From a41f7089618f2e05e48d85605011f7914075d057 Mon Sep 17 00:00:00 2001 From: Martin Beckert Date: Wed, 8 Jul 2026 16:25:11 +0200 Subject: [PATCH 1/4] Remove config from .env.example --- .env.example | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.env.example b/.env.example index a85f24a..35c32b0 100644 --- a/.env.example +++ b/.env.example @@ -57,25 +57,19 @@ CLAMAV_AV_BLOCK_UNREACHABLE=yes # installer # Several variables are set in the 'phpfpm' section PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_HOST=${PWD}/configs/installer/nextcloud_config_default.php -# PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_HOST=/your/absolute/path/to/configs/installer/nextcloud_config.php PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_CONTAINER=/etc/nextcloud_config.php PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_HOST=${PWD}/configs/installer/entrypoint_default.sh -# PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_HOST=/your/absolute/path/to/configs/installer/entrypoint.sh PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_CONTAINER=/etc/entrypoint.sh PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_HOST=${PWD}/configs/installer/nextcloud_setup_default.sh -# PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_HOST=/your/absolute/path/to/configs/installer/nextcloud_setup.sh PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_CONTAINER=/etc/nextcloud_setup.sh # manager PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_HOST=${PWD}/configs/manager/configure_notify_push_default.sh -# PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_HOST=/your/absolute/path/to/configs/manager/configure_notify_push.sh PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_CONTAINER=/etc/configure_notify_push.sh PODMAN_MANAGER_CRON_ROOT_FILE_HOST=${PWD}/configs/manager/cron/root_default -# PODMAN_MANAGER_CRON_ROOT_FILE_HOST=/your/absolute/path/to/configs/manager/cron/cron_root PODMAN_MANAGER_CRON_ROOT_FILE_CONTAINER=/etc/crontabs/root PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_HOST=${PWD}/configs/manager/entrypoint_default.sh -# PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_HOST=/your/absolute/path/to/configs/manager/entrypoint.sh PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_CONTAINER=/etc/entrypoint.sh # mariadb @@ -110,13 +104,10 @@ NGINX_INTERNAL_URL=https://nginx:8443 PODMAN_NEXTCLOUDPHPFPM_IMAGE=ghcr.io/strukturpiloten/nextcloud-phpfpm:latest PODMAN_NEXTCLOUDPHPFPM_PULL_POLICY=missing PODMAN_PHPFPM_CONF_FILE_HOST=${PWD}/configs/phpfpm/conf/zzz-www_default.conf -# PODMAN_PHPFPM_CONF_FILE_HOST=/your/absolute/path/to/configs/phpfpm/conf/zzz-www.conf PODMAN_PHPFPM_CONF_FILE_CONTAINER=/usr/local/etc/php-fpm.d/zzz-www.conf PODMAN_PHPFPM_INI_FILE_HOST=${PWD}/configs/phpfpm/ini/nextcloud_default.ini -# PODMAN_PHPFPM_INI_FILE_HOST=/your/absolute/path/to/configs/phpfpm/ini/nextcloud.ini PODMAN_PHPFPM_INI_FILE_CONTAINER=/usr/local/etc/php/conf.d/nextcloud.ini PODMAN_PHPFPM_HEALTHCHECK_FILE_HOST=${PWD}/configs/phpfpm/nextcloud_status_default.php -# PODMAN_PHPFPM_HEALTHCHECK_FILE_HOST=/your/absolute/path/to/configs/phpfpm/nextcloud_status.php PODMAN_PHPFPM_HEALTHCHECK_FILE_CONTAINER=/etc/nextcloud_status.php # postgres From 285608f412c8657e71aff1b7fba50b2ba546b425 Mon Sep 17 00:00:00 2001 From: Martin Beckert Date: Wed, 8 Jul 2026 16:25:31 +0200 Subject: [PATCH 2/4] Add strukturpiloten/container-setup --- deps/container-setup/.gitignore | 6 ++ deps/container-setup/setup.sh | 157 ++++++++++++++++++++++++++++++++ 2 files changed, 163 insertions(+) create mode 100644 deps/container-setup/.gitignore create mode 100755 deps/container-setup/setup.sh diff --git a/deps/container-setup/.gitignore b/deps/container-setup/.gitignore new file mode 100644 index 0000000..7522c64 --- /dev/null +++ b/deps/container-setup/.gitignore @@ -0,0 +1,6 @@ +# Ignore everything +* + +# except: +!.gitignore +!setup.sh diff --git a/deps/container-setup/setup.sh b/deps/container-setup/setup.sh new file mode 100755 index 0000000..a140d96 --- /dev/null +++ b/deps/container-setup/setup.sh @@ -0,0 +1,157 @@ +#!/usr/bin/env sh +set -eu +unset CDPATH + +CONTAINER_SETUP_VERSION="v1.2.0" +CONTAINER_SETUP_REPOSITORY="Strukturpiloten/container-setup" + +die() { + printf '%s\n' "Error: $*" >&2 + exit 1 +} + +command_exists() { + command -v "$1" >/dev/null 2>&1 +} + +detect_os() { + case "$(uname -s)" in + Linux*) + printf '%s\n' "linux" + ;; + Darwin*) + printf '%s\n' "darwin" + ;; + CYGWIN*|MINGW*|MSYS*) + printf '%s\n' "windows" + ;; + *) + die "Unsupported operating system: $(uname -s)" + ;; + esac +} + +detect_arch() { + case "$(uname -m)" in + x86_64|amd64) + printf '%s\n' "amd64" + ;; + arm64|aarch64) + printf '%s\n' "arm64" + ;; + *) + die "Unsupported CPU architecture: $(uname -m)" + ;; + esac +} + +resolve_project_dir() { + entrypoint_dir=$1 + + if [ -f "$entrypoint_dir/setup.yaml" ]; then + printf '%s\n' "$entrypoint_dir" + return + fi + + parent_project_dir=$(cd "$entrypoint_dir/../.." 2>/dev/null && pwd -P || true) + if [ -n "$parent_project_dir" ] && [ -f "$parent_project_dir/setup.yaml" ]; then + printf '%s\n' "$parent_project_dir" + return + fi + + printf '%s\n' "$entrypoint_dir" +} + +is_container_setup_dir() { + module_file="$1/go.mod" + [ -f "$module_file" ] || return 1 + grep -q '^module github.com/strukturpiloten/container-setup$' "$module_file" +} + +set_platform_variables() { + os_name=$(detect_os) + architecture=$(detect_arch) + binary_name="setup" + asset="setup_${CONTAINER_SETUP_VERSION}_${os_name}_${architecture}" + + if [ "$os_name" = "windows" ]; then + binary_name="setup.exe" + asset="${asset}.exe" + fi + + binary_path="$binary_dir/$binary_name" + checksums="setup_${CONTAINER_SETUP_VERSION}_checksums.txt" + release_url="https://github.com/${CONTAINER_SETUP_REPOSITORY}/releases/download/${CONTAINER_SETUP_VERSION}" +} + +verify_checksum() { + checksum_dir=$1 + asset_name=$2 + checksums_name=$3 + checksum_line=$(awk -v asset="$asset_name" '$2 == asset { print }' "$checksum_dir/$checksums_name") + + [ -n "$checksum_line" ] || die "Checksum for $asset_name was not found in $checksums_name" + + if command_exists sha256sum; then + printf '%s\n' "$checksum_line" | (cd "$checksum_dir" && sha256sum -c -) >/dev/null + return + fi + + if command_exists shasum; then + expected_checksum=$(printf '%s\n' "$checksum_line" | awk '{ print $1 }') + actual_checksum=$(shasum -a 256 "$checksum_dir/$asset_name" | awk '{ print $1 }') + [ "$actual_checksum" = "$expected_checksum" ] || die "Checksum verification failed for $asset_name" + return + fi + + die "sha256sum or shasum is required to verify the downloaded setup binary" +} + +download_setup() { + command_exists curl || die "curl is required to download container-setup" + + mkdir -p "$binary_dir" + + installed_asset="" + if [ -f "$version_file" ]; then + installed_asset=$(cat "$version_file") + fi + + if [ -x "$binary_path" ] && [ "$installed_asset" = "$asset" ]; then + return + fi + + tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/container-setup.XXXXXXXXXX") || die "Could not create temporary download directory" + trap 'rm -rf "$tmp_dir"' EXIT + trap 'rm -rf "$tmp_dir"; exit 1' HUP INT TERM + + printf 'Downloading %s...\n' "$asset" + curl -fsSL -o "$tmp_dir/$asset" "$release_url/$asset" || die "Could not download $asset" + curl -fsSL -o "$tmp_dir/$checksums" "$release_url/$checksums" || die "Could not download $checksums" + + verify_checksum "$tmp_dir" "$asset" "$checksums" + + cp "$tmp_dir/$asset" "$binary_path" + chmod 0755 "$binary_path" + printf '%s\n' "$asset" > "$version_file" + + rm -rf "$tmp_dir" + trap - EXIT HUP INT TERM +} + +entrypoint_dir=$(cd "$(dirname "$0")" && pwd -P) +project_dir=$(resolve_project_dir "$entrypoint_dir") + +if is_container_setup_dir "$entrypoint_dir"; then + binary_dir="$entrypoint_dir" +else + binary_dir="$project_dir/deps/container-setup" +fi + +version_file="$binary_dir/.container-setup-version" + +set_platform_variables +download_setup + +cd "$project_dir" +exec "$binary_path" --project-dir "$project_dir" "$@" \ No newline at end of file From 202dae424e7fe8b42ed9a6ea317ea7a36e8997d8 Mon Sep 17 00:00:00 2001 From: Martin Beckert Date: Wed, 8 Jul 2026 16:27:11 +0200 Subject: [PATCH 3/4] Update License to AGPL 3 --- LICENSE | 149 ++++++++++++++++++++++++++------------------------------ 1 file changed, 68 insertions(+), 81 deletions(-) diff --git a/LICENSE b/LICENSE index f288702..0ad25db 100644 --- a/LICENSE +++ b/LICENSE @@ -1,5 +1,5 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies @@ -7,17 +7,15 @@ Preamble - The GNU General Public License is a free, copyleft license for -software and other kinds of works. + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to +our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. +software for all its users. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you @@ -26,44 +24,34 @@ them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. The precise terms and conditions for copying, distribution and modification follow. @@ -72,7 +60,7 @@ modification follow. 0. Definitions. - "This License" refers to version 3 of the GNU General Public License. + "This License" refers to version 3 of the GNU Affero General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. @@ -549,35 +537,45 @@ to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. - 13. Use with the GNU Affero General Public License. + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single +under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General +Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published +GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's +versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. @@ -635,40 +633,29 @@ the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or + it under the terms of the GNU Affero General Public License as published + by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. + GNU Affero General Public License for more details. - You should have received a copy of the GNU General Public License + You should have received a copy of the GNU Affero General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see +For more information on this, and how to apply and follow the GNU AGPL, see . - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. From e92f95a20a5906ebcc50e8f1296abb9dabbdec20 Mon Sep 17 00:00:00 2001 From: Martin Beckert Date: Wed, 8 Jul 2026 17:27:11 +0200 Subject: [PATCH 4/4] Migrate to new setup --- .env.example => .env.tmpl | 173 +++++++------ .github/renovate.json | 201 +++++++++++++++ .gitignore | 4 + compose.yaml => compose.yaml.tmpl | 111 ++++----- configs/nginx/conf/.gitignore | 2 +- ...fault.conf => nextcloud_default.conf.tmpl} | 7 +- deps/container-setup/setup.sh | 2 +- renovate.json | 113 --------- setup.sh | 1 + setup.yaml | 228 ++++++++++++++++++ 10 files changed, 574 insertions(+), 268 deletions(-) rename .env.example => .env.tmpl (64%) create mode 100644 .github/renovate.json rename compose.yaml => compose.yaml.tmpl (88%) rename configs/nginx/conf/{nextcloud_default.conf => nextcloud_default.conf.tmpl} (98%) delete mode 100644 renovate.json create mode 120000 setup.sh create mode 100644 setup.yaml diff --git a/.env.example b/.env.tmpl similarity index 64% rename from .env.example rename to .env.tmpl index 35c32b0..435ff73 100644 --- a/.env.example +++ b/.env.tmpl @@ -1,40 +1,28 @@ -# Copy this file to '.env' -PODMAN_NAMESPACE=yourcompanyname -PODMAN_SERVICE=nextcloud -PODMAN_STAGE=prod - -# User and group IDs and names running the containers -# Depending on your system setup ${UID}, ${GID} and ${USER} may not be set -# You can uncomment and set them manually if needed -# Some containers may need to be run with names instead of IDs, so all four variable values must be provided -PODMAN_USER_UID=${UID} -PODMAN_GROUP_GID=${GID} -# PODMAN_USER_UID= -# PODMAN_GROUP_GID= - -# SQL database -# 'mariadb' for MariaDB -# 'postgres' for Postgres -PODMAN_SQL_DATABASE=postgres -PODMAN_SQL_DATABASE_REQUIRED_MARIADB=false -PODMAN_SQL_DATABASE_REQUIRED_POSTGRES=true - -# Key-value database -# 'redis' for Redis -# 'valkey' for Valkey -PODMAN_KEY_VALUE_DATABASE=valkey -PODMAN_KEY_VALUE_DATABASE_REQUIRED_REDIS=false -PODMAN_KEY_VALUE_DATABASE_REQUIRED_VALKEY=true +# Podman namespace used for all containers, volumes and networks. +PODMAN_NAMESPACE={{ .PodmanNamespace }} +PODMAN_SERVICE={{ .PodmanService }} +PODMAN_STAGE={{ .PodmanStage }} +# User and group IDs running the containers. +PODMAN_USER_UID={{ .UserUID }} +PODMAN_GROUP_GID={{ .GroupGID }} + +# DatabaseSQL +DATABASE_SQL_SERVICE={{ .DatabaseSQLService }} +# DatabaseKeyValue +DATABASE_KEY_VALUE_SERVICE={{ .DatabaseKeyValueService }} + +{{ if not .UseReverseProxy -}} # SSL -PODMAN_SSL_DIR_HOST=/your/absolute/path/to/configs/ssl +PODMAN_SSL_DIR_HOST={{ .SSLDir }} +{{ end -}} # clamav # https://hub.docker.com/r/clamav/clamav/ PODMAN_CLAMAV_IMAGE=docker.io/clamav/clamav:1.5.3@sha256:6f4a9e7d616ffc8d1070200fe35ac860735fdd522161a1043f94856e6ee13c28 -PODMAN_CLAMAV_DATA_DIR_HOST=/your/absolute/path/to/data/clamav_data +PODMAN_CLAMAV_DATA_DIR_HOST={{ .DataDir }}/clamav_data PODMAN_CLAMAV_DATA_DIR_CONTAINER=/var/lib/clamav -PODMAN_CLAMAV_LOG_DIR_HOST=/your/absolute/path/to/data/clamav_log +PODMAN_CLAMAV_LOG_DIR_HOST={{ .DataDir }}/clamav_log PODMAN_CLAMAV_LOG_DIR_CONTAINER=/var/log/clamav CLAMAV_AV_HOST=clamav @@ -53,114 +41,119 @@ CLAMAV_AV_ICAP_TLS=0 CLAMAV_AV_BLOCK_UNSCANNABLE=0 CLAMAV_AV_BLOCK_UNREACHABLE=yes - # installer -# Several variables are set in the 'phpfpm' section -PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_HOST=${PWD}/configs/installer/nextcloud_config_default.php +# Several variables are set in the 'phpfpm' section. +PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_HOST={{ .DataDir }}/configs/installer/nextcloud_config_default.php PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_CONTAINER=/etc/nextcloud_config.php -PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_HOST=${PWD}/configs/installer/entrypoint_default.sh +PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_HOST={{ .DataDir }}/configs/installer/entrypoint_default.sh PODMAN_INSTALLER_ENTRYPOINT_SCRIPT_FILE_CONTAINER=/etc/entrypoint.sh -PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_HOST=${PWD}/configs/installer/nextcloud_setup_default.sh +PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_HOST={{ .DataDir }}/configs/installer/nextcloud_setup_default.sh PODMAN_INSTALLER_NEXTCLOUD_SETUP_SCRIPT_FILE_CONTAINER=/etc/nextcloud_setup.sh - # manager -PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_HOST=${PWD}/configs/manager/configure_notify_push_default.sh +PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_HOST={{ .DataDir }}/configs/manager/configure_notify_push_default.sh PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_CONTAINER=/etc/configure_notify_push.sh -PODMAN_MANAGER_CRON_ROOT_FILE_HOST=${PWD}/configs/manager/cron/root_default +PODMAN_MANAGER_CRON_ROOT_FILE_HOST={{ .DataDir }}/configs/manager/cron/root_default PODMAN_MANAGER_CRON_ROOT_FILE_CONTAINER=/etc/crontabs/root -PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_HOST=${PWD}/configs/manager/entrypoint_default.sh +PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_HOST={{ .DataDir }}/configs/manager/entrypoint_default.sh PODMAN_MANAGER_ENTRYPOINT_SCRIPT_FILE_CONTAINER=/etc/entrypoint.sh +{{ if .UseMariaDB -}} # mariadb # https://hub.docker.com/_/mariadb PODMAN_MARIADB_IMAGE=docker.io/mariadb:11.4.12-ubi9@sha256:9667dd3add213bfc6b27b8f2a86cf9dd8eebf96ac0732e57ea22d460862acae1 # Uncomment if you want to use a custom mariadb.conf file: -# PODMAN_MARIADB_CONF_FILE_HOST=/your/absolute/path/to/configs/mariadb/mariadb.conf +# PODMAN_MARIADB_CONF_FILE_HOST={{ .DataDir }}/configs/mariadb/mariadb.conf # PODMAN_MARIADB_CONF_FILE_CONTAINER=/etc/mariadb/mariadb.conf -PODMAN_MARIADB_DATA_DIR_HOST=/your/absolute/path/to/data/mariadb +PODMAN_MARIADB_DATA_DIR_HOST={{ .DataDir }}/mariadb PODMAN_MARIADB_DATA_DIR_CONTAINER=/var/lib/mysql -MARIADB_HOST=mariadb -MARIADB_DB=nextcloud -MARIADB_USER=nextcloud -MARIADB_PASSWORD='a_secure_password' -MARIADB_ROOT_PASSWORD='a_secure_password' +DATABASE_SQL_HOST=mariadb +DATABASE_SQL_PORT=3306 +DATABASE_SQL_NAME=nextcloud +DATABASE_SQL_USER=nextcloud +DATABASE_SQL_PASSWORD='{{ .Password.DatabaseSQLPassword }}' +MARIADB_ROOT_PASSWORD='{{ .Password.MariaDBRootPassword }}' # Will always be used (true) if it's not empty # Set to = (without value) if you don't want to use it (false) MARIADB_AUTO_UPGRADE=this_variable_is_used_when_not_empty +{{ end -}} +{{ if .UsePostgreSQL -}} +# postgresql +# https://hub.docker.com/_/postgres +PODMAN_POSTGRES_IMAGE=docker.io/postgres:17.10-alpine3.24@sha256:67f624a4ad70edba8d65c82341124fab7054b277b4f7dea4b04be6f939ce2314 +# Uncomment if you want to use a custom postgresql.conf file: +# PODMAN_POSTGRES_CONF_FILE_HOST={{ .DataDir }}/configs/postgres/postgres.conf +# PODMAN_POSTGRES_CONF_FILE_CONTAINER=/etc/postgresql/postgresql.conf +PODMAN_POSTGRES_DATA_DIR_HOST={{ .DataDir }}/postgres +PODMAN_POSTGRES_DATA_DIR_CONTAINER=/var/lib/postgresql/data + +DATABASE_SQL_HOST=postgres +DATABASE_SQL_PORT=5432 +DATABASE_SQL_NAME=nextcloud +DATABASE_SQL_USER=nextcloud +DATABASE_SQL_PASSWORD='{{ .Password.DatabaseSQLPassword }}' + +{{ end -}} # nginx # https://hub.docker.com/r/nginxinc/nginx-unprivileged PODMAN_NGINX_IMAGE=docker.io/nginxinc/nginx-unprivileged:1.31.2-alpine3.23@sha256:592b23aa79a6e6c08ba4b20f1fff700e1328895705966722608e115d62e52d39 -PODMAN_NGINX_CONF_DIR_HOST=/your/absolute/path/to/configs/nginx/conf +PODMAN_NGINX_CONF_DIR_HOST={{ .DataDir }}/configs/nginx/conf PODMAN_NGINX_CONF_DIR_CONTAINER=/etc/nginx/conf.d - PODMAN_NGINX_SSL_DIR_CONTAINER=/etc/ssl/nginx + +{{ if .UseReverseProxy -}} +NGINX_INTERNAL_URL=http://nginx:8080 +{{ else -}} NGINX_INTERNAL_URL=https://nginx:8443 +{{- end }} # phpfpm # https://github.com/Strukturpiloten/nextcloud-phpfpm/pkgs/container/nextcloud-phpfpm PODMAN_NEXTCLOUDPHPFPM_IMAGE=ghcr.io/strukturpiloten/nextcloud-phpfpm:latest