eightball/all-in-one
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2025-12-19 22:16:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

nextcloud container - allowed clients - only limit access in known use cases

Browse source 
Signed-off-by: Simon L <szaimen@e.mail.de>
This commit is contained in:
Simon L 2023-10-20 17:02:20 +02:00
parent 461ccb0b3e
commit c5135e3a4e
3 changed files with 19 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

23
Containers/nextcloud/start.sh
View file

@ -135,15 +135,20 @@ while [ -z "$(dig nextcloud-aio-apache A +short)" ]; do
echo "Waiting for nextcloud-aio-apache to start..." echo "Waiting for nextcloud-aio-apache to start..."
sleep 5 sleep 5
done done
IPv4_ADDRESS_APACHE="$(dig nextcloud-aio-apache A +short | grep '^[0-9.]\+$' | sort | head -n1)"
IPv6_ADDRESS_APACHE="$(dig nextcloud-aio-apache AAAA +short | grep '^[0-9a-f:]\+$' | sort | head -n1)"
IPv4_ADDRESS_MASTERCONTAINER="$(dig nextcloud-aio-mastercontainer A +short | grep '^[0-9.]\+$' | sort | head -n1)"
IPv6_ADDRESS_MASTERCONTAINER="$(dig nextcloud-aio-mastercontainer AAAA +short | grep '^[0-9a-f:]\+$' | sort | head -n1)"
sed -i "s|^;listen.allowed_clients|listen.allowed_clients|" /usr/local/etc/php-fpm.d/www.conf set -x
sed -i "s|listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1,$IPv4_ADDRESS_APACHE,$IPv6_ADDRESS_APACHE,$IPv4_ADDRESS_MASTERCONTAINER,$IPv6_ADDRESS_MASTERCONTAINER|" /usr/local/etc/php-fpm.d/www.conf if [ "$APACHE_PORT" = 443 ] || [ "$APACHE_IP_BINDING" = "127.0.0.1" ] || [ "$APACHE_IP_BINDING" = "::1" ]; then
sed -i "/^listen.allowed_clients/s/,,/,/g" /usr/local/etc/php-fpm.d/www.conf IPv4_ADDRESS_APACHE="$(dig nextcloud-aio-apache A +short | grep '^[0-9.]\+$' | sort | head -n1)"
sed -i "/^listen.allowed_clients/s/,$//" /usr/local/etc/php-fpm.d/www.conf IPv6_ADDRESS_APACHE="$(dig nextcloud-aio-apache AAAA +short | grep '^[0-9a-f:]\+$' | sort | head -n1)"
grep listen.allowed_clients /usr/local/etc/php-fpm.d/www.conf IPv4_ADDRESS_MASTERCONTAINER="$(dig nextcloud-aio-mastercontainer A +short | grep '^[0-9.]\+$' | sort | head -n1)"
IPv6_ADDRESS_MASTERCONTAINER="$(dig nextcloud-aio-mastercontainer AAAA +short | grep '^[0-9a-f:]\+$' | sort | head -n1)"
sed -i "s|^;listen.allowed_clients|listen.allowed_clients|" /usr/local/etc/php-fpm.d/www.conf
sed -i "s|listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1,$IPv4_ADDRESS_APACHE,$IPv6_ADDRESS_APACHE,$IPv4_ADDRESS_MASTERCONTAINER,$IPv6_ADDRESS_MASTERCONTAINER|" /usr/local/etc/php-fpm.d/www.conf
sed -i "/^listen.allowed_clients/s/,,/,/g" /usr/local/etc/php-fpm.d/www.conf
sed -i "/^listen.allowed_clients/s/,$//" /usr/local/etc/php-fpm.d/www.conf
grep listen.allowed_clients /usr/local/etc/php-fpm.d/www.conf
fi
set +x
exec "$@" exec "$@"

4
php/containers.json
View file

@ -210,7 +210,9 @@
"TALK_RECORDING_HOST=nextcloud-aio-talk-recording", "TALK_RECORDING_HOST=nextcloud-aio-talk-recording",
"FULLTEXTSEARCH_PASSWORD=%FULLTEXTSEARCH_PASSWORD%", "FULLTEXTSEARCH_PASSWORD=%FULLTEXTSEARCH_PASSWORD%",
"DOCKER_SOCKET_PROXY_ENABLED=%DOCKER_SOCKET_PROXY_ENABLED%", "DOCKER_SOCKET_PROXY_ENABLED=%DOCKER_SOCKET_PROXY_ENABLED%",
"REMOVE_DISABLED_APPS=%REMOVE_DISABLED_APPS%" "REMOVE_DISABLED_APPS=%REMOVE_DISABLED_APPS%",
"APACHE_PORT=%APACHE_PORT%",
"APACHE_IP_BINDING=%APACHE_IP_BINDING%"
], ],
"restart": "unless-stopped", "restart": "unless-stopped",
"devices": [ "devices": [

2
php/src/Docker/DockerActionManager.php
View file

@ -289,6 +289,8 @@ class DockerActionManager
$replacements[1] = $this->configurationManager->GetSelectedRestoreTime(); $replacements[1] = $this->configurationManager->GetSelectedRestoreTime();
} elseif ($out[1] === 'APACHE_PORT') { } elseif ($out[1] === 'APACHE_PORT') {
$replacements[1] = $this->configurationManager->GetApachePort(); $replacements[1] = $this->configurationManager->GetApachePort();
} elseif ($out[1] === 'APACHE_IP_BINDING') {
$replacements[1] = $this->configurationManager->GetApacheIPBinding();
} elseif ($out[1] === 'TALK_PORT') { } elseif ($out[1] === 'TALK_PORT') {
$replacements[1] = $this->configurationManager->GetTalkPort(); $replacements[1] = $this->configurationManager->GetTalkPort();
} elseif ($out[1] === 'NEXTCLOUD_MOUNT') { } elseif ($out[1] === 'NEXTCLOUD_MOUNT') {