diff --git a/README.md b/README.md index 7bc7d20..a21b679 100644 --- a/README.md +++ b/README.md @@ -126,7 +126,6 @@ linux/s390x * `HSTS_HEADER`: [HTTP Strict Transport Security](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#enable-http-strict-transport-security) header value (default `max-age=15768000; includeSubDomains`) * `XFRAME_OPTS_HEADER`: [X-Frame-Options](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#serve-security-related-headers-by-the-web-server) header value (default `SAMEORIGIN`) * `RP_HEADER`: [Referrer Policy](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#serve-security-related-headers-by-the-web-server) header value (default `strict-origin`) -* `SUBDIR`: [Subdir](https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html#nextcloud-in-a-subdir-of-nginx) to use. Read [this section](#running-in-a-subdir) for more info. * `DB_TYPE`: Database type (mysql, pgsql or sqlite) (default `sqlite`) * `DB_NAME`: Database name (default `nextcloud`) * `DB_USER`: Username for database (default `nextcloud`) @@ -335,10 +334,33 @@ $CONFIG = [ ### Running in a subdir -If you want to access your Nextcloud installation in a subdir (like -`/nextcloud`), you have to set the `SUBDIR` environment variable and also add -`PathPrefixStrip:/nextcloud` to your frontend rule if you use Traefik. Do not -forget to remove `includeSubDomains` option in `HSTS_HEADER` if used. +This image does not rewrite requests for subdir deployments. The bundled Nginx +configuration expects requests to arrive at the root path it serves and emits +root-relative redirects. + +If you expose Nextcloud below a path prefix like `/nextcloud`, configure the +reverse proxy to own that routing. For example, strip `/nextcloud` before +forwarding requests to this container and handle any public redirects for that +prefix in the proxy configuration. + +Configure Nextcloud's own URLs separately with a custom configuration file such +as `/data/config/proxy.config.php`: + +```php + '/nextcloud', +]; +``` + +CalDAV/CardDAV discovery uses root `/.well-known/...` URLs. If your reverse +proxy only routes `/nextcloud/...` to this container, also route those +`/.well-known` requests to Nextcloud or redirect them at the proxy to +`/nextcloud/remote.php/dav/`. + +Remember to remove `includeSubDomains` from `HSTS_HEADER` if the prefixed +deployment does not cover all subdomains. ## Contributing diff --git a/examples/compose/nextcloud.env b/examples/compose/nextcloud.env index 66145fe..c7f0c6c 100644 --- a/examples/compose/nextcloud.env +++ b/examples/compose/nextcloud.env @@ -8,4 +8,3 @@ LOG_IP_VAR=remote_addr HSTS_HEADER=max-age=15768000; includeSubDomains RP_HEADER=strict-origin -SUBDIR= diff --git a/examples/traefik/nextcloud.env b/examples/traefik/nextcloud.env index a2ca16a..933368a 100644 --- a/examples/traefik/nextcloud.env +++ b/examples/traefik/nextcloud.env @@ -8,4 +8,3 @@ LOG_IP_VAR=http_x_forwarded_for HSTS_HEADER=max-age=15768000; includeSubDomains RP_HEADER=strict-origin -SUBDIR= diff --git a/rootfs/etc/cont-init.d/03-config.sh b/rootfs/etc/cont-init.d/03-config.sh index bbda64d..bc8c1a3 100644 --- a/rootfs/etc/cont-init.d/03-config.sh +++ b/rootfs/etc/cont-init.d/03-config.sh @@ -60,12 +60,6 @@ APC_SHM_SIZE=${APC_SHM_SIZE:-128M} REAL_IP_FROM=${REAL_IP_FROM:-0.0.0.0/32} REAL_IP_HEADER=${REAL_IP_HEADER:-X-Forwarded-For} LOG_IP_VAR=${LOG_IP_VAR:-remote_addr} -if [ -z "$SUBDIR" ] -then - REDIRECT_URL='$scheme://$host' -else - REDIRECT_URL=$SUBDIR -fi HSTS_HEADER=${HSTS_HEADER:-max-age=15768000; includeSubDomains} XFRAME_OPTS_HEADER=${XFRAME_OPTS_HEADER:-SAMEORIGIN} @@ -113,7 +107,6 @@ sed -e "s/@UPLOAD_MAX_SIZE@/$UPLOAD_MAX_SIZE/g" \ -e "s/@HSTS_HEADER@/$HSTS_HEADER/g" \ -e "s/@XFRAME_OPTS_HEADER@/$XFRAME_OPTS_HEADER/g" \ -e "s/@RP_HEADER@/$RP_HEADER/g" \ - -e "s#@REDIRECT_URL@#$REDIRECT_URL#g" \ /tpls/etc/nginx/nginx.conf >/etc/nginx/nginx.conf if [ "$LISTEN_IPV6" != "true" ]; then @@ -247,19 +240,5 @@ fi unset DB_USER unset DB_PASSWORD -subdir_config="/var/www/config/docker-subdir.config.php" -# https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html#proxy-configurations -if [ -n "$SUBDIR" ]; then - cat >"${subdir_config}" < '${SUBDIR}', -); -EOL -else - rm -f "${subdir_config}" -fi - # config, themes and user apps directories must be writable chown -R nextcloud:nextcloud /data/config /data/themes /data/userapps diff --git a/rootfs/etc/cont-init.d/04-svc-main.sh b/rootfs/etc/cont-init.d/04-svc-main.sh index b051801..be89e69 100644 --- a/rootfs/etc/cont-init.d/04-svc-main.sh +++ b/rootfs/etc/cont-init.d/04-svc-main.sh @@ -9,16 +9,17 @@ if [ "$SIDECAR_CRON" = "1" ] || [ "$SIDECAR_PREVIEWGEN" = "1" ] || [ "$SIDECAR_N exit 0 fi -# Override several config values of Nextcloud -echo "Bootstrapping configuration..." -gosu nextcloud:nextcloud php -f /tpls/bootstrap.php > /tmp/config.php -gosu nextcloud:nextcloud cp /tmp/config.php /data/config/config.php -gosu nextcloud:nextcloud sed -i -e "s#@TZ@#$TZ#g" /data/config/config.php +set_system_config() { + echo "Setting Nextcloud system configuration..." + occ config:system:set logtimezone --value="${TZ:-UTC}" --no-ansi + occ config:system:set logdateformat --value="Y-m-d H:i:s" --no-ansi +} # Upgrade Nextcloud if installed if [ "$(occ status --no-ansi | grep 'installed: true')" != "" ]; then echo "Upgrading Nextcloud..." occ upgrade --no-ansi + set_system_config fi # First install ? @@ -26,6 +27,7 @@ if [ -f /tmp/first-install ]; then echo "Installing Nextcloud ${NEXTCLOUD_VERSION}..." gosu nextcloud:nextcloud php /var/www/index.php &>/dev/null rm -f /tmp/first-install + set_system_config echo ">>" echo ">> Open your browser to configure your admin account" diff --git a/rootfs/tpls/bootstrap.php b/rootfs/tpls/bootstrap.php deleted file mode 100644 index f4ed4aa..0000000 --- a/rootfs/tpls/bootstrap.php +++ /dev/null @@ -1,10 +0,0 @@ -