wiki-cafe
/
nextcloud
forked from coop-cloud/nextcloud
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More FPM excitement

This commit is contained in:
3wc 2021-08-26 12:02:21 +02:00
parent 3b565b135c
commit f71e43949a
3 changed files with 183 additions and 170 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
abra.sh
View File

@ -1,4 +1,4 @@
export NGINX_CONF_VERSION="v3" export NGINX_CONF_VERSION="v1"
NC_APP_DIR="app:/var/www/html" NC_APP_DIR="app:/var/www/html"

75
compose.yml
View File

@ -1,13 +1,13 @@
version: "3.8" version: "3.8"
services: services:
web: web:
image: nginx:latest image: nginx:1.20.0
configs: configs:
- source: nginx_conf - source: nginx_conf
target: /etc/nginx/nginx.conf target: /etc/nginx/nginx.conf
environment: environment:
- DOMAIN=${DOMAIN} - DOMAIN
- STACK_NAME=${STACK_NAME} - STACK_NAME
volumes: volumes:
- nextcloud:/var/www/html/ - nextcloud:/var/www/html/
- nextapps:/var/www/html/custom_apps:cached - nextapps:/var/www/html/custom_apps:cached
@ -39,8 +39,8 @@ services:
- db_password - db_password
- admin_password - admin_password
environment: environment:
- DOMAIN=${DOMAIN} - DOMAIN
- STACK_NAME=${STACK_NAME} - STACK_NAME
- MYSQL_HOST=db - MYSQL_HOST=db
- MYSQL_DATABASE=nextcloud - MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud - MYSQL_USER=nextcloud
@ -62,14 +62,13 @@ services:
- nextconfig:/var/www/html/config:cached - nextconfig:/var/www/html/config:cached
- ${EXTRA_VOLUME} - ${EXTRA_VOLUME}
networks: networks:
- proxy
- internal - internal
healthcheck: # healthcheck:
test: ["CMD", "curl", "-f", "http://localhost"] # test: ["CMD", "curl", "-f", "http://localhost"]
interval: 30s # interval: 30s
timeout: 10s # timeout: 10s
retries: 10 # retries: 10
start_period: 1m # start_period: 1m
deploy: deploy:
update_config: update_config:
failure_action: rollback failure_action: rollback
@ -89,34 +88,34 @@ services:
- "mariadb:/var/lib/mysql" - "mariadb:/var/lib/mysql"
networks: networks:
- internal - internal
healthcheck: # healthcheck:
test: 'mysql -p"$$(tr -d "\n" < /run/secrets/db_root_password)"' # test: 'mysql -p"$$(tr -d "\n" < /run/secrets/db_root_password)"'
interval: 20s # interval: 20s
timeout: 2s # timeout: 2s
retries: 3 # retries: 3
start_period: 30s # start_period: 30s
deploy: deploy:
labels: ["coop-cloud.${STACK_NAME}.db.version=10.5-9c681cef"] labels: ["coop-cloud.${STACK_NAME}.db.version=10.5-9c681cef"]
cron: # cron:
image: nextcloud:22.1.0 # image: nextcloud:22.1.0
volumes: # volumes:
- nextcloud:/var/www/html/ # - nextcloud:/var/www/html/
- nextapps:/var/www/html/custom_apps:cached # - nextapps:/var/www/html/custom_apps:cached
- nextdata:/var/www/html/data:cached # - nextdata:/var/www/html/data:cached
- nextconfig:/var/www/html/config:cached # - nextconfig:/var/www/html/config:cached
- ${EXTRA_VOLUME} # - ${EXTRA_VOLUME}
networks: # networks:
- internal # - internal
entrypoint: /cron.sh # entrypoint: /cron.sh
deploy: # deploy:
labels: ['coop-cloud.${STACK_NAME}.cron.version=22.1.0-89d9ab98'] # labels: ['coop-cloud.${STACK_NAME}.cron.version=22.1.0-89d9ab98']
cache: # cache:
image: redis:6.2.5-alpine # image: redis:6.2.5-alpine
networks: # networks:
- internal # - internal
deploy: # deploy:
labels: # labels:
- coop-cloud.${STACK_NAME}.cache.version=6.2.5-alpine-b658aeb0 # - coop-cloud.${STACK_NAME}.cache.version=6.2.5-alpine-b658aeb0
secrets: secrets:
db_root_password: db_root_password:

