Make a slim Murena Nextcloud container

# When using dind, it's wise to use the overlayfs driver for

# improved performance.

variables:

  DOCKER_DRIVER: overlay2

  DOCKER_TLS_CERTDIR: "/certs"

default:

  image: docker:24.0.6

.docker:

  image: docker:28.0

  services:

    - docker:24.0.6-dind

    - docker:28.0-dind

  before_script:

    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY

    - echo $CI_JOB_TOKEN | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY

  tags:

    - generic_privileged

.build-docker:

  script:

    - echo "TARGET $TARGET, BRANCH $CI_COMMIT_BRANCH, COMMIT_REF_SLUG $CI_COMMIT_REF_SLUG, COMMIT_TAG $CI_COMMIT_TAG"

    - docker build --target $TARGET  --pull -t "$CI_REGISTRY_IMAGE$SUBPATH:$CI_COMMIT_REF_SLUG" .

    - docker push "$CI_REGISTRY_IMAGE$SUBPATH:$CI_COMMIT_REF_SLUG"

build-branch:

  stage: build

  variables:

    TARGET: ecloud

    SUBPATH: ''

  only:

    - branches

  extends: .build-docker

build-branch-selfhost:

build:

  extends: .docker

  stage: build

  variables:

    TARGET: selfhost

    SUBPATH: '/selfhost'

  only:

    - branches

  when: manual

  extends: .build-docker

  script:

    - docker build --target ecloud --pull -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG .

    - docker build --pull -t $CI_REGISTRY_IMAGE/slim:$CI_COMMIT_REF_SLUG -f slim.Dockerfile .

  rules:

    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

build-tag:

  stage: build

  variables:

    TARGET: ecloud

    SUBPATH: ''

  only:

    - tags

  extends: .build-docker

build-tag-selfhost:

  stage: build

  variables:

    TARGET: selfhost

    SUBPATH: '/selfhost'

  only:

    - tags

  extends: .build-docker

  extends: .docker

  stage: deploy

  script:

    - docker build --target ecloud --pull -t $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG/v/}

    - docker build --pull -t $CI_REGISTRY_IMAGE/slim:${CI_COMMIT_TAG/v/} -f slim.Dockerfile .

    - docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG/v/} .

    - docker push $CI_REGISTRY_IMAGE/slim:${CI_COMMIT_TAG/v/} -f slim.Dockerfile .

  rules:

    - if: '$CI_COMMIT_TAG'

    rsync $rsync_options --include "/notes/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/calendar/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/contacts/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/user_backend_sql_raw/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/email-recovery/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/ecloud-accounts/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/ecloud-theme-helper/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/murena_launcher/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/integration_google/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/ldap_write_support/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/murena-dashboard/" --exclude '/*' $SRC_DIR/custom_apps/ /$DST_DIR/custom_apps/

    rsync $rsync_options --include "/snappymail/" --exclude '/*' $SRC_DIR/custom_apps/ /$DST_DIR/custom_apps/

    rsync $rsync_options --include "/eCloud/" --exclude '/*' $SRC_DIR/themes/ $DST_DIR/themes/

    rsync $rsync_options --include "/Murena/" --exclude '/*' $SRC_DIR/themes/ $DST_DIR/themes/

    rsync $rsync_options --include "/memories/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/drop_account/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

    rsync $rsync_options --include "/selfhost-theme-helper/" --exclude '/*' $SRC_DIR/custom_apps/ $DST_DIR/custom_apps/

else

    echo "Skipping rsync step as version not updated!"

fi

if [ "$(id -u)" = 0 ]; then

    su -p www-data -s /bin/sh -c "php $DST_DIR/occ config:system:set profile.enabled --value=false --type=boolean"

else

    sh -c "php $DST_DIR/occ config:system:set profile.enabled --value=false --type=boolean"

fi

/entrypoint.sh "$@"

{

  "system": {

    "integrity.check.disabled": true,

    "profile.enabled": false,

    "defaultapp": "murena-dashboard,files",

    "theme": "eCloud",

    "filelocking.enabled": true,

    "loglevel": 2,

    "logfile": "${NEXTCLOUD_LOGFILE}",

    "cron_log": true,

    "enabledPreviewProviders": [

      "OC\\Preview\\PNG",

      "OC\\Preview\\JPEG",

      "OC\\Preview\\GIF",

      "OC\\Preview\\BMP",

      "OC\\Preview\\XBitmap",

      "OC\\Preview\\MP3",

      "OC\\Preview\\TXT",

      "OC\\Preview\\MarkDown",

      "OC\\Preview\\OpenDocument",

      "OC\\Preview\\Krita",

      "OC\\Preview\\Movie"

    ],

    "preview_max_x": 1024,

    "preview_max_y": 1024

  }

}

#!/bin/sh -e

SCRIPT_DIR=$(dirname "$0")

