diff --git a/Containerfile b/Containerfile index 447950f..40c4aa5 100644 --- a/Containerfile +++ b/Containerfile @@ -1,7 +1,7 @@ FROM docker.io/alpine:3.20 AS builder -ENV NC_VERSION=29.0.5 -ENV NC_SHA256_SUM=c7fe9c61e5ec30a5e599e8f152a1825df684d30e899db0caa8868c8d67b53a2c +ENV NC_VERSION=30.0.1 +ENV NC_SHA256_SUM=79ec2ffad6231bd8fcc4abaacc12e5ac51e670d089affb379483592cda0fdccb RUN wget https://download.nextcloud.com/server/releases/nextcloud-$NC_VERSION.tar.bz2 RUN echo "$NC_SHA256_SUM nextcloud-$NC_VERSION.tar.bz2" | sha256sum -c - || exit 1 RUN mkdir -p /var/lib/nextcloud @@ -14,15 +14,15 @@ RUN echo "$POLLS_SHA256_SUM polls-$POLLS_VERSION.tar.gz" | sha256sum -c - || ex RUN mkdir /var/lib/nextcloud/apps/polls RUN tar xzf polls-$POLLS_VERSION.tar.gz -C /var/lib/nextcloud/apps/polls --strip 1 -ENV CONTACTS_VERSION=v6.0.0 -ENV CONTACTS_SHA256_SUM=e3c11127d0d0f70ef57a7713d9756f715695f846ed86013142588a3b5b10fb50 +ENV CONTACTS_VERSION=v6.1.0 +ENV CONTACTS_SHA256_SUM=fef8a49b2e6984e2b53a116eeb0e40d4162235f6d8694ec9b36fa38aeaccdae8 RUN wget https://github.com/nextcloud-releases/contacts/releases/download/$CONTACTS_VERSION/contacts-$CONTACTS_VERSION.tar.gz RUN echo "$CONTACTS_SHA256_SUM contacts-$CONTACTS_VERSION.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/contacts RUN tar xzf contacts-$CONTACTS_VERSION.tar.gz -C /var/lib/nextcloud/apps/contacts --strip 1 -ENV CALENDAR_VERSION=v4.7.16 -ENV CALENDAR_SHA256_SUM=3705d3b921e5dbbf10d96928e030b7af3aaf3479c3239d77509fbcff7469e7f5 +ENV CALENDAR_VERSION=v5.0.1 +ENV CALENDAR_SHA256_SUM=bfdaa373273650164aed078ed57059bb5d5ca0f23dd8f4597138a9cc110c9b77 RUN wget https://github.com/nextcloud-releases/calendar/releases/download/$CALENDAR_VERSION/calendar-$CALENDAR_VERSION.tar.gz RUN echo "$CALENDAR_SHA256_SUM calendar-$CALENDAR_VERSION.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/calendar @@ -35,22 +35,22 @@ RUN echo "$TASKS_SHA256_SUM tasks.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/tasks RUN tar xzf tasks.tar.gz -C /var/lib/nextcloud/apps/tasks --strip 1 -ENV NOTES_VERSION=v4.10.1 -ENV NOTES_SHA256_SUM=4fb15499ace26f92d956c9e8fd537f35961825eb535dc1bcf678da992809e88c +ENV NOTES_VERSION=v4.11.0 +ENV NOTES_SHA256_SUM=7693027a18e13d0a0e03e31574b786737ef4866a96ce6b0c733815d3c9bf70ee RUN wget https://github.com/nextcloud-releases/notes/releases/download/$NOTES_VERSION/notes-$NOTES_VERSION.tar.gz RUN echo "$NOTES_SHA256_SUM notes-$NOTES_VERSION.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/notes RUN tar xzf notes-$NOTES_VERSION.tar.gz -C /var/lib/nextcloud/apps/notes --strip 1 -ENV NEWS_VERSION=25.0.0-alpha8 -ENV NEWS_SHA256_SUM=9e3d7247608ec10e99a99d7ff2ff5cb1bfdd8a95cc6bad5ee395d0980e563f08 +ENV NEWS_VERSION=25.0.0-alpha12 +ENV NEWS_SHA256_SUM=dd24dcfbe4aa5e70098e8139667baeda108e5426a3dc3d3403bb45faa96b8be9 RUN wget https://github.com/nextcloud/news/releases/download/$NEWS_VERSION/news.tar.gz RUN echo "$NEWS_SHA256_SUM news.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/news RUN tar xzf news.tar.gz -C /var/lib/nextcloud/apps/news --strip 1 -ENV SOCIAL_LOGIN_VERSION=v5.6.6 -ENV SOCIAL_LOGIN_SHA256_SUM=196e303b87948603c2e96ab916d1f750cda95e85951827202e8578ed2ca401c2 +ENV SOCIAL_LOGIN_VERSION=v5.6.7 +ENV SOCIAL_LOGIN_SHA256_SUM=e1a4c05f77692c1da1668212f65e41573f355a6283503ffb3beed7e31440b2bb RUN wget https://github.com/zorn-v/nextcloud-social-login/releases/download/$SOCIAL_LOGIN_VERSION/release.tar.gz RUN echo "$SOCIAL_LOGIN_SHA256_SUM release.tar.gz" | sha256sum -c - || exit 1 RUN mkdir /var/lib/nextcloud/apps/sociallogin diff --git a/rootfs/bin/nextcloud-config b/rootfs/bin/nextcloud-config index 6008452..68ffab9 100755 --- a/rootfs/bin/nextcloud-config +++ b/rootfs/bin/nextcloud-config @@ -54,7 +54,7 @@ s6-setuidgid nginx ./occ config:system:set --value "localhost" trusted_domains 0 s6-setuidgid nginx ./occ config:system:set --value "$DOMAIN" trusted_domains 1 s6-setuidgid nginx ./occ config:system:set --value "syslog" log_type s6-setuidgid nginx ./occ config:system:set --value "" logfile -s6-setuidgid nginx ./occ config:system:set --value "3" loglevel +s6-setuidgid nginx ./occ config:system:set --value "1" loglevel s6-setuidgid nginx ./occ config:system:set --value "smtp" mail_smtpmode s6-setuidgid nginx ./occ config:system:set --value "${MAIL_SMTP_AUTH_TYPE:-PLAIN}" mail_smtpauthtype diff --git a/rootfs/etc/confd/templates/nextcloud.conf.tmpl b/rootfs/etc/confd/templates/nextcloud.conf.tmpl index 8b69186..49f399c 