276
nginx.conf.tmpl
View File

@ -1,132 +1,146 @@
server { events {
upstream backend { worker_connections 768;
server {{ env "STACK_NAME" }}_app:9000; }
}
error_log /var/log/nginx/error.log warn;
listen 80 http2;
listen [::]:80 http2; http {
server_name {{ env "DOMAIN" }}; log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
# set max upload size '"$http_user_agent" "$http_x_forwarded_for"';
client_max_body_size 512M;
fastcgi_buffers 64 4K; access_log /var/log/nginx/access.log main;
# Enable gzip but do not remove ETag headers upstream backend {
gzip on; server {{ env "STACK_NAME" }}_app:9000;
gzip_vary on; }
gzip_comp_level 4;
gzip_min_length 256; server {
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; listen 80 http2;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; listen [::]:80 http2;
server_name {{ env "DOMAIN" }};
# Pagespeed is not supported by Nextcloud, so if your server is built
# with the `ngx_pagespeed` module, uncomment this line to disable it. # set max upload size
#pagespeed off; client_max_body_size 512M;
fastcgi_buffers 64 4K;
# HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always; # Enable gzip but do not remove ETag headers
add_header X-Content-Type-Options "nosniff" always; gzip on;
add_header X-Download-Options "noopen" always; gzip_vary on;
add_header X-Frame-Options "SAMEORIGIN" always; gzip_comp_level 4;
add_header X-Permitted-Cross-Domain-Policies "none" always; gzip_min_length 256;
add_header X-Robots-Tag "none" always; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
add_header X-XSS-Protection "1; mode=block" always; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Remove X-Powered-By, which is an information leak # Pagespeed is not supported by Nextcloud, so if your server is built
fastcgi_hide_header X-Powered-By; # with the `ngx_pagespeed` module, uncomment this line to disable it.
#pagespeed off;
# Path to the root of your installation
root /var/www/html; # HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always;
# Specify how to handle directories -- specifying `/index.php$request_uri` add_header X-Content-Type-Options "nosniff" always;
# here as the fallback means that Nginx always exhibits the desired behaviour add_header X-Download-Options "noopen" always;
# when a client requests a path that corresponds to a directory that exists add_header X-Frame-Options "SAMEORIGIN" always;
# on the server. In particular, if that directory contains an index.php file, add_header X-Permitted-Cross-Domain-Policies "none" always;
# that file is correctly served; if it doesn't, then the request is passed to add_header X-Robots-Tag "none" always;
# the front-end controller. This consistent behaviour means that we don't need add_header X-XSS-Protection "1; mode=block" always;
# to specify custom rules for certain paths (e.g. images and other assets,
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus # Remove X-Powered-By, which is an information leak
# `try_files $uri $uri/ /index.php$request_uri` fastcgi_hide_header X-Powered-By;
# always provides the desired behaviour.
index index.php index.html /index.php$request_uri; # Path to the root of your installation
root /var/www/html;
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / { # Specify how to handle directories -- specifying `/index.php$request_uri`
if ( $http_user_agent ~ ^DavClnt ) { # here as the fallback means that Nginx always exhibits the desired behaviour
return 302 /remote.php/webdav/$is_args$args; # when a client requests a path that corresponds to a directory that exists
} # on the server. In particular, if that directory contains an index.php file,
} # that file is correctly served; if it doesn't, then the request is passed to
# the front-end controller. This consistent behaviour means that we don't need
location = /robots.txt { # to specify custom rules for certain paths (e.g. images and other assets,
allow all; # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
log_not_found off; # `try_files $uri $uri/ /index.php$request_uri`
access_log off; # always provides the desired behaviour.
