remove built-in subdir handling

README.md

@@ -126,7 +126,6 @@ linux/s390x
 * `HSTS_HEADER`: [HTTP Strict Transport Security](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#enable-http-strict-transport-security) header value (default `max-age=15768000; includeSubDomains`)
 * `XFRAME_OPTS_HEADER`: [X-Frame-Options](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#serve-security-related-headers-by-the-web-server) header value (default `SAMEORIGIN`)
 * `RP_HEADER`: [Referrer Policy](https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#serve-security-related-headers-by-the-web-server) header value (default `strict-origin`)
-* `SUBDIR`: [Subdir](https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html#nextcloud-in-a-subdir-of-nginx) to use. Read [this section](#running-in-a-subdir) for more info.
 * `DB_TYPE`: Database type (mysql, pgsql or sqlite) (default `sqlite`)
 * `DB_NAME`: Database name (default `nextcloud`)
 * `DB_USER`: Username for database (default `nextcloud`)
@@ -335,10 +334,33 @@ $CONFIG = [
 
 ### Running in a subdir
 
-If you want to access your Nextcloud installation in a subdir (like
-`/nextcloud`), you have to set the `SUBDIR` environment variable and also add
-`PathPrefixStrip:/nextcloud` to your frontend rule if you use Traefik. Do not
-forget to remove `includeSubDomains` option in `HSTS_HEADER` if used.
+This image does not rewrite requests for subdir deployments. The bundled Nginx
+configuration expects requests to arrive at the root path it serves and emits
+root-relative redirects.
+
+If you expose Nextcloud below a path prefix like `/nextcloud`, configure the
+reverse proxy to own that routing. For example, strip `/nextcloud` before
+forwarding requests to this container and handle any public redirects for that
+prefix in the proxy configuration.
+
+Configure Nextcloud's own URLs separately with a custom configuration file such
+as `/data/config/proxy.config.php`:
+
+```php
+<?php
+
+$CONFIG = [
+    'overwritewebroot' => '/nextcloud',
+];
+```
+
+CalDAV/CardDAV discovery uses root `/.well-known/...` URLs. If your reverse
+proxy only routes `/nextcloud/...` to this container, also route those
+`/.well-known` requests to Nextcloud or redirect them at the proxy to
+`/nextcloud/remote.php/dav/`.
+
+Remember to remove `includeSubDomains` from `HSTS_HEADER` if the prefixed
+deployment does not cover all subdomains.
 
 ## Contributing
 

examples/compose/nextcloud.env

@@ -8,4 +8,3 @@ LOG_IP_VAR=remote_addr
 
 HSTS_HEADER=max-age=15768000; includeSubDomains
 RP_HEADER=strict-origin
-SUBDIR=

examples/traefik/nextcloud.env

@@ -8,4 +8,3 @@ LOG_IP_VAR=http_x_forwarded_for
 
 HSTS_HEADER=max-age=15768000; includeSubDomains
 RP_HEADER=strict-origin
-SUBDIR=

rootfs/etc/cont-init.d/03-config.sh

@@ -60,12 +60,6 @@ APC_SHM_SIZE=${APC_SHM_SIZE:-128M}
 REAL_IP_FROM=${REAL_IP_FROM:-0.0.0.0/32}
 REAL_IP_HEADER=${REAL_IP_HEADER:-X-Forwarded-For}
 LOG_IP_VAR=${LOG_IP_VAR:-remote_addr}
-if [ -z "$SUBDIR" ]
-then
-  REDIRECT_URL='$scheme://$host'
-else
-  REDIRECT_URL=$SUBDIR
-fi
 
 HSTS_HEADER=${HSTS_HEADER:-max-age=15768000; includeSubDomains}
 XFRAME_OPTS_HEADER=${XFRAME_OPTS_HEADER:-SAMEORIGIN}
@@ -113,7 +107,6 @@ sed -e "s/@UPLOAD_MAX_SIZE@/$UPLOAD_MAX_SIZE/g" \
   -e "s/@HSTS_HEADER@/$HSTS_HEADER/g" \
   -e "s/@XFRAME_OPTS_HEADER@/$XFRAME_OPTS_HEADER/g" \
   -e "s/@RP_HEADER@/$RP_HEADER/g" \
-  -e "s#@REDIRECT_URL@#$REDIRECT_URL#g" \
   /tpls/etc/nginx/nginx.conf >/etc/nginx/nginx.conf
 
 if [ "$LISTEN_IPV6" != "true" ]; then
@@ -247,19 +240,5 @@ fi
 unset DB_USER
 unset DB_PASSWORD
 
