symlink php84 to php

.gitea/workflows/container.yaml

@@ -0,0 +1,12 @@
+name: Build Multiarch Container Image
+on: [push]
+jobs:
+  call-reusable-workflow:
+    uses: container/multiarch-build-workflow/.gitea/workflows/build.yaml@main
+    with:
+      repository: ${{ gitea.repository }}
+      ref_name: ${{ gitea.ref_name }}
+      sha: ${{ gitea.sha }}
+      registry_url: ${{ secrets.REGISTRY_URL }}
+      registry_user: ${{ secrets.REGISTRY_USER }}
+      registry_pw: ${{ secrets.REGISTRY_PW }}

.gitlab-ci.yml

@@ -1,19 +0,0 @@
-variables:
-  CONTAINER_NAME: thallian/nextcloud
-
-build:
-  stage: build
-  image:
-    name: gcr.io/kaniko-project/executor:debug
-    entrypoint: [""]
-  script:
-    - mkdir -p /kaniko/.docker
-    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(printf "%s:%s" "$CI_REGISTRY_USER" "$CI_REGISTRY_PASSWORD" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
-    - >-
-      /kaniko/executor
-      --cleanup
-      --context "$CI_PROJECT_DIR"
-      --dockerfile "$CI_PROJECT_DIR/Dockerfile"
-      --destination "$CONTAINER_NAME:$CI_COMMIT_SHA"
-      --destination "$CONTAINER_NAME:$CI_COMMIT_REF_NAME"
-      --destination "$CONTAINER_NAME:latest"

