From f4b96228a387a5a7b01faf3a5aed16afa614baf7 Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:19:19 +0530 Subject: [PATCH 01/13] Added local dev instructions --- README.md | 49 ++++++++++ ecloud_dev/.env.dev | 7 ++ ecloud_dev/data/.keep | 0 ecloud_dev/docker-compose.yml | 51 ++++++++++ ecloud_dev/html/.keep | 0 ecloud_dev/log/.keep | 0 ecloud_dev/nginx.conf | 169 ++++++++++++++++++++++++++++++++++ 7 files changed, 276 insertions(+) create mode 100644 ecloud_dev/.env.dev create mode 100644 ecloud_dev/data/.keep create mode 100644 ecloud_dev/docker-compose.yml create mode 100644 ecloud_dev/html/.keep create mode 100644 ecloud_dev/log/.keep create mode 100644 ecloud_dev/nginx.conf diff --git a/README.md b/README.md index fa798dec..7b31b98a 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,55 @@ Simply build as a standard docker image. Check `gitlab-ci.ym` for the commands w We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ecloud-selfhosting) project instead of this one directly. But if you wish to do so, then check our [releases page](https://gitlab.e.foundation/e/infra/ecloud/nextcloud/-/releases) and pull the latest tag from the container registry. +### To run ecloud locally(Tested on Ubuntu and Manjaro, should work on most linux distributions) + +- Install [docker](https://docs.docker.com/engine/install/ubuntu/)(link is for Ubuntu) +- Install [docker-compose](https://docs.docker.com/compose/install/) +- Go into the `ecloud_dev` directory after cloning this repository: `cd ecloud_dev` +- Add a `.env` file with chosen attributes(example [.env](./ecloud_dev/.env.dev) file here, you can rename to `.env` to use same defaults) +- Pull the images and up the containers + - `docker-compose pull` + - `docker-compose up -d` + +### Things to do on first installation locally + +- Set config values, disable integrity check and refresh theme cache: + + - `docker exec -u www-data ecloud /var/www/html/occ config:system:set theme --value='eCloud'` + - `docker exec -u www-data ecloud /var/www/html/occ config:system:set datadirectory --value='/var/www/data'` + - `docker exec -u www-data ecloud /var/www/html/occ config:system:set logfile --value='/var/www/log/nextcloud.log'` + - `docker exec -u www-data ecloud /var/www/html/occ config:system:set loglevel --value='2' --type=integer` + - `docker exec -u www-data ecloud /var/www/html/occ config:system:set integrity.check.disabled --value='true' --type=boolean` + - `docker exec -u www-data ecloud /var/www/html/occ maintenance:theme:update` + +- Disable apps: + + - `docker exec -u www-data ecloud /var/www/html/occ app:disable firstrunwizard` + - `docker exec -u www-data ecloud /var/www/html/occ app:disable theming` + - `docker exec -u www-data ecloud /var/www/html/occ app:disable files_external` + +- Enable\Install apps: + + - `docker exec -u www-data ecloud /var/www/html/occ app:enable ecloud-launcher` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable ecloud-theme-helper` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable notes` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable news` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable quota_warning` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable contacts` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable calendar` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable email-recovery` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable ecloud-accounts` + - `docker exec -u www-data ecloud /var/www/html/occ app:enable integration_google` + - To install more apps, use `docker exec -u www-data ecloud /var/www/html/occ app:install $app` where `$app` is the name of the app + +- Add a new group in your bash shell to make the `html` folder editable(run commands with `sudo` if required): + - `groupadd ecloud` + - `usermod -a -G ecloud http` + - `usermod -a -G ecloud $USER` + - `chgrp -R ecloud html` + - `chmod -R g+w html` + - Log out and log back into your system + ## Contributing Anyone can fork a project on our GitLab instance, but to prevent abuse it's disabled by default. Get in touch with us [by e-mail](mailto:join@e.email) or through our support channels and we will let you create a fork and submit MRs. diff --git a/ecloud_dev/.env.dev b/ecloud_dev/.env.dev new file mode 100644 index 00000000..523e08f9 --- /dev/null +++ b/ecloud_dev/.env.dev @@ -0,0 +1,7 @@ +MYSQL_ROOT_PASSWORD=iamroot +MYSQL_PASSWORD=iamnotroot +MYSQL_USER=nextcloud +NEXTCLOUD_ADMIN_USER=admin +NEXTCLOUD_ADMIN_PASSWORD=admin1234 +NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=abcd1234 +ECLOUD_ACCOUNTS_SECRET=1234abcd diff --git a/ecloud_dev/data/.keep b/ecloud_dev/data/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev/docker-compose.yml new file mode 100644 index 00000000..a2aa7a9e --- /dev/null +++ b/ecloud_dev/docker-compose.yml @@ -0,0 +1,51 @@ +version: "3" + +volumes: + html: + db: + +services: + mariadb: + image: mariadb:10.3 + container_name: mariadb + restart: always + command: --transaction-isolation=READ-COMMITTED --log-bin --binlog-format=ROW + volumes: + - ./db:/var/lib/mysql + environment: + - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} + - MYSQL_PASSWORD=${MYSQL_PASSWORD} + - MYSQL_DATABASE=nextcloud + - MYSQL_USER=${MYSQL_USER} + + nextcloud: + image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:ecloud-21.0.7.18-privacy + container_name: ecloud + restart: always + depends_on: + - mariadb + volumes: + - ./html:/var/www/html/ + - ./log:/var/www/log/ + - ./data:/var/www/data + environment: + - MYSQL_PASSWORD=${MYSQL_PASSWORD} + - MYSQL_DATABASE=nextcloud + - MYSQL_USER=${MYSQL_USER} + - MYSQL_HOST=mariadb + - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER} + - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD} + - NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=${NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET} + - ECLOUD_ACCOUNTS_SECRET=${ECLOUD_ACCOUNTS_SECRET} + + nginx: + image: nginx:1.19-alpine + container_name: nginx + restart: always + ports: + - 8080:80 + depends_on: + - nextcloud + volumes: + - ./nginx.conf:/etc/nginx/nginx.conf:ro + - ./html:/var/www/html diff --git a/ecloud_dev/html/.keep b/ecloud_dev/html/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/log/.keep b/ecloud_dev/log/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/nginx.conf b/ecloud_dev/nginx.conf new file mode 100644 index 00000000..4f6cd516 --- /dev/null +++ b/ecloud_dev/nginx.conf @@ -0,0 +1,169 @@ +worker_processes auto; + +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + upstream php-handler { + server nextcloud:9000; + } + + server { + listen 80; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Path to the root of your installation + root /var/www/html; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + # The following 2 rules are only needed for the user_webfinger app. + # Uncomment it if you're planning to use this app. + #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; + #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; + + # The following rule is only needed for the Social app. + # Uncomment it if you're planning to use this app. + #rewrite ^/.well-known/webfinger /public.php?service=webfinger last; + + location = /.well-known/carddav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + location = /.well-known/caldav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + # set max upload size + client_max_body_size 10G; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Uncomment if your server is build with the ngx_pagespeed module + # This module is currently not supported. + #pagespeed off; + + location / { + rewrite ^ /index.php; + } + + location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { + deny all; + } + location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } + + location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { + fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + # fastcgi_param HTTPS on; + + # Avoid sending the security headers twice + fastcgi_param modHeadersAvailable true; + + # Enable pretty urls + fastcgi_param front_controller_active true; + fastcgi_pass php-handler; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { + try_files $uri/ =404; + index index.php; + } + + # Adding the cache control header for js, css and map files + # Make sure it is BELOW the PHP block + location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + try_files $uri /index.php$request_uri; + add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers (It is intended to + # have those duplicated to the ones above) + # Before enabling Strict-Transport-Security headers please read into + # this topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Optional: Don't log access to assets + access_log off; + } + + location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { + try_files $uri /index.php$request_uri; + # Optional: Don't log access to other assets + access_log off; + } + } +} + -- GitLab From 751e54a21315ad47665003d1895134e779985f60 Mon Sep 17 00:00:00 2001 From: Akhil Date: Wed, 2 Mar 2022 14:52:16 +0000 Subject: [PATCH 02/13] Update nginx.conf --- ecloud_dev/nginx.