} index index.php index.html /index.php$request_uri;
# Make a regex exception for `/.well-known` so that clients can still # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
# access it despite the existence of the regex rule location = / {
# `location ~ /(\.|autotest|...)` which would otherwise handle requests if ( $http_user_agent ~ ^DavClnt ) {
# for `/.well-known`. return 302 /remote.php/webdav/$is_args$args;
location ^~ /.well-known { }
# The rules in this block are an adaptation of the rules }
# in `.htaccess` that concern `/.well-known`.
location = /robots.txt {
location = /.well-known/carddav { return 301 /remote.php/dav/; } allow all;
location = /.well-known/caldav { return 301 /remote.php/dav/; } log_not_found off;
access_log off;
location /.well-known/acme-challenge { try_files $uri $uri/ =404; } }
location /.well-known/pki-validation { try_files $uri $uri/ =404; }
# Make a regex exception for `/.well-known` so that clients can still
# Let Nextcloud's API for `/.well-known` URIs handle all other # access it despite the existence of the regex rule
# requests by passing them to the front-end controller. # `location ~ /(\.|autotest|...)` which would otherwise handle requests
return 301 /index.php$request_uri; # for `/.well-known`.
} location ^~ /.well-known {
# The rules in this block are an adaptation of the rules
# Rules borrowed from `.htaccess` to hide certain paths from clients # in `.htaccess` that concern `/.well-known`.
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
# which handle static assets (as seen below). If this block is not declared first, location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` location /.well-known/pki-validation { try_files $uri $uri/ =404; }
# to the URI, resulting in a HTTP 500 error response.
location ~ \.php(?:$|/) { # Let Nextcloud's API for `/.well-known` URIs handle all other
fastcgi_split_path_info ^(.+?\.php)(/.*)$; # requests by passing them to the front-end controller.
set $path_info $fastcgi_path_info; return 301 /index.php$request_uri;
}
try_files $fastcgi_script_name =404;
# Rules borrowed from `.htaccess` to hide certain paths from clients
include fastcgi_params; location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on; # Ensure this block, which passes PHP files to the PHP process, is above the blocks
# which handle static assets (as seen below). If this block is not declared first,
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
fastcgi_param front_controller_active true; # Enable pretty urls # to the URI, resulting in a HTTP 500 error response.
fastcgi_pass backend; location ~ \.php(?:$|/) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
fastcgi_intercept_errors on; set $path_info $fastcgi_path_info;
fastcgi_request_buffering off;
} try_files $fastcgi_script_name =404;
location ~ \.(?:css|js|svg|gif|png|jpg|ico)$ { include fastcgi_params;
try_files $uri /index.php$request_uri; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
expires 6M; # Cache-Control policy borrowed from `.htaccess` fastcgi_param PATH_INFO $path_info;
access_log off; # Optional: Don't log access to assets fastcgi_param HTTPS on;
}
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
location ~ \.woff2?$ { fastcgi_param front_controller_active true; # Enable pretty urls
try_files $uri /index.php$request_uri; fastcgi_pass backend;
expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets fastcgi_intercept_errors on;
} fastcgi_request_buffering off;
}
# Rule borrowed from `.htaccess`
location /remote { location ~ \.(?:css|js|svg|gif|png|jpg|ico)$ {
return 301 /remote.php$request_uri; try_files $uri /index.php$request_uri;
} expires 6M; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets
location / { }
try_files $uri $uri/ /index.php$request_uri;
} location ~ \.woff2?$ {
try_files $uri /index.php$request_uri;
expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets
}
# Rule borrowed from `.htaccess`
location /remote {
return 301 /remote.php$request_uri;
}
location / {
try_files $uri $uri/ /index.php$request_uri;
}
}
} }