Containerfile

@@ -0,0 +1,110 @@
+FROM docker.io/alpine:3.21 AS builder
+
+ENV NC_VERSION=31.0.2
+ENV NC_SHA256_SUM=00b572111b7c2b98842d95c046de79ef463ccfadc8a04b54006c786e1f94c310
+RUN wget https://download.nextcloud.com/server/releases/nextcloud-$NC_VERSION.tar.bz2
+RUN echo "$NC_SHA256_SUM  nextcloud-$NC_VERSION.tar.bz2" | sha256sum -c - || exit 1
+RUN mkdir -p /var/lib/nextcloud
+RUN tar xjf nextcloud-$NC_VERSION.tar.bz2 -C /var/lib/nextcloud --strip 1
+
+ENV POLLS_VERSION=8.0.0-alpha14
+ENV POLLS_SHA256_SUM=4c7f6853a62a034a1a8c3ff03e7774f3de0d082c056dcd4fb19f6a14df451eb2
+RUN wget https://github.com/nextcloud/polls/releases/download/v$POLLS_VERSION/polls-$POLLS_VERSION.tar.gz
+RUN echo "$POLLS_SHA256_SUM  polls-$POLLS_VERSION.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/polls
+RUN tar xzf polls-$POLLS_VERSION.tar.gz -C /var/lib/nextcloud/apps/polls --strip 1
+
+ENV CONTACTS_VERSION=v7.0.4
+ENV CONTACTS_SHA256_SUM=681adbcd72966f74337812d63d1ff8ad678ce3485a06211007d80550d4f7abf0
+RUN wget https://github.com/nextcloud-releases/contacts/releases/download/$CONTACTS_VERSION/contacts-$CONTACTS_VERSION.tar.gz
+RUN echo "$CONTACTS_SHA256_SUM  contacts-$CONTACTS_VERSION.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/contacts
+RUN tar xzf contacts-$CONTACTS_VERSION.tar.gz -C /var/lib/nextcloud/apps/contacts --strip 1
+
+ENV CALENDAR_VERSION=v5.2.0
+ENV CALENDAR_SHA256_SUM=9801ff039a223f0221e8ae9b6fdc1de790a6a8ca0401a290555afccc535b5c4f
+RUN wget https://github.com/nextcloud-releases/calendar/releases/download/$CALENDAR_VERSION/calendar-$CALENDAR_VERSION.tar.gz
+RUN echo "$CALENDAR_SHA256_SUM  calendar-$CALENDAR_VERSION.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/calendar
+RUN tar xzf calendar-$CALENDAR_VERSION.tar.gz -C /var/lib/nextcloud/apps/calendar --strip 1
+
+ENV TASKS_VERSION=v0.16.1
+ENV TASKS_SHA256_SUM=5296b7765f9bf7b515dca5cb95cc5e4ba3b31414c85be7b753f4fd4094fa3e6c
+RUN wget https://github.com/nextcloud/tasks/releases/download/$TASKS_VERSION/tasks.tar.gz
+RUN echo "$TASKS_SHA256_SUM  tasks.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/tasks
+RUN tar xzf tasks.tar.gz -C /var/lib/nextcloud/apps/tasks --strip 1
+
+ENV NOTES_VERSION=v4.11.0
+ENV NOTES_SHA256_SUM=7693027a18e13d0a0e03e31574b786737ef4866a96ce6b0c733815d3c9bf70ee
+RUN wget https://github.com/nextcloud-releases/notes/releases/download/$NOTES_VERSION/notes-$NOTES_VERSION.tar.gz
+RUN echo "$NOTES_SHA256_SUM  notes-$NOTES_VERSION.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/notes
+RUN tar xzf notes-$NOTES_VERSION.tar.gz -C /var/lib/nextcloud/apps/notes --strip 1
+
+ENV NEWS_VERSION=25.3.1
+ENV NEWS_SHA256_SUM=b6b5e70d2485cabe47297692d52dd7ae5480522893fbc07e90fd2583e7b12dcb
+RUN wget https://github.com/nextcloud/news/releases/download/$NEWS_VERSION/news.tar.gz
+RUN echo "$NEWS_SHA256_SUM  news.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/news
+RUN tar xzf news.tar.gz -C /var/lib/nextcloud/apps/news --strip 1
+
+ENV SOCIAL_LOGIN_VERSION=v5.9.2
+ENV SOCIAL_LOGIN_SHA256_SUM=336b084e989e5af97658f8f1587b72c9944d40f6a060b6a155a25c0e8893b21f
+RUN wget https://github.com/zorn-v/nextcloud-social-login/releases/download/$SOCIAL_LOGIN_VERSION/release.tar.gz
+RUN echo "$SOCIAL_LOGIN_SHA256_SUM  release.tar.gz" | sha256sum -c - || exit 1
+RUN mkdir /var/lib/nextcloud/apps/sociallogin
+RUN tar xzf release.tar.gz -C /var/lib/nextcloud/apps/sociallogin --strip 1
+
+
+FROM docker.io/thallian/php8-fpm:3.21-8.4
+
+ENV FPMUSER=nginx
+ENV FPMGROUP=nginx
+ENV PHP_MEMORY_LIMIT=512M
+
+RUN apk add --no-cache \
+  nginx \
+  ffmpeg \
+  php84-cli \
+  php84-pecl-apcu \
+  php84-opcache \
+  php84-pcntl \
+  php84-ctype \
+  php84-curl \
+  php84-dom \
+  php84-gd \
+  php84-iconv \
+  php84-xml \
+  php84-json \
+  php84-mbstring \
+  php84-openssl \
+  php84-posix \
+  php84-session \
+  php84-simplexml \
+  php84-xmlreader \
+  php84-xmlwriter \
+  php84-zip \
+  php84-zlib \
+  php84-pdo_pgsql \
+  php84-bz2 \
+  php84-fileinfo \
+  php84-intl \
+  php84-exif \
+  php84-bcmath \
+  php84-gmp \
+  php84-imap \
+  php84-pdo \
+  dcron	
+
+RUN ln -s /usr/bin/php84 /bin/php
+
+COPY --from=builder --chown=nginx:nginx /var/lib/nextcloud /var/lib/nextcloud
+
+RUN rm /etc/nginx/http.d/default.conf
+
+ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
+
+ADD /rootfs /
+
+VOLUME [ "/var/lib/nextcloud/data", "/var/lib/nextcloud/config" ]

