diff --git a/.github/ISSUE_TEMPLATE/Bug_report.md b/.github/ISSUE_TEMPLATE/Bug_report.md index 691221d7..d3228dfa 100644 --- a/.github/ISSUE_TEMPLATE/Bug_report.md +++ b/.github/ISSUE_TEMPLATE/Bug_report.md @@ -30,4 +30,6 @@ labels: 0. Needs triage #### Docker run command or docker-compose file that you used -#### Other valuable info +#### Output of `sudo docker logs nextcloud-aio-mastercontainer` + +#### Other valuable info diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile index 179c0a76..dae14ea5 100644 --- a/Containers/mastercontainer/Dockerfile +++ b/Containers/mastercontainer/Dockerfile @@ -6,12 +6,15 @@ FROM docker:29.0.2-cli AS docker FROM caddy:2.10.2-alpine AS caddy # From https://github.com/docker-library/php/blob/master/8.4/alpine3.22/fpm/Dockerfile -FROM php:8.4.14-fpm-alpine3.22 +FROM php:8.4.15-fpm-alpine3.22 EXPOSE 80 EXPOSE 8080 EXPOSE 8443 +# Overwrite home variable for subservices +ENV HOME=/var/www + COPY --from=caddy /usr/bin/caddy /usr/bin/caddy COPY --from=docker /usr/local/bin/docker /usr/local/bin/docker @@ -74,8 +77,8 @@ RUN set -ex; \ rm -r ./php/tests; \ chown www-data:www-data -R /var/www/docker-aio; \ cd php; \ - sudo -u www-data composer install --no-dev; \ - sudo -u www-data composer clear-cache; \ + sudo -E -u www-data composer install --no-dev; \ + sudo -E -u www-data composer clear-cache; \ cd ..; \ rm -f /usr/local/bin/composer; \ chmod -R 770 /var/www/docker-aio; \ diff --git a/Containers/mastercontainer/cron.sh b/Containers/mastercontainer/cron.sh index 5829d8da..67af80e7 100644 --- a/Containers/mastercontainer/cron.sh +++ b/Containers/mastercontainer/cron.sh @@ -45,29 +45,29 @@ while true; do # Check for updates and send notification if yes on saturdays if [ "$(date +%u)" = 6 ]; then - sudo -u www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateNotification.php fi # Check if AIO is outdated - sudo -u www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/OutdatedNotification.php # Remove sessions older than 24h find "/mnt/docker-aio-config/session/" -mindepth 1 -mmin +1440 -delete # Remove nextcloud-aio-domaincheck container - if sudo -u www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then - sudo -u www-data docker container remove nextcloud-aio-domaincheck + if sudo -E -u www-data docker ps --format "{{.Names}}" --filter "status=exited" | grep -q "^nextcloud-aio-domaincheck$"; then + sudo -E -u www-data docker container remove nextcloud-aio-domaincheck fi # Remove dangling images - sudo -u www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force + sudo -E -u www-data docker image prune --filter "label=org.label-schema.vendor=Nextcloud" --force # Check for available free space - sudo -u www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckFreeDiskSpace.php # Remove mastercontainer from default bridge network - if sudo -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then - sudo -u www-data docker network disconnect bridge nextcloud-aio-mastercontainer + if sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer --format "{{.NetworkSettings.Networks}}" | grep -q "bridge"; then + sudo -E -u www-data docker network disconnect bridge nextcloud-aio-mastercontainer fi # Wait 60s so that the whole loop will not be executed again diff --git a/Containers/mastercontainer/daily-backup.sh b/Containers/mastercontainer/daily-backup.sh index 5c97c0ca..edc5bddd 100644 --- a/Containers/mastercontainer/daily-backup.sh +++ b/Containers/mastercontainer/daily-backup.sh @@ -20,7 +20,7 @@ fi if [ "$LOCK_FILE_PRESENT" = 0 ] || ! [ -f "/mnt/docker-aio-config/data/daily_backup_running" ]; then find "/mnt/docker-aio-config/session/" -mindepth 1 -delete fi -sudo -u www-data touch "/mnt/docker-aio-config/data/daily_backup_running" +sudo -E -u www-data touch "/mnt/docker-aio-config/data/daily_backup_running" # Check if apache is running/stopped, watchtower is stopped and backupcontainer is stopped APACHE_PORT="$(docker inspect