symlink php84 to php

Containerfile

@@ -1,63 +1,63 @@
-FROM docker.io/alpine:3.20 AS builder
+FROM docker.io/alpine:3.21 AS builder
 
-ENV NC_VERSION=29.0.1
-ENV NC_SHA256_SUM=759546daecf79ca787ed6705503693c6db553aabf1d7ae4dfa779c7309b2ada9
+ENV NC_VERSION=31.0.2
+ENV NC_SHA256_SUM=00b572111b7c2b98842d95c046de79ef463ccfadc8a04b54006c786e1f94c310
 RUN wget https://download.nextcloud.com/server/releases/nextcloud-$NC_VERSION.tar.bz2
 RUN echo "$NC_SHA256_SUM  nextcloud-$NC_VERSION.tar.bz2" | sha256sum -c - || exit 1
 RUN mkdir -p /var/lib/nextcloud
 RUN tar xjf nextcloud-$NC_VERSION.tar.bz2 -C /var/lib/nextcloud --strip 1
 
-ENV POLLS_VERSION=7.0.3
-ENV POLLS_SHA256_SUM=b93057e4fc0450dfe9cf1d7ab142645d75f79e7f0daca8ac6492d597be85f6ec
+ENV POLLS_VERSION=8.0.0-alpha14
+ENV POLLS_SHA256_SUM=4c7f6853a62a034a1a8c3ff03e7774f3de0d082c056dcd4fb19f6a14df451eb2
 RUN wget https://github.com/nextcloud/polls/releases/download/v$POLLS_VERSION/polls-$POLLS_VERSION.tar.gz
 RUN echo "$POLLS_SHA256_SUM  polls-$POLLS_VERSION.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/polls
 RUN tar xzf polls-$POLLS_VERSION.tar.gz -C /var/lib/nextcloud/apps/polls --strip 1
 
-ENV CONTACTS_VERSION=v6.0.0
-ENV CONTACTS_SHA256_SUM=e3c11127d0d0f70ef57a7713d9756f715695f846ed86013142588a3b5b10fb50
+ENV CONTACTS_VERSION=v7.0.4
+ENV CONTACTS_SHA256_SUM=681adbcd72966f74337812d63d1ff8ad678ce3485a06211007d80550d4f7abf0
 RUN wget https://github.com/nextcloud-releases/contacts/releases/download/$CONTACTS_VERSION/contacts-$CONTACTS_VERSION.tar.gz
 RUN echo "$CONTACTS_SHA256_SUM  contacts-$CONTACTS_VERSION.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/contacts
 RUN tar xzf contacts-$CONTACTS_VERSION.tar.gz -C /var/lib/nextcloud/apps/contacts --strip 1
 
-ENV CALENDAR_VERSION=v4.7.4
-ENV CALENDAR_SHA256_SUM=0b70187f5993dda3760cadb721a7e33c898adba36d8351bb1a76394d3ecff9fb
+ENV CALENDAR_VERSION=v5.2.0
+ENV CALENDAR_SHA256_SUM=9801ff039a223f0221e8ae9b6fdc1de790a6a8ca0401a290555afccc535b5c4f
 RUN wget https://github.com/nextcloud-releases/calendar/releases/download/$CALENDAR_VERSION/calendar-$CALENDAR_VERSION.tar.gz
 RUN echo "$CALENDAR_SHA256_SUM  calendar-$CALENDAR_VERSION.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/calendar
 RUN tar xzf calendar-$CALENDAR_VERSION.tar.gz -C /var/lib/nextcloud/apps/calendar --strip 1
 
-ENV TASKS_VERSION=v0.16.0
-ENV TASKS_SHA256_SUM=1e2b5841c7544541ee8d134c1748ca433bd23bdddb22d8ac2347a6ab4cb0f29e
+ENV TASKS_VERSION=v0.16.1
+ENV TASKS_SHA256_SUM=5296b7765f9bf7b515dca5cb95cc5e4ba3b31414c85be7b753f4fd4094fa3e6c
 RUN wget https://github.com/nextcloud/tasks/releases/download/$TASKS_VERSION/tasks.tar.gz
 RUN echo "$TASKS_SHA256_SUM  tasks.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/tasks
 RUN tar xzf tasks.tar.gz -C /var/lib/nextcloud/apps/tasks --strip 1
 