Dockerfile

@@ -1,135 +0,0 @@
-FROM alpine:3.15 AS builder
-
-ENV NC_VERSION=24.0.2
-ENV NC_SHA256_SUM=30d6cac1265dff221836bec46a937dcafd7e7d52ee59b939841750b514e5033d
-RUN wget https://download.nextcloud.com/server/releases/nextcloud-$NC_VERSION.tar.bz2
-RUN echo "$NC_SHA256_SUM  nextcloud-$NC_VERSION.tar.bz2" | sha256sum -c - || exit 1
-RUN mkdir -p /var/lib/nextcloud
-RUN tar xjf nextcloud-$NC_VERSION.tar.bz2 -C /var/lib/nextcloud --strip 1
-
-ENV TFA_VERSION=v6.4.0
-ENV TFA_SHA256_SUM=711b6946cd6cdf597cc46f38624648b91dc2de983691014d96b6367f9353481a
-RUN wget https://github.com/nextcloud-releases/twofactor_totp/releases/download/$TFA_VERSION/twofactor_totp-$TFA_VERSION.tar.gz
-RUN echo "$TFA_SHA256_SUM  twofactor_totp-$TFA_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/twofactor_totp
-RUN tar xzf twofactor_totp-$TFA_VERSION.tar.gz -C /var/lib/nextcloud/apps/twofactor_totp --strip 1
-
-ENV POLLS_VERSION=3.7.0
-ENV POLLS_SHA256_SUM=1551996c93b7e9b354c3c45c51c309721dab00796782276c691a7b3f8296866d
-RUN wget https://github.com/nextcloud/polls/releases/download/v$POLLS_VERSION/polls-$POLLS_VERSION.tar.gz
-RUN echo "$POLLS_SHA256_SUM  polls-$POLLS_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/polls
-RUN tar xzf polls-$POLLS_VERSION.tar.gz -C /var/lib/nextcloud/apps/polls --strip 1
-
-ENV CONTACTS_VERSION=v4.1.1
-ENV CONTACTS_SHA256_SUM=f9118ef301e982ba18a3575f7b39353582a3b54dc70e0d81b8ae95c59f1ef21a
-RUN wget https://github.com/nextcloud-releases/contacts/releases/download/$CONTACTS_VERSION/contacts-$CONTACTS_VERSION.tar.gz
-RUN echo "$CONTACTS_SHA256_SUM  contacts-$CONTACTS_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/contacts
-RUN tar xzf contacts-$CONTACTS_VERSION.tar.gz -C /var/lib/nextcloud/apps/contacts --strip 1
-
-ENV CALENDAR_VERSION=v3.4.1
-ENV CALENDAR_SHA256_SUM=6e4afc6f74d71ce296ca9bc3c643e4a2eb12e85dfc979186ef2eae17e096713a
-RUN wget https://github.com/nextcloud-releases/calendar/releases/download/$CALENDAR_VERSION/calendar-$CALENDAR_VERSION.tar.gz
-RUN echo "$CALENDAR_SHA256_SUM  calendar-$CALENDAR_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/calendar
-RUN tar xzf calendar-$CALENDAR_VERSION.tar.gz -C /var/lib/nextcloud/apps/calendar --strip 1
-
-ENV TASKS_VERSION=v0.14.4
-ENV TASKS_SHA256_SUM=9175d4cf33838bfa918b636ab49ca24b51a62d3c74905030b47d69d2b09d9d13
-RUN wget https://github.com/nextcloud/tasks/releases/download/$TASKS_VERSION/tasks.tar.gz
-RUN echo "$TASKS_SHA256_SUM  tasks.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/tasks
-RUN tar xzf tasks.tar.gz -C /var/lib/nextcloud/apps/tasks --strip 1
-
-ENV NOTES_VERSION=v4.3.1
-ENV NOTES_SHA256_SUM=02b678c1fa0984b78718071cc6c5f5a4b468d7b1f4508d36eae35bd267c64515
-RUN wget https://github.com/nextcloud/notes/releases/download/$NOTES_VERSION/notes.tar.gz
-RUN echo "$NOTES_SHA256_SUM  notes.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/notes
-RUN tar xzf notes.tar.gz -C /var/lib/nextcloud/apps/notes --strip 1
-
-ENV NEWS_VERSION=18.1.0
-ENV NEWS_SHA256_SUM=8e6ae871d2664696aed3357c52d2f2beb957fe4eceeb3959f06f73af2f226c4c
-RUN wget https://github.com/nextcloud/news/releases/download/$NEWS_VERSION/news.tar.gz
-RUN echo "$NEWS_SHA256_SUM  news.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/news
