Upgrade to Nextcloud v32 + add custom mount for data

2025-11-09 20:02:24 +11:00
15 changed files with 72 additions and 354 deletions
@@ -1,5 +1,40 @@
 ---
 kind: pipeline
+name: deploy to swarm-test.autonomic.zone
+steps:
+  - name: deployment
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    settings:
+      host: swarm-test.autonomic.zone
+      stack: nextcloud
+      generate_secrets: true
+      purge: true
+      deploy_key:
+        from_secret: drone_ssh_swarm_test
+      networks:
+        - proxy
+    environment:
+      DOMAIN: nextcloud.swarm-test.autonomic.zone
+      STACK_NAME: nextcloud
+      LETS_ENCRYPT_ENV: production
+      ADMIN_USER: foobar
+      FPM_TUNE_VERSION: v1
+      NGINX_CONF_VERSION: v1
+      MY_CNF_VERSION: v1
+      ENTRYPOINT_VERSION: v1
+      CRONTAB_VERSION: v1
+      PG_BACKUP_VERSION: v2
+      SECRET_DB_PASSWORD_VERSION: v1
+      SECRET_DB_ROOT_PASSWORD_VERSION: v1
+      SECRET_ADMIN_PASSWORD_VERSION: v1
+      SECRET_ONLYOFFICE_JWT_VERSION: v1
+      SECRET_BBB_SECRET_VERSION: v1
+      EXTRA_VOLUME: "/dev/null:/tmp/.dummy"
+trigger:
+  branch:
+    - main
+---
+kind: pipeline
 name: generate recipe catalogue
 steps:
  - name: release a new version
@@ -1,5 +1,5 @@
 TYPE=nextcloud
-#TIMEOUT=900
+TIMEOUT=900
 ENABLE_AUTO_UPDATE=true
 ENABLE_BACKUPS=true

@@ -15,7 +15,6 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 #MAX_DB_CONNECTIONS=500

 ADMIN_USER=admin
-TZ=Etc/UTC

 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
@@ -25,7 +24,6 @@ EXTRA_VOLUME=/dev/null:/tmp/.dummy

 PHP_MEMORY_LIMIT=1G
 PHP_UPLOAD_LIMIT=512M
-MEM_REQUEST_BODY_SIZE=$(( 1048576 * 16 ))
 # fpm-tune, see: https://spot13.com/pmcalculator/
 FPM_MAX_CHILDREN=16
 FPM_START_SERVERS=4
@@ -88,21 +86,6 @@ DEFAULT_QUOTA="10 GB"
 #COMPOSE_FILE="$COMPOSE_FILE:compose.fulltextsearch.yml"
 #SECRET_ELASTICSEARCH_PASSWORD_VERSION=v1