-ENV NOTES_VERSION=v4.10.0
-ENV NOTES_SHA256_SUM=6afeb2e465624f3947b6751bfce203c3ed30740fd94703d840c537c8311b3134
-RUN wget https://github.com/nextcloud/notes/releases/download/$NOTES_VERSION/notes.tar.gz
-RUN echo "$NOTES_SHA256_SUM  notes.tar.gz" | sha256sum -c - || exit 1
+ENV NOTES_VERSION=v4.11.0
+ENV NOTES_SHA256_SUM=7693027a18e13d0a0e03e31574b786737ef4866a96ce6b0c733815d3c9bf70ee
+RUN wget https://github.com/nextcloud-releases/notes/releases/download/$NOTES_VERSION/notes-$NOTES_VERSION.tar.gz
+RUN echo "$NOTES_SHA256_SUM  notes-$NOTES_VERSION.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/notes
-RUN tar xzf notes.tar.gz -C /var/lib/nextcloud/apps/notes --strip 1
+RUN tar xzf notes-$NOTES_VERSION.tar.gz -C /var/lib/nextcloud/apps/notes --strip 1
 
-ENV NEWS_VERSION=25.0.0-alpha6
-ENV NEWS_SHA256_SUM=5846e79d4889925cbf83e2c72a6d4e2a4710cf3e0f67a910be5016c142bad16c
+ENV NEWS_VERSION=25.3.1
+ENV NEWS_SHA256_SUM=b6b5e70d2485cabe47297692d52dd7ae5480522893fbc07e90fd2583e7b12dcb
 RUN wget https://github.com/nextcloud/news/releases/download/$NEWS_VERSION/news.tar.gz
 RUN echo "$NEWS_SHA256_SUM  news.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/news
 RUN tar xzf news.tar.gz -C /var/lib/nextcloud/apps/news --strip 1
 
-ENV SOCIAL_LOGIN_VERSION=v5.6.4
-ENV SOCIAL_LOGIN_SHA256_SUM=648af2d41d965c8458351c3434b0016da75f7e17c7f8c194b621c724b72ce26f
+ENV SOCIAL_LOGIN_VERSION=v5.9.2
+ENV SOCIAL_LOGIN_SHA256_SUM=336b084e989e5af97658f8f1587b72c9944d40f6a060b6a155a25c0e8893b21f
 RUN wget https://github.com/zorn-v/nextcloud-social-login/releases/download/$SOCIAL_LOGIN_VERSION/release.tar.gz
 RUN echo "$SOCIAL_LOGIN_SHA256_SUM  release.tar.gz" | sha256sum -c - || exit 1
 RUN mkdir /var/lib/nextcloud/apps/sociallogin
 RUN tar xzf release.tar.gz -C /var/lib/nextcloud/apps/sociallogin --strip 1
 
 
-FROM docker.io/thallian/php8-fpm:3.20-8.3
+FROM docker.io/thallian/php8-fpm:3.21-8.4
 
 ENV FPMUSER=nginx
 ENV FPMGROUP=nginx
@@ -66,37 +66,39 @@ ENV PHP_MEMORY_LIMIT=512M
 RUN apk add --no-cache \
   nginx \
   ffmpeg \
-  php83-cli \
-  php83-pecl-apcu \
-  php83-opcache \
-  php83-pcntl \
-  php83-ctype \
-  php83-curl \
-  php83-dom \
-  php83-gd \
-  php83-iconv \
-  php83-xml \
-  php83-json \
-  php83-mbstring \
-  php83-openssl \
-  php83-posix \
-  php83-session \
-  php83-simplexml \
-  php83-xmlreader \
-  php83-xmlwriter \
-  php83-zip \
-  php83-zlib \
-  php83-pdo_pgsql \
-  php83-bz2 \
-  php83-fileinfo \
-  php83-intl \
-  php83-exif \
-  php83-bcmath \
-  php83-gmp \
-  php83-imap \
-  php83-pdo \
+  php84-cli \
+  php84-pecl-apcu \
+  php84-opcache \
+  php84-pcntl \
+  php84-ctype \
+  php84-curl \
+  php84-dom \
+  php84-gd \
+  php84-iconv \
+  php84-xml \
+  php84-json \
+  php84-mbstring \
+  php84-openssl \
+  php84-posix \
+  php84-session \
+  php84-simplexml \
+  php84-xmlreader \
+  php84-xmlwriter \
+  php84-zip \
+  php84-zlib \
+  php84-pdo_pgsql \
+  php84-bz2 \
+  php84-fileinfo \
+  php84-intl \
+  php84-exif \
+  php84-bcmath \
+  php84-gmp \
+  php84-imap \
+  php84-pdo \
   dcron	
 
+RUN ln -s /usr/bin/php84 /bin/php
+
 COPY --from=builder --chown=nginx:nginx /var/lib/nextcloud /var/lib/nextcloud
 