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ecloud_dev/nginx.conf b/ecloud_dev/nginx.conf index 4f6cd516..19eccabe 100644 --- a/ecloud_dev/nginx.conf +++ b/ecloud_dev/nginx.conf @@ -72,7 +72,7 @@ http { # Uncomment it if you're planning to use this app. #rewrite ^/.well-known/webfinger /public.php?service=webfinger last; - location = /.well-known/carddav { + location = /.well-known/carddav { return 301 $scheme://$host:$server_port/remote.php/dav; } -- GitLab From ee3989501e03e5b0ff3da1683edb957c95e34b30 Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:31:02 +0530 Subject: [PATCH 03/13] .dev.env and ECLOUD_IMAGE_TAG --- README.md | 2 +- ecloud_dev/{.env.dev => .dev.env} | 2 ++ ecloud_dev/docker-compose.yml | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) rename ecloud_dev/{.env.dev => .dev.env} (83%) diff --git a/README.md b/README.md index 7b31b98a..7babbc7e 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - Install [docker](https://docs.docker.com/engine/install/ubuntu/)(link is for Ubuntu) - Install [docker-compose](https://docs.docker.com/compose/install/) - Go into the `ecloud_dev` directory after cloning this repository: `cd ecloud_dev` -- Add a `.env` file with chosen attributes(example [.env](./ecloud_dev/.env.dev) file here, you can rename to `.env` to use same defaults) +- Add a `.env` file with chosen attributes(example [.env](./ecloud_dev/.dev.env) file here, you can rename to `.env` to use same defaults) - Pull the images and up the containers - `docker-compose pull` - `docker-compose up -d` diff --git a/ecloud_dev/.env.dev b/ecloud_dev/.dev.env similarity index 83% rename from ecloud_dev/.env.dev rename to ecloud_dev/.dev.env index 523e08f9..d059435a 100644 --- a/ecloud_dev/.env.dev +++ b/ecloud_dev/.dev.env @@ -5,3 +5,5 @@ NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=admin1234 NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=abcd1234 ECLOUD_ACCOUNTS_SECRET=1234abcd + +ECLOUD_IMAGE_TAG=ecloud-21.0.7.18-privacy diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev/docker-compose.yml index a2aa7a9e..ccbb5f85 100644 --- a/ecloud_dev/docker-compose.yml +++ b/ecloud_dev/docker-compose.yml @@ -19,7 +19,7 @@ services: - MYSQL_USER=${MYSQL_USER} nextcloud: - image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:ecloud-21.0.7.18-privacy + image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:${ECLOUD_IMAGE_TAG} container_name: ecloud restart: always depends_on: -- GitLab From d60292eb620ddfcf284be8cd1f739f8dc16524c2 Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:36:16 +0530 Subject: [PATCH 04/13] ecloud_dev -> ecloud_dev_example --- README.md | 5 +++-- {ecloud_dev => ecloud_dev_example}/.dev.env | 0 {ecloud_dev => ecloud_dev_example}/data/.keep | 0 {ecloud_dev => ecloud_dev_example}/docker-compose.yml | 0 {ecloud_dev => ecloud_dev_example}/html/.keep | 0 {ecloud_dev => ecloud_dev_example}/log/.keep | 0 {ecloud_dev => ecloud_dev_example}/nginx.conf | 0 7 files changed, 3 insertions(+), 2 deletions(-) rename {ecloud_dev => ecloud_dev_example}/.dev.env (100%) rename {ecloud_dev => ecloud_dev_example}/data/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/docker-compose.yml (100%) rename {ecloud_dev => ecloud_dev_example}/html/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/log/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/nginx.conf (100%) diff --git a/README.md b/README.md index 7babbc7e..42c7fbe9 100644 --- a/README.md +++ b/README.md @@ -14,8 +14,9 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - Install [docker](https://docs.docker.com/engine/install/ubuntu/)(link is for Ubuntu) - Install [docker-compose](https://docs.docker.com/compose/install/) -- Go into the `ecloud_dev` directory after cloning this repository: `cd ecloud_dev` -- Add a `.env` file with chosen attributes(example [.env](./ecloud_dev/.dev.env) file here, you can rename to `.env` to use same defaults) +- Create a copy of the `ecloud_dev_example` directory locally where you want to install an `ecloud` development environment +- Use `cd` or file manager to enter the above directory +- Add a `.env` file with chosen attributes(example [.env](./ecloud_dev_example/.dev.env) file here, you can rename to `.env` to use same defaults) - Pull the images and up the containers - `docker-compose pull` - `docker-compose up -d` diff --git a/ecloud_dev/.dev.env b/ecloud_dev_example/.dev.env similarity index 100% rename from ecloud_dev/.dev.env rename to ecloud_dev_example/.dev.env diff --git a/ecloud_dev/data/.keep b/ecloud_dev_example/data/.keep similarity index 100% rename from ecloud_dev/data/.keep rename to ecloud_dev_example/data/.keep diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev_example/docker-compose.yml similarity index 100% rename from ecloud_dev/docker-compose.yml rename to ecloud_dev_example/docker-compose.yml diff --git a/ecloud_dev/html/.keep b/ecloud_dev_example/html/.keep similarity index 100% rename from ecloud_dev/html/.keep rename to ecloud_dev_example/html/.keep diff --git a/ecloud_dev/log/.keep b/ecloud_dev_example/log/.keep similarity index 100% rename from ecloud_dev/log/.keep rename to ecloud_dev_example/log/.keep diff --git a/ecloud_dev/nginx.conf b/ecloud_dev_example/nginx.conf similarity index 100% rename from ecloud_dev/nginx.conf rename to ecloud_dev_example/nginx.conf -- GitLab From 2d2192cf02b1f5412c2fa443af4057e002217a35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Arnau=20V=C3=A0zquez?