PODMAN_NEXTCLOUDPHPFPM_PULL_POLICY=missing -PODMAN_PHPFPM_CONF_FILE_HOST=${PWD}/configs/phpfpm/conf/zzz-www_default.conf +PODMAN_PHPFPM_CONF_FILE_HOST={{ .DataDir }}/configs/phpfpm/conf/zzz-www_default.conf PODMAN_PHPFPM_CONF_FILE_CONTAINER=/usr/local/etc/php-fpm.d/zzz-www.conf -PODMAN_PHPFPM_INI_FILE_HOST=${PWD}/configs/phpfpm/ini/nextcloud_default.ini +PODMAN_PHPFPM_INI_FILE_HOST={{ .DataDir }}/configs/phpfpm/ini/nextcloud_default.ini PODMAN_PHPFPM_INI_FILE_CONTAINER=/usr/local/etc/php/conf.d/nextcloud.ini -PODMAN_PHPFPM_HEALTHCHECK_FILE_HOST=${PWD}/configs/phpfpm/nextcloud_status_default.php +PODMAN_PHPFPM_HEALTHCHECK_FILE_HOST={{ .DataDir }}/configs/phpfpm/nextcloud_status_default.php PODMAN_PHPFPM_HEALTHCHECK_FILE_CONTAINER=/etc/nextcloud_status.php -# postgres -# https://hub.docker.com/_/postgres -PODMAN_POSTGRES_IMAGE=docker.io/postgres:17.10-alpine3.24@sha256:67f624a4ad70edba8d65c82341124fab7054b277b4f7dea4b04be6f939ce2314 -# Uncomment if you want to use a custom postgresql.conf file: -# PODMAN_POSTGRES_CONF_FILE_HOST=/your/absolute/path/to/configs/postgres/postgres.conf -# PODMAN_POSTGRES_CONF_FILE_CONTAINER=/etc/postgresql/postgresql.conf -PODMAN_POSTGRES_DATA_DIR_HOST=/your/absolute/path/to/data/postgres -PODMAN_POSTGRES_DATA_DIR_CONTAINER=/var/lib/postgresql/data - -POSTGRES_HOST=postgres -POSTGRES_DB=nextcloud -POSTGRES_USER=nextcloud -POSTGRES_PASSWORD='a_secure_password' - +{{ if .UseRedis -}} # redis # https://hub.docker.com/_/redis PODMAN_REDIS_IMAGE=docker.io/redis:8.6.4-alpine3.23@sha256:2cc044fc5a07c9b701f8f1255a309ae9ad7856e694ac03513bf3648c01e40763 # Uncomment if you want to use a custom redis.conf file: -# PODMAN_REDIS_CONF_FILE_HOST=/your/absolute/path/to/configs/redis/redis.conf +# PODMAN_REDIS_CONF_FILE_HOST={{ .DataDir }}/configs/redis/redis.conf # PODMAN_REDIS_CONF_FILE_CONTAINER=/usr/local/etc/redis/redis.conf -PODMAN_REDIS_DATA_DIR_HOST=/your/absolute/path/to/data/redis +PODMAN_REDIS_DATA_DIR_HOST={{ .DataDir }}/redis PODMAN_REDIS_DATA_DIR_CONTAINER=/data -REDIS_HOST=redis -REDIS_PORT=6379 -REDIS_USER=nextcloud -# TODO @TheRealBecks: REDIS_PASSWORD is not used -REDIS_PASSWORD='a_secure_password' +DATABASE_KEY_VALUE_HOST=redis +DATABASE_KEY_VALUE_PORT=6379 +{{ end -}} +{{ if .UseValkey -}} # valkey -# https://hub.docker.com/r/valkey/valkey/ +# https://hub.docker.com/_/valkey/valkey/ PODMAN_VALKEY_IMAGE=docker.io/valkey/valkey:8.1.8-alpine3.23@sha256:cfe71288f087704b06be45e270afa7a2abbf820093d6b11a23762081f5ff321d # Uncomment if you want to use a custom valkey.conf file: -# PODMAN_VALKEY_CONF_FILE_HOST=/your/absolute/path/to/configs/valkey/valkey.conf +# PODMAN_VALKEY_CONF_FILE_HOST={{ .DataDir }}/configs/valkey/valkey.conf # PODMAN_VALKEY_CONF_FILE_CONTAINER=/usr/local/etc/valkey/valkey.conf -PODMAN_VALKEY_DATA_DIR_HOST=/your/absolute/path/to/data/valkey +PODMAN_VALKEY_DATA_DIR_HOST={{ .DataDir }}/valkey PODMAN_VALKEY_DATA_DIR_CONTAINER=/data -VALKEY_HOST=valkey -VALKEY_PORT=6379 -# user and password are not used: https://github.com/valkey-io/valkey-container/issues/71 -VALKEY_USER=nextcloud -# TODO @TheRealBecks: VALKEY_PASSWORD is not used -VALKEY_PASSWORD='a_secure_password' +DATABASE_KEY_VALUE_HOST=valkey +DATABASE_KEY_VALUE_PORT=6379 +{{ end -}} # whiteboard # https://github.com/nextcloud/whiteboard PODMAN_WHITEBOARD_IMAGE=ghcr.io/nextcloud-releases/whiteboard:v1.5.9@sha256:b60b7633f90d106ac6922f9bc27e1a1ca2442488b740fefdae4c812f34e9cebc WHITEBOARD_STORAGE_STRATEGY=redis -WHITEBOARD_JWT_SECRET_KEY='a_secure_password' +WHITEBOARD_JWT_SECRET_KEY='{{ .Password.WhiteboardJwtSecretKey }}' # notifypush # https://github.com/Strukturpiloten/nextcloud-notifypush/pkgs/container/nextcloud-notifypush @@ -174,18 +167,18 @@ NEXTCLOUD_VERSION=v32.0.12 # on or off NEXTCLOUD_MAINTENANCE=off NEXTCLOUD_ADMIN_USER=admin -NEXTCLOUD_ADMIN_PASSWORD='a_secure_password' -PODMAN_NEXTCLOUD_DATA_DIR_HOST=/your/absolute/path/to/data/nextcloud +NEXTCLOUD_ADMIN_PASSWORD='{{ .Password.NextcloudAdminPassword }}' +PODMAN_NEXTCLOUD_DATA_DIR_HOST={{ .DataDir }}/nextcloud PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER=/var/www/nextcloud # Also used as NC_datadirectory -PODMAN_NEXTCLOUD_USER_DATA_DIR_HOST=/your/absolute/path/to/data/nextcloud_data +PODMAN_NEXTCLOUD_USER_DATA_DIR_HOST={{ .DataDir }}/nextcloud_data PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER=/var/www/nextcloud_data NEXTCLOUD_PERSISTENT_DATABASE_CONNECTION=true # We need to configure the domain twice: NEXTCLOUD_DOMAIN, NEXTCLOUD_TRUSTED_DOMAINS -NEXTCLOUD_DOMAIN=nextcloud.example.com +NEXTCLOUD_DOMAIN={{ .DomainName }} # https://github.com/nextcloud/server/issues/49658 # Whitespace separated string enclosed in double quotes -NEXTCLOUD_TRUSTED_DOMAINS="localhost nextcloud.example.com" +NEXTCLOUD_TRUSTED_DOMAINS="localhost {{ .DomainName }}" NEXTCLOUD_TRUSTED_PROXIES="127.0.0.1 ::1 10.0.0.0/8 fc00::/7" # Language and region settings NEXTCLOUD_DEFAULT_LANGUAGE=de_DE @@ -205,9 +198,9 @@ NEXTCLOUD_CARDDAV_SYNC_REQUEST_TRUNCATION=2500 NEXTCLOUD_SESSION_RELAXED_EXPIRY=false NEXTCLOUD_SESSION_KEEPALIVE=true # Valkey / Redis -NEXTCLOUD_REDIS_DBINDEX=0 # integer -NEXTCLOUD_REDIS_TIMEOUT=1.0 # float -NEXTCLOUD_REDIS_READ_TIMEOUT=1.0 # float +NEXTCLOUD_REDIS_DBINDEX=0 +NEXTCLOUD_REDIS_TIMEOUT=1.0 +NEXTCLOUD_REDIS_READ_TIMEOUT=1.0 # SMTP and mail NC_mail_sendmailmode='smtp' NC_mail_smtpmode='smtp' diff --git a/.github/renovate.json b/.github/renovate.json new file mode 100644 index 0000000..a8545f6 --- /dev/null +++ b/.github/renovate.json @@ -0,0 +1,201 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + "helpers:pinGitHubActionDigests" + ], + "customManagers": [ + { + "customType": "regex", + "description": "Track external pinned container image tags and digests in .env.tmpl", + "managerFilePatterns": [ + "/(^|\\/)\\.env\\.tmpl$/" + ], + "matchStrings": [ + "PODMAN_(?:CLAMAV|MARIADB|NGINX|POSTGRES|REDIS|VALKEY|WHITEBOARD|NEXTCLOUDPHPFPM|NEXTCLOUDNOTIFYPUSH)_IMAGE=(?[^:@\\s]+(?:\\/[^:@\\s]+)*):(?