-#COMPOSE_FILE="$COMPOSE_FILE:compose.talk.yml"
-#TALK_DOMAIN=talk.example.com
-#SECRET_TALK_INTERNAL_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_TURN_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_SIGNALING_SECRET_VERSION=v1 # length=64 charset=default
-
-# COMPOSE_FILE="$COMPOSE_FILE:compose.user_oidc.yml"
-# APPS="$APPS user_oidc"
-# USER_OIDC_PROVIDER=
-# USER_OIDC_ID=
-# USER_OIDC_DISCOVERY_URI=
-# USER_OIDC_END_SESSION_URI=
-# USER_OIDC_LOGIN_ONLY=false
-# SECRET_USER_OIDC_SECRET_VERSION=v1
-
 # HSTS Options
 # Uncomment this line to enable HSTS: https://docs.nextcloud.com/server/30/admin_manual/installation/harden_server.html
 #HSTS_ENABLED=1
@@ -1,91 +0,0 @@
-# Nextcloud Recipe Maintenance
-
-This document describes how the Nextcloud recipe is maintained. It builds on
-the floor set by [Federation Resolution
-025](https://docs.coopcloud.tech/federation/resolutions/passed/025/) and
-follows the [`MAINTENANCE.md`
-template](https://docs.coopcloud.tech/maintainers/maintain/#maintenancemd-template)
-described in the Co-op Cloud maintainers' docs.
-
-All contributions should be made via a pull request so that quality and
-consistency stay something others can rely on.
-
-## Maintainers
-
-Everyone can apply to be a recipe maintainer. 
-Simply add yourself to the list in the README.md and open a new pull request 
-with the change.
-
-## Maintainer Responsibilities
-
-This recipe commits to the following, which is tighter than the floor set by
-Resolution 025 (stable-recipe category). However, these timelines are
-best-effort, so we aim for them as good as possible:
-
- Respond to PRs / issues within 3 working days
- Apply security patches within 1 week of disclosure
- Ship patch / minor image updates within 2 weeks of upstream release
- Adopt major Nextcloud version updates within 1 release cycle of upstream
-  EOL of the previous major (see below)
- Keep documentation current
-
-In order to meet these responsibilities each maintainer:
-
- Watches the repository so notifications arrive
- Keeps an eye on [Renovate](./renovate.json) updates and helps shepherd them through
- Has a working contact (Matrix handle or email) reachable by the others
-
-## Release cadence
-
-The intent is to **track Nextcloud's own release schedule** rather than invent
-our own. In practice this means:
-
- **Patch releases (e.g. `32.0.x`)**: published to this recipe shortly after
-  upstream, ideally within 1 week. `chore(deps)` opens the PRs; a maintainer
-  reviews the release notes and Nextcloud's issue tracker, and merges the PR
-  if it is OK.
- **Minor releases**: same flow as patch releases, but one of the maintainer
-  tests it on their own instance before merging.
- **Major releases (e.g. `32 → 33`)**: not adopted on day one. We wait for the
-  first one or two upstream patch releases of the new major to land
-  (typically 1–2 months) before promoting it here, to avoid passing the
-  early-adopter cost to operators. Major bumps get their own PR with release
-  notes and an upgrade-path check.
-  Before adding a major release, the following needs to be done:
-  - at least two maintainers update one of their production instances to the
-    new version
-  - the previous release gets a last update pointing to the docker image
-    versions nextcloud:xx-fpm, so that users can auto-update if they wish so
-  - the new release is added to this repo
- If people have the time it would be nice to create specially tagged versions
-  for major releases, which reflect that this is 'bleeding edge' and has not
-  been thoroughly tested.
- **Co-installed components** (Talk HPB, OnlyOffice, Whiteboard, etc.) are
-  bumped alongside or shortly after the matching Nextcloud release.
-
-## Pull Requests
-
-A pull request can be merged once it is approved by at least one maintainer.
-PRs opened by a maintainer need approval from another maintainer. With three
-maintainers this is workable; if the group shrinks, the rule should be
-revisited.
-
-Approvals should ideally include a smoke test on a real instance for anything
-beyond a patch bump — Nextcloud upgrades have a long history of surprising us
-(see the [upgrade notes in `README.md`](./README.md#upgrading-nextcloud)),
-and silent CI is not enough.
-
-## Becoming a maintainer
-
-Everyone is welcome to apply:
-
-1. Watch the repository so you get notifications.
-2. Open a pull request adding yourself to the `Maintainer` line in
-   [`README.md`](./README.md) and to the list above.
-3. Once an existing maintainer merges the PR, you'll be added to the
-   [nextcloud maintainers
-   team](https://git.coopcloud.tech/org/coop-cloud/teams/nextcloud-maintainers).
-
-Stepping down is symmetrical: open a PR removing yourself, and flag it in
-the federation channels so the group can plan replacement before falling
-below the Res. 025 floor of one named maintainer.
@@ -5,7 +5,6 @@
 Fully automated luxury Nextcloud via docker-swarm.

 <!-- metadata -->
-* **Maintainer**: [@dannygroenewegen](https://git.coopcloud.tech/dannygroenewegen), [@ineiti](https://git.coopcloud.tech/ineiti)
 * **Category**: Apps
 * **Status**: 5
 * **Image**: [`nextcloud`](https://hub.docker.com/_/nextcloud), 4, upstream
@@ -26,28 +25,20 @@ Fully automated luxury Nextcloud via docker-swarm.

