Update mariadb configuration (e450773e) · Commits · e / infra / ecloud-selfhosting

.env.example

+3 −2

Original line number	Diff line number	Diff line
		@@ -36,9 +36,10 @@ WELCOME_SECRET=123456
		WELCOME_SECRET_SHA=abcdefgh
		WEBSITE_SECRET=123456
		ECLOUD_ACCOUNTS_SECRET=123456
		CREATE_ACCOUNT_PASSWORD=123456

		# nextcloud
		NEXTCLOUD_DOCKER_IMG=registry.gitlab.e.foundation/e/infra/ecloud/nextcloud/selfhost:selfhost-dynamic-conf
		NEXTCLOUD_ADMIN_USER=admin
		NEXTCLOUD_ADMIN_PASSWORD=@adm1n
		NEXTCLOUD_ADMIN_PASSWORD=@dm1n
		NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=123456
		CREATE_ACCOUNT_PASSWORD=123456

config/mariadb/ecloud.cnf

deleted100644 → 0

+0 −32

Original line number	Diff line number	Diff line
		[server]
		skip_name_resolve = 1
		innodb_buffer_pool_size = 128M
		innodb_buffer_pool_instances = 1
		innodb_flush_log_at_trx_commit = 2
		innodb_log_buffer_size = 32M
		innodb_max_dirty_pages_pct = 90
		query_cache_type = 1
		query_cache_limit = 2M
		query_cache_min_res_unit = 2k
		query_cache_size = 64M
		tmp_table_size= 64M
		max_heap_table_size= 64M
		slow_query_log = 1
		slow_query_log_file = /var/log/mysql/slow.log
		long_query_time = 1

		[client-server]
		!includedir /etc/mysql/conf.d/
		!includedir /etc/mysql/mariadb.conf.d/

		[client]
		default-character-set = utf8mb4

		[mysqld]
		character_set_server = utf8mb4
		collation_server = utf8mb4_general_ci
		transaction_isolation = READ-COMMITTED
		binlog_format = ROW
		innodb_large_prefix=on
		innodb_file_format=barracuda
		innodb_file_per_table=1

config/nginx/templates/default.conf.template

+124 −81

Original line number	Diff line number	Diff line
		# Set the `immutable` cache control options only for assets with a cache busting `v` argument
		map $arg_v $asset_immutable {
		"" "";
		default ", immutable";
		}

		upstream php-handler {
		server nextcloud:9000;
		}
		@@ -7,119 +13,156 @@ server {
		listen [::]:80;
		server_name ${DOMAIN};

		root /var/www/html;
		# HSTS settings
		# WARNING: Only add the preload option once you read about
		# the consequences in https://hstspreload.org/. This option
		# will add the domain to a hardcoded list that is shipped
		# in all major browsers and getting removed from this list
		# could take several months.
		#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;

		# set max upload size and increase upload timeout:
		client_max_body_size 512M;
		client_body_timeout 300s;
		fastcgi_buffers 64 4K;

		# The settings allows you to optimize the HTTP2 bandwidth.
		# See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
		# for tuning hints
		client_body_buffer_size 512k;

		include /etc/nginx/params/ssl_params;
		# We include these headers directly because some are already set by Nextcloud.
		#include /etc/nginx/params/headers_params;
		add_header X-Content-Type-Options "nosniff" always;
		add_header X-XSS-Protection "1; mode=block";
		add_header Strict-Transport-Security "max-age=15768000";
		# Enable gzip but do not remove ETag headers
		gzip on;
		gzip_vary on;
		gzip_comp_level 4;
		gzip_min_length 256;
		gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
		gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

		# Pagespeed is not supported by Nextcloud, so if your server is built
		# with the `ngx_pagespeed` module, uncomment this line to disable it.
		#pagespeed off;

		# HTTP response headers borrowed from Nextcloud `.htaccess`
		add_header Referrer-Policy "no-referrer" always;
		add_header X-Content-Type-Options "nosniff" always;
		add_header X-Frame-Options "SAMEORIGIN" always;
		add_header X-Robots-Tag "noindex,nofollow" always;
		add_header X-Download-Options "noopen" always;
		add_header X-Permitted-Cross-Domain-Policies "none" always;
		add_header X-Robots-Tag "noindex, nofollow" always;
		add_header X-XSS-Protection "1; mode=block" always;