nextcloud-aio-apache --format "{{.Config.Env}}" | grep -o 'APACHE_PORT=[0-9]\+' | grep -o '[0-9]\+' | head -1)" @@ -50,7 +50,7 @@ done if [ "$AUTOMATIC_UPDATES" = 1 ]; then echo "Starting mastercontainer update..." echo "(The script might get exited due to that. In order to update all the other containers correctly, you need to run this script with the same settings a second time.)" - sudo -u www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/UpdateMastercontainer.php fi # Wait for watchtower to stop @@ -67,20 +67,20 @@ fi # Update container images to reduce downtime later on if [ "$AUTOMATIC_UPDATES" = 1 ]; then echo "Updating container images..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/PullContainerImages.php fi # Stop containers if required # shellcheck disable=SC2235 if [ "$CHECK_BACKUP" != 1 ] && ([ "$DAILY_BACKUP" != 1 ] || [ "$STOP_CONTAINERS" = 1 ]); then echo "Stopping containers..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StopContainers.php fi # Execute the backup itself and some related tasks (also stops the containers) if [ "$DAILY_BACKUP" = 1 ]; then echo "Creating daily backup..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CreateBackup.php if ! docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-borgbackup$"; then echo "Something seems to be wrong: the borg container should be started at this step." fi @@ -93,17 +93,17 @@ fi # Execute backup check if [ "$CHECK_BACKUP" = 1 ]; then echo "Starting backup check..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/CheckBackup.php fi # Start and/or update containers if [ "$AUTOMATIC_UPDATES" = 1 ]; then echo "Starting and updating containers..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartAndUpdateContainers.php else if [ "$START_CONTAINERS" = 1 ]; then echo "Starting containers without updating them..." - sudo -u www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php + sudo -E -u www-data php /var/www/docker-aio/php/src/Cron/StartContainers.php fi fi diff --git a/Containers/mastercontainer/start.sh b/Containers/mastercontainer/start.sh index 243287ea..77c4675e 100644 --- a/Containers/mastercontainer/start.sh +++ b/Containers/mastercontainer/start.sh @@ -51,7 +51,7 @@ elif mountpoint -q /var/www/docker-aio/php/containers.json; then echo "If you need to customize things, feel free to use https://github.com/nextcloud/all-in-one/tree/main/manual-install" echo "See https://github.com/nextcloud/all-in-one/blob/main/manual-install/latest.yml" exit 1 -elif ! sudo -u www-data test -r /var/run/docker.sock; then +elif ! sudo -E -u www-data test -r /var/run/docker.sock; then echo "Trying to fix docker.sock permissions internally..." DOCKER_GROUP=$(stat -c '%G' /var/run/docker.sock) DOCKER_GROUP_ID=$(stat -c '%g' /var/run/docker.sock) @@ -69,14 +69,14 @@ elif ! sudo -u www-data test -r /var/run/docker.sock; then groupadd -g "$DOCKER_GROUP_ID" docker usermod -aG docker www-data fi - if ! sudo -u www-data test -r /var/run/docker.sock; then + if ! sudo -E -u www-data test -r /var/run/docker.sock; then print_red "Docker socket is not readable by the www-data user. Cannot continue." exit 1 fi fi # Check if api version is supported -if ! sudo -u www-data docker info &>/dev/null; then +if ! sudo -E -u www-data docker info &>/dev/null; then print_red "Cannot connect to the docker socket. Cannot proceed." echo "Did you maybe remove group read permissions for the docker socket? AIO needs them in order to access the docker socket." echo "If SELinux is enabled on your host, see https://github.com/nextcloud/all-in-one#are-there-known-problems-when-selinux-is-enabled" @@ -100,7 +100,7 @@ It is set to '$DOCKER_API_VERSION'." else # shellcheck disable=SC2001 API_VERSION_NUMB="$(echo "$API_VERSION" | sed 's/\.//')" - LOCAL_API_VERSION_NUMB="$(sudo -u www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')" + LOCAL_API_VERSION_NUMB="$(sudo -E -u www-data docker version | grep -i "api version" | grep -oP '[0-9]+.