-RUN tar xzf news.tar.gz -C /var/lib/nextcloud/apps/news --strip 1
-
-ENV MASTODON_INTEGRATION_VERSION=1.0.2
-ENV MASTODON_INTEGRATION_SHA256_SUM=819226a25f293da72416c25a3595ef7e93c37f16cdff5cc4b21399de52073c4f
-RUN wget https://github.com/nextcloud/integration_mastodon/releases/download/v$MASTODON_INTEGRATION_VERSION/integration_mastodon-$MASTODON_INTEGRATION_VERSION.tar.gz
-RUN echo "$MASTODON_INTEGRATION_SHA256_SUM  integration_mastodon-$MASTODON_INTEGRATION_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/integration_mastodon
-RUN tar xzf integration_mastodon-$MASTODON_INTEGRATION_VERSION.tar.gz -C /var/lib/nextcloud/apps/integration_mastodon --strip 1
-
-ENV GITHUB_INTEGRATION_VERSION=1.0.2
-ENV GITHUB_INTEGRATION_SHA256_SUM=1ae96fad28e86a35b4780eff3d1b915b12cc45be4140b9ae10cf914456d386e1
-RUN wget https://github.com/nextcloud/integration_github/releases/download/v$GITHUB_INTEGRATION_VERSION/integration_github-$GITHUB_INTEGRATION_VERSION.tar.gz
-RUN echo "$GITHUB_INTEGRATION_SHA256_SUM  integration_github-$GITHUB_INTEGRATION_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/integration_github
-RUN tar xzf integration_github-$GITHUB_INTEGRATION_VERSION.tar.gz -C /var/lib/nextcloud/apps/integration_github --strip 1
-
-ENV GITLAB_INTEGRATION_VERSION=1.0.3
-ENV GITLAB_INTEGRATION_SHA256_SUM=292a01666abf3b311cacaca27c04550d1ffd884430cab2616ea6e66afd133aa9
-RUN wget https://github.com/nextcloud/integration_gitlab/releases/download/v$GITLAB_INTEGRATION_VERSION/integration_gitlab-$GITLAB_INTEGRATION_VERSION.tar.gz
-RUN echo "$GITLAB_INTEGRATION_SHA256_SUM  integration_gitlab-$GITLAB_INTEGRATION_VERSION.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/integration_gitlab
-RUN tar xzf integration_gitlab-$GITLAB_INTEGRATION_VERSION.tar.gz -C /var/lib/nextcloud/apps/integration_gitlab --strip 1
-
-ENV SOCIAL_LOGIN_VERSION=v4.15.3
-ENV SOCIAL_LOGIN_SHA256_SUM=9d2956f7e85a84a8c05d7f9dd9e194895398f5c3029d85861c89d9acbabc4e5f
-RUN wget https://github.com/zorn-v/nextcloud-social-login/releases/download/$SOCIAL_LOGIN_VERSION/release.tar.gz
-RUN echo "$SOCIAL_LOGIN_SHA256_SUM  release.tar.gz" | sha256sum -c - || exit 1
-RUN mkdir /var/lib/nextcloud/apps/sociallogin
-RUN tar xzf release.tar.gz -C /var/lib/nextcloud/apps/sociallogin --strip 1
-
-
-FROM thallian/php8-fpm:latest
-
-ENV FPMUSER=nginx
-ENV FPMGROUP=nginx
-ENV PHP_MEMORY_LIMIT=512M
-
-RUN apk add --no-cache  \
-    nginx \
-    ffmpeg \
-    php8-cli \
-    php8-pecl-apcu \
-    php8-opcache \
-    php8-pcntl \
-    php8-ctype \
-    php8-curl \
-    php8-dom \
-    php8-gd \
-    php8-iconv \
-    php8-xml \
-    php8-json \
-    php8-mbstring \
-    php8-openssl \
-    php8-posix \
-    php8-session \
-    php8-simplexml \
-    php8-xmlreader \
-    php8-xmlwriter \
-    php8-zip \
-    php8-zlib \
-    php8-pdo_pgsql \
-    php8-bz2 \
-    php8-fileinfo \
-    php8-intl \
-    php8-exif \
-    php8-bcmath \
-    php8-gmp \
-    php8-imap \
-	dcron	
-
-COPY --from=builder --chown=nginx:nginx /var/lib/nextcloud /var/lib/nextcloud
-
-RUN rm /etc/nginx/http.d/default.conf
-
-ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
-
-ADD /rootfs /
-
-VOLUME [ "/var/lib/nextcloud/data", "/var/lib/nextcloud/config" ]