PATH=${PATH}:/var/www/html

# Apply configuration

sed -e "s|\${NEXTCLOUD_LOGFILE}|${NEXTCLOUD_LOGFILE:-nextcloud.log}|g" \

    "${SCRIPT_DIR}/murena-config.json" | occ config:import

# Update theme

occ maintenance:theme:update

echo "Enabling nextcloud apps"

occ app:enable calendar

occ app:enable notes

occ app:enable contacts

occ app:enable ecloud-theme-helper

occ app:enable murena-dashboard

occ app:enable murena_launcher

occ app:enable bruteforcesettings

occ app:enable suspicious_login

occ app:enable twofactor_totp

occ app:disable firstrunwizard

occ app:enable mail

occ app:enable tasks

occ app:enable sentry

echo "Performing some Nextcloud administrative tasks"

if [ -n "${MYSQL_DATABASE+x}" ]; then

  occ db:convert-mysql-charset

fi

occ db:convert-filecache-bigint --no-interaction

occ db:add-missing-indices

# Set background jobs to use system cron

occ background:cron

FROM nextcloud:29.0.14-apache AS nextcloud

ARG BASE_DIR="/usr/src/nextcloud"

ARG TMP_PATCH_DIR="/tmp/build_patches"

ARG NOTES_VERSION="4.11.0"

ARG CONTACTS_JOB_ID="881946"

ARG CALENDAR_JOB_ID="991372"

ARG THEME_HELPER_JOB_ID="1168069"

ARG THEME_VERSION="28.0.2"

ARG LAUNCHER_JOB_ID="1168135"

ARG DASHBOARD_JOB_ID="1168115"

ARG MAIL_URL="https://github.com/nextcloud-releases/mail/releases/download/v3.7.24/mail-stable3.7.tar.gz"

ARG TASKS_URL="https://github.com/nextcloud/tasks/releases/download/v0.16.1/tasks.tar.gz"

ARG SENTRY_URL="https://github.com/ChristophWurst/nextcloud_sentry/releases/download/v8.15.0/sentry-v8.15.0.tar.gz"

COPY custom_entrypoint.sh /

COPY hooks.d/post-installation/ /docker-entrypoint-hooks.d/post-installation/

RUN sed -i 's/29,0,14,1/29,0,14,2/' ${BASE_DIR}/version.php

RUN rm -rf ${BASE_DIR}/core/skeleton/* \

 && mkdir -p ${BASE_DIR}/core/skeleton/Documents \

 && mkdir -p ${BASE_DIR}/core/skeleton/Images

# Install unzip for unzipping artifacts

RUN apt-get update && apt-get install -y unzip ffmpeg

RUN curl -fsSL -o notes.tar.gz \

  "https://github.com/nextcloud-releases/notes/releases/download/v${NOTES_VERSION}/notes-v${NOTES_VERSION}.tar.gz" && \

  tar -xf notes.tar.gz -C ${BASE_DIR}/custom_apps/ && \

  rm notes.tar.gz;

# custom Contact

RUN curl -fsSL -o contacts.zip \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/contacts/-/jobs/${CONTACTS_JOB_ID}/artifacts/download" && \

  unzip contacts.zip && \

  mv dist/contacts ${BASE_DIR}/custom_apps/ && \

  rm contacts.zip;

RUN curl -fsSL -o calendar.zip \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/calendar/-/jobs/${CALENDAR_JOB_ID}/artifacts/download" && \

  unzip calendar.zip && \

  mv dist/calendar ${BASE_DIR}/custom_apps/ && \

  rm calendar.zip;

RUN curl -fsSL -o ecloud-theme-helper.zip \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/ecloud-theme-helper/-/jobs/${THEME_HELPER_JOB_ID}/artifacts/download" && \

  unzip ecloud-theme-helper.zip && \

  mv dist/ecloud-theme-helper ${BASE_DIR}/custom_apps/ && \

  rm ecloud-theme-helper.zip;

# Custom theme

RUN rm -rf ${BASE_DIR}/themes/eCloud && \

  curl -fsSL -o eCloud-theme.tar.gz \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/nextcloud-theme/-/archive/${THEME_VERSION}/nextcloud-theme-${THEME_VERSION}.tar.gz" && \

  tar -xf eCloud-theme.tar.gz -C /tmp/ && \

  mv /tmp/nextcloud-theme-${THEME_VERSION}/ ${BASE_DIR}/themes/eCloud && \

  chown -R www-data:www-data ${BASE_DIR}/themes/eCloud/ && \

  rm -rf eCloud-theme.tar.gz ${BASE_DIR}/themes/example/

RUN curl -fsSL -o murena_launcher.zip \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/launcher/-/jobs/${LAUNCHER_JOB_ID}/artifacts/download" && \

  unzip murena_launcher.zip && \

  mv dist/murena_launcher ${BASE_DIR}/custom_apps/ && \

  rm murena_launcher.zip;

