docs: update README to clarify integration with Caddy reverse proxy and backupbot

Reviewed-on: wiki-cafe/nextcloud#6

.drone.yml

@@ -1,16 +0,0 @@
----
-kind: pipeline
-name: generate recipe catalogue
-steps:
-  - name: release a new version
-    image: plugins/downstream
-    settings:
-      server: https://build.coopcloud.tech
-      token:
-        from_secret: drone_abra-bot_token
-      fork: true
-      repositories:
-        - toolshed/auto-recipes-catalogue-json
-
-trigger:
-  event: tag

.env.sample

@@ -1,109 +0,0 @@
-TYPE=nextcloud
-#TIMEOUT=900
-ENABLE_AUTO_UPDATE=true
-ENABLE_BACKUPS=true
-
-DOMAIN=nextcloud.example.com
-## Domain aliases
-#EXTRA_DOMAINS=', `www.nextcloud.example.com`'
-LETS_ENCRYPT_ENV=production
-
-COMPOSE_FILE="compose.yml"
-COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
-#COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml"
-
-#MAX_DB_CONNECTIONS=500
-
-ADMIN_USER=admin
-TZ=Etc/UTC
-
-SECRET_DB_ROOT_PASSWORD_VERSION=v1
-SECRET_DB_PASSWORD_VERSION=v1
-SECRET_ADMIN_PASSWORD_VERSION=v1
-
-EXTRA_VOLUME=/dev/null:/tmp/.dummy
-
-PHP_MEMORY_LIMIT=1G
-PHP_UPLOAD_LIMIT=512M
-# fpm-tune, see: https://spot13.com/pmcalculator/
-FPM_MAX_CHILDREN=16
-FPM_START_SERVERS=4
-FPM_MIN_SPARE_SERVERS=4
-FPM_MAX_SPARE_SERVERS=12
-
-DEFAULT_QUOTA="10 GB"
-
-# X_FRAME_OPTIONS_ENABLED=1
-# X_FRAME_OPTIONS_ALLOW_FROM=embedding-site.example.org
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
-# See https://github.com/nextcloud/docker#auto-configuration-via-environment-variables for default values
-# SMTP_AUTHTYPE=
-# SMTP_HOST=
-# SMTP_SECURE=
-# SMTP_NAME=
-# SMTP_PORT=
-# MAIL_FROM_ADDRESS=
-# MAIL_DOMAIN=
-# SECRET_SMTP_PASSWORD_VERSION=v1
-
-## Customization
-# THEMING_COLOR=
-# THEMING_SLOGAN=
-# COPY_ASSETS="flow_background.jpg|app:/var/www/html/themes/"
-# COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/var/www/html/themes/"
-# COPY_ASSETS="$COPY_ASSETS icon.png|app:/var/www/html/themes/"
-
-# APPS="calendar"
-
-# COLLABORA_URL=https://collabora.example.com
-## IMPORTANT FOR SECURITY REASONS WHEN RUNNING COLLABORA
-## list of IP addresses that are allowed to make WOPI requests. Use the default
-## when running the collabora server on the same machine as nextcloud.
-## Otherwise set this to the IP address range of your collabora server(s) i.e. 1.2.3.4/32
-## https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings
-# COLLABORA_ALLOWLIST="172.16.0.0/12"
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yml"
-# ONLYOFFICE_URL=https://onlyoffice.example.com
-# APPS="$APPS onlyoffice"
-# SECRET_ONLYOFFICE_JWT_VERSION=v1
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.bbb.yml"
-# BBB_URL=https://talk.example.org/bigbluebutton/ # trailing slash!
-# SECRET_BBB_SECRET_VERSION=v1
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.whiteboard.yml"
-# APPS="$APPS whiteboard"
-# SECRET_WHITEBOARD_JWT_VERSION=v1
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
-# APPS="$APPS sociallogin"
-# AUTHENTIK_USER_PREFIX=authentik
-# AUTHENTIK_DOMAIN=authentik.example.com
-# SECRET_AUTHENTIK_SECRET_VERSION=v1
-# SECRET_AUTHENTIK_ID_VERSION=v1
-
-#COMPOSE_FILE="$COMPOSE_FILE:compose.fulltextsearch.yml"
-#SECRET_ELASTICSEARCH_PASSWORD_VERSION=v1
-
-#COMPOSE_FILE="$COMPOSE_FILE:compose.talk.yml"
-#TALK_DOMAIN=talk.example.com
-#SECRET_TALK_INTERNAL_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_TURN_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_SIGNALING_SECRET_VERSION=v1 # length=64 charset=default
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.user_oidc.yml"
-# APPS="$APPS user_oidc"
-# USER_OIDC_PROVIDER=
-# USER_OIDC_ID=
-# USER_OIDC_DISCOVERY_URI=
-# USER_OIDC_END_SESSION_URI=
-# USER_OIDC_LOGIN_ONLY=false
-# SECRET_USER_OIDC_SECRET_VERSION=v1
-
-# HSTS Options
-# Uncomment this line to enable HSTS: https://docs.nextcloud.com/server/30/admin_manual/installation/harden_server.html
-#HSTS_ENABLED=1
-# Uncomment this line to add the `preload` part
-#HSTS_PRELOAD=1

.gitignore

@@ -1 +1 @@
-/.envrc
+.env

.vscode/settings.json

@@ -1,5 +0,0 @@
-{
-    "shellcheck.customArgs": [
-        "--shell=bash"
-    ]
-}

MAINTENANCE.md

@@ -1,91 +0,0 @@
-# Nextcloud Recipe Maintenance
-
-This document describes how the Nextcloud recipe is maintained. It builds on
-the floor set by [Federation Resolution
-025](https://docs.coopcloud.tech/federation/resolutions/passed/025/) and
-follows the [`MAINTENANCE.md`
-template](https://docs.coopcloud.tech/maintainers/maintain/#maintenancemd-template)
-described in the Co-op Cloud maintainers' docs.
-
-All contributions should be made via a pull request so that quality and
-consistency stay something others can rely on.
-
-## Maintainers
-
-Everyone can apply to be a recipe maintainer. 
-Simply add yourself to the list in the README.md and open a new pull request 
-with the change.
-
-## Maintainer Responsibilities
-
-This recipe commits to the following, which is tighter than the floor set by
-Resolution 025 (stable-recipe category). However, these timelines are
-best-effort, so we aim for them as good as possible:
-
-- Respond to PRs / issues within 3 working days
-- Apply security patches within 1 week of disclosure
-- Ship patch / minor image updates within 2 weeks of upstream release
-- Adopt major Nextcloud version updates within 1 release cycle of upstream
-  EOL of the previous major (see below)
-- Keep documentation current
-
-In order to meet these responsibilities each maintainer:
-
-- Watches the repository so notifications arrive
-- Keeps an eye on [Renovate](./renovate.json) updates and helps shepherd them through
-- Has a working contact (Matrix handle or email) reachable by the others
-
-## Release cadence
-
-The intent is to **track Nextcloud's own release schedule** rather than invent
-our own. In practice this means:
-
-- **Patch releases (e.g. `32.0.x`)**: published to this recipe shortly after
-  upstream, ideally within 1 week. `chore(deps)` opens the PRs; a maintainer
-  reviews the release notes and Nextcloud's issue tracker, and merges the PR
-  if it is OK.
-- **Minor releases**: same flow as patch releases, but one of the maintainer
-  tests it on their own instance before merging.
-- **Major releases (e.g. `32 → 33`)**: not adopted on day one. We wait for the
-  first one or two upstream patch releases of the new major to land
-  (typically 1–2 months) before promoting it here, to avoid passing the
-  early-adopter cost to operators. Major bumps get their own PR with release
-  notes and an upgrade-path check.
-  Before adding a major release, the following needs to be done:
-  - at least two maintainers update one of their production instances to the
-    new version
-  - the previous release gets a last update pointing to the docker image
-    versions nextcloud:xx-fpm, so that users can auto-update if they wish so
-  - the new release is added to this repo
-- If people have the time it would be nice to create specially tagged versions
-  for major releases, which reflect that this is 'bleeding edge' and has not
-  been thoroughly tested.
-- **Co-installed components** (Talk HPB, OnlyOffice, Whiteboard, etc.) are
-  bumped alongside or shortly after the matching Nextcloud release.
-
-## Pull Requests
-
-A pull request can be merged once it is approved by at least one maintainer.
-PRs opened by a maintainer need approval from another maintainer. With three
-maintainers this is workable; if the group shrinks, the rule should be
-revisited.
-
-Approvals should ideally include a smoke test on a real instance for anything
-beyond a patch bump — Nextcloud upgrades have a long history of surprising us
-(see the [upgrade notes in `README.md`](./README.md#upgrading-nextcloud)),
-and silent CI is not enough.
-
-## Becoming a maintainer
-
-Everyone is welcome to apply:
-
-1. Watch the repository so you get notifications.
-2. Open a pull request adding yourself to the `Maintainer` line in
-   [`README.md`](./README.md) and to the list above.
-3. Once an existing maintainer merges the PR, you'll be added to the
-   [nextcloud maintainers
-   team](https://git.coopcloud.tech/org/coop-cloud/teams/nextcloud-maintainers).
-
-Stepping down is symmetrical: open a PR removing yourself, and flag it in
-the federation channels so the group can plan replacement before falling
-below the Res. 025 floor of one named maintainer.