100644 --- a/rootfs/etc/confd/templates/nextcloud.conf.tmpl +++ b/rootfs/etc/confd/templates/nextcloud.conf.tmpl @@ -5,6 +5,11 @@ upstream php { server 127.0.0.1:9000; } +map $arg_v $asset_immutable { + "" ""; + default ", immutable"; +} + server { listen [::]:8080; listen 8080; @@ -19,24 +24,15 @@ server { add_header Referrer-Policy no-referrer; add_header X-Frame-Options "SAMEORIGIN" always; + include mime.types; + types { + text/javascript mjs; + } + + index index.php index.html /index.php$request_uri; + fastcgi_hide_header X-Powered-By; - root /var/lib/nextcloud/; - - location = /robots.txt { - allow all; - log_not_found off; - access_log off; - } - - location = /.well-known/carddav { - return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav; - } - - location = /.well-known/caldav { - return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav; - } - client_max_body_size {{getenv "MAX_UPLOAD_SIZE"}}; fastcgi_buffers 64 4K; @@ -47,55 +43,93 @@ server { gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; - location / { - rewrite ^ /index.php; + root /var/lib/nextcloud/; + + location = / { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /remote.php/webdav/$is_args$args; + } } - location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { - deny all; + location = /robots.txt { + allow all; + log_not_found off; + access_log off; } - location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { - deny all; + # Make a regex exception for `/.well-known` so that clients can still + # access it despite the existence of the regex rule + # `location ~ /(\.|autotest|...)` which would otherwise handle requests + # for `/.well-known`. + location ^~ /.well-known { + # The rules in this block are an adaptation of the rules + # in `.htaccess` that concern `/.well-known`. + + location = /.well-known/carddav { return 301 /remote.php/dav/; } + location = /.well-known/caldav { return 301 /remote.php/dav/; } + + location /.well-known/acme-challenge { try_files $uri $uri/ =404; } + location /.well-known/pki-validation { try_files $uri $uri/ =404; } + + # Let Nextcloud's API for `/.well-known` URIs handle all other + # requests by passing them to the front-end controller. + return 301 /index.php$request_uri; } - location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { - fastcgi_split_path_info ^(.+\.php)(/.*)$; + # Rules borrowed from `.htaccess` to hide certain paths from clients + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + location ~ \.php(?:$|/) { + # Required for legacy support + rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri; + + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_INFO $path_info; fastcgi_param HTTPS {{ getenv "ASSUME_HTTPS" "on" }}; - #Avoid sending the security headers twice - fastcgi_param modHeadersAvailable true; - fastcgi_param front_controller_active true; + fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice + fastcgi_param front_controller_active true; # Enable pretty urls fastcgi_pass php; + fastcgi_intercept_errors on; fastcgi_request_buffering off; + + fastcgi_max_temp_file_size 0; } - location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { - try_files $uri/ =404; - index index.php; - } - - location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + # Serve static files + location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ { try_files $uri /index.php$request_uri; - add_header Cache-Control "public, max-age=15778463"; - add_header Referrer-Policy "no-referrer" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-Download-Options "noopen" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header X-Robots-Tag "none" always; - add_header X-XSS-Protection "1; mode=block" always; - - access_log off; + # HTTP response headers borrowed from Nextcloud `.htaccess` + add_header Cache-Control "public, max-age=15778463$asset_immutable"; + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "noindex, nofollow" always; + add_header X-XSS-Protection "1; mode=block" always; + access_log off; # Optional: Don't log access to assets } - location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ { + location ~ \.(otf|woff2?)$ { try_files $uri /index.php$request_uri; - access_log off; + expires 7d; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets + } + + # Rule borrowed from `.htaccess` + location /remote { + return 301 /remote.php$request_uri; + } + + location / { + try_files $uri $uri/ /index.php$request_uri; } }