RUN curl -fsSL -o ecloud-dashboard.zip \

  "https://gitlab.e.foundation/e/infra/ecloud/nextcloud-apps/murena-dashboard/-/jobs/${DASHBOARD_JOB_ID}/artifacts/download" && \

  unzip ecloud-dashboard.zip && \

  mv dist/murena-dashboard ${BASE_DIR}/custom_apps/ && \

  rm ecloud-dashboard.zip;

RUN bash -c "curl -sL ${MAIL_URL} | tar xzf - -C ${BASE_DIR}/custom_apps"

RUN bash -c "curl -sL ${TASKS_URL} | tar xzf - -C ${BASE_DIR}/custom_apps"

RUN bash -c "curl -sL ${SENTRY_URL} | tar xzf - -C ${BASE_DIR}/custom_apps"

# Patches

COPY patches/ ${TMP_PATCH_DIR}/

RUN cd ${BASE_DIR} \

 && patch -p0 < ${TMP_PATCH_DIR}/002-login-without-domain.patch \

 && patch -u ${BASE_DIR}/apps/settings/lib/Settings/Personal/ServerDevNotice.php -i ${TMP_PATCH_DIR}/007-remove-dev-notice.patch \

 && patch -p1 < ${TMP_PATCH_DIR}/009-help-links.patch \

 && patch -u ${BASE_DIR}/lib/private/Updater.php -i ${TMP_PATCH_DIR}/010-disable-app-store-upgrade.patch \

 && patch -p0 < ${TMP_PATCH_DIR}/011-privacy-settings.patch \

 && patch -u ${BASE_DIR}/lib/private/Authentication/Token/PublicKeyTokenProvider.php -i ${TMP_PATCH_DIR}/013-revert-token-password-update.patch \

 && patch -p0 < ${TMP_PATCH_DIR}/015-email-mail-template.patch \

 && patch -u ${BASE_DIR}/core/Command/User/Setting.php -i ${TMP_PATCH_DIR}/018-occ-user-setting.patch \

 && patch -u ${BASE_DIR}/3rdparty/sabre/vobject/lib/ITip/Broker.php -i ${TMP_PATCH_DIR}/022-significantchange.patch \

 && patch -p0 < ${TMP_PATCH_DIR}/026-primary-color-fix.patch \

 && patch -u ${BASE_DIR}/lib/private/Template/JSResourceLocator.php -i ${TMP_PATCH_DIR}/031-theme-custom-app-translations.patch \

 && patch -u ${BASE_DIR}/lib/private/L10N/Factory.php -i ${TMP_PATCH_DIR}/032-select-lang-from-session.patch \

 && patch -p1 < ${TMP_PATCH_DIR}/036-user-config-change-event.patch \

 && patch -u ${BASE_DIR}/core/templates/layout.user.php -i ${TMP_PATCH_DIR}/003-contact-search-removal.patch \

 && patch -u ${BASE_DIR}/core/Controller/ContactsMenuController.php -i ${TMP_PATCH_DIR}/004-contact-search-controller-removal.patch \

 && patch -p0 < ${TMP_PATCH_DIR}/005-autocomplete-user-leak-core.patch \

 && patch -u ${BASE_DIR}/core/templates/layout.guest.php -i ${TMP_PATCH_DIR}/016-login-screen.patch \

 && patch -u ${BASE_DIR}/lib/private/Notification/Manager.php -i ${TMP_PATCH_DIR}/020-fairuse-notification-fix.patch \

 && patch -u ${BASE_DIR}/lib/private/User/Manager.php -i ${TMP_PATCH_DIR}/025-optimize-get-by-email.patch \

 && patch -u ${BASE_DIR}/apps/dav/lib/Connector/Sabre/Principal.php -i ${TMP_PATCH_DIR}/027-displayname-user-leak-dav.patch \

 && patch -u ${BASE_DIR}/apps/dav/lib/HookManager.php -i ${TMP_PATCH_DIR}/028-default-task-calendar.patch \

 && patch -u ${BASE_DIR}/apps/provisioning_api/lib/Controller/UsersController.php -i ${TMP_PATCH_DIR}/029-restrict-user-to-change-primary-email.patch \

 && patch -u ${BASE_DIR}/lib/private/Security/VerificationToken/VerificationToken.php -i ${TMP_PATCH_DIR}/033-verification-token-private.patch \

 && patch -u ${BASE_DIR}/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php -i ${TMP_PATCH_DIR}/034-oidc-bearer-token-auth.patch \

 && rm -rf ${TMP_PATCH_DIR}

ENTRYPOINT ["/custom_entrypoint.sh"]

CMD ["apache2-foreground"]