README.md

@@ -1,363 +1,135 @@
 # Nextcloud
 
-[![Build Status](https://drone.autonomic.zone/api/badges/coop-cloud/nextcloud/status.svg)](https://drone.autonomic.zone/coop-cloud/nextcloud)
-
-Fully automated luxury Nextcloud via docker-swarm.
-
-<!-- metadata -->
-* **Maintainer**: [@dannygroenewegen](https://git.coopcloud.tech/dannygroenewegen), [@ineiti](https://git.coopcloud.tech/ineiti)
-* **Category**: Apps
-* **Status**: 5
-* **Image**: [`nextcloud`](https://hub.docker.com/_/nextcloud), 4, upstream
-* **Healthcheck**: Yes
-* **Backups**: Yes
-* **Email**: 3
-* **Tests**: 2
-* **SSO**: 1 (OAuth)
-<!-- endmetadata -->
-
-## Quick start
-
-* `abra app new nextcloud`
-* `abra app config <app-name>`
-* `abra app secret insert <app-name> smtp_password v1 <SMTP_PASSWORD>`
-* `abra app secret generate -a <app-name>`
-* `abra app deploy <app-name>`
-
-### Onlyoffice Integration
-
-First, install onlyoffice following the instructions in the 
-[OnlyOffice Recipe](https://recipes.coopcloud.tech/onlyoffice), and enable
-the JWT secret. Then configure your nextcloud instance with:
-
-`abra app config <app-name>` 
-
-Configure the following envs with the URL of the onlyoffice service:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.apps.yml"
-ONLYOFFICE_URL=https://onlyoffice.example.com
-SECRET_ONLYOFFICE_JWT_VERSION=v1
-```
-
-Then set the onlyoffice JWT secret from the onlyoffice installation:
-
-* `abra app secret insert <app-name> onlyoffice_jwt v1 <jwt_secret>`
-* `abra app cmd <app-name> app install_onlyoffice`
-
-### BBB Integration
-
-`abra app config <app-name>` 
-
-Configure the following envs:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.apps.yml"
-BBB_URL=https://talk.example.org/bigbluebutton/ # trailing slash!
-SECRET_BBB_SECRET_VERSION=v1
-```
-
-* `abra app secret insert <app-name> bbb_secret v1 <bbb_secret>`
-* `abra app cmd <app-name> app install_bbb`
-
-### Nextcloud Talk High performance Backend
-
-Note: at the moment you are limited to run one Nextcloud high performance backend per docker host with this setup.
-
-`abra app config <app-name>` 
-
-Configure the following envs:
-```
-#COMPOSE_FILE="$COMPOSE_FILE:compose.talk.yml"
-#TALK_DOMAIN=talk.example.com
-#SECRET_TALK_INTERNAL_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_TURN_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_SIGNALING_SECRET_VERSION=v1 # length=64 charset=default
-```
-
-* `abra app secret insert <app-name> talk_internal_secret v1 <talk_internal_secret>`
-* `abra app secret insert <app-name> talk_turn_secret v1 <talk_turn_secret>`
-* `abra app secret insert <app-name> talk_signaling_secret v1 <talk_signaling_secret>`
-* `abra app cmd <app-name> app install_talk`
-
-Don't forget to enable the additional env's in your hosts traefik instance:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
-NEXTCLOUD_TALK_HPB_ENABLED=1
-```
-
-Due to a bug in compose that deletes duplacted ports without checking for the protocol, traefik need to get the additional udp binding added after the deployment via ssh (this might take longer than expected!):
-```
-docker service update  --publish-add published=3478,target=3478,protocol=udp traefik_XXX_XXX_app
-```
-
-To check if tcp and udp was binded, you can use:
-```
-docker service inspect traefik_XXX_XXX_app | grep 3478 -a2
-```
-
-### Authentik Integration
+Wiki Cafe's configuration for a Nextcloud deployment. Originally slimmed down from an `abra` [recipe](https://git.coopcloud.tech/coop-cloud/nextcloud) by [Co-op Cloud](https://coopcloud.tech/).
 
 
-`abra app config <app-name>` 
-Configure the following envs:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
-AUTHENTIK_USER_PREFIX=authentik
-AUTHENTIK_DOMAIN=authentik.example.com
-AUTHENTIK_SECRET_NAME=authentik_example_com_nextcloud_secret_v1  # the same as in authentik
-AUTHENTIK_ID_NAME=authentik_example_com_nextcloud_id_v1  # the same as in authentik
-```
-
-`abra app cmd <app-name> app set_authentik`
-
-## Running `occ`
-
-`abra app cmd <app-name> app run_occ '"user:list --help"'`
-
-Read more about [occ command here](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).
-
-### Disable Dashboard
-
-To disable dashboard app (since it is so corporate):
-
-`abra app cmd <app-name> app run_occ '"app:disable dashboard"'`
-
-## Default user files
-
-- Follow [these docs](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/default_files_configuration.html) to set the default files list for each user in the Files app
-
-## Default App
-
-- Configure a `defaultapp` in your `config.php` or use [apporder](https://apps.nextcloud.com/apps/apporder)
-
-## Upgrading Nextcloud
-Upgrading Nextcloud can be a hair raising experiance. They [don't support downgrading](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/upgrade.html) even for minor versions.
-
-Many of us  have found that jumping major versions when upgrading is also a bad idea. We have however found that it's ok to skip minor version upgrades and go to the last minor version before a major version (e.g. 24.0.0 to 24.9.9 before going to 25.0.0). To extra cautious just upgrade one release at a time. Read the release notes and check your logs.
-
-## Upgrading Nextcloud apps (plug-ins)
-
-`abra app cmd <app-name> app run_occ '"app:update --all"'`
+This setup works in conjunction with [Caddy reverse proxy](https://git.coopcloud.tech/coop-cloud/caddy), handling TLS certificates via Let's Encrypt. This setup also includes labels for optional integration with [backupbot](https://git.coopcloud.tech/coop-cloud/backup-bot-two) for automated backups.
 