 ### Onlyoffice Integration

-First, install onlyoffice following the instructions in the 
-[OnlyOffice Recipe](https://recipes.coopcloud.tech/onlyoffice), and enable
-the JWT secret. Then configure your nextcloud instance with:
-
 `abra app config <app-name>` 
-
-Configure the following envs with the URL of the onlyoffice service:
+Configure the following envs:
 ```
 COMPOSE_FILE="$COMPOSE_FILE:compose.apps.yml"
 ONLYOFFICE_URL=https://onlyoffice.example.com
 SECRET_ONLYOFFICE_JWT_VERSION=v1
 ```

-Then set the onlyoffice JWT secret from the onlyoffice installation:
-
-* `abra app secret insert <app-name> onlyoffice_jwt v1 <jwt_secret>`
-* `abra app cmd <app-name> app install_onlyoffice`
+`abra app secret insert <app-name> onlyoffice_jwt v1 <jwt_secret>`
+`abra app cmd <app-name> app install_onlyoffice`

 ### BBB Integration

 `abra app config <app-name>` 
-
 Configure the following envs:
 ```
 COMPOSE_FILE="$COMPOSE_FILE:compose.apps.yml"
@@ -55,44 +46,8 @@ BBB_URL=https://talk.example.org/bigbluebutton/ # trailing slash!
 SECRET_BBB_SECRET_VERSION=v1
 ```

-* `abra app secret insert <app-name> bbb_secret v1 <bbb_secret>`
-* `abra app cmd <app-name> app install_bbb`
-
-### Nextcloud Talk High performance Backend
-
-Note: at the moment you are limited to run one Nextcloud high performance backend per docker host with this setup.
-
-`abra app config <app-name>` 
-
-Configure the following envs:
-```
-#COMPOSE_FILE="$COMPOSE_FILE:compose.talk.yml"
-#TALK_DOMAIN=talk.example.com
-#SECRET_TALK_INTERNAL_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_TURN_SECRET_VERSION=v1 # length=64 charset=default
-#SECRET_TALK_SIGNALING_SECRET_VERSION=v1 # length=64 charset=default
-```
-
-* `abra app secret insert <app-name> talk_internal_secret v1 <talk_internal_secret>`
-* `abra app secret insert <app-name> talk_turn_secret v1 <talk_turn_secret>`
-* `abra app secret insert <app-name> talk_signaling_secret v1 <talk_signaling_secret>`
-* `abra app cmd <app-name> app install_talk`
-
-Don't forget to enable the additional env's in your hosts traefik instance:
-```
-COMPOSE_FILE="$COMPOSE_FILE:compose.nextcloud-talk-hpb.yml"
-NEXTCLOUD_TALK_HPB_ENABLED=1
-```
-
-Due to a bug in compose that deletes duplacted ports without checking for the protocol, traefik need to get the additional udp binding added after the deployment via ssh (this might take longer than expected!):
-```
-docker service update  --publish-add published=3478,target=3478,protocol=udp traefik_XXX_XXX_app
-```
-
-To check if tcp and udp was binded, you can use:
-```
-docker service inspect traefik_XXX_XXX_app | grep 3478 -a2
-```
+`abra app secret insert <app-name> bbb_secret v1 <bbb_secret>`
+`abra app cmd <app-name> app install_bbb`

 ### Authentik Integration

@@ -195,31 +150,6 @@ We've been able to get this setup by using the [social login](https://apps.nextc

 If using Keycloak, you'll want to do [this trick](https://janikvonrotz.ch/2020/10/20/openid-connect-with-nextcloud-and-keycloak/) also.

-## How do I enable OpenID Connect (OIDC) providers?
-[user_oidc](https://github.com/nextcloud/user_oidc) is the recommended way to integrate Nextcloud with OIDC providers.
-
-Run `abra app config <app-name>`
-
-Set the following envs:
-```env
-COMPOSE_FILE="$COMPOSE_FILE:compose.user_oidc.yml"
-APPS="$APPS user_oidc"
-USER_OIDC_PROVIDER=example-provider # this has been tested with keycloak
-USER_OIDC_ID=example-client-id # get this from your oidc provider
-USER_OIDC_DISCOVERY_URI=example-oidc-provider.com/.well-known/openid-configuration # get this from your oidc provider
-USER_OIDC_END_SESSION_URI=example-oidc-provider.com/protocol/openid-connect/logout # get this from your oidc provider
-USER_OIDC_LOGIN_ONLY=false # set this to true to automatically redirect all logins to your oidc provider
-SECRET_USER_OIDC_SECRET_VERSION=v1
-```
-
-Then insert the client secret from your OIDC provider:
-```sh
-abra app secret insert <app-name> user_oidc_secret v1 <client-secret from oidc provider>
-```
-
-After you deploy (or redeploy), run the following to set up the user_oidc Nextcloud app:
-`abra app cmd <app-name> app set_user_oidc`
-
 ## How can I customise the CSS?