[^@\\s]+)(?:@(?sha256:[a-f0-9]+))?" + ], + "datasourceTemplate": "docker" + }, + { + "customType": "regex", + "description": "Track Nextcloud server version in .env.tmpl", + "managerFilePatterns": [ + "/(^|\\/)\\.env\\.tmpl$/" + ], + "matchStrings": [ + "NEXTCLOUD_VERSION=(?[^\\n]+)" + ], + "depNameTemplate": "nextcloud/server", + "datasourceTemplate": "github-releases" + }, + { + "customType": "regex", + "description": "Track the container-setup wrapper version", + "managerFilePatterns": [ + "/^setup\\.sh$/", + "/^deps\\/container-setup\\/setup\\.sh$/" + ], + "matchStrings": [ + "CONTAINER_SETUP_VERSION=\"(?v?\\d+\\.\\d+\\.\\d+)\"" + ], + "depNameTemplate": "container-setup setup.sh", + "packageNameTemplate": "Strukturpiloten/container-setup", + "datasourceTemplate": "github-releases", + "versioningTemplate": "semver-coerced" + } + ], + "packageRules": [ + { + "description": "Use a readable topic for container-setup wrapper updates", + "matchManagers": [ + "custom.regex" + ], + "matchPackageNames": [ + "Strukturpiloten/container-setup" + ], + "commitMessageTopic": "container-setup setup.sh" + }, + { + "description": "Keep GitHub Actions pinned to immutable commits while allowing Renovate updates", + "matchManagers": [ + "github-actions" + ], + "pinDigests": true + }, + { + "description": "Use a readable topic for Nextcloud server updates", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "github-releases" + ], + "matchPackageNames": [ + "nextcloud/server" + ], + "commitMessageTopic": "Nextcloud server" + }, + { + "description": "Automerge pinned container digest updates", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchUpdateTypes": [ + "digest" + ], + "automerge": true, + "automergeType": "pr", + "platformAutomerge": true + }, + { + "description": "Automerge patch updates for pinned container base images", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchUpdateTypes": [ + "minor", + "patch" + ], + "automerge": true, + "automergeType": "pr", + "platformAutomerge": true + }, + { + "description": "Automerge selected patch updates for tooling dependencies", + "matchManagers": [ + "custom.regex" + ], + "matchPackageNames": [ + "Strukturpiloten/container-setup" + ], + "matchUpdateTypes": [ + "minor", + "patch" + ], + "automerge": true, + "automergeType": "pr", + "platformAutomerge": true + }, + { + "description": "Treat numeric distro suffixes like alpine3.22 and ubi9 as updatable while keeping the image variant stable", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchCurrentValue": "/-(?:[a-z-]*(?:alpine|ubi))\\d+(?:\\.\\d+)?$/", + "versioning": "regex:^(?\\d+)(?:\\.(?\\d+))?(?:\\.(?\\d+))?(?:-(?[a-z-]*(?:alpine|ubi))(?\\d+)(?:\\.(?\\d+))?)?$" + }, + { + "description": "Allow same-major.same-minor updates once the patch floor is >= 2", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchDepNames": [ + "docker.io/mariadb" + ], + "allowedVersions": "/^{{{major}}}\\.{{{minor}}}\\.(?:[2-9]|[1-9]\\d+)(?:-.*)?$/" + }, + { + "description": "Allow same-major updates once the patch floor is >= 2", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchDepNames": [ + "docker.io/nginxinc/nginx-unprivileged" + ], + "allowedVersions": "/^{{{major}}}\\.\\d+\\.(?:[2-9]|[1-9]\\d+)(?:-.*)?$/" + }, + { + "description": "Allow same-major updates once the minor floor is >= 1", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchDepNames": [ + "docker.io/postgres" + ], + "allowedVersions": "/^{{{major}}}\\.[1-9]\\d*(?:-.*)?$/" + }, + { + "description": "Allow same-major updates once the patch floor is >= 1", + "matchManagers": [ + "custom.regex" + ], + "matchDatasources": [ + "docker" + ], + "matchDepNames": [ + "docker.io/redis", + "docker.io/valkey" + ], + "allowedVersions": "/^{{{major}}}\\.\\d+\\.[1-9]\\d*(?:-.*)?$/" + }, + { + "description": "Allow releases once the patch floor is >= 2", + "matchManagers": [ + "custom.regex" + ], + "matchDepNames": [ + "ghcr.io/nextcloud-releases/whiteboard", + "nextcloud/server" + ], + "allowedVersions": "/^v?\\d+\\.\\d+\\.(?:[2-9]|[1-9]\\d+)$/" + } + ] +} \ No newline at end of file diff --git a/.gitignore b/.gitignore index ed3fe5c..2164c96 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,7 @@ temp/ # Built Visual Studio Code Extensions *.vsix + +############################## +# Generated files +compose.yaml diff --git a/compose.yaml b/compose.yaml.tmpl similarity index 88% rename from compose.yaml rename to compose.yaml.tmpl index decb072..7c14d30 100644 --- a/compose.yaml +++ b/compose.yaml.tmpl @@ -1,12 +1,16 @@ --- name: ${PODMAN_NAMESPACE}-${PODMAN_SERVICE}-${PODMAN_STAGE} - networks: backend: name: ${PODMAN_NAMESPACE}-${PODMAN_SERVICE}-${PODMAN_STAGE}-network-backend driver: bridge enable_ipv4: true enable_ipv6: true +{{- if .UseReverseProxy }} + reverse-proxy: + name: {{ printf "%q" .ReverseProxyNetworkName }} + external: true +{{- end }} services: clamav: hostname: clamav @@ -42,7 +46,6 @@ services: - PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER=${PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER} # Nextcloud - NC_dbpersistent=${NEXTCLOUD_PERSISTENT_DATABASE_CONNECTION} - # - NC_trusted_domains=${NEXTCLOUD_TRUSTED_DOMAINS} - NC_datadirectory=${PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER} - NC_default_language=${NEXTCLOUD_DEFAULT_LANGUAGE} - NC_default_phone_region=${NEXTCLOUD_DEFAULT_PHONE_REGION} @@ -73,7 +76,7 @@ services: required: true installer: hostname: installer - restart: no + restart: "no" image: ${PODMAN_NEXTCLOUDPHPFPM_IMAGE} pull_policy: ${PODMAN_NEXTCLOUDPHPFPM_PULL_POLICY} networks: @@ -95,21 +98,15 @@ services: clamav: condition: service_started required: true - mariadb: + {{ .DatabaseSQLService }}: condition: service_healthy - required: ${PODMAN_SQL_DATABASE_REQUIRED_MARIADB} - postgres: - condition: service_healthy - required: ${PODMAN_SQL_DATABASE_REQUIRED_POSTGRES} - redis: + required: true + {{ .DatabaseKeyValueService }}: condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_REDIS} + required: true whiteboard: condition: service_healthy