/** + * The user that Nextcloud uses to write to the database. This must be unique + * across Nextcloud instances using the same SQL database. This is set up during + * installation, so you shouldn't need to change it. + */ +'dbuser' => getenv('MYSQL_USER'), + +/** + * The password for the database user. This is set up during installation, so + * you shouldn't need to change it. + */ +'dbpassword' => getenv('MYSQL_PASSWORD'), + +/** + * Mail Parameters + * + * These configure the email settings for Nextcloud notifications and password + * resets. + */ + +/** + * The return address that you want to appear on emails sent by the Nextcloud + * server, for example ``nc-admin@example.com``, substituting your own domain, + * of course. + */ +'mail_domain' => getenv('MAIL_FROM'), + +/** + * This depends on ``mail_smtpmode``. Specify the IP address of your mail + * server host. This may contain multiple hosts separated by a semi-colon. If + * you need to specify the port number append it to the IP address separated by + * a colon, like this: ``127.0.0.1:24``. + * + * Defaults to ``127.0.0.1`` + */ +'mail_smtphost' => getenv('MAIL_HOST'), + +/** + * This depends on ``mail_smtpmode``. Specify the port for sending mail. + * + * Defaults to ``25`` + */ +'mail_smtpport' => getenv('MAIL_PORT'), + +/** + * This depends on ``mail_smtpmode``. Specify when you are using ``ssl`` for SSL/TLS or + * ``tls`` for STARTTLS, or leave empty for no encryption. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpsecure' => 'ssl', + +/** + * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail + * server requires authentication. + * + * Defaults to ``false`` + */ +'mail_smtpauth' => true, + +/** + * This depends on ``mail_smtpmode``. If SMTP authentication is required, choose + * the authentication type as ``LOGIN`` or ``PLAIN``. + * + * Defaults to ``LOGIN`` + */ +'mail_smtpauthtype' => 'LOGIN', + +/** + * This depends on ``mail_smtpauth``. Specify the username for authenticating to + * the SMTP server. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpname' => getenv('MAIL_USER'), + +/** + * This depends on ``mail_smtpauth``. Specify the password for authenticating to + * the SMTP server. + * + * Default to ``''`` (empty string) + */ +'mail_smtppassword' => getenv('MAIL_PASSWORD'), + +/** + * Memory caching backend configuration + * + * Available cache backends: + * + * * ``\OC\Memcache\APCu`` APC user backend + * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended) + * * ``\OC\Memcache\Memcached`` Memcached backend + * * ``\OC\Memcache\Redis`` Redis backend + * + * Advice on choosing between the various backends: + * + * * APCu should be easiest to install. Almost all distributions have packages. + * Use this for single user environment for all caches. + * * Use Redis or Memcached for distributed environments. + * For the local cache (you can configure two) take APCu. + */ + +/** + * Connection details for redis to use for memory caching in a single server configuration. + * + * For enhanced security it is recommended to configure Redis + * to require a password. See http://redis.io/topics/security + * for more information. + */ +'redis' => [ + 'host' => 'localhost', // can also be a unix domain socket: '/tmp/redis.sock' + 'port' => 6379, + 'timeout' => 0.0, + 'password' => '', // Optional, if not defined no password will be used. + 'dbindex' => 0, // Optional, if undefined SELECT will not run and will use Redis Server's default DB Index. +], +]; + diff --git a/nextcloud/config/config.php b/nextcloud/config/config.php new file mode 100755 index 0000000..ecccbc1 --- /dev/null +++ b/nextcloud/config/config.php @@ -0,0 +1,168 @@ + is deprecated + */ +'trusted_domains' => + [ + 'tower.scarif.local', + ], + +/** + * Identifies the database used with this installation. See also config option + * ``supportedDatabases`` + * + * Available: + * - sqlite3 (SQLite3) + * - mysql (MySQL/MariaDB) + * - pgsql (PostgreSQL) + * + * Defaults to ``sqlite3`` + */ +'dbtype' => 'mysql', + +/** + * Your host server name, for example ``localhost``, ``hostname``, + * ``hostname.example.com``, or the IP address. To specify a port use + * ``hostname:####``; to specify a Unix socket use + * ``localhost:/path/to/socket``. + */ +'dbhost' => getenv('MYSQL_HOST'), + +/** + * The name of the Nextcloud database, which is set during installation. You + * should not need to change this. + */ +'dbname' => getenv('MYSQL_DATABASE'), + +/** + * The user that Nextcloud uses to write to the database. This must be unique + * across Nextcloud instances using the same SQL database. This is set up during + * installation, so you shouldn't need to change it. + */ +'dbuser' => getenv('MYSQL_USER'), + +/** + * The password for the database user. This is set up during installation, so + * you shouldn't need to change it. + */ +'dbpassword' => getenv('MYSQL_PASSWORD'), + +/** + * Mail Parameters + * + * These configure the email settings for Nextcloud notifications and password + * resets. + */ + +/** + * The return address that you want to appear on emails sent by the Nextcloud + * server, for example ``nc-admin@example.com``, substituting your own domain, + * of course. + */ +'mail_domain' => getenv('MAIL_FROM'), + +/** + * This depends on ``mail_smtpmode``. Specify the IP address of your mail + * server host. This may contain multiple hosts separated by a semi-colon. If + * you need to specify the port number append it to the IP address separated by + * a colon, like this: ``127.0.0.1:24``. + * + * Defaults to ``127.0.0.1`` + */ +'mail_smtphost' => getenv('MAIL_HOST'), + +/** + * This depends on ``mail_smtpmode``. Specify the port for sending mail. + * + * Defaults to ``25`` + */ +'mail_smtpport' => getenv('MAIL_PORT'), + +/** + * This depends on ``mail_smtpmode``. Specify when you are using ``ssl`` for SSL/TLS or + * ``tls`` for STARTTLS, or leave empty for no encryption. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpsecure' => 'ssl', + +/** + * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail + * server requires authentication. + * + * Defaults to ``false`` + */ +'mail_smtpauth' => true, + +/** + * This depends on ``mail_smtpmode``. If SMTP authentication is required, choose + * the authentication type as ``LOGIN`` or ``PLAIN``. + * + * Defaults to ``LOGIN`` + */ +'mail_smtpauthtype' => 'LOGIN', + +/** + * This depends on ``mail_smtpauth``. Specify the username for authenticating to + * the SMTP server. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpname' => getenv('MAIL_USER'), + +/** + * This depends on ``mail_smtpauth``. Specify the password for authenticating to + * the SMTP server. + * + * Default to ``''`` (empty string) + */ +'mail_smtppassword' => getenv('MAIL_PASSWORD'), + +/** + * Memory caching backend configuration + * + * Available cache backends: + * + * * ``\OC\Memcache\APCu`` APC user backend + * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended) + * * ``\OC\Memcache\Memcached`` Memcached backend + * * ``\OC\Memcache\Redis`` Redis backend + * + * Advice on choosing between the various backends: + * + * * APCu should be easiest to install. Almost all distributions have packages. + * Use this for single user environment for all caches. + * * Use Redis or Memcached for distributed environments. + * For the local cache (you can configure two) take APCu. + */ + +/** + * Connection details for redis to use for memory caching in a single server configuration. + * + * For enhanced security it is recommended to configure Redis + * to require a password. See http://redis.io/topics/security + * for more information. + */ +'redis' => [ + 'host' => 'localhost', // can also be a unix domain socket: '/tmp/redis.sock' + 'port' => 6379, + 'timeout' => 0.0, + 'password' => '', // Optional, if not defined no password will be used. + 'dbindex' => 0, // Optional, if undefined SELECT will not run and will use Redis Server's default DB Index. +], +]; + diff --git a/nextcloud/config/config.sample.php b/nextcloud/config/config.sample.php new file mode 100755 index 0000000..a12150f --- /dev/null +++ b/nextcloud/config/config.sample.php @@ -0,0 +1,1851 @@ + 'd3c944a9a', + */ +'instanceid' => '', + + /** + * The salt used to hash all passwords, auto-generated by the Nextcloud + * installer. (There are also per-user salts.) If you lose this salt you lose + * all your passwords. This example is for documentation only, and you should + * never use it. + * + * @deprecated This salt is deprecated and only used for legacy-compatibility, + * developers should *NOT* use this value for anything nowadays. + * + * 'passwordsalt' => 'd3c944a9af095aa08f', + */ +'passwordsalt' => '', + +/** + * Your list of trusted domains that users can log