diff --git a/nextcloud/docker-compose.yml b/nextcloud/docker-compose.yml index edee8a2..921fccd 100644 --- a/nextcloud/docker-compose.yml +++ b/nextcloud/docker-compose.yml @@ -1,7 +1,7 @@ # Nextcloud-Stack services: nextcloud: - image: nextcloud:31.0-fpm + image: nextcloud:31.0-fpm container_name: nextcloud depends_on: - nextcloud-redis @@ -29,7 +29,6 @@ services: networks: - nextcloud - traefik - - onlyoffice - database restart: unless-stopped @@ -53,7 +52,6 @@ services: networks: - nextcloud - traefik - - onlyoffice restart: unless-stopped nextcloud-redis: @@ -71,9 +69,6 @@ networks: database: external: true nextcloud: - name: nextcloud external: true traefik: external: true - onlyoffice: - external: true diff --git a/nextcloud/hooks/post-installation/install-only-office.sh b/nextcloud/hooks/post-installation/install-only-office.sh index 2dedab9..b00471f 100644 --- a/nextcloud/hooks/post-installation/install-only-office.sh +++ b/nextcloud/hooks/post-installation/install-only-office.sh @@ -1,7 +1,7 @@ #!/bin/bash # Print all commands and their arguments as they are executed. -set -x +set -e # Get the trusted domains from the Nextcloud config php /var/www/html/occ --no-warnings config:system:get trusted_domains >> trusted_domain.tmp diff --git a/nextcloud/reverse-proxy/nginx.conf b/nextcloud/reverse-proxy/nginx.conf index 2f41670..f23a318 100644 --- a/nextcloud/reverse-proxy/nginx.conf +++ b/nextcloud/reverse-proxy/nginx.conf @@ -1,5 +1,5 @@ user www-data; -worker_processes auto; +worker_processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; @@ -10,17 +10,17 @@ events { http { - upstream php-handler { + upstream backend { server nextcloud:9000; } + include /etc/nginx/mime.types; default_type application/octet-stream; - # Add custom MIME types + # Add custom MIME type for .mjs files types { - text/javascript mjs; - application/wasm wasm; + text/javascript mjs; } log_format main '$remote_addr - $remote_user [$time_local] "$request" ' @@ -30,17 +30,10 @@ http { access_log /var/log/nginx/access.log main; sendfile on; - tcp_nopush on; - tcp_nodelay on; + #tcp_nopush on; keepalive_timeout 65; - # Set the `immutable` cache control options only for assets with a cache busting `v` argument - map $arg_v $asset_immutable { - "" ""; - default ", immutable"; - } - map $http_host $this_host { "" $host; default $http_host; @@ -58,33 +51,24 @@ http { server { listen 80; - # The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect + # The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect server_tokens off; # Add headers to serve security related headers - add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header X-Robots-Tag "noindex, nofollow" always; - add_header X-Download-Options "noopen" always; - add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header Referrer-Policy "no-referrer" always; + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag "noindex, nofollow"; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options "SAMEORIGIN"; + add_header Referrer-Policy "no-referrer"; root /var/www/html; client_max_body_size 10G; # 0=unlimited - set max upload size fastcgi_buffers 64 4K; - # Enable gzip but do not remove ETag headers - gzip on; - gzip_vary on; - gzip_comp_level 4; - gzip_min_length 256; - gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; - gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; - - # The settings allows you to optimize the HTTP2 bandwidth - client_body_buffer_size 512k; + gzip off; index index.php; error_page 403 /core/templates/403.php; @@ -115,7 +99,6 @@ http { access_log off; } - # Rules borrowed from `.htaccess` to hide certain paths from clients location ~ ^/(build|tests|config|lib|3rdparty|templates|data)/ { deny all; } @@ -127,86 +110,69 @@ http { location / { rewrite ^/remote/(.*) /remote.php last; rewrite ^(/core/doc/[^\/]+/)$ $1/index.html; - try_files $uri $uri/ /index.php$request_uri; + try_files $uri $uri/ =404; } - location ~* ^/ds-vpath/ { - rewrite /ds-vpath/(.*) /$1 break; - proxy_pass http://onlyoffice-documentserver; - proxy_redirect off; + location ~* ^/ds-vpath/ { + rewrite /ds-vpath/(.