required: true - valkey: - condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_VALKEY} environment: # Storage - PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_CONTAINER=${PODMAN_INSTALLER_NEXTCLOUD_CONFIG_SCRIPT_FILE_CONTAINER} @@ -119,24 +116,22 @@ services: - PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER=${PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER} - PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER=${PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER} # SQL databases - - PODMAN_SQL_DATABASE=${PODMAN_SQL_DATABASE} + - PODMAN_SQL_DATABASE=${DATABASE_SQL_SERVICE} # MariaDB - - MARIADB_HOST=${MARIADB_HOST} - - MARIADB_DB=${MARIADB_DB} - - MARIADB_USER=${MARIADB_USER} - - MARIADB_PASSWORD=${MARIADB_PASSWORD} + - MARIADB_HOST=${DATABASE_SQL_HOST} + - MARIADB_DB=${DATABASE_SQL_NAME} + - MARIADB_USER=${DATABASE_SQL_USER} + - MARIADB_PASSWORD=${DATABASE_SQL_PASSWORD} # Postgres - - POSTGRES_HOST=${POSTGRES_HOST} - - POSTGRES_DB=${POSTGRES_DB} - - POSTGRES_USER=${POSTGRES_USER} - - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} + - POSTGRES_HOST=${DATABASE_SQL_HOST} + - POSTGRES_DB=${DATABASE_SQL_NAME} + - POSTGRES_USER=${DATABASE_SQL_USER} + - POSTGRES_PASSWORD=${DATABASE_SQL_PASSWORD} # Key-value databases - - PODMAN_KEY_VALUE_DATABASE=${PODMAN_KEY_VALUE_DATABASE} + - PODMAN_KEY_VALUE_DATABASE=${DATABASE_KEY_VALUE_SERVICE} # Valkey - - VALKEY_HOST=${VALKEY_HOST} - - VALKEY_PORT=${VALKEY_PORT} - - VALKEY_USER=${VALKEY_USER} - - VALKEY_PASSWORD=${VALKEY_PASSWORD} + - VALKEY_HOST=${DATABASE_KEY_VALUE_HOST} + - VALKEY_PORT=${DATABASE_KEY_VALUE_PORT} # Nextcloud - NEXTCLOUD_VERSION=${NEXTCLOUD_VERSION} - NEXTCLOUD_MAINTENANCE=${NEXTCLOUD_MAINTENANCE} @@ -144,7 +139,6 @@ services: - NC_admin_user=${NEXTCLOUD_ADMIN_USER} - NC_admin_password=${NEXTCLOUD_ADMIN_PASSWORD} - NEXTCLOUD_DOMAIN=${NEXTCLOUD_DOMAIN} - # - NC_trusted_domains=${NEXTCLOUD_TRUSTED_DOMAINS} - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS} - NEXTCLOUD_TRUSTED_PROXIES=${NEXTCLOUD_TRUSTED_PROXIES} - NC_datadirectory=${PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER} @@ -231,21 +225,15 @@ services: installer: condition: service_completed_successfully required: true - mariadb: - condition: service_healthy - required: ${PODMAN_SQL_DATABASE_REQUIRED_MARIADB} - postgres: + {{ .DatabaseSQLService }}: condition: service_healthy - required: ${PODMAN_SQL_DATABASE_REQUIRED_POSTGRES} - redis: + required: true + {{ .DatabaseKeyValueService }}: condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_REDIS} + required: true whiteboard: condition: service_healthy required: true - valkey: - condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_VALKEY} environment: # Storage - PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_CONTAINER=${PODMAN_MANAGER_CONFIGURE_NOTIFY_PUSH_SCRIPT_FILE_CONTAINER} @@ -264,7 +252,6 @@ services: - NC_admin_user=${NEXTCLOUD_ADMIN_USER} - NC_admin_password=${NEXTCLOUD_ADMIN_PASSWORD} - NEXTCLOUD_DOMAIN=${NEXTCLOUD_DOMAIN} - # - NC_trusted_domains=${NEXTCLOUD_TRUSTED_DOMAINS} - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS} - NEXTCLOUD_TRUSTED_PROXIES=${NEXTCLOUD_TRUSTED_PROXIES} - NC_datadirectory=${PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER} @@ -291,12 +278,11 @@ services: - NEXTCLOUD_APPS_REMOVED=${NEXTCLOUD_APPS_REMOVED} - NEXTCLOUD_APPS_ENABLED=${NEXTCLOUD_APPS_ENABLED} - NEXTCLOUD_APPS_DISABLED=${NEXTCLOUD_APPS_DISABLED} +{{- if .UseMariaDB }} mariadb: hostname: mariadb image: ${PODMAN_MARIADB_IMAGE} restart: unless-stopped - profiles: - - mariadb networks: - backend userns_mode: "keep-id:uid=999,gid=999" @@ -312,31 +298,39 @@ services: timeout: 5s retries: 3 environment: - - MARIADB_DATABASE=${MARIADB_DB} - - MARIADB_USER=${MARIADB_USER} - - MARIADB_PASSWORD=${MARIADB_PASSWORD} + - MARIADB_DATABASE=${DATABASE_SQL_NAME} + - MARIADB_USER=${DATABASE_SQL_USER} + - MARIADB_PASSWORD=${DATABASE_SQL_PASSWORD} - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD} - MARIADB_AUTO_UPGRADE=${MARIADB_AUTO_UPGRADE} +{{- end }} nginx: hostname: nginx image: ${PODMAN_NGINX_IMAGE} restart: unless-stopped networks: - backend +{{- if .UseReverseProxy }} + - reverse-proxy +{{- end }} user: "${PODMAN_USER_UID}:${PODMAN_GROUP_GID}" userns_mode: "keep-id" volumes: # private - ${PODMAN_NGINX_CONF_DIR_HOST}:${PODMAN_NGINX_CONF_DIR_CONTAINER}:ro,Z +{{- if not .UseReverseProxy }} - ${PODMAN_SSL_DIR_HOST}:${PODMAN_NGINX_SSL_DIR_CONTAINER}:ro,Z +{{- end }} # shared - ${PODMAN_NEXTCLOUD_DATA_DIR_HOST}:${PODMAN_NEXTCLOUD_DATA_DIR_CONTAINER}:z - ${PODMAN_NEXTCLOUD_USER_DATA_DIR_HOST}:${PODMAN_NEXTCLOUD_USER_DATA_DIR_CONTAINER}:z +{{- if not .UseReverseProxy }} ports: - 80:8080 # - 80:80/udp - 443:8443 # - 443:443/udp +{{- end }} healthcheck: test: curl -sSfk "https://localhost:8443/status.php" | grep '"installed":true' | grep '"needsDbUpgrade":false' || exit 1 interval: 10s @@ -346,12 +340,11 @@ services: phpfpm: condition: service_healthy required: true +{{- if .UsePostgreSQL }} postgres: hostname: postgres image: ${PODMAN_POSTGRES_IMAGE} restart: unless-stopped - profiles: - - postgres networks: - backend user: "${PODMAN_USER_UID}:${PODMAN_GROUP_GID}" @@ -362,21 +355,21 @@ services: # Uncomment if you want to use a custom postgresql.conf file: # - ${PODMAN_POSTGRES_CONF_FILE_HOST}:${PODMAN_POSTGRES_CONF_FILE_CONTAINER}:ro,Z environment: - - POSTGRES_DB=${POSTGRES_DB} - - POSTGRES_USER=${POSTGRES_USER} - - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} + - POSTGRES_DB=${DATABASE_SQL_NAME} + - POSTGRES_USER=${DATABASE_SQL_USER} + - POSTGRES_PASSWORD=${DATABASE_SQL_PASSWORD} healthcheck: - test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}", "-d", "${POSTGRES_DB}"] + test: ["CMD", "pg_isready", "-U", "${DATABASE_SQL_USER}", "-d", "${DATABASE_SQL_NAME}"] start_period: 10s interval: 10s timeout: 5s retries: 3 +{{- end }} +{{- if .UseRedis }} redis: hostname: redis image: ${PODMAN_REDIS_IMAGE} restart: unless-stopped - profiles: - - redis networks: - backend