into. Specifying trusted + * domains prevents host header poisoning. Do not remove this, as it performs + * necessary security checks. + * You can specify: + * + * - the exact hostname of your host or virtual host, e.g. demo.example.org. + * - the exact hostname with permitted port, e.g. demo.example.org:443. + * This disallows all other ports on this host + * - use * as a wildcard, e.g. ubos-raspberry-pi*.local will allow + * ubos-raspberry-pi.local and ubos-raspberry-pi-2.local + * - the IP address with or without permitted port, e.g. [2001:db8::1]:8080 + * Using TLS certificates where commonName= is deprecated + */ +'trusted_domains' => + [ + 'demo.example.org', + 'otherdomain.example.org', + '10.111.112.113', + '[2001:db8::1]' + ], + + +/** + * Where user files are stored. The SQLite database is also stored here, when + * you use SQLite. + * + * Default to ``data/`` in the Nextcloud directory. + */ +'datadirectory' => '/var/www/nextcloud/data', + +/** + * The current version number of your Nextcloud installation. This is set up + * during installation and update, so you shouldn't need to change it. + */ +'version' => '', + +/** + * Identifies the database used with this installation. See also config option + * ``supportedDatabases`` + * + * Available: + * - sqlite3 (SQLite3) + * - mysql (MySQL/MariaDB) + * - pgsql (PostgreSQL) + * + * Defaults to ``sqlite3`` + */ +'dbtype' => 'sqlite3', + +/** + * Your host server name, for example ``localhost``, ``hostname``, + * ``hostname.example.com``, or the IP address. To specify a port use + * ``hostname:####``; to specify a Unix socket use + * ``localhost:/path/to/socket``. + */ +'dbhost' => '', + +/** + * The name of the Nextcloud database, which is set during installation. You + * should not need to change this. + */ +'dbname' => 'nextcloud', + +/** + * The user that Nextcloud uses to write to the database. This must be unique + * across Nextcloud instances using the same SQL database. This is set up during + * installation, so you shouldn't need to change it. + */ +'dbuser' => '', + +/** + * The password for the database user. This is set up during installation, so + * you shouldn't need to change it. + */ +'dbpassword' => '', + +/** + * Prefix for the Nextcloud tables in the database. + * + * Default to ``oc_`` + */ +'dbtableprefix' => '', + + +/** + * Indicates whether the Nextcloud instance was installed successfully; ``true`` + * indicates a successful installation, and ``false`` indicates an unsuccessful + * installation. + * + * Defaults to ``false`` + */ +'installed' => false, + + +/** + * User Experience + * + * These optional parameters control some aspects of the user interface. Default + * values, where present, are shown. + */ + +/** + * This sets the default language on your Nextcloud server, using ISO_639-1 + * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for + * French. It overrides automatic language detection on public pages like login + * or shared items. User's language preferences configured under "personal -> + * language" override this setting after they have logged in. Nextcloud has two + * distinguished language codes for German, 'de' and 'de_DE'. 'de' is used for + * informal German and 'de_DE' for formal German. By setting this value to 'de_DE' + * you can enforce the formal version of German unless the user has chosen + * something different explicitly. + * + * Defaults to ``en`` + */ +'default_language' => 'en', + +/** + * With this setting a language can be forced for all users. If a language is + * forced, the users are also unable to change their language in the personal + * settings. If users shall be unable to change their language, but users have + * different languages, this value can be set to ``true`` instead of a language + * code. + * + * Defaults to ``false`` + */ +'force_language' => 'en', + +/** + * This sets the default locale on your Nextcloud server, using ISO_639 + * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for + * French, and ISO-3166 country codes such as ``GB``, ``US``, ``CA``, as defined + * in RFC 5646. It overrides automatic locale detection on public pages like + * login or shared items. User's locale preferences configured under "personal + * -> locale" override this setting after they have logged in. + * + * Defaults to ``en`` + */ +'default_locale' => 'en_US', + +/** + * With this setting a locale can be forced for all users. If a locale is + * forced, the users are also unable to change their locale in the personal + * settings. If users shall be unable to change their locale, but users have + * different languages, this value can be set to ``true`` instead of a locale + * code. + * + * Defaults to ``false`` + */ +'force_locale' => 'en_US', + +/** + * Set the default app to open on login. Use the app names as they appear in the + * URL after clicking them in the Apps menu, such as documents, calendar, and + * gallery. You can use a comma-separated list of app names, so if the first + * app is not enabled for a user then Nextcloud will try the second one, and so + * on. If no enabled apps are found it defaults to the Files app. + * + * Defaults to ``files`` + */ +'defaultapp' => 'files', + +/** + * ``true`` enables the Help menu item in the user menu (top right of the + * Nextcloud Web interface). ``false`` removes the Help item. + */ +'knowledgebaseenabled' => true, + +/** + * ``true`` allows users to change their display names (on their Personal + * pages), and ``false`` prevents them from changing their display names. + */ +'allow_user_to_change_display_name' => true, + +/** + * Lifetime of the remember login cookie. This should be larger than the + * session_lifetime. If it is set to 0 remember me is disabled. + * + * Defaults to ``60*60*24*15`` seconds (15 days) + */ +'remember_login_cookie_lifetime' => 60*60*24*15, + +/** + * The lifetime of a session after inactivity. + * + * Defaults to ``60*60*24`` seconds (24 hours) + */ +'session_lifetime' => 60 * 60 * 24, + +/** + * Enable or disable session keep-alive when a user is logged in to the Web UI. + * Enabling this sends a "heartbeat" to the server to keep it from timing out. + * + * Defaults to ``true`` + */ +'session_keepalive' => true, + +/** + * Enable or disable the automatic logout after session_lifetime, even if session + * keepalive is enabled. This will make sure that an inactive browser will be logged out + * even if requests to the server might extend the session lifetime. + * + * Defaults to ``false`` + */ +'auto_logout' => false, + +/** + * Enforce token authentication for clients, which blocks requests using the user + * password for enhanced security. Users need to generate tokens in personal settings + * which can be used as passwords on their clients. + * + * Defaults to ``false`` + */ +'token_auth_enforced' => false, + +/** + * The interval at which token activity should be updated. + * Increasing this value means that the last activty on the security page gets + * more outdated. + * + * Tokens are still checked every 5 minutes for validity + * max value: 300 + * + * Defaults to ``300`` + */ +'token_auth_activity_update' => 60, + +/** + * Whether the bruteforce protection shipped with Nextcloud should be enabled or not. + * + * Disabling this is discouraged for security reasons. + * + * Defaults to ``true`` + */ +'auth.bruteforce.protection.enabled' => true, + +/** + * By default WebAuthn is available but it can be explicitly disabled by admins + */ +'auth.webauthn.enabled' => true, + +/** + * The directory where the skeleton files are located. These files will be + * copied to the data directory of new users. Leave empty to not copy any + * skeleton files. + * ``{lang}`` can be used as a placeholder for the language of the user. + * If the directory does not exist, it falls back to non dialect (from ``de_DE`` + * to ``de``). If that does not exist either, it falls back to ``default`` + * + * Defaults to ``core/skeleton`` in the Nextcloud directory. + */ +'skeletondirectory' => '/path/to/nextcloud/core/skeleton', + +/** + * If your user backend does not allow password resets (e.g. when it's a + * read-only user backend like LDAP), you can specify a custom link, where the + * user is redirected to, when clicking the "reset password" link after a failed + * login-attempt. + * In case you do not want to provide any link, replace the url with 'disabled' + */ +'lost_password_link' => 'https://example.org/link/to/password/reset', + +/** + * Mail Parameters + * + * These configure the email settings for Nextcloud notifications and password + * resets. + */ + +/** + * The return address that you want to appear on emails sent by the Nextcloud + * server, for example ``nc-admin@example.com``, substituting