		# Remove X-Powered-By, which is an information leak
		fastcgi_hide_header X-Powered-By;
		server_tokens off;

		location = /.well-known/carddav {
		return 301 $scheme://$host/remote.php/dav;
		# Path to the root of your installation
		root /var/www/html;

		# Specify how to handle directories -- specifying `/index.php$request_uri`
		# here as the fallback means that Nginx always exhibits the desired behaviour
		# when a client requests a path that corresponds to a directory that exists
		# on the server. In particular, if that directory contains an index.php file,
		# that file is correctly served; if it doesn't, then the request is passed to
		# the front-end controller. This consistent behaviour means that we don't need
		# to specify custom rules for certain paths (e.g. images and other assets,
		# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
		# `try_files $uri $uri/ /index.php$request_uri`
		# always provides the desired behaviour.
		index index.php index.html /index.php$request_uri;

		# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
		location = / {
		if ( $http_user_agent ~ ^DavClnt ) {
		return 302 /remote.php/webdav/$is_args$args;
		}
		location = /.well-known/caldav {
		return 301 $scheme://$host/remote.php/dav;
		}

		location = /.well-known/webfinger {
		return 301 $scheme://$host/index.php$uri;
		}
		location = /.well-known/nodeinfo {
		return 301 $scheme://$host/index.php$uri;
		location = /robots.txt {
		allow all;
		log_not_found off;
		access_log off;
		}

		client_max_body_size 4096M;
		fastcgi_buffers 64 4K;
		# Make a regex exception for `/.well-known` so that clients can still
		# access it despite the existence of the regex rule
		# `location ~ /(\.\|autotest\|...)` which would otherwise handle requests
		# for `/.well-known`.
		location ^~ /.well-known {
		# The rules in this block are an adaptation of the rules
		# in `.htaccess` that concern `/.well-known`.

		fastcgi_connect_timeout 60;
		fastcgi_send_timeout 600;
		fastcgi_read_timeout 600;
		location = /.well-known/carddav { return 301 /remote.php/dav/; }
		location = /.well-known/caldav { return 301 /remote.php/dav/; }

		# Enable gzip but do not remove ETag headers
		gzip on;
		gzip_vary on;
		gzip_comp_level 4;
		gzip_min_length 256;
		gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
		# Enable compression for JS/CSS/HTML bundle, for improved client load times.
		# It might be nice to compress JSON, but leaving that out to protect against potential
		# compression+encryption information leak attacks like BREACH.
		gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
		location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
		location /.well-known/pki-validation { try_files $uri $uri/ =404; }


		location / {
		rewrite ^ /index.php;
		# Let Nextcloud's API for `/.well-known` URIs handle all other
		# requests by passing them to the front-end controller.
		return 301 /index.php$request_uri;
		}

		location ~ ^/(?:build\|tests\|config\|lib\|3rdparty\|templates\|data)/ {
		deny all;
		}
		location ~ ^/(?:\.\|autotest\|occ\|issue\|indie\|db_\|console) {
		deny all;
		}
		# Rules borrowed from `.htaccess` to hide certain paths from clients
		location ~ ^/(?:build\|tests\|config\|lib\|3rdparty\|templates\|data)(?:$\|/) { return 404; }
		location ~ ^/(?:\.\|autotest\|occ\|issue\|indie\|db_\|console) { return 404; }

		location ~ ^/(?:index\|remote\|public\|cron\|core/ajax/update\|status\|ocs/v[12]\|updater/.+\|ocs-provider/.+\|.+/richdocumentscode/proxy)\.php(?:$\|/) {
		fastcgi_split_path_info ^(.+?\.php)(/.*\|)$;
		# Ensure this block, which passes PHP files to the PHP process, is above the blocks
		# which handle static assets (as seen below). If this block is not declared first,
		# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
		# to the URI, resulting in a HTTP 500 error response.
		location ~ \.php(?:$\|/) {
		# Required for legacy support
		rewrite ^/(?!index\|remote\|public\|cron\|core\/ajax\/update\|status\|ocs\/v[12]\|updater\/.+\|ocs-provider\/.+\|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;

		fastcgi_split_path_info ^(.+?\.php)(/.*)$;
		set $path_info $fastcgi_path_info;

		try_files $fastcgi_script_name =404;