user: "${PODMAN_USER_UID}:${PODMAN_GROUP_GID}" @@ -393,12 +386,12 @@ services: interval: 10s timeout: 5s retries: 3 +{{- end }} +{{- if .UseValkey }} valkey: hostname: valkey image: ${PODMAN_VALKEY_IMAGE} restart: unless-stopped - profiles: - - valkey networks: - backend user: "${PODMAN_USER_UID}:${PODMAN_GROUP_GID}" @@ -415,6 +408,7 @@ services: interval: 10s timeout: 5s retries: 3 +{{- end }} whiteboard: hostname: whiteboard image: ${PODMAN_WHITEBOARD_IMAGE} @@ -422,17 +416,14 @@ services: networks: - backend depends_on: - redis: + {{ .DatabaseKeyValueService }}: condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_REDIS} - valkey: - condition: service_healthy - required: ${PODMAN_KEY_VALUE_DATABASE_REQUIRED_VALKEY} + required: true environment: - STORAGE_STRATEGY=${WHITEBOARD_STORAGE_STRATEGY} - NEXTCLOUD_URL=https://${NEXTCLOUD_DOMAIN} - JWT_SECRET_KEY=${WHITEBOARD_JWT_SECRET_KEY} - - REDIS_URL=redis://${VALKEY_HOST} + - REDIS_URL=redis://${DATABASE_KEY_VALUE_HOST} notifypush: hostname: notifypush image: ${PODMAN_NEXTCLOUDNOTIFYPUSH_IMAGE} diff --git a/configs/nginx/conf/.gitignore b/configs/nginx/conf/.gitignore index 3434608..d39385a 100644 --- a/configs/nginx/conf/.gitignore +++ b/configs/nginx/conf/.gitignore @@ -3,5 +3,5 @@ # except: !.gitignore -!nextcloud_default.conf +!nextcloud_default.conf.tmpl !nextcloud_original.conf diff --git a/configs/nginx/conf/nextcloud_default.conf b/configs/nginx/conf/nextcloud_default.conf.tmpl similarity index 98% rename from configs/nginx/conf/nextcloud_default.conf rename to configs/nginx/conf/nextcloud_default.conf.tmpl index 2c17f82..6a95c0b 100644 --- a/configs/nginx/conf/nextcloud_default.conf +++ b/configs/nginx/conf/nextcloud_default.conf.tmpl @@ -14,11 +14,11 @@ map $arg_v $asset_immutable { server { listen 8080; listen [::]:8080; - server_name cloud.example.com; + server_name {{ .DomainName }}; # Prevent nginx HTTP Server Detection server_tokens off; - +{{ if not .UseReverseProxy }} # Enforce HTTPS return 301 https://$server_name$request_uri; } @@ -27,7 +27,7 @@ server { listen 8443 ssl; listen [::]:8443 ssl; http2 on; - server_name cloud.example.com; + server_name {{ .DomainName }}; # Path to the root of your installation root /var/www/nextcloud; @@ -39,6 +39,7 @@ server { # Prevent nginx HTTP Server Detection server_tokens off; +{{ end }} # HSTS settings # WARNING: Only add the preload option once you read about diff --git a/deps/container-setup/setup.sh b/deps/container-setup/setup.sh index a140d96..5c74394 100755 --- a/deps/container-setup/setup.sh +++ b/deps/container-setup/setup.sh @@ -154,4 +154,4 @@ set_platform_variables download_setup cd "$project_dir" -exec "$binary_path" --project-dir "$project_dir" "$@" \ No newline at end of file +exec "$binary_path" --project-dir "$project_dir" "$@" diff --git a/renovate.json b/renovate.json deleted file mode 100644 index 1fc1102..0000000 --- a/renovate.json +++ /dev/null @@ -1,113 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:best-practices", - "docker:disable" - ], - "customManagers": [ - { - "customType": "regex", - "description": "Update *_IMAGE variables in .env.example", - "datasourceTemplate": "docker", - "managerFilePatterns": [ - "/^\\.env\\.example$/" - ], - "matchStrings": [ - "\\w+_IMAGE=(?[^:\\s]+):(?[^@\\s]+)(@(?sha256:[a-f0-9]+))?" - ] - }, - { - "customType": "regex", - "description": "Update NEXTCLOUD_VERSION variable in .env.example", - "datasourceTemplate": "github-releases", - "managerFilePatterns": [ - "/^\\.env\\.example$/" - ], - "matchStrings": [ - "NEXTCLOUD_VERSION=(?[^\\s]+)" - ], - "depNameTemplate": "nextcloud/server" - } - ], - "packageRules": [ - { - "description": "Only allow patch updates in .env.example", - "matchFileNames": [ - ".env.example" - ], - "matchUpdateTypes": [ - "minor", - "major" - ], - "enabled": false - }, - { - "description": "Treat numeric distro suffixes like alpine3.22 and ubi9 as updatable while keeping the image variant stable", - "matchFileNames": [ - ".env.example" - ], - "matchDatasources": [ - "docker" - ], - "matchCurrentValue": "/-(?:[a-z-]*(?:alpine|ubi))\\d+(?:\\.\\d+)?$/", - "versioning": "regex:^(?\\d+)(?:\\.(?\\d+))?(?:\\.(?\\d+))?(?:-(?[a-z-]*(?:alpine|ubi))(?\\d+)(?:\\.(?\\d+))?)?$" - }, - { - "description": "Allow same-major.same-minor updates once the patch floor is >= 2", - "matchFileNames": [ - ".env.example" - ], - "matchDepNames": [ - "docker.io/mariadb" - ], - "enabled": true, - "allowedVersions": "/^{{{major}}}\\.{{{minor}}}\\.(?:[2-9]|[1-9]\\d+)(?:-.*)?$/" - }, - { - "description": "Allow same-major updates once the patch floor is >= 2", - "matchFileNames": [ - ".env.example" - ], - "matchDepNames": [ - "docker.io/nginxinc/nginx-unprivileged" - ], - "enabled": true, - "allowedVersions": "/^{{{major}}}\\.\\d+\\.(?:[2-9]|[1-9]\\d+)(?:-.*)?$/" - }, - { - "description": "Allow same-major updates once the minor floor is >= 1", - "matchFileNames": [ - ".env.example" - ], - "matchDepNames": [ - "docker.io/postgres" - ], - "enabled": true, - "allowedVersions": "/^{{{major}}}\\.[1-9]\\d*(?:-.*)?$/" - }, - { - "description": "Allow same-major updates once the patch floor is >= 1", - "matchFileNames": [ - ".env.example" - ], - "matchDepNames": [ - "docker.io/redis", - "docker.io/valkey" - ], - "enabled": true, - "allowedVersions": "/^{{{major}}}\\.\\d+\\.[1-9]\\d*(?:-.*)?$/" - }, - { - "description": "Allow releases once the patch floor is >= 2", - "matchFileNames": [ - ".env.example" - ], - "matchDepNames": [ - "ghcr.io/nextcloud-releases/whiteboard", - "nextcloud/server" - ], - "enabled": true, - "allowedVersions": "/^v?\\d+\\.\\d+\\.