your own domain, + * of course. + */ +'mail_domain' => 'example.com', + +/** + * FROM address that overrides the built-in ``sharing-noreply`` and + * ``lostpassword-noreply`` FROM addresses. + * + * Defaults to different from addresses depending on the feature. + */ +'mail_from_address' => 'nextcloud', + +/** + * Enable SMTP class debugging. + * + * Defaults to ``false`` + */ +'mail_smtpdebug' => false, + +/** + * Which mode to use for sending mail: ``sendmail``, ``smtp`` or ``qmail``. + * + * If you are using local or remote SMTP, set this to ``smtp``. + * + * For the ``sendmail`` option you need an installed and working email system on + * the server, with ``/usr/sbin/sendmail`` installed on your Unix system. + * + * For ``qmail`` the binary is /var/qmail/bin/sendmail, and it must be installed + * on your Unix system. + * + * Defaults to ``smtp`` + */ +'mail_smtpmode' => 'smtp', + +/** + * This depends on ``mail_smtpmode``. Specify the IP address of your mail + * server host. This may contain multiple hosts separated by a semi-colon. If + * you need to specify the port number append it to the IP address separated by + * a colon, like this: ``127.0.0.1:24``. + * + * Defaults to ``127.0.0.1`` + */ +'mail_smtphost' => '127.0.0.1', + +/** + * This depends on ``mail_smtpmode``. Specify the port for sending mail. + * + * Defaults to ``25`` + */ +'mail_smtpport' => 25, + +/** + * This depends on ``mail_smtpmode``. This sets the SMTP server timeout, in + * seconds. You may need to increase this if you are running an anti-malware or + * spam scanner. + * + * Defaults to ``10`` seconds + */ +'mail_smtptimeout' => 10, + +/** + * This depends on ``mail_smtpmode``. Specify when you are using ``ssl`` for SSL/TLS or + * ``tls`` for STARTTLS, or leave empty for no encryption. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpsecure' => '', + +/** + * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail + * server requires authentication. + * + * Defaults to ``false`` + */ +'mail_smtpauth' => false, + +/** + * This depends on ``mail_smtpmode``. If SMTP authentication is required, choose + * the authentication type as ``LOGIN`` or ``PLAIN``. + * + * Defaults to ``LOGIN`` + */ +'mail_smtpauthtype' => 'LOGIN', + +/** + * This depends on ``mail_smtpauth``. Specify the username for authenticating to + * the SMTP server. + * + * Defaults to ``''`` (empty string) + */ +'mail_smtpname' => '', + +/** + * This depends on ``mail_smtpauth``. Specify the password for authenticating to + * the SMTP server. + * + * Default to ``''`` (empty string) + */ +'mail_smtppassword' => '', + +/** + * Replaces the default mail template layout. This can be utilized if the + * options to modify the mail texts with the theming app is not enough. + * The class must extend ``\OC\Mail\EMailTemplate`` + */ +'mail_template_class' => '\OC\Mail\EMailTemplate', + +/** + * Email will be send by default with an HTML and a plain text body. This option + * allows to only send plain text emails. + */ +'mail_send_plaintext_only' => false, + +/** + * This depends on ``mail_smtpmode``. Array of additional streams options that + * will be passed to underlying Swift mailer implementation. + * Defaults to an empty array. + */ +'mail_smtpstreamoptions' => [], + +/** + * Which mode is used for sendmail/qmail: ``smtp`` or ``pipe``. + * + * For ``smtp`` the sendmail binary is started with the parameter ``-bs``: + * - Use the SMTP protocol on standard input and output. + * + * For ``pipe`` the binary is started with the parameters ``-t``: + * - Read message from STDIN and extract recipients. + * + * Defaults to ``smtp`` + */ +'mail_sendmailmode' => 'smtp', + +/** + * Proxy Configurations + */ + +/** + * The automatic hostname detection of Nextcloud can fail in certain reverse + * proxy and CLI/cron situations. This option allows you to manually override + * the automatic detection; for example ``www.example.com``, or specify the port + * ``www.example.com:8080``. + */ +'overwritehost' => '', + +/** + * When generating URLs, Nextcloud attempts to detect whether the server is + * accessed via ``https`` or ``http``. However, if Nextcloud is behind a proxy + * and the proxy handles the ``https`` calls, Nextcloud would not know that + * ``ssl`` is in use, which would result in incorrect URLs being generated. + * Valid values are ``http`` and ``https``. + */ +'overwriteprotocol' => '', + +/** + * Nextcloud attempts to detect the webroot for generating URLs automatically. + * For example, if ``www.example.com/nextcloud`` is the URL pointing to the + * Nextcloud instance, the webroot is ``/nextcloud``. When proxies are in use, + * it may be difficult for Nextcloud to detect this parameter, resulting in + * invalid URLs. + */ +'overwritewebroot' => '', + +/** + * This option allows you to define a manual override condition as a regular + * expression for the remote IP address. For example, defining a range of IP + * addresses starting with ``10.0.0.`` and ending with 1 to 3: + * ``^10\.0\.0\.[1-3]$`` + * + * Defaults to ``''`` (empty string) + */ +'overwritecondaddr' => '', + +/** + * Use this configuration parameter to specify the base URL for any URLs which + * are generated within Nextcloud using any kind of command line tools (cron or + * occ). The value should contain the full base URL: + * ``https://www.example.com/nextcloud`` + * + * Defaults to ``''`` (empty string) + */ +'overwrite.cli.url' => '', + +/** + * To have clean URLs without `/index.php` this parameter needs to be configured. + * + * This parameter will be written as "RewriteBase" on update and installation of + * Nextcloud to your `.htaccess` file. While this value is often simply the URL + * path of the Nextcloud installation it cannot be set automatically properly in + * every scenario and needs thus some manual configuration. + * + * In a standard Apache setup this usually equals the folder that Nextcloud is + * accessible at. So if Nextcloud is accessible via "https://mycloud.org/nextcloud" + * the correct value would most likely be "/nextcloud". If Nextcloud is running + * under "https://mycloud.org/" then it would be "/". + * + * Note that the above rule is not valid in every case, as there are some rare setup + * cases where this may not apply. However, to avoid any update problems this + * configuration value is explicitly opt-in. + * + * After setting this value run `occ maintenance:update:htaccess`. Now, when the + * following conditions are met Nextcloud URLs won't contain `index.php`: + * + * - `mod_rewrite` is installed + * - `mod_env` is installed + * + * Defaults to ``''`` (empty string) + */ +'htaccess.RewriteBase' => '/', + +/** + * For server setups, that don't have `mod_env` enabled or restricted (e.g. suEXEC) + * this parameter has to be set to true and will assume mod_rewrite. + * + * Please check, if `mod_rewrite` is active and functional before setting this + * parameter and you updated your .htaccess with `occ maintenance:update:htaccess`. + * Otherwise your nextcloud installation might not be reachable anymore. + * For example, try accessing resources by leaving out `index.php` in the URL. + */ +'htaccess.IgnoreFrontController' => false, + +/** + * The URL of your proxy server, for example ``proxy.example.com:8081``. + * + * Note: Guzzle (the http library used by Nextcloud) is reading the environment + * variables HTTP_PROXY (only for cli request), HTTPS_PROXY, and NO_PROXY by default. + * + * If you configure proxy with Nextcloud any default configuration by Guzzle + * is overwritten. Make sure to set ``proxyexclude`` accordingly if necessary. + * + * Defaults to ``''`` (empty string) + */ +'proxy' => '', + +/** + * The optional authentication for the proxy to use to connect to the internet. + * The format is: ``username:password``. + * + * Defaults to ``''`` (empty string) + */ +'proxyuserpwd' => '', + +/** + * List of host names that should not be proxied to. + * For example: ``['.mit.edu', 'foo.com']``. + * + * Hint: Use something like ``explode(',', getenv('NO_PROXY'))`` to sync this + * value with the global NO_PROXY option. + * + * Defaults to empty array. + */ +'proxyexclude' => [], + +/** + * Allow remote servers with local addresses e.g. in federated shares, webcal services and more + * + * Defaults to false + */ +'allow_local_remote_servers' => true, + +/** + * Deleted Items (trash bin) + * + * These parameters control the Deleted files app. + */ + +/** + * If the trash bin app is enabled (default), this setting defines the policy + * for when files and folders in the trash bin will be permanently deleted. + * The app allows for two settings, a minimum time for trash bin retention, + * and a maximum time for trash bin retention. + * Minimum