		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
		fastcgi_param PATH_INFO $path_info;
		#Avoid sending the security headers twice
		fastcgi_param modHeadersAvailable true;
		fastcgi_param front_controller_active true;
		#fastcgi_param HTTPS on;

		fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
		fastcgi_param front_controller_active true; # Enable pretty urls
		fastcgi_pass php-handler;

		fastcgi_intercept_errors on;
		fastcgi_request_buffering off;
		}

		location ~ ^/(?:updater\|ocs-provider)(?:$\|/) {
		try_files $uri/ =404;
		index index.php;
		fastcgi_max_temp_file_size 0;
		}

		# Adding the cache control header for js, css and map files
		# Make sure it is BELOW the PHP block
		location ~ \.(?:css\|js\|woff2?\|svg\|gif\|map)$ {
		# Serve static files
		location ~ \.(?:css\|js\|mjs\|svg\|gif\|ico\|jpg\|png\|webp\|wasm\|tflite\|map\|ogg\|flac)$ {
		try_files $uri /index.php$request_uri;
		add_header Cache-Control "public, max-age=15778463";
		# Add headers to serve security related headers (It is intended to
		# have those duplicated to the ones above)
		# Before enabling Strict-Transport-Security headers please read into
		# this topic first.
		#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
		#
		# WARNING: Only add the preload option once you read about
		# the consequences in https://hstspreload.org/. This option
		# will add the domain to a hardcoded list that is shipped
		# in all major browsers and getting removed from this list
		# could take several months.
		add_header Referrer-Policy "no-referrer" always;
		add_header X-Content-Type-Options "nosniff" always;
		add_header X-Download-Options "noopen" always;
		add_header X-Frame-Options "SAMEORIGIN" always;
		add_header X-Permitted-Cross-Domain-Policies "none" always;
		add_header X-Robots-Tag "none" always;
		add_header X-Robots-Tag "noindex, nofollow" always;
		add_header X-XSS-Protection "1; mode=block" always;
		access_log off; # Optional: Don't log access to assets

		# Optional: Don't log access to assets
		access_log off;
		location ~ \.wasm$ {
		default_type application/wasm;
		}
		}

		location ~ \.(?:png\|html\|ttf\|ico\|jpg\|jpeg\|bcmap\|mp4\|webm)$ {
		location ~ \.(otf\|woff2?)$ {
		try_files $uri /index.php$request_uri;
		# Optional: Don't log access to other assets
		access_log off;
		expires 7d; # Cache-Control policy borrowed from `.htaccess`
		access_log off; # Optional: Don't log access to assets
		}

		# Rule borrowed from `.htaccess`
		location /remote {
		return 301 /remote.php$request_uri;
		}

		location / {
		try_files $uri $uri/ /index.php$request_uri;
		}

		# For the Rainloop admin message saying "data folder accessible"

docker-compose.yml

+48 −31

Original line number	Diff line number	Diff line
		services:
		mariadb:
		image: mariadb:11.7
		restart: unless-stopped
		environment:
		- MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
		- MYSQL_DATABASE=${PFDB_DB}
		- MYSQL_USER=${DBUSER}
		- MYSQL_PASSWORD=${DBPASS}
		command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
		volumes:
		- ${DEPLOYMENT_PATH:-.}/volumes/mysql/db/data:/var/lib/mysql
		- ${DEPLOYMENT_PATH:-.}/config/mariadb/init.sql:/docker-entrypoint-initdb.d/init.sql
		healthcheck:
		test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
		start_period: 10s
		interval: 10s
		timeout: 5s
		retries: 3

