diff --git a/templates/Nextcloud/0/Resources/conf.d/collabora.conf b/templates/Nextcloud/0/Resources/conf.d/collabora.conf new file mode 100644 index 0000000..1f6b893 --- /dev/null +++ b/templates/Nextcloud/0/Resources/conf.d/collabora.conf @@ -0,0 +1,40 @@ +server { + listen 81; + listen [::]:81; + + # static files + location ^~ /loleaflet { + proxy_pass http://collabora:9980; + proxy_set_header Host $http_host; + } + + # WOPI discovery URL + location ^~ /hosting/discovery { + proxy_pass http://collabora:9980; + proxy_set_header Host $http_host; + } + + # main websocket + location ~ ^/lool/(.*)/ws$ { + proxy_pass http://collabora:9980; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $http_host; + proxy_read_timeout 36000s; + } + + # download, presentation and image upload + location ~ ^/lool { + proxy_pass http://collabora:9980; + proxy_set_header Host $http_host; + } + + # Admin Console websocket + location ^~ /lool/adminws { + proxy_pass http://collabora:9980; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $http_host; + proxy_read_timeout 36000s; + } +} \ No newline at end of file diff --git a/templates/Nextcloud/0/Resources/conf.d/nextcloud.conf b/templates/Nextcloud/0/Resources/conf.d/nextcloud.conf new file mode 100644 index 0000000..50ad8e7 --- /dev/null +++ b/templates/Nextcloud/0/Resources/conf.d/nextcloud.conf @@ -0,0 +1,69 @@ +upstream php-handler { + server nextcloud:9000; +} + +server { + listen 80; + listen [::]:80; + server_name _; + + root /var/www/html/; # Path to the root of your installation + + client_max_body_size 10G; # Max upload size + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip off; + + index index.php + error_page 403 /core/templates/403.php; + error_page 404 /core/templates/404.php; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location = /.well-known/carddav { + return 301 $scheme://$host/remote.php/dav; + } + + location = /.well-known/caldav { + return 301 $scheme://$host/remote.php/dav; + } + + + + location / { + rewrite ^ /index.php$request_uri; + } + + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_pass php-handler; + fastcgi_intercept_errors on; + } + + # Adding the cache control header for js and css files + # Make sure it is BELOW the location ~ \.php(?:$|/) { block + location ~* \.(?:css|js)$ { + add_header Cache-Control "public, max-age=7200"; + # Add headers to serve security related headers + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + add_header X-Content-Type-Options nosniff; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag none; + # Optional: Don't log access to assets + access_log off; + } + + # Optional: Don't log access to other assets + location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$ { + access_log off; + } +} \ No newline at end of file diff --git a/templates/Nextcloud/0/Resources/fastcgi_params b/templates/Nextcloud/0/Resources/fastcgi_params index 14e5ac6..c2f509a 100644 --- a/templates/Nextcloud/0/Resources/fastcgi_params +++ b/templates/Nextcloud/0/Resources/fastcgi_params @@ -1,27 +1,21 @@ -fastcgi_param QUERY_STRING $query_string; -fastcgi_param REQUEST_METHOD $request_method; -fastcgi_param CONTENT_TYPE $content_type; -fastcgi_param CONTENT_LENGTH $content_length; +fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; -fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; -fastcgi_param SCRIPT_NAME $fastcgi_script_name; -fastcgi_param PATH_INFO $fastcgi_path_info; -fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; -fastcgi_param REQUEST_URI $request_uri; -fastcgi_param DOCUMENT_URI $document_uri; -fastcgi_param DOCUMENT_ROOT $document_root; -fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_index index.php; -fastcgi_param GATEWAY_INTERFACE CGI/1.1; -fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; - -fastcgi_param REMOTE_ADDR $remote_addr; -fastcgi_param REMOTE_PORT $remote_port; -fastcgi_param SERVER_ADDR $server_addr; -fastcgi_param SERVER_PORT $server_port; -fastcgi_param SERVER_NAME $server_name; - -fastcgi_param HTTPS $https; - -# PHP only, required if PHP was built with --enable-force-cgi-redirect -fastcgi_param REDIRECT_STATUS 200; \ No newline at end of file +fastcgi_param REDIRECT_STATUS 200; \ No newline at end of file diff --git a/templates/Nextcloud/0/Resources/nginx.conf b/templates/Nextcloud/0/Resources/nginx.conf index ca6c521..9493b30 100644 --- a/templates/Nextcloud/0/Resources/nginx.conf +++ b/templates/Nextcloud/0/Resources/nginx.conf @@ -1,175 +1,79 @@ user www-data; -worker_processes 1; -# worker_rlimit_nofile 8192; +worker_processes auto; -#error_log /var/log/nginx/error.log warn; +# error_log /var/log/nginx.error_log info; # [ debug | info | notice | warn | error | crit ] pid /var/run/nginx.pid; events { worker_connections 1024; + use epoll; # use [ kqueue | rtsig | epoll | /dev/poll | select | poll ] } http { - include /etc/nginx/mime.types; - default_type application/octet-stream; + #---------------------------------------- + # Logging + #---------------------------------------- + + + # REFERENCE 1 #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log /var/log/nginx/access.log main; - - sendfile on; - #tcp_nopush on; - + + # REFERENCE 2 + #log_format main '$remote_addr - $host [$time_local] "$request" ' + # '$status $body_bytes_sent "$http_referer" ' + # '"$http_user_agent" "$http_x_forwarded_for"' + # 'rt=$request_time ut=$upstream_response_time ' + # 'cs=$upstream_cache_status'; + + #log_format