time is the number of days a file will be kept, after which it + * may be deleted. Maximum time is the number of days at which it is guaranteed + * to be deleted. + * Both minimum and maximum times can be set together to explicitly define + * file and folder deletion. For migration purposes, this setting is installed + * initially set to "auto", which is equivalent to the default setting in + * Nextcloud. + * + * Available values: + * + * * ``auto`` + * default setting. keeps files and folders in the trash bin for 30 days + * and automatically deletes anytime after that if space is needed (note: + * files may not be deleted if space is not needed). + * * ``D, auto`` + * keeps files and folders in the trash bin for D+ days, delete anytime if + * space needed (note: files may not be deleted if space is not needed) + * * ``auto, D`` + * delete all files in the trash bin that are older than D days + * automatically, delete other files anytime if space needed + * * ``D1, D2`` + * keep files and folders in the trash bin for at least D1 days and + * delete when exceeds D2 days (note: files will not be deleted automatically if space is needed) + * * ``disabled`` + * trash bin auto clean disabled, files and folders will be kept forever + * + * Defaults to ``auto`` + */ +'trashbin_retention_obligation' => 'auto', + + +/** + * File versions + * + * These parameters control the Versions app. + */ + +/** + * If the versions app is enabled (default), this setting defines the policy + * for when versions will be permanently deleted. + * The app allows for two settings, a minimum time for version retention, + * and a maximum time for version retention. + * Minimum time is the number of days a version will be kept, after which it + * may be deleted. Maximum time is the number of days at which it is guaranteed + * to be deleted. + * Both minimum and maximum times can be set together to explicitly define + * version deletion. For migration purposes, this setting is installed + * initially set to "auto", which is equivalent to the default setting in + * Nextcloud. + * + * Available values: + * + * * ``auto`` + * default setting. Automatically expire versions according to expire + * rules. Please refer to :doc:`../configuration_files/file_versioning` for + * more information. + * * ``D, auto`` + * keep versions at least for D days, apply expire rules to all versions + * that are older than D days + * * ``auto, D`` + * delete all versions that are older than D days automatically, delete + * other versions according to expire rules + * * ``D1, D2`` + * keep versions for at least D1 days and delete when exceeds D2 days + * * ``disabled`` + * versions auto clean disabled, versions will be kept forever + * + * Defaults to ``auto`` + */ +'versions_retention_obligation' => 'auto', + +/** + * Nextcloud Verifications + * + * Nextcloud performs several verification checks. There are two options, + * ``true`` and ``false``. + */ + +/** + * Checks an app before install whether it uses private APIs instead of the + * proper public APIs. If this is set to true it will only allow to install or + * enable apps that pass this check. + * + * Defaults to ``false`` + */ +'appcodechecker' => true, + +/** + * Check if Nextcloud is up-to-date and shows a notification if a new version is + * available. + * + * Defaults to ``true`` + */ +'updatechecker' => true, + +/** + * URL that Nextcloud should use to look for updates + * + * Defaults to ``https://updates.nextcloud.com/updater_server/`` + */ +'updater.server.url' => 'https://updates.nextcloud.com/updater_server/', + +/** + * The channel that Nextcloud should use to look for updates + * + * Supported values: + * - ``daily`` + * - ``beta`` + * - ``stable`` + */ +'updater.release.channel' => 'stable', + +/** + * Is Nextcloud connected to the Internet or running in a closed network? + * + * Defaults to ``true`` + */ +'has_internet_connection' => true, + +/** + * Which domains to request to determine the availability of an Internet + * connection. If none of these hosts are reachable, the administration panel + * will show a warning. Set to an empty list to not do any such checks (warning + * will still be shown). + * + * Defaults to the following domains: + * + * - www.nextcloud.com + * - www.startpage.com + * - www.eff.org + * - www.edri.org + */ +'connectivity_check_domains' => [ + 'www.nextcloud.com', + 'www.startpage.com', + 'www.eff.org', + 'www.edri.org' +], + +/** + * Allows Nextcloud to verify a working .well-known URL redirects. This is done + * by attempting to make a request from JS to + * https://your-domain.com/.well-known/caldav/ + * + * Defaults to ``true`` + */ +'check_for_working_wellknown_setup' => true, + +/** + * This is a crucial security check on Apache servers that should always be set + * to ``true``. This verifies that the ``.htaccess`` file is writable and works. + * If it is not, then any options controlled by ``.htaccess``, such as large + * file uploads, will not work. It also runs checks on the ``data/`` directory, + * which verifies that it can't be accessed directly through the Web server. + * + * Defaults to ``true`` + */ +'check_for_working_htaccess' => true, + +/** + * In rare setups (e.g. on Openshift or docker on windows) the permissions check + * might block the installation while the underlying system offers no means to + * "correct" the permissions. In this case, set the value to false. + * + * In regular cases, if issues with permissions are encountered they should be + * adjusted accordingly. Changing the flag is discouraged. + * + * Defaults to ``true`` + */ +'check_data_directory_permissions' => true, + +/** + * In certain environments it is desired to have a read-only configuration file. + * When this switch is set to ``true`` Nextcloud will not verify whether the + * configuration is writable. However, it will not be possible to configure + * all options via the Web interface. Furthermore, when updating Nextcloud + * it is required to make the configuration file writable again for the update + * process. + * + * Defaults to ``false`` + */ +'config_is_read_only' => false, + +/** + * Logging + */ + +/** + * This parameter determines where the Nextcloud logs are sent. + * ``file``: the logs are written to file ``nextcloud.log`` in the default + * Nextcloud data directory. The log file can be changed with parameter + * ``logfile``. + * ``syslog``: the logs are sent to the system log. This requires a syslog daemon + * to be active. + * ``errorlog``: the logs are sent to the PHP ``error_log`` function. + * ``systemd``: the logs are sent to the Systemd journal. This requires a system + * that runs Systemd and the Systemd journal. The PHP extension ``systemd`` + * must be installed and active. + * + * Defaults to ``file`` + */ +'log_type' => 'file', + +/** + * Name of the file to which the Nextcloud logs are written if parameter + * ``log_type`` is set to ``file``. + * + * Defaults to ``[datadirectory]/nextcloud.log`` + */ +'logfile' => '/var/log/nextcloud.log', + +/** + * Log file mode for the Nextcloud loggin type in octal notation. + * + * Defaults to 0640 (writeable by user, readable by group). + */ +'logfilemode' => 0640, + +/** + * Loglevel to start logging at. Valid values are: 0 = Debug, 1 = Info, 2 = + * Warning, 3 = Error, and 4 = Fatal. The default value is Warning. + * + * Defaults to ``2`` + */ +'loglevel' => 2, + +/** + * If you maintain different instances and aggregate the logs, you may want + * to distinguish between them. ``syslog_tag`` can be set per instance + * with a unique id. Only available if ``log_type`` is set to ``syslog`` or + * ``systemd``. + * + * The default value is ``Nextcloud``. + */ +'syslog_tag' => 'Nextcloud', + +/** + * Log condition for log level increase based on conditions. Once one of these + * conditions is met, the required log level is set to debug. This allows to + * debug specific requests, users or apps + * + * Supported conditions: + * - ``shared_secret``: if a request parameter with the name `log_secret` is set to + * this value the condition is met + * - ``users``: if the current request is done by one of the specified users, + * this condition is met + * - ``apps``: if the log message is invoked by one of the specified apps, + * this condition is met + * + * Defaults to an empty array. + */ +'log.condition' => [ + 'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9', + 'users' => ['sample-user'], + 'apps' => ['files'], +], + +/** + * This uses PHP.date formatting; see http://php.net/manual/en/function.date.php + * + * Defaults to ISO 8601 ``2005-08-15T15:52:01+00:00`` - see \DateTime::ATOM + * (https://secure.php.net/manual/en/class.datetime.php#datetime.constants.atom) + */ +'logdateformat' => 