= Date: Wed, 2 Mar 2022 15:44:37 +0000 Subject: [PATCH 05/13] Apply 1 suggestion(s) to 1 file(s) --- ecloud_dev_example/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ecloud_dev_example/docker-compose.yml b/ecloud_dev_example/docker-compose.yml index ccbb5f85..91ec0e85 100644 --- a/ecloud_dev_example/docker-compose.yml +++ b/ecloud_dev_example/docker-compose.yml @@ -39,7 +39,7 @@ services: - ECLOUD_ACCOUNTS_SECRET=${ECLOUD_ACCOUNTS_SECRET} nginx: - image: nginx:1.19-alpine + image: nginx:1.20-alpine container_name: nginx restart: always ports: -- GitLab From c9c9c7b60fa882529b98c282ef685e684899e1ae Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 21:55:02 +0530 Subject: [PATCH 06/13] following volumes/config convention --- README.md | 4 ++-- ecloud_dev_example/{ => config/nginx}/nginx.conf | 0 ecloud_dev_example/docker-compose.yml | 16 ++++++---------- ecloud_dev_example/{ => volumes/db}/data/.keep | 0 .../{html => volumes/nextcloud/data}/.keep | 0 .../{log => volumes/nextcloud/html}/.keep | 0 ecloud_dev_example/volumes/nextcloud/log/.keep | 0 7 files changed, 8 insertions(+), 12 deletions(-) rename ecloud_dev_example/{ => config/nginx}/nginx.conf (100%) rename ecloud_dev_example/{ => volumes/db}/data/.keep (100%) rename ecloud_dev_example/{html => volumes/nextcloud/data}/.keep (100%) rename ecloud_dev_example/{log => volumes/nextcloud/html}/.keep (100%) create mode 100644 ecloud_dev_example/volumes/nextcloud/log/.keep diff --git a/README.md b/README.md index 42c7fbe9..fa1528b9 100644 --- a/README.md +++ b/README.md @@ -56,8 +56,8 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - `groupadd ecloud` - `usermod -a -G ecloud http` - `usermod -a -G ecloud $USER` - - `chgrp -R ecloud html` - - `chmod -R g+w html` + - `chgrp -R ecloud volumes/nextcloud/html` + - `chmod -R g+w volumes/nextcloud/html` - Log out and log back into your system ## Contributing diff --git a/ecloud_dev_example/nginx.conf b/ecloud_dev_example/config/nginx/nginx.conf similarity index 100% rename from ecloud_dev_example/nginx.conf rename to ecloud_dev_example/config/nginx/nginx.conf diff --git a/ecloud_dev_example/docker-compose.yml b/ecloud_dev_example/docker-compose.yml index 91ec0e85..9dd49107 100644 --- a/ecloud_dev_example/docker-compose.yml +++ b/ecloud_dev_example/docker-compose.yml @@ -1,9 +1,5 @@ version: "3" -volumes: - html: - db: - services: mariadb: image: mariadb:10.3 @@ -11,7 +7,7 @@ services: restart: always command: --transaction-isolation=READ-COMMITTED --log-bin --binlog-format=ROW volumes: - - ./db:/var/lib/mysql + - ./volumes/db/data:/var/lib/mysql environment: - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} - MYSQL_PASSWORD=${MYSQL_PASSWORD} @@ -25,9 +21,9 @@ services: depends_on: - mariadb volumes: - - ./html:/var/www/html/ - - ./log:/var/www/log/ - - ./data:/var/www/data + - ./volumes/nextcloud/html:/var/www/html/ + - ./volumes/nextcloud/log:/var/www/log/ + - ./volumes/nextcloud/data:/var/www/data environment: - MYSQL_PASSWORD=${MYSQL_PASSWORD} - MYSQL_DATABASE=nextcloud @@ -47,5 +43,5 @@ services: depends_on: - nextcloud volumes: - - ./nginx.conf:/etc/nginx/nginx.conf:ro - - ./html:/var/www/html + - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - ./volumes/nextcloud/html:/var/www/html diff --git a/ecloud_dev_example/data/.keep b/ecloud_dev_example/volumes/db/data/.keep similarity index 100% rename from ecloud_dev_example/data/.keep rename to ecloud_dev_example/volumes/db/data/.keep diff --git a/ecloud_dev_example/html/.keep b/ecloud_dev_example/volumes/nextcloud/data/.keep similarity index 100% rename from ecloud_dev_example/html/.keep rename to ecloud_dev_example/volumes/nextcloud/data/.keep diff --git a/ecloud_dev_example/log/.keep b/ecloud_dev_example/volumes/nextcloud/html/.keep similarity index 100% rename from ecloud_dev_example/log/.keep rename to ecloud_dev_example/volumes/nextcloud/html/.keep diff --git a/ecloud_dev_example/volumes/nextcloud/log/.keep b/ecloud_dev_example/volumes/nextcloud/log/.keep new file mode 100644 index 00000000..e69de29b -- GitLab From 7b8a29acd1880cad2dfb4ed3c72de64402261239 Mon Sep 17 00:00:00 2001 From: akhil Date: Thu, 3 Mar 2022 15:25:27 +0530 Subject: [PATCH 07/13] added data dir as env var --- README.md | 2 -- ecloud_dev_example/docker-compose.yml | 1 + 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index fa1528b9..bf224fd3 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,6 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - Set config values, disable integrity check and refresh theme