Testing

templates/Nextcloud/0/Resources/conf.d/collabora.conf

@@ -0,0 +1,40 @@
+server {
+    listen 81;
+    listen [::]:81;
+    
+    # static files
+    location ^~ /loleaflet {
+        proxy_pass http://collabora:9980;
+        proxy_set_header Host $http_host;
+    }
+
+    # WOPI discovery URL
+    location ^~ /hosting/discovery {
+        proxy_pass http://collabora:9980;
+        proxy_set_header Host $http_host;
+    }
+
+    # main websocket
+    location ~ ^/lool/(.*)/ws$ {
+        proxy_pass http://collabora:9980;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $http_host;
+        proxy_read_timeout 36000s;
+    }
+    
+    # download, presentation and image upload
+    location ~ ^/lool {
+        proxy_pass http://collabora:9980;
+        proxy_set_header Host $http_host;
+    }
+    
+    # Admin Console websocket
+    location ^~ /lool/adminws {
+        proxy_pass http://collabora:9980;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host $http_host;
+        proxy_read_timeout 36000s;
+    }
+}

templates/Nextcloud/0/Resources/conf.d/nextcloud.conf

@@ -0,0 +1,69 @@
+upstream php-handler {
+    server nextcloud:9000;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    root /var/www/html/; # Path to the root of your installation
+
+    client_max_body_size 10G; # Max upload size
+    fastcgi_buffers 64 4K;
+
+    # Enable gzip but do not remove ETag headers
+    gzip off;
+
+    index index.php
+    error_page 403 /core/templates/403.php;
+    error_page 404 /core/templates/404.php;
+
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+    }
+
+    location = /.well-known/carddav {
+        return 301 $scheme://$host/remote.php/dav;
+    }
+
+    location = /.well-known/caldav {
+        return 301 $scheme://$host/remote.php/dav;
+    }
+
+
+
+    location / {
+        rewrite ^ /index.php$request_uri;
+    }
+
+    location ~ \.php(?:$|/) {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_pass php-handler;
+        fastcgi_intercept_errors on;
+    }
+
+    # Adding the cache control header for js and css files
+    # Make sure it is BELOW the location ~ \.php(?:$|/) { block
+    location ~* \.(?:css|js)$ {
+        add_header Cache-Control "public, max-age=7200";
+        # Add headers to serve security related headers
+        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
+        add_header X-Content-Type-Options nosniff;
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Robots-Tag none;
+        # Optional: Don't log access to assets
+        access_log off;
+    }
+
+    # Optional: Don't log access to other assets
+    location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$ {
+        access_log off;
+    }
+}

templates/Nextcloud/0/Resources/fastcgi_params

@@ -1,27 +1,21 @@
+fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
 fastcgi_param  QUERY_STRING       $query_string;
 fastcgi_param  REQUEST_METHOD     $request_method;
 fastcgi_param  CONTENT_TYPE       $content_type;
 fastcgi_param  CONTENT_LENGTH     $content_length;
-
-fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
 fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
-fastcgi_param   PATH_INFO               $fastcgi_path_info;
-fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info;
 fastcgi_param  REQUEST_URI        $request_uri;
 fastcgi_param  DOCUMENT_URI       $document_uri;
 fastcgi_param  DOCUMENT_ROOT      $document_root;
 fastcgi_param  SERVER_PROTOCOL    $server_protocol;
-
 fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
 fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
-
 fastcgi_param  REMOTE_ADDR        $remote_addr;
 fastcgi_param  REMOTE_PORT        $remote_port;
 fastcgi_param  SERVER_ADDR        $server_addr;
 fastcgi_param  SERVER_PORT        $server_port;
 fastcgi_param  SERVER_NAME        $server_name;
 
-fastcgi_param   HTTPS                   $https;
+fastcgi_index  index.php;
 
-# PHP only, required if PHP was built with --enable-force-cgi-redirect
 fastcgi_param  REDIRECT_STATUS    200;

templates/Nextcloud/0/Resources/nginx.conf

@@ -1,175 +1,79 @@
 user       www-data;
-worker_processes  1;
+worker_processes  auto;
-# worker_rlimit_nofile 8192;
 
-#error_log  /var/log/nginx/error.log warn;
+# error_log  /var/log/nginx.error_log  info; # [ debug | info | notice | warn | error | crit ]
 pid        /var/run/nginx.pid;
 
 events {
     worker_connections  1024;
+    use epoll; # use [ kqueue | rtsig | epoll | /dev/poll | select | poll ]
 }
 
 http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
 
+    #----------------------------------------
+    #           Logging
+    #----------------------------------------
+
+
+    # REFERENCE 1
     #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
     #                  '$status $body_bytes_sent "$http_referer" '
     #                  '"$http_user_agent" "$http_x_forwarded_for"';
     
     #access_log  /var/log/nginx/access.log  main;
 