 
-## How do I fix a Nextcloud version snafu?
+## Deploying the app with Docker Swarm
 
-`Exception: Updates between multiple major versions and downgrades are unsupported.`
-
-Solution:
-
-- Look at log files to determine the old Nextcloud version
-- Change your local `~/.abra/recipes/nextcloud/compose.yml` to the highest minor
-    version in the old version -- e.g. choose `22.2.5` for `22`, if you're
-    upgrading to `23`.
-- Then, do one of (both bad):
-  1. `abra app deploy --chaos ...`, then `app run` to go in and manually lower the version number in PHP (shell in, `apt install vim-core && vi version.php`), then try `php ./occ upgrade`
-  2. `abra app undeploy ...`, `abra volume rm`, CAREFULLY only choose the volume
-     ENDING `_nextcloud`, then `abra app deploy --chaos ...`, then edit the
-     `compose.yml` to add `entrypoint: ['tail', '-f', '/dev/null']` to `app`,
-     then `app deploy --chaos` again, then `app run --user=www-data ... app bash` to get in and run `./occ maintenance:repair`, and `./occ upgrade`. 
-- Change `compose.yml` to the new version number; `git checkout compose.yml`
-- `abra app deploy --force`
-- This wasn't even multiplle major versions was it 😾
-
-## How do I integrate with Keycloak SSO?
-
-Use [this plugin](https://github.com/pulsejet/nextcloud-oidc-login). Unlike the plugin it's forked from, there is no configuration UI, so you'll need to edit `/var/www/html/config/config.php`:
+Create a new file `.env` in this directory with the following contents, adjusting as necessary:
 
 ```
-  'oidc_login_client_id' => 'nextcloud',
-  'oidc_login_client_secret' => 'mysecret',
-  'oidc_login_provider_url' => 'https://example.com/realms/myrealm',
-  'oidc_login_disable_registration' => false,
-  'oidc_login_hide_password_form' => true,
-  'oidc_login_button_text' => 'Log in with your myssodomain',
-  'oidc_login_default_group' => 'mygroup',
-  'oidc_login_attributes' =>
-  array (
-    'id' => 'sub',
-    'name' => 'name',
-    'mail' => 'email',
-  ),
-  'oidc_create_groups' => true,
+STACK_NAME=nextcloud
+DOMAIN=nextcloud.example.com
+## Domain aliases
+#EXTRA_DOMAINS=', `www.nextcloud.example.com`'
+LETS_ENCRYPT_ENV=production
+
+ADMIN_USER=admin
+
+EXTRA_VOLUME=/dev/null:/tmp/.dummy
+
+PHP_MEMORY_LIMIT=1G
+# fpm-tune, see: https://spot13.com/pmcalculator/
+FPM_MAX_CHILDREN=128
+FPM_START_SERVERS=32
+FPM_MIN_SPARE_SERVERS=32
+FPM_MAX_SPARE_SERVERS=64
+
+DEFAULT_QUOTA="500 MB"
+
+# X_FRAME_OPTIONS_ENABLED=1
+# X_FRAME_OPTIONS_ALLOW_FROM=embedding-site.example.org
+
+# SMTP Config
+# See https://github.com/nextcloud/docker#auto-configuration-via-environment-variables for default values
+SMTP_AUTHTYPE=LOGIN
+SMTP_HOST=mail.example.com
+SMTP_SECURE=tls
+SMTP_NAME=mail@example.com
+SMTP_PORT=587
+MAIL_FROM_ADDRESS=cloud
+MAIL_DOMAIN=example.com
+
+# Database tuning variables
+INNODB_BUFFER_POOL_SIZE=1G
+MAX_DB_CONNECTIONS=256
 ```
 
-You can use [this trick](https://janikvonrotz.ch/2020/10/20/openid-connect-with-nextcloud-and-keycloak/) (see "Cryptic Usernames" work-around) to get proper usernames.
-
-If you ever need to change the realm, you'll need to reset the cache with:
+Set the environment variables from the .env file during the shell session:
 
 ```
-docker exec -u www-data <container-id> php occ config:app:delete oidc_login last_updated_well_known
-docker exec -u www-data <container-id> php occ config:app:delete oidc_login last_updated_jwks
+set -a && source .env && set +a
 ```
 
-## How do I enable multiple SSO login buttons?
+### Creating Secrets
 
-We've been able to get this setup by using the [social login](https://apps.nextcloud.com/apps/sociallogin) plugin.
-
-If using Keycloak, you'll want to do [this trick](https://janikvonrotz.ch/2020/10/20/openid-connect-with-nextcloud-and-keycloak/) also.
-
-## How do I enable OpenID Connect (OIDC) providers?
-[user_oidc](https://github.com/nextcloud/user_oidc) is the recommended way to integrate Nextcloud with OIDC providers.
-
-Run `abra app config <app-name>`
-
-Set the following envs:
-```env
-COMPOSE_FILE="$COMPOSE_FILE:compose.user_oidc.yml"
-APPS="$APPS user_oidc"
-USER_OIDC_PROVIDER=example-provider # this has been tested with keycloak
-USER_OIDC_ID=example-client-id # get this from your oidc provider
-USER_OIDC_DISCOVERY_URI=example-oidc-provider.com/.well-known/openid-configuration # get this from your oidc provider
-USER_OIDC_END_SESSION_URI=example-oidc-provider.com/protocol/openid-connect/logout # get this from your oidc provider
-USER_OIDC_LOGIN_ONLY=false # set this to true to automatically redirect all logins to your oidc provider
-SECRET_USER_OIDC_SECRET_VERSION=v1
-```
-
-Then insert the client secret from your OIDC provider:
-```sh
-abra app secret insert <app-name> user_oidc_secret v1 <client-secret from oidc provider>
-```
-
-After you deploy (or redeploy), run the following to set up the user_oidc Nextcloud app:
-`abra app cmd <app-name> app set_user_oidc`
-
-## How can I customise the CSS?
-
-There is some basic stuff in the admin settings.
-
-To go a little deeper, you can use [this handy app](https://apps.nextcloud.com/apps/theming_customcss).
-
-Here is an example CSS config which hides the local login and makes space for a central image:
-
-```css
-#body-login .wrapper main form[name="login"],
-#body-login .wrapper main form[name="login"] ~ a {
-  display: none;
-}
-
-#body-login .logo {
-  visibility: hidden;
-}
-
-#body-login #alternative-logins a.button[href*="oidc"] {
-  background: #233b4a;
-  color: #fff;
-  transition: all 0.2s ease-in-out;
-}
-#body-login #alternative-logins a.button[href*="oidc"]:hover {
-  background: linear-gradient(-35deg, #233b4a 40%, #486c83 100%);
-}
-
-#body-login #alternative-logins a.button[href*="/sociallogin/oauth/google"] {
-  border: 0;
-  color: #db4437 !important;
-  background-color: #fff;
-}
-
-#body-login
-  #alternative-logins
-  a.button[href*="/sociallogin/oauth/google"]::before {
-  width: 25px;
-  background-color: #db4437;
-  border-radius: 100%;
-  background-size: 60%;
-  background-position: center;
-  height: 25px;
-  vertical-align: middle;
-  margin-right: 4px;
-}
-
-#body-login main {
-  padding: 50vh 0 0 0;
-}
-
-#body-login a[href*="#body-login"] {
-  visibility: hidden;
-}
-
-#body-login footer a,
-#body-login footer p {
-  color: #233b4a;
-}
-
-#body-login footer a:hover {
-  color: #fff;
-}
-
-#body-login footer p.info {
-  text-shadow: none;
-}
-```
-
-[nextcloud-docker]: https://hub.docker.com/_/nextcloud/
-[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
-[`coop-cloud/traefik`]: https://git.autonomic.zone/coop-cloud/traefik
-
-## Using [`previewgenerator`](https://github.com/nextcloud/previewgenerator) app
-
-> Beware, this appp has been known to not work...
-
-After you install, enable etc. then you need to run the generation (**warning**: it can take a long time!):
+Set the secrets. The usual way to create a secret is:
 
 ```
-abra app run <domain> app bash -u www-data
-./occ preview:generate-all
+printf "SECRET_HERE" | docker secret create SECRET_NAME -
 ```
 
