eightball/all-in-one
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2025-12-19 22:16:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Let the Nextcloud-Container trust custom CAs (e.g. for using LDAPS) 2

Browse source 
Signed-off-by: Lorenzo Marroccoli <lollo0296@gmail.com>
Signed-off-by: szaimen <szaimen@e.mail.de>
Co-Authored-By: Simon L. <szaimen@e.mail.de>
This commit is contained in:
Lorenzo Marroccoli 2022-08-31 22:50:19 +02:00 • committed by szaimen
parent bfcbc41141
commit 935d4aab11
10 changed files with 48 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
readme.md
View file

@ -490,3 +490,12 @@ What are the requirements?
3. The feature that gets added into Nextcloud by adding the container must be maintained by the Nextcloud GmbH.
4. It must be possible to run the container without big quirks inside docker containers. Big quirks means e.g. needing to change the capabilities or security options.
5. The container should not mount directories from the host into the container: only docker volumes should be used.
### How to trust user-defiend Certification Authorities (CA)?
For some applications it might be necessary to enstablish a secured connection to a host / server which is using a certificated issued by a Certification Authority that is not trusted out of the box. An example could be configuring LDAPS against the Domain Controller (ActiveDirectory) of an organization
You can make the Nextcloud container trust any Certification Authority by providing the environmental variable `TRUSTED_CACERTS_DIR` when starting the AIO-mastercontainer. The value of the variables should be set to the absolute path to a directory on the host, which contains one or more Certification Authority's certificate. You should use X.509 certificates, Base64 encoded. (Other formats may work but have not been tested!) All the certificates in the directory will be trusted.
When using `docker run`, the environmental variable can be set with `-e TRUSTED_CACERTS_DIR=/path/to/my/cacerts`.
In order for the value to be valid, the path should start with `/` and not end with '/' and point to an existing **directory**. Pointing the variable directly to a certificate **file** will not work and may also break things.