-    sendfile     on;
+    # REFERENCE 2
-    #tcp_nopush   on;
+    #log_format main '$remote_addr - $host [$time_local] "$request" '
+    #                '$status $body_bytes_sent "$http_referer" '
+    #                '"$http_user_agent" "$http_x_forwarded_for"'
+    #                'rt=$request_time ut=$upstream_response_time '
+    #                'cs=$upstream_cache_status';
 
+    #log_format cache '$remote_addr - $host [$time_local] "$request" $status '
+    #                 '$body_bytes_sent "$http_referer" '
+    #                 'rt=$request_time ut=$upstream_response_time '
+    #                 'cs=$upstream_cache_status';
+
+    #access_log /var/log/nginx/access.log main;
+    #error_log /var/log/nginx/error.log warn;
+
+    #----------------------------------------
+    #           Basic Settings
+    #----------------------------------------
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
     keepalive_timeout  65;
 
-    upstream php-handler {
+    include /etc/nginx/mime.types;
-        server nextcloud:9000;
+    default_type application/octet-stream;
-    }
+
-
+    #----------------------------------------
-    server {
+    #           Common Limits
-        listen 80;
+    #----------------------------------------
-        listen [::]:80;
+
-
+    client_max_body_size 1G; # Max upload size
-        # Add headers to serve security related headers
+
-        add_header X-Content-Type-Options nosniff;
+    #----------------------------------------
-        add_header X-XSS-Protection "1; mode=block";
+    #           GZip
-        add_header X-Robots-Tag none;
+    #----------------------------------------
-        add_header X-Download-Options noopen;
+
-        add_header X-Permitted-Cross-Domain-Policies none;
+
-        add_header Referrer-Policy no-referrer;
+
-
+
-        # Remove X-Powered-By, which is an information leak
+
-        fastcgi_hide_header X-Powered-By;
+    #----------------------------------------
-
+    #           Cache
-        # Path to the root of your installation
+    #----------------------------------------
-        root /var/www/html/;
+
-
+    proxy_cache_valid 1m;
-        # Will test later
+
-        #error_page 403 /core/templates/403.php;
+    #----------------------------------------
-        #error_page 404 /core/templates/404.php;
+    #           Virtual Hosts
-
+    #----------------------------------------
-        location = /robots.txt {
+
-            allow all;
+    include /etc/nginx/conf.d/*.conf;
-            log_not_found off;
+
-            access_log off;
-        }
-
-        location = /.well-known/carddav {
-            return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location = /.well-known/caldav {
-            return 301 $scheme://$host/remote.php/dav;
-        }
-
-        # set max upload size
-        client_max_body_size 10G;
-        fastcgi_buffers 64 4K;
-
-        # Enable gzip but do not remove ETag headers
-        gzip on;
-        gzip_vary on;
-        gzip_comp_level 4;
-        gzip_min_length 256;
-        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-        location / {
-            rewrite ^ /index.php$request_uri;
-        }
-
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
-            deny all;
-        }
-
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
-            deny all;
-        }
-
-        location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
-            fastcgi_split_path_info ^(.+\.php)(/.*)$;
-            # Mitigate https://httpoxy.org/ vulnerabilities:
-            fastcgi_param HTTP_PROXY "";
-            #fastcgi_index index.php;
-            include fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
-            #Avoid sending the security headers twice
-            fastcgi_param modHeadersAvailable true;
-            fastcgi_param front_controller_active true;
-            fastcgi_pass php-handler;
-            fastcgi_intercept_errors on;
-            fastcgi_request_buffering off;
-        }
-
-        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
-            try_files $uri/ =404;
-            index index.php;
-        }
-
-        # Adding the cache control header for js and css files
-        # Make sure it is BELOW the PHP block
-        location ~ \.(?:css|js|woff|svg|gif)$ {
-            try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463";
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
-
-            # Optional: Don't log access to assets
-            access_log off;
-        }
-
-        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
-            try_files $uri /index.php$request_uri;
-            # Optional: Don't log access to other assets
-            access_log off;
-        }
-    }
-
-    server {
-        listen 81;
-        listen [::]:81;
-        
-        # static files
-        location ^~ /loleaflet {
-            proxy_pass http://collabora:9980;
-            proxy_set_header Host $http_host;
-        }
-
-        # WOPI discovery URL
-        location ^~ /hosting/discovery {
-            proxy_pass http://collabora:9980;
-            proxy_set_header Host $http_host;
-        }
-
-        # main websocket
-        location ~ ^/lool/(.*)/ws$ {
-            proxy_pass http://collabora:9980;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "Upgrade";
-            proxy_set_header Host $http_host;
-            proxy_read_timeout 36000s;
-        }
-        
-        # download, presentation and image upload
-        location ~ ^/lool {
-            proxy_pass http://collabora:9980;
-            proxy_set_header Host $http_host;
-        }
-        
-        # Admin Console websocket
-        location ^~ /lool/adminws {
-            proxy_pass http://collabora:9980;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "Upgrade";
-            proxy_set_header Host $http_host;
-            proxy_read_timeout 36000s;
-        }
-    }
 }