[0-9]+' | head -1 | sed 's/\.//')" if [ -n "$LOCAL_API_VERSION_NUMB" ] && [ -n "$API_VERSION_NUMB" ]; then if ! [ "$LOCAL_API_VERSION_NUMB" -ge "$API_VERSION_NUMB" ]; then print_red "Docker API v$API_VERSION is not supported by your docker engine. Cannot proceed. Please upgrade your docker engine if you want to run Nextcloud AIO!" @@ -116,7 +116,7 @@ else fi # Check Storage drivers -STORAGE_DRIVER="$(sudo -u www-data docker info | grep "Storage Driver")" +STORAGE_DRIVER="$(sudo -E -u www-data docker info | grep "Storage Driver")" # Check if vfs is used: https://github.com/nextcloud/all-in-one/discussions/1467 if echo "$STORAGE_DRIVER" | grep -q vfs; then echo "$STORAGE_DRIVER" @@ -127,23 +127,23 @@ elif echo "$STORAGE_DRIVER" | grep -q fuse-overlayfs; then fi # Check if snap install -if sudo -u www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then +if sudo -E -u www-data docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"; then print_red "Warning: It looks like your installation uses docker installed via snap." print_red "This comes with some limitations and is disrecommended by the docker maintainers." print_red "See for example https://github.com/nextcloud/all-in-one/discussions/4890#discussioncomment-10386752" fi # Check if startup command was executed correctly -if ! sudo -u www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then +if ! sudo -E -u www-data docker ps --format "{{.Names}}" | grep -q "^nextcloud-aio-mastercontainer$"; then print_red "It seems like you did not give the mastercontainer the correct name? (The 'nextcloud-aio-mastercontainer' container was not found.) Using a different name is not supported since mastercontainer updates will not work in that case! If you are on docker swarm and try to run AIO, see https://github.com/nextcloud/all-in-one#can-i-run-this-with-docker-swarm" exit 1 -elif ! sudo -u www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then +elif ! sudo -E -u www-data docker volume ls --format "{{.Name}}" | grep -q "^nextcloud_aio_mastercontainer$"; then print_red "It seems like you did not give the mastercontainer volume the correct name? (The 'nextcloud_aio_mastercontainer' volume was not found.) Using a different name is not supported since the built-in backup solution will not work in that case!" exit 1 -elif ! sudo -u www-data docker inspect nextcloud-aio-mastercontainer | grep -q "nextcloud_aio_mastercontainer"; then +elif ! sudo -E -u www-data docker inspect nextcloud-aio-mastercontainer | grep -q "nextcloud_aio_mastercontainer"; then print_red "It seems like you did not attach the 'nextcloud_aio_mastercontainer' volume to the mastercontainer? This is not supported since the built-in backup solution will not work in that case!" exit 1 diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile index 69c45670..034ebba2 100644 --- a/Containers/nextcloud/Dockerfile +++ b/Containers/nextcloud/Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:latest -FROM php:8.3.27-fpm-alpine3.22 +FROM php:8.3.28-fpm-alpine3.22 ENV PHP_MEMORY_LIMIT=512M ENV PHP_UPLOAD_LIMIT=16G diff --git a/Containers/nextcloud/config/s3.config.php b/Containers/nextcloud/config/s3.config.php index 04e606be..66e1476d 100644 --- a/Containers/nextcloud/config/s3.config.php +++ b/Containers/nextcloud/config/s3.config.php @@ -22,7 +22,8 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) { // required for some non Amazon S3 implementations 'use_path_style' => strtolower($use_path) === 'true', // required for older protocol versions - 'legacy_auth' => strtolower($use_legacyauth) === 'true' + 'legacy_auth' => strtolower($use_legacyauth) === 'true', + 'use_nextcloud_bundle' => 1, ) ) ); diff --git a/Containers/nextcloud/start.sh b/Containers/nextcloud/start.sh index 37aa4d98..14cb35d1 100644 --- a/Containers/nextcloud/start.sh +++ b/Containers/nextcloud/start.sh @@ -8,7 +8,7 @@ fi # Only start container if database is accessible # POSTGRES_HOST must be set