-To set up the cron to run again, there is [no clear solution in the context of
-containers](https://github.com/nextcloud/previewgenerator/issues/1). So, a
-pretty dodgy hack is to run it from the system directly:
+The required secrets are:
+
+- `db_password`: The MariaDB database password for the `nextcloud` user.
+- `admin_password`: The Nextcloud admin user's password.
+- `smtp_password`: The SMTP password for sending emails.
+- `elasticsearch_password`: The Elasticsearch password.
+- `db_root_password`: The MariaDB root user password.
+
+We can generate these secrets using `openssl rand -base64 32` or similar.
 
 ```
-root@foo.com /etc/cron.hourly $ cat foo-com-preview-generate 
-#!/bin/bash
-
-docker exec -u www-data $(docker ps -f name=foo_com_app -q) ./occ preview:pre-generate
+openssl rand -base64 32 | docker secret create db_password -
+openssl rand -base64 32 | docker secret create admin_password -
+openssl rand -base64 32 | docker secret create smtp_password -
+openssl rand -base64 32 | docker secret create elasticsearch_password -
+openssl rand -base64 32 | docker secret create db_root_password -
 ```
 
-This app will improve performance of image browsing at the cost of storage space.
+### Deploying the App
 
-## Fulltextsearch using elasticsearch
-
-1. Uncomment the following lines in your env file:
-```
-#COMPOSE_FILE="$COMPOSE_FILE:compose.fulltextsearch.yml"
-#SECRET_ELASTICSEARCH_PASSWORD_VERSION=v1
-```
-
-2. Generate the secret for elasticsearch:
-```bash
-abra app secret generate <domain> elasticsearch_password v1
-```
-
-3. Deploy your app:
-```bash
-abra app deploy <domain>
-```
-
-4. Install the apps and configure them:
-```
-abra app cmd <domain> app install_fulltextsearch
-```
-
-5. You might need to configure the files_fulltextsearch app. run this command to check its settings:
-```
-abra app cmd <domain> app run_occ '"config:list files_fulltextsearch"
-```
-
-6. You can check if the nextcloud can connect to elasticsearch:
-```
-abra app cmd <domain> app run_occ '"fulltextsearch:test"'
-```
-
-And you can populate the index manually and check if any errors occur:
-```
-abra app cmd <domain> app run_occ '"fulltextsearch:index"'
-```
-
-### Troubleshooting fulltextsearch
-
-The fulltextsearch plugin might be stuck with this error: "Index is already running". In that case the following command can get things runing again:
+Deploy using the `-c` flag to specify one or multiple compose files.
 
 ```
-abra app run <domain> db /bin/sh -- -c 'echo "delete from oc_fulltextsearch_ticks;" | mariadb -u root -p$(cat /run/secrets/db_root_password) nextcloud'
+docker stack deploy nextcloud --detach=true -c compose.yaml -c compose.mariadb.yaml -c compose.smtp.yaml -c compose.fulltextsearch.yaml
+```
+
+### Enabling Full Text Search
+
+To enable full text search, we first set up some environment variables for running commands inside the app and database containers:
+
+```
+export NC_APP="docker exec -u www-data -it $(docker ps --filter name=${STACK_NAME}_app --format '{{.ID}}' | head -n 1)"
+export NC_DB="docker exec -it $(docker ps --filter name=${STACK_NAME}_db --format '{{.ID}}' | head -n 1)"
+```
+
+Next, run the following commands to install and configure the necessary Nextcloud apps for full text search with Elasticsearch:
+
+```
+$NC_APP php /var/www/html/occ app:install fulltextsearch
+$NC_APP php /var/www/html/occ app:install fulltextsearch_elasticsearch
+$NC_APP php /var/www/html/occ app:install files_fulltextsearch
+
+$NC_APP php /var/www/html/occ config:app:set fulltextsearch search_platform --value="OCA\\FullTextSearch_Elasticsearch\\Platform\\ElasticSearchPlatform"
+$NC_APP php /var/www/html/occ config:app:set fulltextsearch_elasticsearch elastic_host --value="http://elastic:$(cat /run/secrets/elasticsearch_password)@elasticsearch:9200/"
+$NC_APP php /var/www/html/occ config:app:set fulltextsearch_elasticsearch elastic_index --value="nextcloud"
+$NC_APP php /var/www/html/occ config:app:set files_fulltextsearch files_local --value="1"
+```
+
+Verify the setup by running:
+
+```
+$NC_APP php /var/www/html/occ config:list files_fulltextsearch
+```
+
+Then, check for connectivity with Elasticsearch:
+
+```
+$NC_APP php /var/www/html/occ fulltextsearch:test
+```
+
+Manually build the search index:
+
+```
+$NC_APP php /var/www/html/occ fulltextsearch:index
+```
+
+If you get “Index is already running”, clear the ticker table in the database:
+
+```
+$NC_DB sh -c 'echo "delete from oc_fulltextsearch_ticks;" | mariadb -u root -p$(cat /run/secrets/db_root_password) nextcloud'
 ```