templates/Nextcloud/0/docker-compose.yml

@@ -11,8 +11,6 @@ services:
       - 1.0.0.1
     environment:
       domain: collabora.${TRAEFIK_HOST}
-    expose:
-      - "9980"
     labels:
       io.rancher.container.pull_image: always
       {{- if .Values.HOST_LABEL}}
@@ -20,6 +18,9 @@ services:
       {{- end}}
       traefik.enable: false
     restart: on-failure
+    volumes:
+      - Localtime:/etc/localtime:ro # Syncronize time of container with the host system
+      - Timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
   {{- end}}
   cron:
     image: nextcloud:fpm-alpine
@@ -30,13 +31,13 @@ services:
       sh -c 'sh -s <<EOF
       trap "break;exit" SIGHUP SIGINT SIGTERM
       while /bin/true; do
-        su -s "/bin/sh" -c "/usr/local/bin/php /var/www/html/cron.php" 82
+        su -s "/bin/sh" -c "/usr/local/bin/php /var/www/html/cron.php" www-data
         echo $$(date) - Running cron finished
         sleep 900
       done
       EOF'
     restart: on-failure
-    user: "82"
+    user: "www-data"
     volumes_from:
       - nginx
   nextcloud:
@@ -52,9 +53,6 @@ services:
       NEXTCLOUD_ADMIN_USER: ${NC_ADMIN}
       NEXTCLOUD_ADMIN_PASSWORD: ${NC_ADMIN_PASS}
       NEXTCLOUD_TRUSTED_DOMAINS: ${TRAEFIK_HOST}
-    expose:
-      - "80"
-      - "9000"
     labels:
       io.rancher.container.pull_image: always
       {{- if .Values.HOST_LABEL}}
@@ -114,13 +112,13 @@ services:
     {{- end}}
     restart: on-failure
     volumes:
-      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
+      - Localtime:/etc/localtime:ro # Syncronize time of container with the host system
-      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
+      - Timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
-      - /RancherCattle/${DATA_DIR}/Configuration/Nextcloud:/var/www/html/config # Nextcloud configuration files
+      - Apps:/var/www/html/custom_apps # Nextcloud apps
-      - /RancherCattle/${DATA_DIR}/Configuration/NGINX:/etc/nginx # NGINX configuration files
+      - Configuration-Nextcloud:/var/www/html/config # Nextcloud configuration files
-      - /RancherCattle/${DATA_DIR}/Apps:/var/www/html/custom_apps # Nextcloud apps
+      - Configuration-NGINX:/etc/nginx # NGINX configuration files
-      - /RancherCattle/${DATA_DIR}/Nextcloud:/var/www/html # Nextcloud site
+      - Nextcloud:/var/www/html # Nextcloud site
-      - /RancherCattle/${DATA_DIR}/UserData:/var/www/html/data # Users' data file
+      - UserData:/var/www/html/data # Users' data file
   mysql:
     image: mysql:5
     dns: # Using Cloudflare DNS
@@ -143,9 +141,9 @@ services:
           - nextcloud
     restart: on-failure
     volumes:
-      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
+      - Localtime:/etc/localtime:ro # Syncronize time of container with the host system
-      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
+      - Timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
-      - /RancherCattle/${DATA_DIR}/Database:/var/lib/mysql
+      - mysql:/var/lib/mysql
   {{- if eq .Values.REDIS "true"}}
   redis:
     image: redis:alpine
@@ -160,12 +158,58 @@ services:
       traefik.enable: false
     restart: on-failure
     volumes:
-      - /etc/localtime:/etc/localtime:ro # Syncronize time of container with the host system
+      - Localtime:/etc/localtime:ro # Syncronize time of container with the host system
-      - /etc/timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
+      - Timezone:/etc/timezone:ro # Syncronize timezone of container with the host system
   {{- end}}
 
-networks:
+volumes:
-  db-admin: 
+  Localtime:
-    external: true # Created by administrative stack (such as Adminer or phpMyAdmin)
+    driver_opts:
-  public-proxy:
+      type: none
-    external: true # Created by Traefik stack
+      device: /etc/localtime
+      o: bind
+  Timezone:
+    driver_opts:
+      type: none
+      device: /etc/timezone
+      o: bind
+  Database:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Database
+      o: bind
+  Configuration-Nextcloud:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Configuration/Nextcloud
+      o: bind
+  Configuration-NGINX:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Configuration/NGINX
+      o: bind
+  Apps:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Apps
+      o: bind
+  Nextcloud:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Nextcloud
+      o: bind
+  UserData:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/UserData
+      o: bind
+  Logs-Nextcloud:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Logs/Nextcloud
+      o: bind
+  Logs-NGINX:
+    driver_opts:
+      type: none
+      device: /RancherCattle/${DATA_DIR}/Logs/NGINX
+      o: bind