[doc] warning for AUTHENTIK_USER_PREFIX

[Discussion here](#106)

.env.sample

@@ -79,11 +79,14 @@ DEFAULT_QUOTA="10 GB"
 
 # COMPOSE_FILE="$COMPOSE_FILE:compose.authentik.yml"
 # APPS="$APPS sociallogin"
-# AUTHENTIK_USER_PREFIX=authentik
 # AUTHENTIK_DOMAIN=authentik.example.com
 # SECRET_AUTHENTIK_SECRET_VERSION=v1
 # SECRET_AUTHENTIK_ID_VERSION=v1
 
+# Only change this if you've configured your authentik instance to use a non-default user prefix.
+# If you're unsure, this should match the redirect_uri in authentik's nextcloud provider.
+# AUTHENTIK_USER_PREFIX=authentik
+
 #COMPOSE_FILE="$COMPOSE_FILE:compose.fulltextsearch.yml"
 #SECRET_ELASTICSEARCH_PASSWORD_VERSION=v1
 
@@ -109,4 +112,4 @@ DEFAULT_QUOTA="10 GB"
 #HSTS_PRELOAD=1
 
 # Metrics
-# COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
+# COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"

MAINTENANCE.md

@@ -38,7 +38,7 @@ In order to meet these responsibilities each maintainer:
 ## Release cadence
 
 The intent is to **track Nextcloud's own release schedule** rather than invent
-our own. In practice this means:
+our own. In practice this means the following regarding new **nextcloud** releases:
 
 - **Patch releases (e.g. `32.0.x`)**: published to this recipe shortly after
   upstream, ideally within 1 week. `chore(deps)` opens the PRs; a maintainer
@@ -63,6 +63,40 @@ our own. In practice this means:
 - **Co-installed components** (Talk HPB, OnlyOffice, Whiteboard, etc.) are
   bumped alongside or shortly after the matching Nextcloud release.
 
+## Semver versioning within this recipe
+
+The recipe version itself is updated according to the following semver
+rules, following
+[How are recipes versioned](https://docs.coopcloud.tech/maintainers/handbook/#how-are-recipes-versioned):
+These describe the minimum required bump for a given kind of change. 
+The actual impact of any change (an image update or, e.g. a compose or config change) 
+should always be considered, and the recipe version can always be bumped higher 
+than the guideline below to match the impact of the change.
+ 
+- For updates of the image in the app container (nextcloud), we match the 
+  recipe version bump to at least the image version bump.
+- Other containers in this recipe are considered dependencies of the app container 
+  unless they expose additional functionality directly.
+- For image updates of dependency containers, we judge the recipe version bump 
+  from the perspective of the app itself, but a minor or major update of a 
+  dependent container is always reflected by at least a minor recipe version bump 
+  to indicate a substantial update under the hood.
+
+Temporary exception:
+- In the past, there have been issues with upgrades from database containers 
+  (before the `pgautoupgrade` image and `MARIADB_AUTO_UPGRADE` setting). 
+  We continue treating a major update of a database container (postgresql, mariadb) 
+  as a major recipe bump until that database has had two consecutive major upgrades 
+  with no issues reported, building trust in its automatic upgrade. 
+  Once that trust is established for a given database, we continue with the 
+  default guidelines above.
+
+WARNING:
+When moving to a new major version of a dependency, the maintainer needs to make
+sure that the version is supported!
+Example: in June 2026, MariaDB got updated to version 12, but nextcloud suggests
+only up to version 11.8 for best performance.
+
 ## Pull Requests
 
 A pull request can be merged once it is approved by at least one maintainer.

abra.sh

@@ -90,6 +90,7 @@ install_collabora() {
     # important for security reaosns
     # https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings
     set_app_config richdocuments wopi_allowlist "$COLLABORA_ALLOWLIST"
+    run_occ "richdocuments:activate-config"
 }
 
 install_whiteboard() {

compose.fulltextsearch.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   elasticsearch:
-    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.21"
+    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.22"
     environment:
       - cluster.name=docker-cluster
       - bootstrap.memory_lock=true

compose.metrics.yml

@@ -5,6 +5,4 @@ services:
       - METRICS_ENABLED=true
     deploy:
       labels:
-        - "prometheus.io/scrape=true"
-        - "prometheus.io/port=9205"
-        - "prometheus.io/path=/metrics"
+        - "prometheus.io/scrape=true"

compose.whiteboard.yml

@@ -6,7 +6,7 @@ services:
       - whiteboard_jwt
 
   whiteboard:
-    image: ghcr.io/nextcloud-releases/whiteboard:v1.5.9
+    image: ghcr.io/nextcloud-releases/whiteboard:v2.0.0
     deploy:
       labels:
         - traefik.enable=true

compose.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: nginx:1.31.5
+    image: nginx:1.31.6
     depends_on:
       - app
     configs:
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=14.1.2+33.0.9-fpm"
+        - "coop-cloud.${STACK_NAME}.version=14.5.0+33.0.9-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
@@ -125,7 +125,7 @@ services:
 
 
   cache:
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     networks:
       - internal
     volumes:

nginx.conf.tmpl

@@ -184,24 +184,16 @@ http {
         location / {
             try_files $uri $uri/ /index.php$request_uri;
         }
-    }
-
-    {{ if env "METRICS_ENABLED" }}
-    server {
-        listen 9205;
 
+        {{ if env "METRICS_ENABLED" }}
         location = /metrics {
             include fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME /var/www/html/index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
             fastcgi_param SCRIPT_NAME /index.php;
             fastcgi_param REQUEST_URI /metrics;
             fastcgi_param HTTP_HOST {{ env "DOMAIN" }};
             fastcgi_pass php-handler;
         }
-
-        location / {
-            return 404;
-        }
+        {{ end }}
     }
-    {{ end }}
 }