NextCloud¶
NextCloud (a fork of OwnCloud, led by original developer Frank Karlitschek) is a suite of client-server software for creating and using file hosting services. It is functionally similar to Dropbox, although Nextcloud is free and open-source, allowing anyone to install and operate it on a private server. - https://en.wikipedia.org/wiki/Nextcloud
This recipe is based on the official NextCloud docker image, but includes seprate containers ofor the database (MariaDB), Redis (for transactional locking), Apache Solr (for full-text searching), automated database backup, (you do backup the stuff you care about, right?) and a separate cron container for running NextCloud's 15-min crons.
Ingredients¶
- Docker swarm cluster with persistent shared storage
- Traefik configured per design
- DNS entry pointing your NextCloud url (nextcloud.example.com) to your keepalived IP
Preparation¶
Setup data locations¶
We'll need several directories for static data to bind-mount into our container, so create them in /var/data/nextcloud (so that they can be backed up)
1 2 3 | mkdir /var/data/nextcloud cd /var/data/nextcloud mkdir -p {html,apps,config,data,database-dump} |
Now make more directories for runtime data (so that they can be not backed-up):
1 2 3 | mkdir /var/data/runtime/nextcloud cd /var/data/runtime/nextcloud mkdir -p {db,redis} |
Prepare environment¶
Create nextcloud.env, and populate with the following variables
1 2 3 4 5 6 7 8 9 | NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=FVuojphozxMVyaYCUWomiP9b MYSQL_HOST=db # For mysql MYSQL_ROOT_PASSWORD=<set to something secure> MYSQL_DATABASE=nextcloud MYSQL_USER=nextcloud MYSQL_PASSWORD=set to something secure> |
Now create a separate nextcloud-db-backup.env file, to capture the environment variables necessary to perform the backup. (If the same variables are shared with the mariadb container, they cause issues with database access)
1 2 3 4 5 | # For database backup (keep 7 days daily backups) MYSQL_PWD=<set to something secure, same as MYSQL_ROOT_PASSWORD above> MYSQL_USER=root BACKUP_NUM_KEEP=7 BACKUP_FREQUENCY=1d |
Setup Docker Swarm¶
Create a docker swarm config file in docker-compose syntax (v3), something like this:
Tip
I share (with my patreon patrons) a private "premix" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a git pull
and a docker stack deploy
👍
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 | version: "3.0" services: nextcloud: image: nextcloud env_file: /var/data/config/nextcloud/nextcloud.env networks: - internal - traefik_public deploy: labels: - traefik.frontend.rule=Host:nextcloud.example.com - traefik.docker.network=traefik_public - traefik.port=80 volumes: - /var/data/nextcloud/html:/var/www/html - /var/data/nextcloud/apps:/var/www/html/custom_apps - /var/data/nextcloud/config:/var/www/html/config - /var/data/nextcloud/data:/var/www/html/data db: image: mariadb:10 env_file: /var/data/config/nextcloud/nextcloud.env networks: - internal volumes: - /var/data/runtime/nextcloud/db:/var/lib/mysql db-backup: image: mariadb:10 env_file: /var/data/config/nextcloud/nextcloud.env volumes: - /var/data/nextcloud/database-dump:/dump - /etc/localtime:/etc/localtime:ro entrypoint: | bash -c 'bash -s <<EOF trap "break;exit" SIGHUP SIGINT SIGTERM sleep 2m while /bin/true; do mysqldump -h db --all-databases | gzip -c > /dump/dump_\`date +%d-%m-%Y"_"%H_%M_%S\`.sql.gz (ls -t /dump/dump*.sql.gz|head -n $$BACKUP_NUM_KEEP;ls /dump/dump*.sql.gz)|sort|uniq -u|xargs rm -- {} sleep $$BACKUP_FREQUENCY done EOF' networks: - internal redis: image: redis:alpine networks: - internal volumes: - /var/data/runtime/nextcloud/redis:/data cron: image: nextcloud volumes: - /var/data/nextcloud/:/var/www/html user: www-data networks: - internal entrypoint: | bash -c 'bash -s <<EOF trap "break;exit" SIGHUP SIGINT SIGTERM while [ ! -f /var/www/html/config/config.php ]; do sleep 1 done while true; do php -f /var/www/html/cron.php sleep 15m done EOF' networks: traefik_public: external: true internal: driver: overlay ipam: config: - subnet: 172.16.12.0/24 |
Note
Setup unique static subnets for every stack you deploy. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See my list here.