'F d, Y H:i:s', + +/** + * The timezone for logfiles. You may change this; see + * http://php.net/manual/en/timezones.php + * + * Defaults to ``UTC`` + */ +'logtimezone' => 'Europe/Berlin', + +/** + * Append all database queries and parameters to the log file. Use this only for + * debugging, as your logfile will become huge. + */ +'log_query' => false, + +/** + * Enables log rotation and limits the total size of logfiles. Set it to 0 for + * no rotation. Specify a size in bytes, for example 104857600 (100 megabytes + * = 100 * 1024 * 1024 bytes). A new logfile is created with a new name when the + * old logfile reaches your limit. If a rotated log file is already present, it + * will be overwritten. + * + * Defaults to 100 MB + */ +'log_rotate_size' => 100 * 1024 * 1024, + + +/** + * Alternate Code Locations + * + * Some of the Nextcloud code may be stored in alternate locations. + */ + +/** + * This section is for configuring the download links for Nextcloud clients, as + * seen in the first-run wizard and on Personal pages. + * + * Defaults to: + * - Desktop client: ``https://nextcloud.com/install/#install-clients`` + * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client`` + * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8`` + * - iOS client app id: ``1125420102`` + */ +'customclient_desktop' => + 'https://nextcloud.com/install/#install-clients', +'customclient_android' => + 'https://play.google.com/store/apps/details?id=com.nextcloud.client', +'customclient_ios' => + 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8', +'customclient_ios_appid' => + '1125420102', +/** + * Apps + * + * Options for the Apps folder, Apps store, and App code checker. + */ + +/** + * When enabled, admins may install apps from the Nextcloud app store. + * + * Defaults to ``true`` + */ +'appstoreenabled' => true, + +/** + * Enables the installation of apps from a self hosted apps store. + * Requires that at least one of the configured apps directories is writeable. + * + * Defaults to ``https://apps.nextcloud.com/api/v1`` + */ +'appstoreurl' => 'https://apps.nextcloud.com/api/v1', + +/** + * Use the ``apps_paths`` parameter to set the location of the Apps directory, + * which should be scanned for available apps, and where user-specific apps + * should be installed from the Apps store. The ``path`` defines the absolute + * file system path to the app folder. The key ``url`` defines the HTTP Web path + * to that folder, starting from the Nextcloud webroot. The key ``writable`` + * indicates if a Web server can write files to that folder. + */ +'apps_paths' => [ + [ + 'path'=> '/var/www/nextcloud/apps', + 'url' => '/apps', + 'writable' => true, + ], +], + +/** + * @see appcodechecker + */ + +/** + * Previews + * + * Nextcloud supports previews of image files, the covers of MP3 files, and text + * files. These options control enabling and disabling previews, and thumbnail + * size. + */ + +/** + * By default, Nextcloud can generate previews for the following filetypes: + * + * - Image files + * - Covers of MP3 files + * - Text documents + * + * Valid values are ``true``, to enable previews, or + * ``false``, to disable previews + * + * Defaults to ``true`` + */ +'enable_previews' => true, +/** + * The maximum width, in pixels, of a preview. A value of ``null`` means there + * is no limit. + * + * Defaults to ``4096`` + */ +'preview_max_x' => 4096, +/** + * The maximum height, in pixels, of a preview. A value of ``null`` means there + * is no limit. + * + * Defaults to ``4096`` + */ +'preview_max_y' => 4096, + +/** + * max file size for generating image previews with imagegd (default behavior) + * If the image is bigger, it'll try other preview generators, but will most + * likely show the default mimetype icon. Set to -1 for no limit. + * + * Defaults to ``50`` megabytes + */ +'preview_max_filesize_image' => 50, + +/** + * custom path for LibreOffice/OpenOffice binary + * + * + * Defaults to ``''`` (empty string) + */ +'preview_libreoffice_path' => '/usr/bin/libreoffice', +/** + * Use this if LibreOffice/OpenOffice requires additional arguments. + * + * Defaults to ``''`` (empty string) + */ +'preview_office_cl_parameters' => + ' --headless --nologo --nofirststartwizard --invisible --norestore '. + '--convert-to png --outdir ', + +/** + * Only register providers that have been explicitly enabled + * + * The following providers are disabled by default due to performance or privacy + * concerns: + * + * - OC\Preview\Illustrator + * - OC\Preview\Movie + * - OC\Preview\MSOffice2003 + * - OC\Preview\MSOffice2007 + * - OC\Preview\MSOfficeDoc + * - OC\Preview\PDF + * - OC\Preview\Photoshop + * - OC\Preview\Postscript + * - OC\Preview\StarOffice + * - OC\Preview\SVG + * - OC\Preview\TIFF + * - OC\Preview\Font + * + * + * Defaults to the following providers: + * + * - OC\Preview\BMP + * - OC\Preview\GIF + * - OC\Preview\HEIC + * - OC\Preview\JPEG + * - OC\Preview\MarkDown + * - OC\Preview\MP3 + * - OC\Preview\PNG + * - OC\Preview\TXT + * - OC\Preview\XBitmap + * - OC\Preview\OpenDocument + * - OC\Preview\Krita + */ +'enabledPreviewProviders' => [ + 'OC\Preview\PNG', + 'OC\Preview\JPEG', + 'OC\Preview\GIF', + 'OC\Preview\HEIC', + 'OC\Preview\BMP', + 'OC\Preview\XBitmap', + 'OC\Preview\MP3', + 'OC\Preview\TXT', + 'OC\Preview\MarkDown', + 'OC\Preview\OpenDocument', + 'OC\Preview\Krita', +], + +/** + * LDAP + * + * Global settings used by LDAP User and Group Backend + */ + +/** + * defines the interval in minutes for the background job that checks user + * existence and marks them as ready to be cleaned up. The number is always + * minutes. Setting it to 0 disables the feature. + * See command line (occ) methods ``ldap:show-remnants`` and ``user:delete`` + * + * Defaults to ``51`` minutes + */ +'ldapUserCleanupInterval' => 51, + +/** + * Sort groups in the user settings by name instead of the user count + * + * By enabling this the user count beside the group name is disabled as well. + */ +'sort_groups_by_name' => false, + +/** + * Comments + * + * Global settings for the Comments infrastructure + */ + +/** + * Replaces the default Comments Manager Factory. This can be utilized if an + * own or 3rdParty CommentsManager should be used that – for instance – uses the + * filesystem instead of the database to keep the comments. + * + * Defaults to ``\OC\Comments\ManagerFactory`` + */ +'comments.managerFactory' => '\OC\Comments\ManagerFactory', + +/** + * Replaces the default System Tags Manager Factory. This can be utilized if an + * own or 3rdParty SystemTagsManager should be used that – for instance – uses the + * filesystem instead of the database to keep the tags. + * + * Defaults to ``\OC\SystemTag\ManagerFactory`` + */ +'systemtags.managerFactory' => '\OC\SystemTag\ManagerFactory', + +/** + * Maintenance + * + * These options are for halting user activity when you are performing server + * maintenance. + */ + +/** + * Enable maintenance mode to disable Nextcloud + * + * If you want to prevent users from logging in to Nextcloud before you start + * doing some maintenance work, you need to set the value of the maintenance + * parameter to true. Please keep in mind that users who are already logged-in + * are kicked out of Nextcloud instantly. + * + * Defaults to ``false`` + */ +'maintenance' => false, + + +/** + * SSL + */ + +/** + * Extra SSL options to be used for configuration. + * + * Defaults to an empty array. + */ +'openssl' => [ + 'config' => '/absolute/location/of/openssl.cnf', +], + +/** + * Memory caching backend configuration + * + * Available cache backends: + * + * * ``\OC\Memcache\APCu`` APC user backend + * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended) + * * ``\OC\Memcache\Memcached`` Memcached backend + * * ``\OC\Memcache\Redis`` Redis backend + * + * Advice on choosing between the various backends: + * + * * APCu should be easiest to install. Almost all distributions have packages. + * Use this for single user environment for all caches. + * * Use Redis or Memcached for distributed environments. + * For the local cache (you can configure two) take APCu. + */ + +/** + * Memory caching backend for locally stored data + * + * * Used for host-specific data, e.g. file paths + * + * Defaults to ``none`` + */ +'memcache.local' => '\OC\Memcache\APCu', + +/** + * Memory caching backend for distributed data + * + * * Used for installation-specific data, e.g. database caching + * * If unset, defaults to the value of memcache.local + * + * Defaults to ``none`` + */ +'memcache.distributed' => '\OC\Memcache\Memcached', + +/** + * Connection details for redis to use for memory caching in a single server configuration. + * + * For enhanced security it is recommended to configure