abra.sh

@@ -1,195 +0,0 @@
-#!/bin/bash
-
-export FPM_TUNE_VERSION=v5
-export NGINX_CONF_VERSION=v8
-export MY_CNF_VERSION=v6
-export ENTRYPOINT_VERSION=v3
-export ENTRYPOINT_WHITEBOARD_VERSION=v1
-export ENTRYPOINT_TALK_VERSION=v1
-export CRONTAB_VERSION=v1
-export PG_BACKUP_VERSION=v2
-
-run_occ() {
-    su -p www-data -s /bin/sh -c "/var/www/html/occ $@"
-}
-
-install_apps() {
-    install_apps="$@"
-    if [ -z "$install_apps" ]; then
-        install_apps=$APPS
-    fi
-    for app in $install_apps; do
-        run_occ "app:install $app"
-    done
-}
-
-set_app_config() {
-    APP=$1
-    KEY=$2
-    VALUE=$3
-    run_occ "config:app:set $APP $KEY --value '$VALUE'"
-}
-
-set_system_config() {
-    KEY=$1
-    VALUE=$2
-    run_occ "config:system:set $KEY --value '$VALUE'"
-}
-
-set_trusted_proxies() {
-    trusted_proxies="$@"
-    if [ -z "$1" ]; then
-        trusted_proxies="$TRUSTED_PROXIES"
-    fi
-    set_system_config trusted_proxies "$trusted_proxies"
-}
-
-set_logfile_stdout() {
-    set_system_config logfile '/dev/stdout'
-}
-
-customize() {
-    if [ -z "$1" ]
-    then
-            echo "Usage: ... customize <assets_path>"
-            exit 1
-    fi
-    asset_dir=$1
-    for asset in $COPY_ASSETS; do
-        source=$(echo $asset | cut -d "|" -f1)
-        target=$(echo $asset | cut -d "|" -f2)
-        echo copy $source to $target
-        abra app cp $APP_NAME $asset_dir/$source $target
-    done
-
-    abra app cmd -T $APP_NAME app set_app_config theming color \"$THEMING_COLOR\"
-    abra app cmd -T $APP_NAME app set_app_config theming slogan \"$THEMING_SLOGAN\"
-    abra app cmd -T $APP_NAME app run_occ '"theming:config background \"/var/www/html/themes/flow_background.jpg\""'
-    abra app cmd -T $APP_NAME app run_occ '"theming:config logo \"/var/www/html/themes/icon_left_brand.svg\""'
-    abra app cmd -T $APP_NAME app run_occ '"theming:config logoheader \"/var/www/html/themes/icon.png\""'
-}
-
-install_bbb() {
-    install_apps bbb
-    set_app_config bbb app.navigation true
-    set_app_config bbb api.url "$BBB_URL"
-    set_app_config bbb api.secret "$(cat /run/secrets/bbb_secret)"
-}
-
-install_onlyoffice() {
-    install_apps onlyoffice
-    set_app_config onlyoffice DocumentServerUrl "$ONLYOFFICE_URL"
-    set_app_config onlyoffice jwt_secret "$(cat /run/secrets/onlyoffice_jwt)"
-    set_app_config onlyoffice customizationForcesave true
-}
-
-install_collabora() {
-    install_apps richdocuments
-    set_app_config richdocuments wopi_url "$COLLABORA_URL"
-    # important for security reaosns
-    # https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings
-    set_app_config richdocuments wopi_allowlist "$COLLABORA_ALLOWLIST"
-}
-
-install_whiteboard() {
-    install_apps whiteboard
-    set_app_config whiteboard collabBackendUrl "https://${DOMAIN}/whiteboard"
-    set_app_config whiteboard jwt_secret_key "$(cat /run/secrets/whiteboard_jwt)"
-}
-
-
-install_talk() {
-    install_apps spreed
-    run_occ "talk:signaling:add --verify 'wss://${TALK_DOMAIN}' '$(cat /run/secrets/talk_signaling_secret)'"
-    run_occ "talk:stun:add '${TALK_DOMAIN}:3478'"
-    run_occ "talk:stun:add '${TALK_DOMAIN}:443'"
-    run_occ "talk:turn:add --secret='$(cat /run/secrets/talk_turn_secret)' turn '${TALK_DOMAIN}:3478' udp,tcp"
-
-}
-
-install_fulltextsearch() {
-    install_apps fulltextsearch
-    install_apps fulltextsearch_elasticsearch
-    install_apps files_fulltextsearch
-    set_app_config fulltextsearch search_platform "OCA\\FullTextSearch_Elasticsearch\\Platform\\ElasticSearchPlatform"
-    set_app_config fulltextsearch_elasticsearch elastic_host "http://elastic:$(cat /run/secrets/elasticsearch_password)@elasticsearch:9200/"
-    set_app_config fulltextsearch_elasticsearch elastic_index "nextcloud"
-    set_app_config files_fulltextsearch files_local "1"
-}
-
-set_default_quota() {
-    set_app_config files default_quota "$DEFAULT_QUOTA"
-}
-
-set_authentik() {
-    install_apps sociallogin
-    AUTHENTIK_SECRET=$(cat /run/secrets/authentik_secret)
-    AUTHENTIK_ID=$(cat /run/secrets/authentik_id)
-    set_system_config logo_url https://$AUTHENTIK_DOMAIN
-    set_app_config sociallogin custom_providers "
-{
-    \"custom_oidc\":[
-    {
-        \"name\":\"$AUTHENTIK_USER_PREFIX\",
-        \"title\":\"authentik\",
-        \"authorizeUrl\": \"https://$AUTHENTIK_DOMAIN/application/o/authorize/\",
-        \"tokenUrl\": \"https://$AUTHENTIK_DOMAIN/application/o/token/\",
-        \"displayNameClaim\":\"preferred_username\",
-        \"userInfoUrl\": \"https://$AUTHENTIK_DOMAIN/application/o/userinfo/\",
-        \"logoutUrl\": \"https://$AUTHENTIK_DOMAIN/application/o/nextcloud/end-session/\",
-        \"clientId\":\"$AUTHENTIK_ID\",
-        \"clientSecret\":\"$AUTHENTIK_SECRET\",
-        \"scope\":\"openid profile email nextcloud\",
-        \"groupsClaim\":\"nextcloud_groups\",
-        \"style\":\"openid\",
-        \"defaultGroup\":\"\",
-        \"groupMapping\": {
-          \"admin\": \"admin\",
-          \"authentik Admins\": \"admin\"
-        }
-    }
-]
-}"
-
-    set_app_config sociallogin update_profile_on_login 1
-    set_app_config sociallogin auto_create_groups 1
-    set_app_config sociallogin hide_default_login 1
-    run_occ 'config:system:set social_login_auto_redirect --value true'
-    run_occ 'config:system:set allow_user_to_change_display_name --value=false'
-    run_occ 'config:system:set lost_password_link --value=disabled'
-}
-
-set_user_oidc() {
-    install_apps user_oidc
-    USER_OIDC_SECRET=$(cat /run/secrets/user_oidc_secret)
-    run_occ "user_oidc:provider \
-            --clientid=${USER_OIDC_ID} \
-            --clientsecret=${USER_OIDC_SECRET} \
-            --discoveryuri=${USER_OIDC_DISCOVERY_URI} \
-            --endsessionendpointuri=${USER_OIDC_END_SESSION_URI} \
-            --postlogouturi=https://${DOMAIN} \
-            --scope='openid email profile' \
-            ${USER_OIDC_PROVIDER}"
-    # disable non user_oidc login
-    if [[ ${USER_OIDC_LOGIN_ONLY:-false} = "true" ]]; then
-        run_occ "config:app:set --value=0 user_oidc allow_multiple_user_backends"
-    fi
-}
-
-disable_skeletondirectory() {
-    run_occ "config:system:set skeletondirectory --value ''"
-}
-
-set_windowsfriendly_filenames() {
-    run_occ 'config:system:set forbidden_filename_characters 0 --value=?'
-    run_occ 'config:system:set forbidden_filename_characters 1 --value=\<'
-    run_occ 'config:system:set forbidden_filename_characters 2 --value=\>'
-    run_occ 'config:system:set forbidden_filename_characters 3 --value=:'
-    run_occ 'config:system:set forbidden_filename_characters 4 --value=*'
-    run_occ 'config:system:set forbidden_filename_characters 5 --value=\|'
-    run_occ 'config:system:set forbidden_filename_characters 6 --value=\"'
-}
-
-upgrade_mariadb() {
-    mariadb-upgrade -p`cat /run/secrets/db_root_password`
-}

alaconnect.yml

@@ -1,24 +0,0 @@
-authentik:
-    uncomment:
-        - compose.authentik.yml
-        - AUTHENTIK_USER_PREFIX
-        - AUTHENTIK_DOMAIN
-        - SECRET_AUTHENTIK_SECRET_VERSION
-        - SECRET_AUTHENTIK_ID_VERSION
-    initial-hooks:
-        - app set_authentik
-    shared_secrets:
-        nextcloud_secret: authentik_secret
-        nextcloud_id: authentik_id
-onlyoffice:
-    uncomment:
-        - compose.onlyoffice.yml
-        - ONLYOFFICE_URL
-        - SECRET_ONLYOFFICE_JWT_VERSION
-    initial-hooks:
-        - app install_onlyoffice
-collabora:
-    uncomment:
-        - COLLABORA_URL
-    initial-hooks:
-        - app install_collabora