in the containers env vars and POSTGRES_PORT has a default above # shellcheck disable=SC2153 -while ! sudo -u www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do +while ! sudo -E -u www-data nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do echo "Waiting for database to start..." sleep 5 done @@ -25,7 +25,7 @@ fi # Fix false database connection on old instances if [ -f "/var/www/html/config/config.php" ]; then sleep 2 - while ! sudo -u www-data psql -d "postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB" -c "select now()"; do + while ! sudo -E -u www-data psql -d "postgresql://$POSTGRES_USER:$POSTGRES_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB" -c "select now()"; do echo "Waiting for the database to start..." sleep 5 done @@ -56,12 +56,12 @@ fi set +x # Check datadir permissions -sudo -u www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null +sudo -E -u www-data touch "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" &>/dev/null if ! [ -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" ]; then chown -R www-data:root "$NEXTCLOUD_DATA_DIR" chmod 750 -R "$NEXTCLOUD_DATA_DIR" fi -sudo -u www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" +sudo -E -u www-data rm -f "$NEXTCLOUD_DATA_DIR/this-is-a-test-file" # Install additional dependencies if [ -n "$ADDITIONAL_APKS" ]; then diff --git a/community-containers/caddy/caddy.json b/community-containers/caddy/caddy.json index e4669e09..b85d74a0 100644 --- a/community-containers/caddy/caddy.json +++ b/community-containers/caddy/caddy.json @@ -44,7 +44,7 @@ "aio_variables": [ "apache_ip_binding=@INTERNAL", "apache_port=11000", - "turn_domain=turn.%NC_DOMAIN%", + "turn_domain=%NC_DOMAIN%", "talk_port=443" ], "nextcloud_exec_commands": [ diff --git a/community-containers/caddy/readme.md b/community-containers/caddy/readme.md index ba13015e..99bf133e 100644 --- a/community-containers/caddy/readme.md +++ b/community-containers/caddy/readme.md @@ -4,7 +4,7 @@ This container bundles caddy and auto-configures it for you. It also covers [vau ### Notes - This container is incompatible with the [npmplus](https://github.com/nextcloud/all-in-one/tree/main/community-containers/npmplus) community container. So make sure that you do not enable both at the same time! - Make sure that no other service is using port 443 on your host as otherwise the containers will fail to start. You can check this with `sudo netstat -tulpn | grep 443` before installing AIO. -- Starting with AIO v12, the Talk port that was usually exposed on port 3478 is now set to port 443 udp and tcp and reachable via `turn.your-nc-domain.com`. So instead of opening port 3478, you need to configure the mentioned subdomain by using a cname record. For the changes to become activated, you need to go to `https://your-nc-domain.com/settings/admin/talk` and delete all turn and stun servers. Then restart the containers and the new config should become active. +- Starting with AIO v12, the Talk port that was usually exposed on port 3478 is now set to port 443 udp and tcp and reachable via `your-nc-domain.com`. For the changes to become activated, you need to go to `https://your-nc-domain.com/settings/admin/talk` and delete all turn and stun servers. Then restart the containers and the new config should become active. - Starting with AIO v12, you can also limit vaultwarden, stalwart and lldap to certain ip-addresses. You can do so by creating a `allowed-IPs-vaultwarden.txt`, `allowed-IPs-stalwart.txt`, or `allowed-IPs-lldap.txt` file in the `nextcloud-aio-caddy` directory of your admin user and adding the ip-addresses in these files. - If you want to use this with [vaultwarden](https://github.com/nextcloud/all-in-one/tree/main/community-containers/vaultwarden), make sure that you point `bw.your-nc-domain.com` to your server using a cname record so that caddy can get a certificate automatically for vaultwarden. - If you want to use this with [stalwart](https://github.com/nextcloud/all-in-one/tree/main/community-containers/stalwart), make sure that you point `mail.your-nc-domain.com` to your server using an A, AAAA or CNAME record so that caddy can get a certificate automatically for stalwart. diff --git a/manual-install/latest.yml b/manual-install/latest.yml index 83bc1ef1..6599cac9 100644 --- a/manual-install/latest.yml +++ b/manual-install/latest.yml @@ -160,7 +160,6 @@ services: - TALK_PORT - IMAGINARY_ENABLED - IMAGINARY_HOST=nextcloud-aio-imaginary - - CLAMAV_MAX_SIZE=${APACHE_MAX_SIZE} - PHP_UPLOAD_LIMIT=${NEXTCLOUD_UPLOAD_LIMIT} - PHP_MEMORY_LIMIT=${NEXTCLOUD_MEMORY_LIMIT} - FULLTEXTSEARCH_ENABLED @@ -256,7 +255,7 @@ services: - "9980" environment: - aliasgroup1=https://${NC_DOMAIN}:443,http://nextcloud-aio-apache:23973 - - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.level=warning --o:logging.level_startup=warning --o:home_mode.enable=true --o:remote_font_config.url=https://${NC_DOMAIN}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+ + - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:mount_jail_tree=false --o:logging.disable_server_audit=true --o:logging.level=warning --o:logging.level_startup=warning --o:welcome.enable=false --o:remote_font_config.url=https://${NC_DOMAIN}/apps/richdocuments/settings/fonts.json --o:net.post_allow.host[0]=.+ - dictionaries=${COLLABORA_DICTIONARIES} - TZ=${TIMEZONE} - server_name=${NC_DOMAIN} @@ -270,6 +269,9 @@ services: - SYS_CHROOT - FOWNER - CHOWN + - MAC_OVERRIDE + - BLOCK_SUSPEND + - AUDIT_READ cap_drop: - NET_RAW diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php index 463b4a72..b63fef32 100644 --- a/php/src/Docker/DockerActionManager.php +++ b/php/src/Docker/DockerActionManager.php @@ -849,6 +849,7 @@ readonly class DockerActionManager { [ 'json' => [ 'Name' => $network, + 'CheckDuplicate' => true, 'Driver' => 'bridge', 'Internal' => false, ] diff --git a/php/templates/containers.twig b/php/templates/containers.twig index 79bff6a0..fc2ae585 100644 --- a/php/templates/containers.twig +++ b/php/templates/containers.twig @@ -17,7 +17,7 @@
-

Nextcloud AIO v12.1.0

+

Nextcloud AIO v12.1.2

{# Add 2nd tab warning #} diff --git a/readme.md b/readme.md index 0aa54476..0ae3d618 100644 --- a/readme.md +++ b/readme.md @@ -1093,7 +1093,7 @@ You can do so by running the `/daily-backup.sh` script that is stored in the mas - `AUTOMATIC_UPDATES` if set to `1`, it will automatically stop the containers, update them and start them including the mastercontainer. If the mastercontainer gets updated, this script's execution will stop as soon as the mastercontainer gets stopped. You can then wait until it is started again and run the script with this flag again in order to update all containers correctly afterwards. - `DAILY_BACKUP` if set to `1`, it will automatically stop the containers and create a backup. If you want to start them again afterwards, you may have a look at the `START_CONTAINERS` option. - `STOP_CONTAINERS` if set to `1`, it will automatically stop the containers at the start of the script. Implied by `DAILY_BACKUP=1`. -- `START_CONTAINERS` if set to `1`, it will automatically start the containers at the end of the script, without updating them. Implied by `DAILY_BACKUP=1`. +- `START_CONTAINERS` if set to `1`, it will automatically start the containers at the end of the script, without updating them. Implied by `AUTOMATIC_UPDATES=1`. - `CHECK_BACKUP` if set to `1`, it will start the integrity check of all borg backups made by AIO. Note that the backup check is non blocking so containers can be kept running while the check lasts. That means you can't pass `DAILY_BACKUP=1` at the same time. The output of the check can be found in the logs of the container `nextcloud-aio-borgbackup`. One example to do a backup would be `sudo docker exec -it --env DAILY_BACKUP=1 nextcloud-aio-mastercontainer /daily-backup.sh`, which you can run via a cronjob or put it in a script.