rootfs/bin/nextcloud-config

@@ -5,40 +5,35 @@ cd /var/lib/nextcloud
 chmod +x ./occ
 
 if [ ! -f /var/lib/nextcloud/data/.installed ]; then
-    s6-setuidgid nginx ./occ maintenance:install \
+  s6-setuidgid nginx ./occ maintenance:install \
-        --database=pgsql \
+    --database=pgsql \
-        --database-host="$DB_HOST" \
+    --database-host="$DB_HOST" \
-        --database-name="$DB_NAME" \
+    --database-name="$DB_NAME" \
-        --database-user="$DB_USER" \
+    --database-user="$DB_USER" \
-        --database-pass="$DB_PASSWORD" \
+    --database-pass="$DB_PASSWORD" \
-        --database-port="$DB_PORT" \
+    --database-port="$DB_PORT" \
-        --admin-user="$ADMIN_USER" \
+    --admin-user="$ADMIN_USER" \
-        --admin-pass="$ADMIN_PASSWORD" \
+    --admin-pass="$ADMIN_PASSWORD" \
-        --data-dir=/var/lib/nextcloud/data/ \
+    --data-dir=/var/lib/nextcloud/data/ \
-        --no-interaction
+    --no-interaction
 
-    touch /var/lib/nextcloud/data/.installed
+  touch /var/lib/nextcloud/data/.installed
 fi
 
 s6-setuidgid nginx ./occ config:app:set --value cron core backgroundjobs_mode
 s6-setuidgid nginx ./occ app:enable files_sharing
 s6-setuidgid nginx ./occ app:enable text
 s6-setuidgid nginx ./occ app:enable files_pdfviewer
-s6-setuidgid nginx ./occ app:enable files_videoplayer
 s6-setuidgid nginx ./occ app:enable theming
 s6-setuidgid nginx ./occ app:enable photos
-s6-setuidgid nginx ./occ app:enable twofactor_totp
 s6-setuidgid nginx ./occ app:enable twofactor_backupcodes
 s6-setuidgid nginx ./occ app:enable polls
 s6-setuidgid nginx ./occ app:enable calendar
 s6-setuidgid nginx ./occ app:enable contacts
 s6-setuidgid nginx ./occ app:enable news
 s6-setuidgid nginx ./occ app:enable tasks
-s6-setuidgid nginx ./occ app:enable notes
+# s6-setuidgid nginx ./occ app:enable notes
 s6-setuidgid nginx ./occ app:enable sociallogin
-s6-setuidgid nginx ./occ app:enable integration_mastodon
-s6-setuidgid nginx ./occ app:enable integration_github
-s6-setuidgid nginx ./occ app:enable integration_gitlab
 s6-setuidgid nginx ./occ app:disable activity
 s6-setuidgid nginx ./occ app:disable comments
 s6-setuidgid nginx ./occ app:disable files_trashbin
@@ -59,7 +54,7 @@ s6-setuidgid nginx ./occ config:system:set --value "localhost" trusted_domains 0
 s6-setuidgid nginx ./occ config:system:set --value "$DOMAIN" trusted_domains 1
 s6-setuidgid nginx ./occ config:system:set --value "syslog" log_type
 s6-setuidgid nginx ./occ config:system:set --value "" logfile
-s6-setuidgid nginx ./occ config:system:set --value "3" loglevel
+s6-setuidgid nginx ./occ config:system:set --value "1" loglevel
 
 s6-setuidgid nginx ./occ config:system:set --value "smtp" mail_smtpmode
 s6-setuidgid nginx ./occ config:system:set --value "${MAIL_SMTP_AUTH_TYPE:-PLAIN}" mail_smtpauthtype

rootfs/etc/confd/templates/nextcloud.conf.tmpl

@@ -5,7 +5,13 @@ upstream php {
     server 127.0.0.1:9000;
 }
 
+map $arg_v $asset_immutable {
+    "" "";
+    default ", immutable";
+}
+
 server {
+    listen [::]:8080;
     listen 8080;
 
     server_name {{getenv "DOMAIN"}};
@@ -18,24 +24,15 @@ server {
     add_header Referrer-Policy no-referrer;
     add_header X-Frame-Options "SAMEORIGIN" always;
 