compose.authentik.yml

@@ -1,14 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - authentik_secret
-      - authentik_id
-
-secrets:
-  authentik_secret:
-    external: true
-    name: ${STACK_NAME}_authentik_secret_${SECRET_AUTHENTIK_SECRET_VERSION}
-  authentik_id:
-    external: true
-    name: ${STACK_NAME}_authentik_id_${SECRET_AUTHENTIK_ID_VERSION}

compose.bbb.yml

@@ -1,12 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - bbb_secret
-    environment:
-      - BBB_URL
-
-secrets:
-  bbb_secret:
-    external: true
-    name: ${STACK_NAME}_bbb_secret_${SECRET_BBB_SECRET_VERSION}

compose.fulltextsearch.yaml

@@ -1,8 +1,6 @@
-version: "3.8"
-
 services:
   elasticsearch:
-    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.19"
+    image: "docker.elastic.co/elasticsearch/elasticsearch:9.2.0"
     environment:
       - cluster.name=docker-cluster
       - bootstrap.memory_lock=true
@@ -29,7 +27,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
@@ -40,8 +38,6 @@ services:
       - internal
     entrypoint: su -p www-data -s /bin/sh -c '/var/www/html/occ fulltextsearch:live'
 
-  # Add the secret to the app service so it is avaiable in the
-  # install_fulltextsearch command
   app:
     secrets:
       - elasticsearch_password
@@ -49,7 +45,7 @@ services:
 secrets:
   elasticsearch_password:
     external: true
-    name: ${STACK_NAME}_elasticsearch_password_${SECRET_ELASTICSEARCH_PASSWORD_VERSION}
+    name: ${STACK_NAME}_elasticsearch_password
 
 volumes:
   elasticsearch:

compose.mariadb.yaml

@@ -1,5 +1,3 @@
-version: "3.8"
-
 services:
   app:
     environment:
@@ -9,7 +7,7 @@ services:
       - MYSQL_PASSWORD_FILE=/run/secrets/db_password
 
   db:
-    image: "mariadb:12.3"
+    image: "mariadb:12.0"
     environment:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
@@ -29,6 +27,7 @@ services:
       - internal
     deploy:
       labels:
+        backupbot.backup: "true"
         backupbot.backup.pre-hook: 'mariadb-dump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" nextcloud > /var/lib/mysql/backup.sql'
         backupbot.backup.volumes.mariadb.path: "backup.sql"
         backupbot.restore.post-hook: 'mariadb -u root -p"$$(cat /run/secrets/db_root_password)" nextcloud < /var/lib/mysql/backup.sql'
@@ -40,14 +39,17 @@ services:
       start_period: 1m
 configs:
   my_tune:
-    name: ${STACK_NAME}_my_cnf_${MY_CNF_VERSION}
+    name: ${STACK_NAME}_my_cnf
     file: my-tune.cnf
     template_driver: golang
 
 secrets:
   db_root_password:
     external: true
-    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
+    name: ${STACK_NAME}_db_root_password
+  db_password:
+    external: true
+    name: ${STACK_NAME}_db_password
 
 volumes:
   mariadb:

compose.onlyoffice.yml

@@ -1,12 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - onlyoffice_jwt
-    environment:
-      - ONLYOFFICE_URL
-
-secrets:
-  onlyoffice_jwt:
-    external: true
-    name: ${STACK_NAME}_onlyoffice_jwt_${SECRET_ONLYOFFICE_JWT_VERSION}

compose.postgres.yml

@@ -1,46 +0,0 @@
-version: '3.8'
-
-services:
-  app:
-    environment:
-      - POSTGRES_HOST=db
-      - POSTGRES_DB=nextcloud
-      - POSTGRES_USER=nextcloud
-      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
-      - NEXTCLOUD_UPDATE=1
-
-  db:
-    image: "pgautoupgrade/pgautoupgrade:14-debian"
-    command: -c "max_connections=${MAX_DB_CONNECTIONS:-100}"
-    volumes:
-      - "postgres:/var/lib/postgresql/data"
-    networks:
-      - internal
-    environment:
-      POSTGRES_USER: nextcloud
-      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
-      POSTGRES_DB: nextcloud
-    secrets:
-      - db_password
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready", "-U", "nextcloud"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    deploy:
-      labels:
-        backupbot.backup.pre-hook: "/pg_backup.sh backup"
-        backupbot.backup.volumes.postgres.path: "backup.sql"
-        backupbot.restore.post-hook: '/pg_backup.sh restore'
-    configs:
-        - source: pg_backup
-          target: /pg_backup.sh
-          mode: 0555
-
-volumes:
-  postgres:
-
-configs:
-  pg_backup:
-    name: ${STACK_NAME}_pg_backup_${PG_BACKUP_VERSION}
-    file: pg_backup.sh

compose.smtp.yaml

@@ -1,4 +1,3 @@
-version: "3.8"
 services:
   app:
     secrets:
@@ -16,4 +15,4 @@ services:
 secrets:
   smtp_password:
     external: true
-    name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
+    name: ${STACK_NAME}_smtp_password

compose.talk.yml

@@ -1,70 +0,0 @@
-version: "3.8"
-
-services:
-  talk:
-    image: "nextcloud/aio-talk:20251128_084214"
-    environment:
-      - NC_DOMAIN=${DOMAIN}
-      - TALK_HOST=${TALK_DOMAIN}
-      - TZ
-      - TALK_PORT=3478
-      - INTERNAL_SECRET_FILE=/run/secrets/talk_internal_secret 
-      - TURN_SECRET_FILE=/run/secrets/talk_turn_secret
-      - SIGNALING_SECRET_FILE=/run/secrets/talk_signaling_secret
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.swarm.network=proxy
-        - traefik.http.services.${STACK_NAME}_talk.loadbalancer.server.port=8081
-        - traefik.http.routers.${STACK_NAME}_talk.rule=Host(`${TALK_DOMAIN}`)
-        - traefik.http.routers.${STACK_NAME}_talk.entrypoints=web-secure
-        - traefik.http.routers.${STACK_NAME}_talk.tls.certresolver=${LETS_ENCRYPT_ENV}
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.rule=HostSNI(`*`)
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.entrypoints=nextcloud-talk-hpb
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.service=${STACK_NAME}_nextcloud-talk-hpb-svc
-        - traefik.tcp.services.${STACK_NAME}_nextcloud-talk-hpb-svc.loadbalancer.server.port=3478
-        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.entrypoints=nextcloud-talk-hpb-udp
-        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.service=${STACK_NAME}_nextcloud-talk-hpb-udp-svc
-        - traefik.udp.services.${STACK_NAME}_nextcloud-talk-hpb-udp-svc.loadbalancer.server.port=3478
-    networks:
-      - proxy
-    configs:
-      - source: entrypoint_talk
-        target: /custom-entrypoint.sh
-        mode: 775
-    entrypoint: /custom-entrypoint.sh
-    secrets:
-      - source: talk_internal_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-      - source: talk_turn_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-      - source: talk_signaling_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-
-  app:
-    secrets:
-      - talk_turn_secret
-      - talk_signaling_secret
-
-secrets:
-  talk_internal_secret:
-    external: true
-    name: ${STACK_NAME}_talk_internal_secret_${SECRET_TALK_INTERNAL_SECRET_VERSION}
-  talk_turn_secret:
-    external: true
-    name: ${STACK_NAME}_talk_turn_secret_${SECRET_TALK_TURN_SECRET_VERSION}
-  talk_signaling_secret:
-    external: true
-    name: ${STACK_NAME}_talk_signaling_secret_${SECRET_TALK_SIGNALING_SECRET_VERSION}
-
-configs:
-  entrypoint_talk:
-    name: ${STACK_NAME}_entrypoint_talk_${ENTRYPOINT_TALK_VERSION}
-    file: entrypoint.talk.sh.tmpl
-    template_driver: golang