cache: - `docker exec -u www-data ecloud /var/www/html/occ config:system:set theme --value='eCloud'` - - `docker exec -u www-data ecloud /var/www/html/occ config:system:set datadirectory --value='/var/www/data'` - `docker exec -u www-data ecloud /var/www/html/occ config:system:set logfile --value='/var/www/log/nextcloud.log'` - `docker exec -u www-data ecloud /var/www/html/occ config:system:set loglevel --value='2' --type=integer` - `docker exec -u www-data ecloud /var/www/html/occ config:system:set integrity.check.disabled --value='true' --type=boolean` @@ -54,7 +53,6 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - Add a new group in your bash shell to make the `html` folder editable(run commands with `sudo` if required): - `groupadd ecloud` - - `usermod -a -G ecloud http` - `usermod -a -G ecloud $USER` - `chgrp -R ecloud volumes/nextcloud/html` - `chmod -R g+w volumes/nextcloud/html` diff --git a/ecloud_dev_example/docker-compose.yml b/ecloud_dev_example/docker-compose.yml index 9dd49107..21f736aa 100644 --- a/ecloud_dev_example/docker-compose.yml +++ b/ecloud_dev_example/docker-compose.yml @@ -31,6 +31,7 @@ services: - MYSQL_HOST=mariadb - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER} - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD} + - NEXTCLOUD_DATA_DIR=/var/www/data - NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=${NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET} - ECLOUD_ACCOUNTS_SECRET=${ECLOUD_ACCOUNTS_SECRET} -- GitLab From c6be6982a0deac12084989e49ff5623d92044769 Mon Sep 17 00:00:00 2001 From: akhil Date: Thu, 3 Mar 2022 17:40:23 +0530 Subject: [PATCH 08/13] Update README --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index bf224fd3..16d13869 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,8 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - Create a copy of the `ecloud_dev_example` directory locally where you want to install an `ecloud` development environment - Use `cd` or file manager to enter the above directory - Add a `.env` file with chosen attributes(example [.env](./ecloud_dev_example/.dev.env) file here, you can rename to `.env` to use same defaults) +- Set correct permissions to volumes: + - `chown -R '33':'33' volumes/nextcloud/{html,data,log}` - Pull the images and up the containers - `docker-compose pull` - `docker-compose up -d` @@ -51,10 +53,8 @@ We suggest you use our [ecloud-selfhosting](https://gitlab.e.foundation/e/infra/ - `docker exec -u www-data ecloud /var/www/html/occ app:enable integration_google` - To install more apps, use `docker exec -u www-data ecloud /var/www/html/occ app:install $app` where `$app` is the name of the app -- Add a new group in your bash shell to make the `html` folder editable(run commands with `sudo` if required): - - `groupadd ecloud` - - `usermod -a -G ecloud $USER` - - `chgrp -R ecloud volumes/nextcloud/html` +- To make the `html` folder editable to current user(`$USER`)(run commands with `sudo` if required): + - `usermod -a -G '33' $USER` - `chmod -R g+w volumes/nextcloud/html` - Log out and log back into your system -- GitLab From 0a9cc1c84fefd527c1021789a7310aa7b7fb3b45 Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:19:19 +0530 Subject: [PATCH 09/13] Merge nc-21 into local-dev --- ecloud_dev/.env.dev | 7 ++ ecloud_dev/data/.keep | 0 ecloud_dev/docker-compose.yml | 51 ++++++++++ ecloud_dev/html/.keep | 0 ecloud_dev/log/.keep | 0 ecloud_dev/nginx.conf | 169 ++++++++++++++++++++++++++++++++++ 6 files changed, 227 insertions(+) create mode 100644 ecloud_dev/.env.dev create mode 100644 ecloud_dev/data/.keep create mode 100644 ecloud_dev/docker-compose.yml create mode 100644 ecloud_dev/html/.keep create mode 100644 ecloud_dev/log/.keep create mode 100644 ecloud_dev/nginx.conf diff --git a/ecloud_dev/.env.dev b/ecloud_dev/.env.dev new file mode 100644 index 00000000..523e08f9 --- /dev/null +++ b/ecloud_dev/.env.dev @@ -0,0 +1,7 @@ +MYSQL_ROOT_PASSWORD=iamroot +MYSQL_PASSWORD=iamnotroot +MYSQL_USER=nextcloud +NEXTCLOUD_ADMIN_USER=admin +NEXTCLOUD_ADMIN_PASSWORD=admin1234 +NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=abcd1234 +ECLOUD_ACCOUNTS_SECRET=1234abcd diff --git a/ecloud_dev/data/.keep b/ecloud_dev/data/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev/docker-compose.yml new file mode 100644 index 00000000..a2aa7a9e --- /dev/null +++ b/ecloud_dev/docker-compose.yml @@ -0,0 +1,51 @@ +version: "3" + +volumes: + html: + db: + +services: + mariadb: + image: mariadb:10.3 + container_name: mariadb + restart: always + command: --transaction-isolation=READ-COMMITTED --log-bin --binlog-format=ROW + volumes: + - ./db:/var/lib/mysql + environment: + - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} + - MYSQL_PASSWORD=${MYSQL_PASSWORD} + - MYSQL_DATABASE=nextcloud + - MYSQL_USER=${MYSQL_USER} + + nextcloud: + image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:ecloud-21.0.7.18-privacy + container_name: ecloud + restart: always + depends_on: + - mariadb + volumes: + - ./html:/var/www/html/ + - ./log:/var/www/log/ + - ./data:/var/www/data + environment: + - MYSQL_PASSWORD=${MYSQL_PASSWORD} + - MYSQL_DATABASE=nextcloud + - MYSQL_USER=${MYSQL_USER} + - MYSQL_HOST=mariadb + - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER} + - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD} + - NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=${NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET} + - ECLOUD_ACCOUNTS_SECRET=${ECLOUD_ACCOUNTS_SECRET} + + nginx: + image: nginx:1.19-alpine + container_name: nginx + restart: always + ports: + - 8080:80 + depends_on: + - nextcloud + volumes: + - ./nginx.conf:/etc/nginx/nginx.conf:ro + - ./html:/var/www/html diff --git a/ecloud_dev/html/.keep b/ecloud_dev/html/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/log/.keep b/ecloud_dev/log/.keep new file mode 100644 index 00000000..e69de29b diff --git a/ecloud_dev/nginx.conf b/ecloud_dev/nginx.conf new file mode 100644 index 00000000..4f6cd516 --- /dev/null +++ b/ecloud_dev/nginx.conf @@ -0,0 +1,169 @@ +worker_processes auto; + +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + upstream php-handler { + server nextcloud:9000; + } + + server { + listen 80; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Path to the root of your installation + root /var/www/html; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + # The following 2 rules are only needed for the user_webfinger app. + # Uncomment it if you're planning to use this app. + #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; + #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; + + # The following rule is only needed for the Social app. + # Uncomment it if you're planning to use this app. + #rewrite ^/.well-known/webfinger /public.php?service=webfinger last; + + location = /.well-known/carddav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + location = /.well-known/caldav { + return 301 $scheme://$host:$server_port/remote.php/dav; + } + + # set max upload size + client_max_body_size 10G; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Uncomment if your server is build with the ngx_pagespeed module + # This module is currently not supported. + #pagespeed off; + + location / { + rewrite ^ /index.php; + } + + location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { + deny all; + } + location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } + + location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { + fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + # fastcgi_param HTTPS on; + + # Avoid sending the security headers twice + fastcgi_param modHeadersAvailable true; + + # Enable pretty urls + fastcgi_param front_controller_active true; + fastcgi_pass php-handler; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { + try_files $uri/ =404; + index index.php; + } + + # Adding the cache control header for js, css and map files + # Make sure it is BELOW the PHP block + location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + try_files $uri /index.php$request_uri; + add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers (It is intended to + # have those duplicated to the ones above) + # Before enabling Strict-Transport-Security headers please read into + # this topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Optional: Don't log access to assets + access_log off; + } + + location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { + try_files $uri /index.php$request_uri; + # Optional: Don't log access to other assets + access_log off; + } + } +} + -- GitLab From e70e50fbc27d87b4984bf03c223adb1142e90b80 Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:31:02 +0530 Subject: [PATCH 10/13] .dev.env and ECLOUD_IMAGE_TAG --- ecloud_dev/{.env.dev => .dev.env} | 2 ++ ecloud_dev/docker-compose.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) rename ecloud_dev/{.env.dev => .dev.env} (83%) diff --git a/ecloud_dev/.env.dev b/ecloud_dev/.dev.env similarity index 83% rename from ecloud_dev/.env.dev rename to ecloud_dev/.dev.env index 523e08f9..d059435a 100644 --- a/ecloud_dev/.env.dev +++ b/ecloud_dev/.dev.env @@ -5,3 +5,5 @@ NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=admin1234 NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=abcd1234 ECLOUD_ACCOUNTS_SECRET=1234abcd + +ECLOUD_IMAGE_TAG=ecloud-21.0.7.18-privacy diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev/docker-compose.yml index a2aa7a9e..ccbb5f85 100644 --- a/ecloud_dev/docker-compose.yml +++ b/ecloud_dev/docker-compose.yml @@ -19,7 +19,7 @@ services: - MYSQL_USER=${MYSQL_USER} nextcloud: - image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:ecloud-21.0.7.18-privacy + image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:${ECLOUD_IMAGE_TAG} container_name: ecloud restart: always depends_on: -- GitLab From 7ef3f15be3241e5c104af8050d09856052a18a2d Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 20:36:16 +0530 Subject: [PATCH 11/13] ecloud_dev -> ecloud_dev_example --- ecloud_dev/.dev.env | 9 ---- ecloud_dev/docker-compose.yml | 51 ------------------- {ecloud_dev => ecloud_dev_example}/data/.keep | 0 {ecloud_dev => ecloud_dev_example}/html/.keep | 0 {ecloud_dev => ecloud_dev_example}/log/.keep | 0 {ecloud_dev => ecloud_dev_example}/nginx.conf | 0 6 files changed, 60 deletions(-) delete mode 100644 ecloud_dev/.dev.env delete mode 100644 ecloud_dev/docker-compose.yml rename {ecloud_dev => ecloud_dev_example}/data/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/html/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/log/.keep (100%) rename {ecloud_dev => ecloud_dev_example}/nginx.conf (100%) diff --git a/ecloud_dev/.dev.env b/ecloud_dev/.dev.env deleted file mode 100644 index d059435a..00000000 --- a/ecloud_dev/.dev.env +++ /dev/null @@ -1,9 +0,0 @@ -MYSQL_ROOT_PASSWORD=iamroot -MYSQL_PASSWORD=iamnotroot -MYSQL_USER=nextcloud -NEXTCLOUD_ADMIN_USER=admin -NEXTCLOUD_ADMIN_PASSWORD=admin1234 -NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=abcd1234 -ECLOUD_ACCOUNTS_SECRET=1234abcd - -ECLOUD_IMAGE_TAG=ecloud-21.0.7.18-privacy diff --git a/ecloud_dev/docker-compose.yml b/ecloud_dev/docker-compose.yml deleted file mode 100644 index ccbb5f85..00000000 --- a/ecloud_dev/docker-compose.yml +++ /dev/null @@ -1,51 +0,0 @@ -version: "3" - -volumes: - html: - db: - -services: - mariadb: - image: mariadb:10.3 - container_name: mariadb - restart: always - command: --transaction-isolation=READ-COMMITTED --log-bin --binlog-format=ROW - volumes: - - ./db:/var/lib/mysql - environment: - - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} - - MYSQL_PASSWORD=${MYSQL_PASSWORD} - - MYSQL_DATABASE=nextcloud - - MYSQL_USER=${MYSQL_USER} - - nextcloud: - image: registry.gitlab.e.foundation:5000/e/infra/ecloud/nextcloud:${ECLOUD_IMAGE_TAG} - container_name: ecloud - restart: always - depends_on: - - mariadb - volumes: - - ./html:/var/www/html/ - - ./log:/var/www/log/ - - ./data:/var/www/data - environment: - - MYSQL_PASSWORD=${MYSQL_PASSWORD} - - MYSQL_DATABASE=nextcloud - - MYSQL_USER=${MYSQL_USER} - - MYSQL_HOST=mariadb - - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER} - - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD} - - NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET=${NEXTCLOUD_EMAIL_RECOVERY_APP_SECRET} - - ECLOUD_ACCOUNTS_SECRET=${ECLOUD_ACCOUNTS_SECRET} - - nginx: - image: nginx:1.19-alpine - container_name: nginx - restart: always - ports: - - 8080:80 - depends_on: - - nextcloud - volumes: - - ./nginx.conf:/etc/nginx/nginx.conf:ro - - ./html:/var/www/html diff --git a/ecloud_dev/data/.keep b/ecloud_dev_example/data/.keep similarity index 100% rename from ecloud_dev/data/.keep rename to ecloud_dev_example/data/.keep diff --git a/ecloud_dev/html/.keep b/ecloud_dev_example/html/.keep similarity index 100% rename from ecloud_dev/html/.keep rename to ecloud_dev_example/html/.keep diff --git a/ecloud_dev/log/.keep b/ecloud_dev_example/log/.keep similarity index 100% rename from ecloud_dev/log/.keep rename to ecloud_dev_example/log/.keep diff --git a/ecloud_dev/nginx.conf b/ecloud_dev_example/nginx.conf similarity index 100% rename from ecloud_dev/nginx.conf rename to ecloud_dev_example/nginx.conf -- GitLab From 17d3f7b1733fcd3107f602dd5cb8e44aa59b35ad Mon Sep 17 00:00:00 2001 From: akhil Date: Wed, 2 Mar 2022 21:55:02 +0530 Subject: [PATCH 12/13] following volumes/config convention --- ecloud_dev_example/data/.keep | 0 ecloud_dev_example/html/.keep | 0 ecloud_dev_example/log/.keep | 0 3 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 ecloud_dev_example/data/.keep delete mode 100644 ecloud_dev_example/html/.keep delete mode 100644 ecloud_dev_example/log/.keep diff --git a/ecloud_dev_example/data/.keep b/ecloud_dev_example/data/.keep deleted file mode 100644 index e69de29b..00000000 diff --git a/ecloud_dev_example/html/.keep b/ecloud_dev_example/html/.keep deleted file mode 100644 index e69de29b..00000000 diff --git a/ecloud_dev_example/log/.keep b/ecloud_dev_example/log/.keep deleted file mode 100644 index e69de29b..00000000 -- GitLab From b712aae3f478149bbaf51cc9d9668aeecd4a8d7e Mon Sep 17 00:00:00 2001 From: akhil Date: Fri, 4 Mar 2022 15:25:56 +0530 Subject: [PATCH 13/13] Remove nginx.conf --- ecloud_dev_example/nginx.conf | 169 ---------------------------------- 1 file changed, 169 deletions(-) delete mode 100644 ecloud_dev_example/nginx.conf