 There is some basic stuff in the admin settings.
@@ -1,11 +1,10 @@
 #!/bin/bash

 export FPM_TUNE_VERSION=v5
-export NGINX_CONF_VERSION=v8c
+export NGINX_CONF_VERSION=v8
 export MY_CNF_VERSION=v6
 export ENTRYPOINT_VERSION=v3
 export ENTRYPOINT_WHITEBOARD_VERSION=v1
-export ENTRYPOINT_TALK_VERSION=v1
 export CRONTAB_VERSION=v1
 export PG_BACKUP_VERSION=v2

@@ -98,15 +97,6 @@ install_whiteboard() {
 }


-install_talk() {
-    install_apps spreed
-    run_occ "talk:signaling:add --verify 'wss://${TALK_DOMAIN}' '$(cat /run/secrets/talk_signaling_secret)'"
-    run_occ "talk:stun:add '${TALK_DOMAIN}:3478'"
-    run_occ "talk:stun:add '${TALK_DOMAIN}:443'"
-    run_occ "talk:turn:add --secret='$(cat /run/secrets/talk_turn_secret)' turn '${TALK_DOMAIN}:3478' udp,tcp"
-
-}
-
 install_fulltextsearch() {
    install_apps fulltextsearch
    install_apps fulltextsearch_elasticsearch
@@ -159,23 +149,6 @@ set_authentik() {
    run_occ 'config:system:set lost_password_link --value=disabled'
 }

-set_user_oidc() {
-    install_apps user_oidc
-    USER_OIDC_SECRET=$(cat /run/secrets/user_oidc_secret)
-    run_occ "user_oidc:provider \
-            --clientid=${USER_OIDC_ID} \
-            --clientsecret=${USER_OIDC_SECRET} \
-            --discoveryuri=${USER_OIDC_DISCOVERY_URI} \
-            --endsessionendpointuri=${USER_OIDC_END_SESSION_URI} \
-            --postlogouturi=https://${DOMAIN} \
-            --scope='openid email profile' \
-            ${USER_OIDC_PROVIDER}"
-    # disable non user_oidc login
-    if [[ ${USER_OIDC_LOGIN_ONLY:-false} = "true" ]]; then
-        run_occ "config:app:set --value=0 user_oidc allow_multiple_user_backends"
-    fi
-}
-
 disable_skeletondirectory() {
    run_occ "config:system:set skeletondirectory --value ''"
 }
@@ -2,7 +2,7 @@ version: "3.8"

 services:
  elasticsearch:
-    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.19"
+    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.6"
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
@@ -29,7 +29,7 @@ services:
        mode: 0600

  searchindexer:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
    volumes:
      - nextcloud:/var/www/html/
      - nextapps:/var/www/html/custom_apps:cached
@@ -9,7 +9,7 @@ services:
      - MYSQL_PASSWORD_FILE=/run/secrets/db_password

  db:
-    image: "mariadb:12.3"
+    image: "mariadb:11.4"
    environment:
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
@@ -10,7 +10,7 @@ services:
      - NEXTCLOUD_UPDATE=1