compose.user_oidc.yml

@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - user_oidc_secret
-
-secrets:
-  user_oidc_secret:
-    external: true
-    name: ${STACK_NAME}_user_oidc_secret_${SECRET_USER_OIDC_SECRET_VERSION}

compose.whiteboard.yml

@@ -1,44 +0,0 @@
-version: "3.8"
-
-services:
-  app:
-    secrets:
-      - whiteboard_jwt
-
-  whiteboard:
-    image: ghcr.io/nextcloud-releases/whiteboard:v1.5.9
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.swarm.network=proxy
-        - traefik.http.services.${STACK_NAME}_whiteboard.loadbalancer.server.port=3002
-        - traefik.http.routers.${STACK_NAME}_whiteboard.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS}) && PathPrefix(`/whiteboard`)
-        - traefik.http.routers.${STACK_NAME}_whiteboard.entrypoints=web-secure
-        - traefik.http.routers.${STACK_NAME}_whiteboard.tls.certresolver=${LETS_ENCRYPT_ENV}
-        - traefik.http.middlewares.${STACK_NAME}_whiteboard-stripprefix.stripprefix.prefixes=/whiteboard
-        - traefik.http.routers.${STACK_NAME}_whiteboard.middlewares=${STACK_NAME}_whiteboard-stripprefix
-    configs:
-      - source: entrypoint_whiteboard
-        target: /custom-entrypoint.sh
-    entrypoint: ["sh", "/custom-entrypoint.sh"]
-    user: root
-    networks:
-     - proxy
-    ports:
-      - 3002:3002
-    secrets:
-      - whiteboard_jwt
-    environment:
-      - NEXTCLOUD_URL=https://$DOMAIN
-      - JWT_SECRET_KEY_FILE=/run/secrets/whiteboard_jwt
-
-secrets:
-  whiteboard_jwt:
-    external: true
-    name: ${STACK_NAME}_whiteboard_jwt_${SECRET_WHITEBOARD_JWT_VERSION}
-
-configs:
-  entrypoint_whiteboard:
-    name: ${STACK_NAME}_entrypoint_whiteboard_${ENTRYPOINT_WHITEBOARD_VERSION}
-    file: entrypoint.whiteboard.sh.tmpl
-    template_driver: golang

compose.yaml

@@ -1,9 +1,6 @@
-version: "3.8"
 services:
   web:
-    image: nginx:1.31.3
-    depends_on:
-      - app
+    image: nginx:1.29.3
     configs:
       - source: nginx_conf
         target: /etc/nginx/nginx.conf
@@ -12,8 +9,6 @@ services:
       - X_FRAME_OPTIONS_ENABLED
       - DOMAIN
       - STACK_NAME
-      - HSTS_ENABLED
-      - HSTS_PRELOAD
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
@@ -29,26 +24,26 @@ services:
         order: start-first
       labels:
         - "traefik.enable=true"
-        - "traefik.swarm.network=proxy"
+        - "traefik.docker.network=proxy"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
         - "caddy=${DOMAIN}"
         - "caddy.reverse_proxy={{upstreams 80}}"
         - "caddy.tls.on_demand="
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://localhost/status.php | grep -q '\"installed\":true'"]
+      test: ["CMD-SHELL", 'curl -s -N curl -Ns localhost/status.php |  grep "installed\":true"']
       interval: 30s
       timeout: 10s
       retries: 10
       start_period: 5m
 
   app:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
     depends_on:
       - db
     configs:
@@ -63,7 +58,6 @@ services:
       - admin_password
     environment:
       - APPS
-      - OCC_CMDS
       - X_FRAME_OPTIONS_ALLOW_FROM
       - X_FRAME_OPTIONS_ENABLED
       - DOMAIN
@@ -74,9 +68,7 @@ services:
       - TRUSTED_PROXIES=10.0.0.0/8
       - REDIS_HOST=cache
       - OVERWRITEPROTOCOL=https
-      - OVERWRITECLIURL=https://${DOMAIN}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-1G}
-      - PHP_UPLOAD_LIMIT=${PHP_UPLOAD_LIMIT:-512M}
       - FPM_MAX_CHILDREN=${FPM_MAX_CHILDREN:-131}
       - FPM_START_SERVERS=${FPM_START_SERVERS:-32}
       - FPM_MIN_SPARE_SERVERS=${FPM_MIN_SPARE_SERVERS:-32}
@@ -95,21 +87,17 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.12-fpm"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
-        - "backupbot.backup.volumes.redis=false"
-       #- "backupbot.backup.volumes.nextcloud=false"
-
+        - "backupbot.backup=true"
+        - "backupbot.backup.path=/var/www/html/config/,/var/www/html/data/,/var/www/html/custom_apps/"
     healthcheck:
       test: ["CMD-SHELL", 'SCRIPT_NAME=status SCRIPT_FILENAME=/var/www/html/status.php REQUEST_METHOD=GET cgi-fcgi -bind -connect 127.0.0.1:9000 | grep "installed\":true"']
       interval: 30s
       timeout: 10s
       retries: 10
-      start_period: 15m
+      start_period: 5m
 
   cron:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
@@ -119,13 +107,9 @@ services:
     networks:
       - internal
     entrypoint: /cron.sh
-    configs:
-      - source: crontab
-        target: /var/spool/cron/crontabs/www-data
-
 
   cache:
-    image: redis:8.8.1-alpine
+    image: redis:8.2.2-alpine
     networks:
       - internal
     volumes:
@@ -139,10 +123,10 @@ services:
 secrets:
   db_password:
     external: true
-    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+    name: ${STACK_NAME}_db_password
   admin_password:
     external: true
-    name: ${STACK_NAME}_admin_password_${SECRET_ADMIN_PASSWORD_VERSION}
+    name: ${STACK_NAME}_admin_password
 
 volumes:
   nextcloud:
@@ -154,20 +138,17 @@ volumes:
 
 configs:
   nginx_conf:
-    name: ${STACK_NAME}_nginx_${NGINX_CONF_VERSION}
+    name: ${STACK_NAME}_nginx
     file: nginx.conf.tmpl
     template_driver: golang
   fpm_tune:
-    name: ${STACK_NAME}_fpm_tune_${FPM_TUNE_VERSION}
+    name: ${STACK_NAME}_fpm_tune
     file: fpm-tune.ini
     template_driver: golang
   entrypoint:
-    name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
+    name: ${STACK_NAME}_entrypoint
     file: entrypoint.sh.tmpl
     template_driver: golang
-  crontab:
-    name: ${STACK_NAME}_crontab_${CRONTAB_VERSION}
-    file: crontab
 
 networks:
   proxy:

crontab

@@ -1 +0,0 @@
-*/5 * * * * php -d memory_limit=1G -f /var/www/html/cron.php

entrypoint.talk.sh.tmpl

@@ -1,30 +0,0 @@
-#!/bin/bash
-
-set -eu
-
-file_env() {
-  local var="$1"
-  local fileVar="${var}_FILE"
-  local def="${2:-}"
-
-  if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
-    echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
-    exit 1
-  fi
-
-  local val="$def"
-  if [ "${!var:-}" ]; then
-    val="${!var}"
-  elif [ "${!fileVar:-}" ]; then
-    val="$(< "${!fileVar}")"
-  fi
-
-  export "$var"="$val"
-  unset "$fileVar"
-}
-
-file_env "INTERNAL_SECRET"
-file_env "TURN_SECRET"
-file_env "SIGNALING_SECRET"
-
-/start.sh supervisord -c /supervisord.conf

entrypoint.whiteboard.sh.tmpl

@@ -1,6 +0,0 @@
-#!/bin/sh
-set -e
-
-export JWT_SECRET_KEY=$(cat /run/secrets/whiteboard_jwt)
-
-exec npm run server:start

nginx.conf.tmpl

@@ -11,7 +11,6 @@ events {
 
 http {
     include       /etc/nginx/mime.types;
-    # See https://github.com/nextcloud/forms/issues/1838#issuecomment-1860497200
     types {
         application/javascript js mjs;
     }
@@ -45,13 +44,6 @@ http {
         # could take several months.
         #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
 