(?:[2-9]|[1-9]\\d+)$/" - } - ] -} \ No newline at end of file diff --git a/setup.sh b/setup.sh new file mode 120000 index 0000000..8fe1441 --- /dev/null +++ b/setup.sh @@ -0,0 +1 @@ +deps/container-setup/setup.sh \ No newline at end of file diff --git a/setup.yaml b/setup.yaml new file mode 100644 index 0000000..6351980 --- /dev/null +++ b/setup.yaml @@ -0,0 +1,228 @@ +version: 1 +variables: + - name: PodmanNamespace + flag: podman-namespace + prompt: Podman Namespace + description: Podman namespace used for container, network, and volume names + default: yourcompanyname + + - name: PodmanService + flag: podman-service + prompt: Podman Service + description: Podman service name used for container, network, and volume names + default: nextcloud + + - name: PodmanStage + flag: podman-stage + prompt: Podman Stage + description: Podman stage used for container, network, and volume names + default: prod + + - name: DataDir + flag: data-dir + prompt: Data directory + description: Directory where generated runtime files and container data are stored + type: path + default: "{{ .ProjectDir }}/../{{ .PodmanNamespace }}_{{ .PodmanService }}_{{ .PodmanStage }}" + + - name: DatabaseSQL + flag: database-sql + prompt: Database SQL service (postgresql/mariadb) + description: "SQL database service to use: postgresql or mariadb" + required: true + invalid_message: Please choose postgresql or mariadb. + choices: + - mariadb + - postgresql + default: postgresql + + - name: DatabaseKeyValue + flag: database-key-value + prompt: Database key-value service (valkey/redis) + description: "Key-value database service to use: valkey or redis" + required: true + invalid_message: Please choose valkey or redis. + choices: + - valkey + - redis + default: valkey + + - name: UserUID + flag: uid + prompt: User ID + description: Host user ID for container processes + type: int + default: "{{ .CurrentUserUID }}" + + - name: GroupGID + flag: gid + prompt: Group ID + description: Host group ID for container processes + type: int + default: "{{ .CurrentGroupGID }}" + + - name: UseReverseProxy + flag: reverse-proxy + prompt: Use an external reverse proxy network + description: "Whether an external reverse-proxy network is used: true or false" + type: bool + default: "{{ if .FlagValues.ReverseProxyNetworkName }}true{{ else }}false{{ end }}" + + - name: ReverseProxyNetworkName + flag: reverse-proxy-network-name + prompt: External reverse-proxy network name + description: Already-created external reverse-proxy network name + required_when: "{{ .UseReverseProxy }}" + forbidden_when: "{{ not .UseReverseProxy }}" + forbidden_message: --reverse-proxy-network-name requires --reverse-proxy true + + - name: DomainName + flag: domain + prompt: Domain name + description: Domain name served by nginx + required: true + + - name: SSLDir + flag: ssl-dir + prompt: SSL certificate directory + description: SSL certificate directory when no reverse proxy is used + type: path + default: "{{ .DataDir }}/ssl" + when: "{{ not .UseReverseProxy }}" + +computed: + - name: DatabaseSQLService + value: "{{ .DatabaseSQL }}" + - name: DatabaseKeyValueService + value: "{{ .DatabaseKeyValue }}" + - name: UseMariaDB + type: bool + value: '{{ eq .DatabaseSQL "mariadb" }}' + - name: UsePostgreSQL + type: bool + value: '{{ eq .DatabaseSQL "postgresql" }}' + - name: UseRedis + type: bool + value: '{{ eq .DatabaseKeyValue "redis" }}' + - name: UseValkey + type: bool + value: '{{ eq .DatabaseKeyValue "valkey" }}' + +passwords: + - name: DatabaseSQLPassword + length: 24 + - name: MariaDBRootPassword + length: 24 + when: "{{ .UseMariaDB }}" + - name: NextcloudAdminPassword + length: 24 + - name: WhiteboardJwtSecretKey + length: 32 + +directories: + - path: "{{ .DataDir }}" + - path: "{{ .DataDir }}/configs" + - path: "{{ .DataDir }}/configs/nginx/conf" + - path: "{{ .DataDir }}/configs/installer" + - path: "{{ .DataDir }}/configs/manager" + - path: "{{ .DataDir }}/configs/manager/cron" + - path: "{{ .DataDir }}/configs/phpfpm" + - path: "{{ .DataDir }}/configs/phpfpm/conf" + - path: "{{ .DataDir }}/configs/phpfpm/ini" + - path: "{{ .DataDir }}/nextcloud" + - path: "{{ .DataDir }}/nextcloud_data" + - path: "{{ .DataDir }}/clamav_data" + - path: "{{ .DataDir }}/clamav_log" + - path: "{{ .DataDir }}/mariadb" + when: "{{ .UseMariaDB }}" + - path: "{{ .DataDir }}/postgres" + when: "{{ .UsePostgreSQL }}" + - path: "{{ .DataDir }}/redis" + when: "{{ .UseRedis }}" + - path: "{{ .DataDir }}/valkey" + when: "{{ .UseValkey }}" + - path: "{{ .SSLDir }}" + when: "{{ not .UseReverseProxy }}" + +assets: + - source: configs + target: "{{ .DataDir }}/configs" + exclude: + names: + - .gitignore + suffixes: + - .tmpl + +env: + source: ".env.tmpl" + output: "{{ .DataDir }}/.env" + default_output: "{{ .DataDir }}/.env_default" + backup_name_template: ".env_{{ .Timestamp }}" + mode: "0600" + protected: + suffixes: + - _CONTAINER + - _IMAGE + - _PASSWORD + keys: + - NGINX_INTERNAL_URL + - PODMAN_NAMESPACE + - PODMAN_NGINX_SSL_DIR_CONTAINER + - PODMAN_SERVICE + - PODMAN_STAGE + +templates: + - source: compose.yaml.tmpl + target: "{{ .DataDir }}/compose.yaml" + mode: "0644" + - source: configs/nginx/conf/nextcloud_default.conf.tmpl + target: "{{ .DataDir }}/configs/nginx/conf/nextcloud_default.conf" + mode: "0644" + +state: + output: "{{ .DataDir }}/setup.json" + mode: "0644" + entries: + - key: data_dir + variable: DataDir + - key: database_key_value + variable: DatabaseKeyValue + - key: database_sql + variable: DatabaseSQL + - key: domain_name + variable: DomainName + - key: group_gid + variable: GroupGID + - key: podman_namespace + variable: PodmanNamespace + - key: podman_service + variable: PodmanService + - key: podman_stage + variable: PodmanStage + - key: project_dir + variable: ProjectDir + - key: reverse_proxy_network_name + variable: ReverseProxyNetworkName + omit_empty: true + - key: ssl_dir + variable: SSLDir + omit_empty: true + - key: use_reverse_proxy + variable: UseReverseProxy + type: bool + - key: user_uid + variable: UserUID + +messages: + - | + + Generated runtime files in "{{ .DataDir }}". + + Run from inside "{{ .DataDir }}", but `-f` can be omitted: + cd "{{ .DataDir }}" + podman compose -f "compose.yaml" --env-file ".env" up -d + + Run from anywhere: + podman compose -f "{{ .DataDir }}/compose.yaml" --env-file "{{ .DataDir }}/.env" up -d + + For Docker use the same commands with `docker compose ...`.