  db:
-    image: "pgautoupgrade/pgautoupgrade:14-debian"
+    image: "postgres:13"
    command: -c "max_connections=${MAX_DB_CONNECTIONS:-100}"
    volumes:
      - "postgres:/var/lib/postgresql/data"
@@ -1,70 +0,0 @@
-version: "3.8"
-
-services:
-  talk:
-    image: "nextcloud/aio-talk:20251128_084214"
-    environment:
-      - NC_DOMAIN=${DOMAIN}
-      - TALK_HOST=${TALK_DOMAIN}
-      - TZ
-      - TALK_PORT=3478
-      - INTERNAL_SECRET_FILE=/run/secrets/talk_internal_secret 
-      - TURN_SECRET_FILE=/run/secrets/talk_turn_secret
-      - SIGNALING_SECRET_FILE=/run/secrets/talk_signaling_secret
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.swarm.network=proxy
-        - traefik.http.services.${STACK_NAME}_talk.loadbalancer.server.port=8081
-        - traefik.http.routers.${STACK_NAME}_talk.rule=Host(`${TALK_DOMAIN}`)
-        - traefik.http.routers.${STACK_NAME}_talk.entrypoints=web-secure
-        - traefik.http.routers.${STACK_NAME}_talk.tls.certresolver=${LETS_ENCRYPT_ENV}
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.rule=HostSNI(`*`)
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.entrypoints=nextcloud-talk-hpb
-        - traefik.tcp.routers.${STACK_NAME}_nextcloud-talk-hpb.service=${STACK_NAME}_nextcloud-talk-hpb-svc
-        - traefik.tcp.services.${STACK_NAME}_nextcloud-talk-hpb-svc.loadbalancer.server.port=3478
-        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.entrypoints=nextcloud-talk-hpb-udp
-        - traefik.udp.routers.${STACK_NAME}_nextcloud-talk-hpb-udp.service=${STACK_NAME}_nextcloud-talk-hpb-udp-svc
-        - traefik.udp.services.${STACK_NAME}_nextcloud-talk-hpb-udp-svc.loadbalancer.server.port=3478
-    networks:
-      - proxy
-    configs:
-      - source: entrypoint_talk
-        target: /custom-entrypoint.sh
-        mode: 775
-    entrypoint: /custom-entrypoint.sh
-    secrets:
-      - source: talk_internal_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-      - source: talk_turn_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-      - source: talk_signaling_secret
-        uid: "1000"
-        gid: "122"
-        mode: 0600
-
-  app:
-    secrets:
-      - talk_turn_secret
-      - talk_signaling_secret
-
-secrets:
-  talk_internal_secret:
-    external: true
-    name: ${STACK_NAME}_talk_internal_secret_${SECRET_TALK_INTERNAL_SECRET_VERSION}
-  talk_turn_secret:
-    external: true
-    name: ${STACK_NAME}_talk_turn_secret_${SECRET_TALK_TURN_SECRET_VERSION}
-  talk_signaling_secret:
-    external: true
-    name: ${STACK_NAME}_talk_signaling_secret_${SECRET_TALK_SIGNALING_SECRET_VERSION}
-
-configs:
-  entrypoint_talk:
-    name: ${STACK_NAME}_entrypoint_talk_${ENTRYPOINT_TALK_VERSION}
-    file: entrypoint.talk.sh.tmpl
-    template_driver: golang
@@ -1,10 +0,0 @@
-version: "3.8"
-services:
-  app:
-    secrets:
-      - user_oidc_secret
-
-secrets:
-  user_oidc_secret:
-    external: true
-    name: ${STACK_NAME}_user_oidc_secret_${SECRET_USER_OIDC_SECRET_VERSION}
@@ -6,11 +6,11 @@ services:
      - whiteboard_jwt

  whiteboard:
-    image: ghcr.io/nextcloud-releases/whiteboard:v1.5.9
+    image: ghcr.io/nextcloud-releases/whiteboard:v1.4.1
    deploy:
      labels:
        - traefik.enable=true
-        - traefik.swarm.network=proxy
+        - traefik.docker.network=proxy
        - traefik.http.services.${STACK_NAME}_whiteboard.loadbalancer.server.port=3002
        - traefik.http.routers.${STACK_NAME}_whiteboard.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS}) && PathPrefix(`/whiteboard`)
        - traefik.http.routers.${STACK_NAME}_whiteboard.entrypoints=web-secure
@@ -41,4 +41,4 @@ configs:
  entrypoint_whiteboard:
    name: ${STACK_NAME}_entrypoint_whiteboard_${ENTRYPOINT_WHITEBOARD_VERSION}
    file: entrypoint.whiteboard.sh.tmpl
-    template_driver: golang
+    template_driver: golang
@@ -1,7 +1,7 @@
 version: "3.8"
 services:
  web:
-    image: nginx:1.31.3
+    image: nginx:1.29.3
    depends_on:
      - app
    configs:
@@ -14,11 +14,10 @@ services:
      - STACK_NAME
      - HSTS_ENABLED
      - HSTS_PRELOAD
-      - PHP_UPLOAD_LIMIT=${PHP_UPLOAD_LIMIT:-512M}
    volumes:
      - nextcloud:/var/www/html/
      - nextapps:/var/www/html/custom_apps:cached
-      - nextdata:/var/www/html/data:cached
+      - /mnt/data-3t/nextdata:/var/www/html/data:cached
      - nextconfig:/var/www/html/config:cached
      - ${EXTRA_VOLUME}
    networks:
@@ -30,28 +29,35 @@ services:
        order: start-first
      labels:
        - "traefik.enable=true"
-        - "traefik.swarm.network=proxy"
+        - "traefik.docker.network=proxy"
+        # shared service & middleware
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
+        # public domain (lets-encrypt cert)
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
-        - "traefik.http.middlewares.${STACK_NAME}-buffering.buffering.maxRequestBodyBytes=0"
-        - "traefik.http.middlewares.${STACK_NAME}-buffering.buffering.memRequestBodyBytes=${MEM_REQUEST_BODY_BYTES:-1048576}"
+        # local domain (self-signed cert)
+        - "traefik.http.routers.${STACK_NAME}-local.rule=Host(`${LOCAL_DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}-local.tls=true"
+        - "traefik.http.routers.${STACK_NAME}-local.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}-local.middlewares=${STACK_NAME}-redirect"
+        - "traefik.http.routers.${STACK_NAME}-local.service=${STACK_NAME}"
+
        - "caddy=${DOMAIN}"
        - "caddy.reverse_proxy={{upstreams 80}}"
        - "caddy.tls.on_demand="
    healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://localhost/status.php | grep -q '\"installed\":true'"]
+      test: ["CMD-SHELL", 'curl -s -N curl -Ns localhost/status.php |  grep "installed\":true"']
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 5m