-        {{ if eq (env "HSTS_ENABLED") "1" }}
-        {{ if eq (env "HSTS_PRELOAD") "1" }}
-        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
-        {{ else }}
-        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains;" always;
-        {{ end }}
-        {{ end }}
 
         # set max upload size
         client_max_body_size 512M;
@@ -143,9 +135,6 @@ http {
         # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
         # to the URI, resulting in a HTTP 500 error response.
         location ~ \.php(?:$|/) {
-            # Required for legacy support
-            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
-
             fastcgi_split_path_info ^(.+?\.php)(/.*)$;
             set $path_info $fastcgi_path_info;
 

pg_backup.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-
-set -e
-
-BACKUP_FILE='/var/lib/postgresql/data/backup.sql'
-
-function backup {
-  export PGPASSWORD=$(cat /run/secrets/db_password)
-  pg_dump -U ${POSTGRES_USER} ${POSTGRES_DB} > $BACKUP_FILE
-}
-
-function restore {
-    cd /var/lib/postgresql/data/
-    restore_config(){
-        # Restore allowed connections
-        cat pg_hba.conf.bak > pg_hba.conf
-        su postgres -c 'pg_ctl reload'
-    }
-    # Don't allow any other connections than local
-    cp pg_hba.conf pg_hba.conf.bak
-    echo "local all all trust" > pg_hba.conf
-    su postgres -c 'pg_ctl reload'
-    trap restore_config EXIT INT TERM
-
-    # Recreate Database
-    psql -U ${POSTGRES_USER} -d postgres -c "DROP DATABASE ${POSTGRES_DB} WITH (FORCE);" 
-    createdb -U ${POSTGRES_USER} ${POSTGRES_DB}
-    psql -U ${POSTGRES_USER} -d ${POSTGRES_DB} -1 -f $BACKUP_FILE
-
-    trap - EXIT INT TERM
-    restore_config
-}
-
-$@

release/10.0.0+30.0.4-fpm

@@ -1 +0,0 @@
-https://docs.nextcloud.com/server/latest/admin_manual/release_notes/upgrade_to_30.html

release/11.0.0+30.0.4-fpm

@@ -1,4 +0,0 @@
-Upgrades mariadb from 10.5 to 11.4
-NOTE: If your Nextcloud instance is using mariadb, after running this update you MUST run the database upgrade command:
-`abra app command nextcloud.yourserver.org db upgrade_mariadb`
-More info: https://mariadb.com/kb/en/upgrading-from-mariadb-10-11-to-mariadb-11-4/

release/13.1.0+32.0.11-fpm

@@ -1,3 +0,0 @@
-Important:
-Posgres: Due to end of support for postgres 13 we upgraded to pgautoupgrade-14-debian but we could not test it, so please take backups before the upgrade!
-Elastic Search: We chose the latest minor update for elasticsearch but we were also not able to test it.

release/13.1.4+32.0.13-fpm

@@ -1,4 +0,0 @@
-    chore(deps): update mariadb docker tag to v12
-    chore(deps): update mariadb docker tag to v11.8
-    chore(deps): update nginx docker tag to v1.31.3
-    chore(deps): update docker.elastic.co/elasticsearch/elasticsearch docker tag to v8.19.19

release/2.0.0+23.0.3-fpm

@@ -1,6 +0,0 @@
-2.0.0 introduces a minor nextcloud update to 23.0.4 and moves the database service to a seperate override.yml file to support different database types (mariadb / postgres). This might break your installation. Please add the following snippet to your config .env to ensure the right db is used:
-
-```
-COMPOSE_FILE="compose.yml"
-COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
-```

release/3.1.0+25.0.1-fpm

@@ -1,57 +0,0 @@
-
-## FPM Tune
-
-The fpm-tune.ini settings are now configurable by `.env`. Please add this to your servers configs:
-
-```
-# fpm-tune, see: https://spot13.com/pmcalculator/
-FPM_MAX_CHILDREN=131
-FPM_START_SERVERS=32
-FPM_MIN_SPARE_SERVERS=32
-FPM_MAX_SPARE_SERVERS=98
-```
-
-## SMTP
-
-Add SMTP Config to your .env file:
-
-```
-# COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
-# See https://github.com/nextcloud/docker#auto-configuration-via-environment-variables for default values
-# SMTP_AUTHTYPE=
-# SMTP_HOST=
-# SMTP_SECURE=
-# SMTP_NAME=
-# SMTP_PORT=
-# MAIL_FROM_ADDRESS=
-# MAIL_DOMAIN=
-# SECRET_SMTP_PASSWORD_VERSION=v1
-abra app secret insert example.com smtp_password v1 example_password
-```
-
-
-## Post Deploy Commands
-
-Some Apps can also be managed with abra app cmd!
-
-```
-# COMPOSE_FILE="$COMPOSE_FILE:compose.apps.yml"
-# APPS="calendar sociallogin onlyoffice"
-abra app cmd example.com app install_apps
-# ONLYOFFICE_URL=https://onlyoffice.example.com
-# SECRET_ONLYOFFICE_JWT_VERSION=v1
-abra app secret insert example.com onlyoffice_jwt v1 example_password
-abra app cmd example.com app install_onlyoffice
-# BBB_URL=https://talk.example.org/bigbluebutton/ # trailing slash!
-# SECRET_BBB_SECRET_VERSION=v1
-abra app secret insert example.com bbb_secret v1 example_password
-abra app cmd example.com app install_bbb
-```
-
-## Set Quota
-
-```
-# DEFAULT_QUOTA="10 GB"
-abra app cmd example.com app set_default_quota
-```
-

release/3.2.0+25.0.4-fpm

@@ -1,11 +0,0 @@
-If the authentik configuration should be handled by abra add the following to the env:
-
-    COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
-    AUTHENTIK_USER_PREFIX=authentik
-    AUTHENTIK_DOMAIN=authentik.example.com
-    AUTHENTIK_SECRET_NAME=authentik_example_com_nextcloud_secret_v1  # the same as in authentik
-    AUTHENTIK_ID_NAME=authentik_example_com_nextcloud_id_v1  # the same as in authentik
-
-And run:
-
-    abra app cmd <app-name> app set_authentik

release/5.0.1+27.0.1-fpm

@@ -1 +0,0 @@
-The authentik secrets need to be inserted again, as nextcloud is not sharing the secret with authentik any more.

release/8.0.0+29.0.1-fpm

@@ -1 +0,0 @@
-BREAKING CHANGE: compose.apps.yml is now split for bbb and onlyoffice, configs must be updated

release/9.1.0+29.0.5-fpm

@@ -1 +0,0 @@
-Added automated customization options. Config needs to be updated to be able to use it.

renovate.json

@@ -1,9 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "ignoreDeps": [
-    "mariadb:10.6"
-  ],
   "extends": [
-    "config:base"
+    "config:recommended"
   ]
 }