+    include mime.types;
+    types {
+        text/javascript mjs;
+    }
+
+    index index.php index.html /index.php$request_uri;
+
     fastcgi_hide_header X-Powered-By;
 
-    root /var/lib/nextcloud/;
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    location = /.well-known/carddav {
-      return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav;
-    }
-
-    location = /.well-known/caldav {
-      return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav;
-    }
-
     client_max_body_size {{getenv "MAX_UPLOAD_SIZE"}};
     fastcgi_buffers 64 4K;
 
@@ -46,55 +43,93 @@ server {
     gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
     gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 
-    location / {
+    root /var/lib/nextcloud/;
-        rewrite ^ /index.php;
+
+    location = / {
+        if ( $http_user_agent ~ ^DavClnt ) {
+            return 302 /remote.php/webdav/$is_args$args;
+        }
     }
 
-    location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
+    location = /robots.txt {
-        deny all;
+        allow all;
+        log_not_found off;
+        access_log off;
     }
 
-    location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
+    # Make a regex exception for `/.well-known` so that clients can still
-        deny all;
+    # access it despite the existence of the regex rule
+    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+    # for `/.well-known`.
+    location ^~ /.well-known {
+        # The rules in this block are an adaptation of the rules
+        # in `.htaccess` that concern `/.well-known`.
+
+        location = /.well-known/carddav { return 301 /remote.php/dav/; }
+        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
+        # Let Nextcloud's API for `/.well-known` URIs handle all other
+        # requests by passing them to the front-end controller.
+        return 301 /index.php$request_uri;
     }
 
-    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+    # Rules borrowed from `.htaccess` to hide certain paths from clients
-        fastcgi_split_path_info ^(.+\.php)(/.*)$;
+    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+    location ~ \.php(?:$|/) {
+        # Required for legacy support
+        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
+
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        set $path_info $fastcgi_path_info;
+
         try_files $fastcgi_script_name =404;
+
         include fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param PATH_INFO $path_info;
         fastcgi_param HTTPS {{ getenv "ASSUME_HTTPS" "on" }};
 
-        #Avoid sending the security headers twice
+        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-        fastcgi_param modHeadersAvailable true;
+        fastcgi_param front_controller_active true;     # Enable pretty urls
-        fastcgi_param front_controller_active true;
         fastcgi_pass php;
+
         fastcgi_intercept_errors on;
         fastcgi_request_buffering off;
+
+        fastcgi_max_temp_file_size 0;
     }
 
-    location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
+    # Serve static files
-        try_files $uri/ =404;
+    location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
-        index index.php;
-    }
-
-    location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
         try_files $uri /index.php$request_uri;
-        add_header Cache-Control "public, max-age=15778463";
+        # HTTP response headers borrowed from Nextcloud `.htaccess`
-        add_header Referrer-Policy "no-referrer" always;
+        add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
-        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy                   "no-referrer"       always;
-        add_header X-Download-Options "noopen" always;
+        add_header X-Content-Type-Options            "nosniff"           always;
-        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Frame-Options                   "SAMEORIGIN"        always;
-        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Permitted-Cross-Domain-Policies "none"              always;
-        add_header X-Robots-Tag "none" always;
+        add_header X-Robots-Tag                      "noindex, nofollow" always;
-        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-XSS-Protection                  "1; mode=block"     always;
-
+        access_log off;     # Optional: Don't log access to assets
-        access_log off;
     }
 
-    location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
+    location ~ \.(otf|woff2?)$ {
         try_files $uri /index.php$request_uri;
-        access_log off;
+        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+        access_log off;     # Optional: Don't log access to assets
+    }
+
+    # Rule borrowed from `.htaccess`
+    location /remote {
+        return 301 /remote.php$request_uri;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$request_uri;
     }
 }