  app:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
    depends_on:
      - db
    configs:
@@ -88,7 +94,7 @@ services:
    volumes:
      - nextcloud:/var/www/html/
      - nextapps:/var/www/html/custom_apps:cached
-      - nextdata:/var/www/html/data:cached
+      - /mnt/data-3t/nextdata:/var/www/html/data:cached
      - nextconfig:/var/www/html/config:cached
      - ${EXTRA_VOLUME}
    networks:
@@ -98,8 +104,8 @@ services:
        failure_action: rollback
        order: start-first
      labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.12-fpm"
-        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
+        - "coop-cloud.${STACK_NAME}.version=12.0.1+31.0.6-fpm"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
        - "backupbot.backup=${ENABLE_BACKUPS:-true}"
        - "backupbot.backup.volumes.redis=false"
       #- "backupbot.backup.volumes.nextcloud=false"
@@ -112,11 +118,11 @@ services:
      start_period: 15m

  cron:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32.0.1-fpm
    volumes:
      - nextcloud:/var/www/html/
      - nextapps:/var/www/html/custom_apps:cached
-      - nextdata:/var/www/html/data:cached
+      - /mnt/data-3t/nextdata:/var/www/html/data:cached
      - nextconfig:/var/www/html/config:cached
      - ${EXTRA_VOLUME}
    networks:
@@ -128,7 +134,7 @@ services:


  cache:
-    image: redis:8.8.1-alpine
+    image: redis:8.2.3-alpine
    networks:
      - internal
    volumes:
@@ -150,7 +156,6 @@ secrets:
 volumes:
  nextcloud:
  nextapps:
-  nextdata:
  nextconfig:
  redis:

@@ -1,30 +0,0 @@
-#!/bin/bash
-
-set -eu
-
-file_env() {
-  local var="$1"
-  local fileVar="${var}_FILE"
-  local def="${2:-}"
-
-  if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
-    echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
-    exit 1
-  fi
-
-  local val="$def"
-  if [ "${!var:-}" ]; then
-    val="${!var}"
-  elif [ "${!fileVar:-}" ]; then
-    val="$(< "${!fileVar}")"
-  fi
-
-  export "$var"="$val"
-  unset "$fileVar"
-}
-
-file_env "INTERNAL_SECRET"
-file_env "TURN_SECRET"
-file_env "SIGNALING_SECRET"
-
-/start.sh supervisord -c /supervisord.conf
@@ -54,7 +54,7 @@ http {
        {{ end }}

        # set max upload size
-        client_max_body_size {{ env "PHP_UPLOAD_LIMIT" }} ;
+        client_max_body_size 512M;
        fastcgi_buffers 64 4K;

        # Enable gzip but do not remove ETag headers
@@ -162,10 +162,6 @@ http {

            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
-
-            fastcgi_read_timeout 3600s;
-            fastcgi_send_timeout 3600s;
-            fastcgi_connect_timeout 60s;
        }

        location ~ \.(?:css|js|svg|gif)$ {
@@ -1,3 +0,0 @@
-Important:
-Posgres: Due to end of support for postgres 13 we upgraded to pgautoupgrade-14-debian but we could not test it, so please take backups before the upgrade!
-Elastic Search: We chose the latest minor update for elasticsearch but we were also not able to test it.