Redis + * to require a password. See http://redis.io/topics/security + * for more information. + */ +'redis' => [ + 'host' => 'localhost', // can also be a unix domain socket: '/tmp/redis.sock' + 'port' => 6379, + 'timeout' => 0.0, + 'password' => '', // Optional, if not defined no password will be used. + 'dbindex' => 0, // Optional, if undefined SELECT will not run and will use Redis Server's default DB Index. +], + +/** + * Connection details for a Redis Cluster + * + * Only for use with Redis Clustering, for Sentinel-based setups use the single + * server configuration above, and perform HA on the hostname. + * + * Redis Cluster support requires the php module phpredis in version 3.0.0 or + * higher. + * + * Available failover modes: + * - \RedisCluster::FAILOVER_NONE - only send commands to master nodes (default) + * - \RedisCluster::FAILOVER_ERROR - failover to slaves for read commands if master is unavailable (recommended) + * - \RedisCluster::FAILOVER_DISTRIBUTE - randomly distribute read commands across master and slaves + * + * WARNING: FAILOVER_DISTRIBUTE is a not recommended setting and we strongly + * suggest to not use it if you use Redis for file locking. Due to the way Redis + * is synchronized it could happen, that the read for an existing lock is + * scheduled to a slave that is not fully synchronized with the connected master + * which then causes a FileLocked exception. + * + * See https://redis.io/topics/cluster-spec for details about the Redis cluster + * + * Authentication works with phpredis version 4.2.1+. See + * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1 + */ +'redis.cluster' => [ + 'seeds' => [ // provide some/all of the cluster servers to bootstrap discovery, port required + 'localhost:7000', + 'localhost:7001', + ], + 'timeout' => 0.0, + 'read_timeout' => 0.0, + 'failover_mode' => \RedisCluster::FAILOVER_ERROR, + 'password' => '', // Optional, if not defined no password will be used. +], + + +/** + * Server details for one or more memcached servers to use for memory caching. + */ +'memcached_servers' => [ + // hostname, port and optional weight. Also see: + // http://www.php.net/manual/en/memcached.addservers.php + // http://www.php.net/manual/en/memcached.addserver.php + ['localhost', 11211], + //array('other.host.local', 11211), +], + +/** + * Connection options for memcached + */ +'memcached_options' => [ + // Set timeouts to 50ms + \Memcached::OPT_CONNECT_TIMEOUT => 50, + \Memcached::OPT_RETRY_TIMEOUT => 50, + \Memcached::OPT_SEND_TIMEOUT => 50, + \Memcached::OPT_RECV_TIMEOUT => 50, + \Memcached::OPT_POLL_TIMEOUT => 50, + + // Enable compression + \Memcached::OPT_COMPRESSION => true, + + // Turn on consistent hashing + \Memcached::OPT_LIBKETAMA_COMPATIBLE => true, + + // Enable Binary Protocol + \Memcached::OPT_BINARY_PROTOCOL => true, + + // Binary serializer vill be enabled if the igbinary PECL module is available + //\Memcached::OPT_SERIALIZER => \Memcached::SERIALIZER_IGBINARY, +], + + +/** + * Location of the cache folder, defaults to ``data/$user/cache`` where + * ``$user`` is the current user. When specified, the format will change to + * ``$cache_path/$user`` where ``$cache_path`` is the configured cache directory + * and ``$user`` is the user. + * + * Defaults to ``''`` (empty string) + */ +'cache_path' => '', + +/** + * TTL of chunks located in the cache folder before they're removed by + * garbage collection (in seconds). Increase this value if users have + * issues uploading very large files via the Nextcloud Client as upload isn't + * completed within one day. + * + * Defaults to ``60*60*24`` (1 day) + */ +'cache_chunk_gc_ttl' => 60*60*24, + +/** + * Using Object Store with Nextcloud + */ + +/** + * This example shows how to configure Nextcloud to store all files in a + * swift object storage. + * + * It is important to note that Nextcloud in object store mode will expect + * exclusive access to the object store container because it only stores the + * binary data for each file. The metadata is currently kept in the local + * database for performance reasons. + * + * WARNING: The current implementation is incompatible with any app that uses + * direct file IO and circumvents our virtual filesystem. That includes + * Encryption and Gallery. Gallery will store thumbnails directly in the + * filesystem and encryption will cause severe overhead because key files need + * to be fetched in addition to any requested file. + * + * One way to test is applying for a trystack account at http://trystack.org/ + */ +'objectstore' => [ + 'class' => 'OC\\Files\\ObjectStore\\Swift', + 'arguments' => [ + // trystack will use your facebook id as the user name + 'username' => 'facebook100000123456789', + // in the trystack dashboard go to user -> settings -> API Password to + // generate a password + 'password' => 'Secr3tPaSSWoRdt7', + // must already exist in the objectstore, name can be different + 'container' => 'nextcloud', + // prefix to prepend to the fileid, default is 'oid:urn:' + 'objectPrefix' => 'oid:urn:', + // create the container if it does not exist. default is false + 'autocreate' => true, + // required, dev-/trystack defaults to 'RegionOne' + 'region' => 'RegionOne', + // The Identity / Keystone endpoint + 'url' => 'http://8.21.28.222:5000/v2.0', + // required on dev-/trystack + 'tenantName' => 'facebook100000123456789', + // dev-/trystack uses swift by default, the lib defaults to 'cloudFiles' + // if omitted + 'serviceName' => 'swift', + // The Interface / url Type, optional + 'urlType' => 'internal' + ], +], + +/** + * To use swift V3 + */ +'objectstore' => [ + 'class' => 'OC\\Files\\ObjectStore\\Swift', + 'arguments' => [ + 'autocreate' => true, + 'user' => [ + 'name' => 'swift', + 'password' => 'swift', + 'domain' => [ + 'name' => 'default', + ], + ], + 'scope' => [ + 'project' => [ + 'name' => 'service', + 'domain' => [ + 'name' => 'default', + ], + ], + ], + 'tenantName' => 'service', + 'serviceName' => 'swift', + 'region' => 'regionOne', + 'url' => 'http://yourswifthost:5000/v3', + 'bucket' => 'nextcloud', + ], +], + +/** + * If this is set to true and a multibucket object store is configured then + * newly created previews are put into 256 dedicated buckets. + * + * Those buckets are named like the mulibucket version but with the postfix + * ``-preview-NUMBER`` where NUMBER is between 0 and 255. + * + * Keep in mind that only previews of files are put in there that don't have + * some already. Otherwise the old bucket will be used. + * + * To migrate existing previews to this new multibucket distribution of previews + * use the occ command ``preview:repair``. For now this will only migrate + * previews that were generated before Nextcloud 19 in the flat + * ``appdata_INSTANCEID/previews/FILEID`` folder structure. + */ +'objectstore.multibucket.preview-distribution' => false, + + +/** + * Sharing + * + * Global settings for Sharing + */ + +/** + * Replaces the default Share Provider Factory. This can be utilized if + * own or 3rdParty Share Providers are used that – for instance – use the + * filesystem instead of the database to keep the share information. + * + * Defaults to ``\OC\Share20\ProviderFactory`` + */ +'sharing.managerFactory' => '\OC\Share20\ProviderFactory', + +/** + * Define max number of results returned by the user search for auto-completion + * Default is unlimited (value set to 0). + */ +'sharing.maxAutocompleteResults' => 0, + +/** + * Define the minimum length of the search string before we start auto-completion + * Default is no limit (value set to 0) + */ +'sharing.minSearchStringLength' => 0, + +/** + * Set to true to enable that internal shares need to be accepted by the users by default. + * Users can change this for their account in their personal sharing settings + */ +'sharing.enable_share_accept' => false, + +/** + * Set to true to enforce that internal shares need to be accepted + */ +'sharing.force_share_accept' => false, + +/** + * Set to false to stop sending a mail when users receive a share + */ +'sharing.enable_share_mail' => true, + + +/** + * All other configuration options + */ + +/** + * Additional driver options for the database connection, eg. to enable SSL + * encryption in MySQL or specify a custom wait timeout on a cheap hoster. + */ +'dbdriveroptions' => [ + PDO::MYSQL_ATTR_SSL_CA => '/file/path/to/ca_cert.pem', + PDO::MYSQL_ATTR_INIT_COMMAND => 'SET wait_timeout = 28800' +], + +/** + * sqlite3 journal mode can be specified using this configuration parameter - + * can be 'WAL' or 'DELETE' see for more details https://www.sqlite.org/wal.html + */ +'sqlite.journal_mode' => 'DELETE', + +/** + * During setup, if requirements are met (see below), this setting is set to true + * and