*) /$1 break; + proxy_pass http://onlyoffice-documentserver; + proxy_redirect off; - client_max_body_size 100m; + client_max_body_size 100m; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Host $the_host/ds-vpath; - proxy_set_header X-Forwarded-Proto $the_scheme; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $the_host/ds-vpath; + proxy_set_header X-Forwarded-Proto https; } - # Ensure this block, which passes PHP files to the PHP process, is above the blocks - # which handle static assets (as seen below). If this block is not declared first, - # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` - # to the URI, resulting in a HTTP 500 error response. location ~ \.php(?:$|/) { - # Required for legacy support - rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri; - fastcgi_split_path_info ^(.+\.php)(/.+)$; - set $path_info $fastcgi_path_info; - - try_files $fastcgi_script_name =404; - include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $path_info; - # Set HTTPS parameter for Nextcloud - should be on when behind Traefik with SSL + fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS on; - # Forward the scheme from Traefik - fastcgi_param HTTP_X_FORWARDED_PROTO $the_scheme; - - fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice - fastcgi_param front_controller_active true; # Enable pretty urls - fastcgi_pass php-handler; + fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice + fastcgi_pass backend; fastcgi_intercept_errors on; - fastcgi_request_buffering off; - fastcgi_max_temp_file_size 0; } - # Serve static files - location ~* \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ { - try_files $uri /index.php$request_uri; - add_header Cache-Control "public, max-age=15778463$asset_immutable"; - # Include security headers - add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header X-Robots-Tag "noindex, nofollow" always; - add_header X-Download-Options "noopen" always; - add_header X-Permitted-Cross-Domain-Policies "none" always; - add_header Referrer-Policy "no-referrer" always; + # Adding the cache control header for js and css files + # Make sure it is BELOW the location ~ \.php(?:$|/) { block + location ~* \.(?:css|js)$ { + add_header Cache-Control "public, max-age=7200"; + # Add headers to serve security related headers + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + add_header X-Content-Type-Options nosniff; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag "noindex, nofollow"; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header Referrer-Policy "no-referrer"; + # Optional: Don't log access to assets access_log off; } - location ~* \.(?:otf|woff2?)$ { - try_files $uri /index.php$request_uri; - expires 7d; + # Optional: Don't log access to other assets + location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$ { access_log off; } + location ~ ^/(?:updater|ocs-provider)(?:$|/) { + try_files $uri/ =404; + index index.php; + } + # Add support for ocm-provider path handling location /ocm-provider { return 301 $scheme://$host/index.php/ocm-provider; } - # Rule borrowed from `.htaccess` - location /remote { - return 301 /remote.php$request_uri; - } } } diff --git a/override/onlyoffice.docker-compose.override.yml b/override/onlyoffice.docker-compose.override.yml index 0a567d7..7ce00f1 100644 --- a/override/onlyoffice.docker-compose.override.yml +++ b/override/onlyoffice.docker-compose.override.yml @@ -21,15 +21,14 @@ services: stdin_open: true stop_grace_period: 60s volumes: - - ./app/data:/var/www/onlyoffice/Data - - ./app/log:/var/log/onlyoffice - - ./app/cache:/var/lib/onlyoffice/documentserver/App_Data/cache/files - - ./app/files:/var/www/onlyoffice/documentserver-example/public/files - - ./app/fonts:/usr/share/fonts + - /var/www/onlyoffice/Data + - /var/log/onlyoffice + - /var/lib/onlyoffice/documentserver/App_Data/cache/files + - /var/www/onlyoffice/documentserver-example/public/files + - /usr/share/fonts networks: - database - nextcloud - - onlyoffice restart: unless-stopped onlyoffice-rabbitmq: @@ -39,12 +38,10 @@ services: expose: - '5672' networks: - - onlyoffice + - nextcloud networks: database: external: true nextcloud: - external: true - onlyoffice: - name: onlyoffice + name: nextcloud