-subdir_config="/var/www/config/docker-subdir.config.php"
-# https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html#proxy-configurations
-if [ -n "$SUBDIR" ]; then
-  cat >"${subdir_config}" <<EOL
-<?php
-// Generated by docker-nextcloud from the SUBDIR environment variable.
-\$CONFIG = array(
-    'overwritewebroot' => '${SUBDIR}',
-);
-EOL
-else
-  rm -f "${subdir_config}"
-fi
-
 # config, themes and user apps directories must be writable
 chown -R nextcloud:nextcloud /data/config /data/themes /data/userapps

rootfs/etc/cont-init.d/04-svc-main.sh

@@ -9,23 +9,25 @@ if [ "$SIDECAR_CRON" = "1" ] || [ "$SIDECAR_PREVIEWGEN" = "1" ] || [ "$SIDECAR_N
   exit 0
 fi
 
-# Override several config values of Nextcloud
-echo "Bootstrapping configuration..."
-gosu nextcloud:nextcloud php -f /tpls/bootstrap.php > /tmp/config.php
-gosu nextcloud:nextcloud cp /tmp/config.php /data/config/config.php
-gosu nextcloud:nextcloud sed -i -e "s#@TZ@#$TZ#g" /data/config/config.php
+set_system_config() {
+  echo "Setting Nextcloud system configuration..."
+  occ config:system:set logtimezone --value="${TZ:-UTC}" --no-ansi
+  occ config:system:set logdateformat --value="Y-m-d H:i:s" --no-ansi
+}
 
 # Upgrade Nextcloud if installed
 if [ "$(occ status --no-ansi | grep 'installed: true')" != "" ]; then
   echo "Upgrading Nextcloud..."
   occ upgrade --no-ansi
+  set_system_config
 fi
 
 # First install ?
 if [ -f /tmp/first-install ]; then
   echo "Installing Nextcloud ${NEXTCLOUD_VERSION}..."
   gosu nextcloud:nextcloud php /var/www/index.php &>/dev/null
   rm -f /tmp/first-install
+  set_system_config
 
   echo ">>"
   echo ">> Open your browser to configure your admin account"

rootfs/tpls/etc/nginx/nginx.conf

@@ -83,6 +83,10 @@ http {
         listen 8000;
         listen [::]:8000;
 
+        # Keep locally generated redirects relative so the reverse proxy remains
+        # responsible for the public scheme, host, and port.
+        absolute_redirect off;
+
         root /var/www;
         index index.php index.html;
 
@@ -132,7 +136,7 @@ http {
         # Handle Microsoft DAV clients
         location = / {
             if ( $http_user_agent ~ ^DavClnt ) {
-                return 302 @REDIRECT_URL@/remote.php/webdav/$is_args$args;
+                return 302 /remote.php/webdav/$is_args$args;
             }
         }
 
@@ -150,14 +154,14 @@ http {
             # The rules in this block are an adaptation of the rules
             # in `.htaccess` that concern `/.well-known`.
 
-            location = /.well-known/carddav { return 301 @REDIRECT_URL@/remote.php/dav/; }
-            location = /.well-known/caldav { return 301 @REDIRECT_URL@/remote.php/dav/; }
+            location = /.well-known/carddav { return 301 /remote.php/dav/; }
+            location = /.well-known/caldav { return 301 /remote.php/dav/; }
             location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
             location /.well-known/pki-validation { try_files $uri $uri/ =404; }
 
             # Let Nextcloud's API for `/.well-known` URIs handle all other
             # requests by passing them to the front-end controller.
-            return 301 @REDIRECT_URL@/index.php$request_uri;
+            return 301 /index.php$request_uri;
         }
 
         location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
@@ -216,7 +220,7 @@ http {
 
         # Rule borrowed from `.htaccess`
         location /remote {
-            return 301 @REDIRECT_URL@/remote.php$request_uri;
+            return 301 /remote.php$request_uri;
         }
 
         location / {

test/mysql/nextcloud.env

@@ -8,4 +8,3 @@ LOG_IP_VAR=remote_addr
 
 HSTS_HEADER=max-age=15768000; includeSubDomains
 RP_HEADER=strict-origin
-SUBDIR=

test/pgsql/nextcloud.env

@@ -8,4 +8,3 @@ LOG_IP_VAR=remote_addr
 
 HSTS_HEADER=max-age=15768000; includeSubDomains
 RP_HEADER=strict-origin
-SUBDIR=

test/sqlite/nextcloud.env

@@ -8,4 +8,3 @@ LOG_IP_VAR=remote_addr
 
 HSTS_HEADER=max-age=15768000; includeSubDomains
 RP_HEADER=strict-origin
-SUBDIR=