		redis:
		image: redis:7.4-alpine
		restart: unless-stopped
		command: redis-server --maxmemory 8G --maxmemory-policy allkeys-lru
		volumes:
		- ${DEPLOYMENT_PATH:-.}/volumes/redis/db:/data

		mailserver:
		image: mailserver2/mailserver:1.1.22
		domainname: ${DOMAIN} # Mail server A/MX/FQDN & reverse PTR = mail.${DOMAIN}.
		@@ -56,25 +82,20 @@ services:
		- mailserver
		- mariadb

		mariadb:
		image: mariadb:11.7
		mail-autodiscover-autoconfig:
		image: wdes/mail-autodiscover-autoconfig:latest
		restart: unless-stopped
		environment:
		- MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
		- MYSQL_DATABASE=${PFDB_DB}
		- MYSQL_USER=${DBUSER}
		- MYSQL_PASSWORD=${DBPASS}
		volumes:
		- ${DEPLOYMENT_PATH:-.}/volumes/mysql/db/data:/var/lib/mysql
		- ${DEPLOYMENT_PATH:-.}/config/mariadb/:/etc/mysql/conf.d/:ro
		- ${DEPLOYMENT_PATH:-.}/config/mariadb/init.sql:/docker-entrypoint-initdb.d/init.sql

		redis:
		image: redis:7.4-alpine
		restart: unless-stopped
		command: redis-server --maxmemory 8G --maxmemory-policy allkeys-lru
		ROCKET_PROFILE: production
		ROCKET_ADDRESS: "0.0.0.0"
		ROCKET_PORT: "80"
		APPLE_MAIL_UUID: ${AUTODISCOVER_AM_UUID}
		APPLE_PROFILE_UUID: ${AUTODISCOVER_AP_UUID}
		IMAP_HOSTNAME: ${SMTP_HOST}
		POP_HOSTNAME: ${SMTP_HOST}
		SMTP_HOSTNAME: ${SMTP_HOST}
		volumes:
		- ${DEPLOYMENT_PATH:-.}/volumes/redis/db:/data
		- ${DEPLOYMENT_PATH:-.}/config/autodiscover/xml:/usr/lib/mail-autodiscover-autoconfig/templates/xml

		welcome:
		image: registry.gitlab.e.foundation/e/infra/docker-welcome:2.5.0
		@@ -109,7 +130,7 @@ services:
		# - "mail.${DOMAIN}:${NC_HOST_IP}"

		nextcloud:
		image: registry.gitlab.e.foundation/e/infra/ecloud/nextcloud/selfhost:selfhost-dynamic-conf
		image: ${NEXTCLOUD_DOCKER_IMG}
		restart: unless-stopped
		environment:
		- MYSQL_DATABASE=${MYSQL_DATABASE_NC}
		@@ -136,23 +157,19 @@ services:
		volumes:
		- ${DEPLOYMENT_PATH:-.}/volumes/nextcloud/html:/var/www/html
		depends_on:
		- mariadb
		- redis
		mariadb:
		condition: service_healthy
		redis:
		condition: service_started

		mail-autodiscover-autoconfig:
		image: wdes/mail-autodiscover-autoconfig:latest
		nextcloud-cron:
		image: ${NEXTCLOUD_DOCKER_IMG}
		restart: unless-stopped
		environment:
		ROCKET_PROFILE: production
		ROCKET_ADDRESS: "0.0.0.0"
		ROCKET_PORT: "80"
		APPLE_MAIL_UUID: ${AUTODISCOVER_AM_UUID}
		APPLE_PROFILE_UUID: ${AUTODISCOVER_AP_UUID}
		IMAP_HOSTNAME: ${SMTP_HOST}
		POP_HOSTNAME: ${SMTP_HOST}
		SMTP_HOSTNAME: ${SMTP_HOST}
		entrypoint: /cron.sh
		volumes:
		- ${DEPLOYMENT_PATH:-.}/config/autodiscover/xml:/usr/lib/mail-autodiscover-autoconfig/templates/xml
		- ${DEPLOYMENT_PATH:-.}/volumes/nextcloud/html:/var/www/html
		depends_on:
		- nextcloud

		nginx:
		image: nginx:stable-alpine