Serving¶
Launch NextCloud stack¶
Launch the NextCloud stack by running docker stack deploy nextcloud -c <path -to-docker-compose.yml>
Log into your new instance at https://YOUR-FQDN, with user "admin" and the password you specified in nextcloud.env.
Enable redis¶
To make NextCloud a little snappier, edit /var/data/nextcloud/config/config.php
(now that it's been created on the first container launch), and add the following:
1 2 3 4 | 'redis' => array( 'host' => 'redis', 'port' => 6379, ), |
Use service discovery¶
Want to use Calendar/Contacts on your iOS device? Want to avoid dictating long, rambling URL strings to your users, like https://nextcloud.batcave.com/remote.php/dav/principals/users/USERNAME/
?
Huzzah! NextCloud supports service discovery for CalDAV/CardDAV, allowing you to simply tell your device the primary URL of your server (nextcloud.batcave.org, for example), and have the device figure out the correct WebDAV path to use.
We (and anyone else using the NextCloud Docker image) are using an SSL-terminating reverse proxy (Traefik) in front of our NextCloud container. In fact, it's not possible to setup SSL within the NextCloud container.
When using a reverse proxy, your device requests a URL from your proxy (https://nextcloud.batcave.com/.well-known/caldav), and the reverse proxy then passes that request unencrypted to the internal URL of the NextCloud instance (i.e., http://172.16.12.123/.well-known/caldav)
The Apache webserver on the NextCloud container (knowing it was spoken to via HTTP), responds with a 301 redirect to http://nextcloud.batcave.com/remote.php/dav/. See the problem? You requested an HTTPS (encrypted) url, and in return, you received a redirect to an HTTP (unencrypted) URL. Any sensible client (iOS included) will refuse such schenanigans.
To correct this, we need to tell NextCloud to always redirect the .well-known URLs to an HTTPS location. This can only be done after deploying NextCloud, since it's only on first launch of the container that the .htaccess file is created in the first place.
To make NextCloud service discovery work with Traefik reverse proxy, edit /var/data/nextcloud/html/.htaccess
, and change this:
1 2 | RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L] RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L] |
To this:
1 2 | RewriteRule ^\.well-known/carddav https://%{SERVER_NAME}/remote.php/dav/ [R=301,L] RewriteRule ^\.well-known/caldav https://%{SERVER_NAME}/remote.php/dav/ [R=301,L] |
Then restart your container with docker service update nextcloud_nextcloud --force
to restart apache.
Your can test for success by running curl -i https://nextcloud.batcave.org/.well-known/carddav
. You should get a 301 redirect to your equivalent of https://nextcloud.batcave.org/remote.php/dav/, as below:
1 2 3 4 5 | [davidy:~] % curl -i https://nextcloud.batcave.org/.well-known/carddav HTTP/2 301 content-type: text/html; charset=iso-8859-1 date: Wed, 12 Dec 2018 08:30:11 GMT location: https://nextcloud.batcave.org/remote.php/dav/ |
Note that this .htaccess can be overwritten by NextCloud, and you may have to reapply the change in future. I've created an issue requesting a permanent fix.
Chef's Notes 📓¶
- Since many of my other recipes use PostgreSQL, I'd have preferred to use Postgres over MariaDB, but MariaDB seems to be the preferred database type.
- I'm not the first user to stumble across the service discovery bug with reverse proxies.
Tip your waiter (support me) 👏¶
Did you receive excellent service? Want to make your waiter happy? (..and support development of current and future recipes!) See the support page for (free or paid) ways to say thank you! 👏
Flirt with waiter (subscribe) 💌¶
Want to know now when this recipe gets updated, or when future recipes are added? Subscribe to the RSS feed, or leave your email address below, and we'll keep you updated. (double-opt-in, no monkey business, no spam either - check the archive for proof!)