MySQL can handle 4 byte characters instead of 3 byte characters. + * + * If you want to convert an existing 3-byte setup into a 4-byte setup please + * set the parameters in MySQL as mentioned below and run the migration command: + * ./occ db:convert-mysql-charset + * The config setting will be set automatically after a successful run. + * + * Consult the documentation for more details. + * + * MySQL requires a special setup for longer indexes (> 767 bytes) which are + * needed: + * + * [mysqld] + * innodb_large_prefix=ON + * innodb_file_format=Barracuda + * innodb_file_per_table=ON + * + * Tables will be created with + * * character set: utf8mb4 + * * collation: utf8mb4_bin + * * row_format: compressed + * + * See: + * https://dev.mysql.com/doc/refman/5.7/en/charset-unicode-utf8mb4.html + * https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_large_prefix + * https://mariadb.com/kb/en/mariadb/xtradbinnodb-server-system-variables/#innodb_large_prefix + * http://www.tocker.ca/2013/10/31/benchmarking-innodb-page-compression-performance.html + * http://mechanics.flite.com/blog/2014/07/29/using-innodb-large-prefix-to-avoid-error-1071/ + */ +'mysql.utf8mb4' => false, + +/** + * Database types that are supported for installation. + * + * Available: + * - sqlite (SQLite3) + * - mysql (MySQL) + * - pgsql (PostgreSQL) + * - oci (Oracle) + * + * Defaults to the following databases: + * - sqlite (SQLite3) + * - mysql (MySQL) + * - pgsql (PostgreSQL) + */ +'supportedDatabases' => [ + 'sqlite', + 'mysql', + 'pgsql', + 'oci', +], + +/** + * Override where Nextcloud stores temporary files. Useful in situations where + * the system temporary directory is on a limited space ramdisk or is otherwise + * restricted, or if external storages which do not support streaming are in + * use. + * + * The Web server user must have write access to this directory. + */ +'tempdirectory' => '/tmp/nextcloudtemp', + +/** + * Hashing + */ + +/** + * By default Nextcloud will use the Argon2 password hashing if available. + * However if for whatever reason you want to stick with the PASSWORD_DEFAULT + * of your php version. Then set the setting to true. + */ +'hashing_default_password' => false, + +/** + * + * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its + * own and exposes its configuration options as following. More information can + * be found at: https://www.php.net/manual/en/function.password-hash.php + */ + +/** + * The allowed maximum memory in KiB to be used by the algorithm for computing a + * hash. The smallest possible value is 8. Values that undershoot the minimum + * will be ignored in favor of the default. + */ +'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, + +/** + * The allowed maximum time in seconds that can be used by the algorithm for + * computing a hash. The value must be an integer, and the minimum value is 1. + * Values that undershoot the minimum will be ignored in favor of the default. + */ +'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, + +/** + * The allowed number of CPU threads that can be used by the algorithm for + * computing a hash. The value must be an integer, and the minimum value is 1. + * Rationally it does not help to provide a number higher than the available + * threads on the machine. Values that undershoot the minimum will be ignored + * in favor of the default. + */ +'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS, + +/** + * The hashing cost used by hashes generated by Nextcloud + * Using a higher value requires more time and CPU power to calculate the hashes + */ +'hashingCost' => 10, + +/** + * Blacklist a specific file or files and disallow the upload of files + * with this name. ``.htaccess`` is blocked by default. + * WARNING: USE THIS ONLY IF YOU KNOW WHAT YOU ARE DOING. + * + * Defaults to ``array('.htaccess')`` + */ +'blacklisted_files' => ['.htaccess'], + +/** + * Define a default folder for shared files and folders other than root. + * Changes to this value will only have effect on new shares. + * + * Defaults to ``/`` + */ +'share_folder' => '/', + +/** + * If you are applying a theme to Nextcloud, enter the name of the theme here. + * The default location for themes is ``nextcloud/themes/``. + * + * Defaults to the theming app which is shipped since Nextcloud 9 + */ +'theme' => '', + +/** + * The default cipher for encrypting files. Currently AES-128-CFB and + * AES-256-CFB are supported. + */ +'cipher' => 'AES-256-CFB', + +/** + * The minimum Nextcloud desktop client version that will be allowed to sync with + * this server instance. All connections made from earlier clients will be denied + * by the server. Defaults to the minimum officially supported Nextcloud desktop + * clientversion at the time of release of this server version. + * + * When changing this, note that older unsupported versions of the Nextcloud desktop + * client may not function as expected, and could lead to permanent data loss for + * clients or other unexpected results. + * + * Defaults to ``2.0.0`` + */ +'minimum.supported.desktop.version' => '2.0.0', + +/** + * EXPERIMENTAL: option whether to include external storage in quota + * calculation, defaults to false. + * + * Defaults to ``false`` + */ +'quota_include_external_storage' => false, + +/** + * When an external storage is unavailable for some reasons, it will be flagged + * as such for 10 minutes. When the trigger is a failed authentication attempt + * the delay is higher and can be controlled with this option. The motivation + * is to make account lock outs at Active Directories (and compatible) more + * unlikely. + * + * Defaults to ``1800`` (seconds) + */ +'external_storage.auth_availability_delay' => 1800, + +/** + * Specifies how often the local filesystem (the Nextcloud data/ directory, and + * NFS mounts in data/) is checked for changes made outside Nextcloud. This + * does not apply to external storages. + * + * 0 -> Never check the filesystem for outside changes, provides a performance + * increase when it's certain that no changes are made directly to the + * filesystem + * + * 1 -> Check each file or folder at most once per request, recommended for + * general use if outside changes might happen. + * + * Defaults to ``0`` + */ +'filesystem_check_changes' => 0, + +/** + * By default Nextcloud will store the part files created during upload in the + * same storage as the upload target. Setting this to false will store the part + * files in the root of the users folder which might be required to work with certain + * external storage setups that have limited rename capabilities. + * + * Defaults to ``true`` + */ +'part_file_in_storage' => true, + +/** + * Where ``mount.json`` file should be stored, defaults to ``data/mount.json`` + * in the Nextcloud directory. + * + * Defaults to ``data/mount.json`` in the Nextcloud directory. + */ +'mount_file' => '/var/www/nextcloud/data/mount.json', + +/** + * When ``true``, prevent Nextcloud from changing the cache due to changes in + * the filesystem for all storage. + * + * Defaults to ``false`` + */ +'filesystem_cache_readonly' => false, + +/** + * Secret used by Nextcloud for various purposes, e.g. to encrypt data. If you + * lose this string there will be data corruption. + */ +'secret' => '', + +/** + * List of trusted proxy servers + * + * You may set this to an array containing a combination of + * - IPv4 addresses, e.g. `192.168.2.123` + * - IPv4 ranges in CIDR notation, e.g. `192.168.2.0/24` + * - IPv6 addresses, e.g. `fd9e:21a7:a92c:2323::1` + * + * _(CIDR notation for IPv6 is currently work in progress and thus not + * available as of yet)_ + * + * When an incoming request's `REMOTE_ADDR` matches any of the IP addresses + * specified here, it is assumed to be a proxy instead of a client. Thus, the + * client IP will be read from the HTTP header specified in + * `forwarded_for_headers` instead of from `REMOTE_ADDR`. + * + * So if you configure `trusted_proxies`, also consider setting + * `forwarded_for_headers` which otherwise defaults to `HTTP_X_FORWARDED_FOR` + * (the `X-Forwarded-For` header). + * + * Defaults to an empty array. + */ +'trusted_proxies' => ['203.0.113.45', '198.51.100.128', '192.168.2.0/24'], + +/** + * Headers that should be trusted as client IP address in combination with + * `trusted_proxies`. If the HTTP header looks like 'X-Forwarded-For', then use + * 'HTTP_X_FORWARDED_FOR' here. + * + * If set incorrectly, a client can spoof their IP address as visible to + * Nextcloud, bypassing access controls and making logs useless! + * + * Defaults to ``'HTTP_X_FORWARDED_FOR'`` + */ +'forwarded_for_headers' => ['HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'], + +/** + * max file size for animating gifs on