 RUN rm /etc/nginx/http.d/default.conf

rootfs/bin/nextcloud-config

@@ -54,7 +54,7 @@ s6-setuidgid nginx ./occ config:system:set --value "localhost" trusted_domains 0
 s6-setuidgid nginx ./occ config:system:set --value "$DOMAIN" trusted_domains 1
 s6-setuidgid nginx ./occ config:system:set --value "syslog" log_type
 s6-setuidgid nginx ./occ config:system:set --value "" logfile
-s6-setuidgid nginx ./occ config:system:set --value "3" loglevel
+s6-setuidgid nginx ./occ config:system:set --value "1" loglevel
 
 s6-setuidgid nginx ./occ config:system:set --value "smtp" mail_smtpmode
 s6-setuidgid nginx ./occ config:system:set --value "${MAIL_SMTP_AUTH_TYPE:-PLAIN}" mail_smtpauthtype

rootfs/etc/confd/templates/nextcloud.conf.tmpl

@@ -5,6 +5,11 @@ upstream php {
     server 127.0.0.1:9000;
 }
 
+map $arg_v $asset_immutable {
+    "" "";
+    default ", immutable";
+}
+
 server {
     listen [::]:8080;
     listen 8080;
@@ -19,24 +24,15 @@ server {
     add_header Referrer-Policy no-referrer;
     add_header X-Frame-Options "SAMEORIGIN" always;
 
+    include mime.types;
+    types {
+        text/javascript mjs;
+    }
+
+    index index.php index.html /index.php$request_uri;
+
     fastcgi_hide_header X-Powered-By;
 
-    root /var/lib/nextcloud/;
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    location = /.well-known/carddav {
-      return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav;
-    }
-
-    location = /.well-known/caldav {
-      return 301 http{{ if eq (getenv "ASSUME_HTTPS" "on") "on" }}s{{end}}://$host/remote.php/dav;
-    }
-
     client_max_body_size {{getenv "MAX_UPLOAD_SIZE"}};
     fastcgi_buffers 64 4K;
 
@@ -47,55 +43,93 @@ server {
     gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
     gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 
-    location / {
-        rewrite ^ /index.php;
+    root /var/lib/nextcloud/;
+
+    location = / {
+        if ( $http_user_agent ~ ^DavClnt ) {
+            return 302 /remote.php/webdav/$is_args$args;
+        }
     }
 
-    location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
-        deny all;
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
     }
 
-    location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
-        deny all;
+    # Make a regex exception for `/.well-known` so that clients can still
+    # access it despite the existence of the regex rule
+    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+    # for `/.well-known`.
+    location ^~ /.well-known {
+        # The rules in this block are an adaptation of the rules
+        # in `.htaccess` that concern `/.well-known`.
+
+        location = /.well-known/carddav { return 301 /remote.php/dav/; }
+        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
+        # Let Nextcloud's API for `/.well-known` URIs handle all other
+        # requests by passing them to the front-end controller.
+        return 301 /index.php$request_uri;
     }
 
-    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
-        fastcgi_split_path_info ^(.+\.php)(/.*)$;
+    # Rules borrowed from `.htaccess` to hide certain paths from clients
+    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+    location ~ \.php(?:$|/) {
+        # Required for legacy support
+        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
+
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        set $path_info $fastcgi_path_info;
+
         try_files $fastcgi_script_name =404;
+
         include fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param PATH_INFO $path_info;
         fastcgi_param HTTPS {{ getenv "ASSUME_HTTPS" "on" }};
 
-        #Avoid sending the security headers twice
-        fastcgi_param modHeadersAvailable true;
-        fastcgi_param front_controller_active true;
+        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
+        fastcgi_param front_controller_active true;     # Enable pretty urls
         fastcgi_pass php;
+
         fastcgi_intercept_errors on;
         fastcgi_request_buffering off;
+
+        fastcgi_max_temp_file_size 0;
     }
 
-    location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
-        try_files $uri/ =404;
-        index index.php;
-    }
-
-    location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
+    # Serve static files
+    location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
         try_files $uri /index.php$request_uri;
-        add_header Cache-Control "public, max-age=15778463";
-        add_header Referrer-Policy "no-referrer" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-Download-Options "noopen" always;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-Permitted-Cross-Domain-Policies "none" always;
-        add_header X-Robots-Tag "none" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-
-        access_log off;
+        # HTTP response headers borrowed from Nextcloud `.htaccess`
+        add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
+        add_header Referrer-Policy                   "no-referrer"       always;
+        add_header X-Content-Type-Options            "nosniff"           always;
+        add_header X-Frame-Options                   "SAMEORIGIN"        always;
+        add_header X-Permitted-Cross-Domain-Policies "none"              always;
+        add_header X-Robots-Tag                      "noindex, nofollow" always;
+        add_header X-XSS-Protection                  "1; mode=block"     always;
+        access_log off;     # Optional: Don't log access to assets
     }
 
-    location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
+    location ~ \.(otf|woff2?)$ {
         try_files $uri /index.php$request_uri;
-        access_log off;
+        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+        access_log off;     # Optional: Don't log access to assets
+    }
+
+    # Rule borrowed from `.htaccess`
+    location /remote {
+        return 301 /remote.php$request_uri;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$request_uri;
     }
 }