cache '$remote_addr - $host [$time_local] "$request" $status ' + # '$body_bytes_sent "$http_referer" ' + # 'rt=$request_time ut=$upstream_response_time ' + # 'cs=$upstream_cache_status'; + + #access_log /var/log/nginx/access.log main; + #error_log /var/log/nginx/error.log warn; + + #---------------------------------------- + # Basic Settings + #---------------------------------------- + + sendfile on; + tcp_nopush on; + tcp_nodelay on; keepalive_timeout 65; - - upstream php-handler { - server nextcloud:9000; - } - server { - listen 80; - listen [::]:80; + include /etc/nginx/mime.types; + default_type application/octet-stream; - # Add headers to serve security related headers - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Robots-Tag none; - add_header X-Download-Options noopen; - add_header X-Permitted-Cross-Domain-Policies none; - add_header Referrer-Policy no-referrer; + #---------------------------------------- + # Common Limits + #---------------------------------------- - # Remove X-Powered-By, which is an information leak - fastcgi_hide_header X-Powered-By; + client_max_body_size 1G; # Max upload size - # Path to the root of your installation - root /var/www/html/; + #---------------------------------------- + # GZip + #---------------------------------------- - # Will test later - #error_page 403 /core/templates/403.php; - #error_page 404 /core/templates/404.php; - location = /robots.txt { - allow all; - log_not_found off; - access_log off; - } - location = /.well-known/carddav { - return 301 $scheme://$host/remote.php/dav; - } - location = /.well-known/caldav { - return 301 $scheme://$host/remote.php/dav; - } - # set max upload size - client_max_body_size 10G; - fastcgi_buffers 64 4K; + #---------------------------------------- + # Cache + #---------------------------------------- - # Enable gzip but do not remove ETag headers - gzip on; - gzip_vary on; - gzip_comp_level 4; - gzip_min_length 256; - gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; - gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + proxy_cache_valid 1m; - location / { - rewrite ^ /index.php$request_uri; - } + #---------------------------------------- + # Virtual Hosts + #---------------------------------------- - location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { - deny all; - } + include /etc/nginx/conf.d/*.conf; - location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { - deny all; - } - - location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) { - fastcgi_split_path_info ^(.+\.php)(/.*)$; - # Mitigate https://httpoxy.org/ vulnerabilities: - fastcgi_param HTTP_PROXY ""; - #fastcgi_index index.php; - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $fastcgi_path_info; - #Avoid sending the security headers twice - fastcgi_param modHeadersAvailable true; - fastcgi_param front_controller_active true; - fastcgi_pass php-handler; - fastcgi_intercept_errors on; - fastcgi_request_buffering off; - } - - location ~ ^/(?:updater|ocs-provider)(?:$|/) { - try_files $uri/ =404; - index index.php; - } - - # Adding the cache control header for js and css files - # Make sure it is BELOW the PHP block - location ~ \.(?:css|js|woff|svg|gif)$ { - try_files $uri /index.php$request_uri; - add_header Cache-Control "public, max-age=15778463"; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Robots-Tag none; - add_header X-Download-Options noopen; - add_header X-Permitted-Cross-Domain-Policies none; - add_header Referrer-Policy no-referrer; - - # Optional: Don't log access to assets - access_log off; - } - - location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { - try_files $uri /index.php$request_uri; - # Optional: Don't log access to other assets - access_log off; - } - } - - server { - listen 81; - listen [::]:81; - - # static files - location ^~ /loleaflet { - proxy_pass http://collabora:9980; - proxy_set_header Host $http_host; - } - - # WOPI discovery URL - location ^~ /hosting/discovery { - proxy_pass http://collabora:9980; - proxy_set_header Host $http_host; - } - - # main websocket - location ~ ^/lool/(.*)/ws$ { - proxy_pass http://collabora:9980; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "Upgrade"; - proxy_set_header Host $http_host; - proxy_read_timeout 36000s; - } - - # download, presentation and image upload - location ~ ^/lool { - proxy_pass http://collabora:9980; - proxy_set_header Host $http_host; - } - - # Admin Console websocket - location ^~ /lool/adminws { - proxy_pass http://collabora:9980; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "Upgrade"; - proxy_set_header Host $http_host; - proxy_read_timeout 36000s; - } - } } \ No newline at end of file diff --git a/templates/Nextcloud/0/docker-compose.yml b/templates/Nextcloud/0/docker-compose.yml index c6af9d7..4a001fb 100644 --- a/templates/Nextcloud/0/docker-compose.yml +++ b/templates/Nextcloud/0/docker-compose.yml @@ -11,8 +11,6 @@ services: - 1.0.0.1 environment: domain: collabora.${TRAEFIK_HOST} - expose: - - "9980" labels: io.rancher.container.pull_image: always {{- if .Values.HOST_LABEL}} @@ -20,6 +18,9 @@ services: {{- end}} traefik.enable: false restart: on-failure + volumes: + - Localtime:/etc/localtime:ro # Syncronize time of container with the host system + - Timezone:/etc/timezone:ro # Syncronize timezone of container with the host system {{- end}} cron: image: nextcloud:fpm-alpine @@ -30,13 +31,13 @@ services: sh -c 'sh -s <