public-sharing-site. + * If the gif is bigger, it'll show a static preview + * + * Value represents the maximum filesize in megabytes. Set to ``-1`` for + * no limit. + * + * Defaults to ``10`` megabytes + */ +'max_filesize_animated_gifs_public_sharing' => 10, + + +/** + * Enables transactional file locking. + * This is enabled by default. + * + * Prevents concurrent processes from accessing the same files + * at the same time. Can help prevent side effects that would + * be caused by concurrent operations. Mainly relevant for + * very large installations with many users working with + * shared files. + * + * Defaults to ``true`` + */ +'filelocking.enabled' => true, + +/** + * Set the lock's time-to-live in seconds. + * + * Any lock older than this will be automatically cleaned up. + * + * Defaults to ``60*60`` seconds (1 hour) or the php + * max_execution_time, whichever is higher. + */ +'filelocking.ttl' => 60*60, + +/** + * Memory caching backend for file locking + * + * Because most memcache backends can clean values without warning using redis + * is highly recommended to *avoid data loss*. + * + * Defaults to ``none`` + */ +'memcache.locking' => '\\OC\\Memcache\\Redis', + +/** + * Enable locking debug logging + * + * Note that this can lead to a very large volume of log items being written which can lead + * to performance degradation and large log files on busy instance. + * + * Thus enabling this in production for longer periods of time is not recommended + * or should be used together with the ``log.condition`` setting. + */ +'filelocking.debug' => false, + +/** + * Disable the web based updater + */ +'upgrade.disable-web' => false, + +/** + * Set this Nextcloud instance to debugging mode + * + * Only enable this for local development and not in production environments + * This will disable the minifier and outputs some additional debug information + * + * Defaults to ``false`` + */ +'debug' => false, + +/** + * Sets the data-fingerprint of the current data served + * + * This is a property used by the clients to find out if a backup has been + * restored on the server. Once a backup is restored run + * ./occ maintenance:data-fingerprint + * To set this to a new value. + * + * Updating/Deleting this value can make connected clients stall until + * the user has resolved conflicts. + * + * Defaults to ``''`` (empty string) + */ +'data-fingerprint' => '', + +/** + * This entry is just here to show a warning in case somebody copied the sample + * configuration. DO NOT ADD THIS SWITCH TO YOUR CONFIGURATION! + * + * If you, brave person, have read until here be aware that you should not + * modify *ANY* settings in this file without reading the documentation. + */ +'copied_sample_config' => true, + +/** + * use a custom lookup server to publish user data + */ +'lookup_server' => 'https://lookup.nextcloud.com', + +/** + * set to true if the server is used in a setup based on Nextcloud's Global Scale architecture + */ +'gs.enabled' => false, + +/** + * by default federation is only used internally in a Global Scale setup + * If you want to allow federation outside of your environment set it to 'global' + */ +'gs.federation' => 'internal', + +/** + * List of incompatible user agents opted out from Same Site Cookie Protection. + * Some user agents are notorious and don't really properly follow HTTP + * specifications. For those, have an opt-out. + * + * WARNING: only use this if you know what you are doing + */ +'csrf.optout' => [ + '/^WebDAVFS/', // OS X Finder + '/^Microsoft-WebDAV-MiniRedir/', // Windows webdav drive +], + +/** + * By default there is on public pages a link shown that allows users to + * learn about the "simple sign up" - see https://nextcloud.com/signup/ + * + * If this is set to "false" it will not show the link. + */ +'simpleSignUpLink.shown' => true, + +/** + * By default autocompletion is enabled for the login form on Nextcloud's login page. + * While this is enabled, browsers are allowed to "remember" login names and such. + * Some companies require it to be disabled to comply with their security policy. + * + * Simply set this property to "false", if you want to turn this feature off. + */ + +'login_form_autocomplete' => true, +]; + diff --git a/nextcloud/db.env b/nextcloud/db.env new file mode 100644 index 0000000..b99a181 --- /dev/null +++ b/nextcloud/db.env @@ -0,0 +1,3 @@ +MYSQL_PASSWORD=secret +MYSQL_DATABASE=nextcloud +MYSQL_USER=chris diff --git a/nextcloud/supervisord.conf b/nextcloud/supervisord.conf new file mode 100644 index 0000000..0fe583f --- /dev/null +++ b/nextcloud/supervisord.conf @@ -0,0 +1,22 @@ +[supervisord] +nodaemon=true +logfile=/var/log/supervisord/supervisord.log +pidfile=/var/run/supervisord/supervisord.pid +childlogdir=/var/log/supervisord/ +logfile_maxbytes=50MB ; maximum size of logfile before rotation +logfile_backups=10 ; number of backed up logfiles +loglevel=error + +[program:php-fpm] +stdout_logfile=/dev/stdout +stdout_logfile_maxbytes=0 +stderr_logfile=/dev/stderr +stderr_logfile_maxbytes=0 +command=php-fpm + +[program:cron] +stdout_logfile=/dev/stdout +stdout_logfile_maxbytes=0 +stderr_logfile=/dev/stderr +stderr_logfile_maxbytes=0 +command=/cron.shv diff --git a/nginx.conf b/nginx.conf index 69b813f..b56e652 100644 --- a/nginx.conf +++ b/nginx.conf @@ -1,4 +1,4 @@ -worker_processes 1; +worker_processes auto; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; @@ -27,10 +27,13 @@ http { set_real_ip_from 192.168.0.0/16; real_ip_header X-Real-IP; - # Connect to app service - upstream php-handler { + # Connect to service services + upstream monica-handler { server monica:9000; } + upstream nextcloud-handler { + server nextcloud:9000; + } server { listen 443 ssl http2; @@ -110,7 +113,7 @@ http { # Check that the PHP script exists before passing it try_files $fastcgi_script_name =404; - fastcgi_pass php-handler; + fastcgi_pass monica-handler; fastcgi_index index.php; include fastcgi_params; @@ -163,4 +166,137 @@ http { deny all; } } + + + server { + listen 443 ssl http2; + + ssl_certificate /etc/nginx/certs/tower.scarif.local.crt; + ssl_certificate_key /etc/nginx/certs/tower.scarif.local.key; + + server_name tower.scarif.local; + + ## HSTS ## + # Add the 'Strict-Transport-Security' headers to enable HSTS protocol. + # WARNING: Only add the preload option once you read about the consequences: https://hstspreload.org/. + # This form will add the domain to a hardcoded list that is shipped in all major browsers and getting + # removed from this list could take several months. + # + #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;" always; + + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + root /var/www/html/nextcloud; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location = /.well-known/carddav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + location = /.well-known/caldav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + # set max upload size + client_max_body_size 10G; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Uncomment if your server is build with the ngx_pagespeed module + # This module is currently not supported. + #pagespeed off; + + location / { + rewrite ^ /index.php; + } + + location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { + deny all; + } + location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } + + location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) { + fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + include fastcgi_params; + + # Cannot use $document_root as the path to monica on the docker container + # is different to the path to the public files in this nginx container. + fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + # fastcgi_param HTTPS on; + + # Avoid sending the security headers twice + fastcgi_param modHeadersAvailable true; + + # Enable pretty urls + fastcgi_param front_controller_active true; + fastcgi_pass nextcloud-handler; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { + try_files $uri/ =404; + index index.php; + } + + # Adding the cache control header for js, css and map files + # Make sure it is BELOW the PHP block + location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + try_files $uri /index.php$request_uri; + add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers (It is intended to + # have those duplicated to the ones above) + # Before enabling Strict-Transport-Security headers please read into + # this topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Optional: Don't log access to assets + access_log off; + } + + location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { + try_files $uri /index.php$request_uri; + # Optional: Don't log access to other assets + access_log off; + } + } }