diff --git a/ecloud_dev_example/nginx.conf b/ecloud_dev_example/nginx.conf deleted file mode 100644 index 4f6cd516..00000000 --- a/ecloud_dev_example/nginx.conf +++ /dev/null @@ -1,169 +0,0 @@ -worker_processes auto; - -error_log /var/log/nginx/error.log warn; -pid /var/run/nginx.pid; - - -events { - worker_connections 1024; -} - - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - - sendfile on; - #tcp_nopush on; - - keepalive_timeout 65; - - #gzip on; - - upstream php-handler { - server nextcloud:9000; - } - - server { - listen 80; - - # Add headers to serve security related headers - # Before enabling Strict-Transport-Security headers please read into this - # topic first. - #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; - # - # WARNING: Only add the preload option once you read about - # the consequences in https://hstspreload.org/. This option - # will add the domain to a hardcoded list that is shipped - # in all major browsers and getting removed from this list - # could take several months. - add_header Referrer-Policy "no-referrer" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-Download-Options "noopen" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header X-Robots-Tag "none" always; - add_header X-XSS-Protection "1; mode=block" always; - - # Remove X-Powered-By, which is an information leak - fastcgi_hide_header X-Powered-By; - - # Path to the root of your installation - root /var/www/html; - - location = /robots.txt { - allow all; - log_not_found off; - access_log off; - } - - # The following 2 rules are only needed for the user_webfinger app. - # Uncomment it if you're planning to use this app. - #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; - #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; - - # The following rule is only needed for the Social app. - # Uncomment it if you're planning to use this app. - #rewrite ^/.well-known/webfinger /public.php?service=webfinger last; - - location = /.well-known/carddav { - return 301 $scheme://$host:$server_port/remote.php/dav; - } - - location = /.well-known/caldav { - return 301 $scheme://$host:$server_port/remote.php/dav; - } - - # set max upload size - client_max_body_size 10G; - fastcgi_buffers 64 4K; - - # Enable gzip but do not remove ETag headers - gzip on; - gzip_vary on; - gzip_comp_level 4; - gzip_min_length 256; - gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; - gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; - - # Uncomment if your server is build with the ngx_pagespeed module - # This module is currently not supported. - #pagespeed off; - - location / { - rewrite ^ /index.php; - } - - location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { - deny all; - } - location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { - deny all; - } - - location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { - fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; - set $path_info $fastcgi_path_info; - try_files $fastcgi_script_name =404; - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $path_info; - # fastcgi_param HTTPS on; - - # Avoid sending the security headers twice - fastcgi_param modHeadersAvailable true; - - # Enable pretty urls - fastcgi_param front_controller_active true; - fastcgi_pass php-handler; - fastcgi_intercept_errors on; - fastcgi_request_buffering off; - } - - location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { - try_files $uri/ =404; - index index.php; - } - - # Adding the cache control header for js, css and map files - # Make sure it is BELOW the PHP block - location ~ \.(?:css|js|woff2?|svg|gif|map)$ { - try_files $uri /index.php$request_uri; - add_header Cache-Control "public, max-age=15778463"; - # Add headers to serve security related headers (It is intended to - # have those duplicated to the ones above) - # Before enabling Strict-Transport-Security headers please read into - # this topic first. - #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; - # - # WARNING: Only add the preload option once you read about - # the consequences in https://hstspreload.org/. This option - # will add the domain to a hardcoded list that is shipped - # in all major browsers and getting removed from this list - # could take several months. - add_header Referrer-Policy "no-referrer" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-Download-Options "noopen" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header X-Robots-Tag "none" always; - add_header X-XSS-Protection "1; mode=block" always; - - # Optional: Don't log access to assets - access_log off; - } - - location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { - try_files $uri /index.php$request_uri; - # Optional: Don't log access to other assets - access_log off; - } - } -} - -- GitLab