From 2e6915fe20487a469cb234ed4fc64745f31fd59d Mon Sep 17 00:00:00 2001 From: Stefan Saibel Date: Sun, 3 Mar 2019 19:24:20 +0100 Subject: [PATCH] init repo --- docker-compose.yml | 68 ++++++++++++++++++++++ nginx.conf | 142 +++++++++++++++++++++++++++++++++++++++++++++ set_config.sh | 18 ++++++ 3 files changed, 228 insertions(+) create mode 100644 docker-compose.yml create mode 100644 nginx.conf create mode 100644 set_config.sh diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..5a336b0 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,68 @@ +version: "3" + +services: + nextcloud-app: # app-server + container_name: nextcloud-app + image: nextcloud:fpm + stdin_open: true + tty: true + restart: always + expose: + - "80" + - "9000" + networks: + - default + - saibelstefan-vm-01 + depends_on: + - nextcloud-onlyoffice + - nextcloud-db + volumes: + - /srv/data/nextcloud/nextcloud:/var/www/html + + nextcloud-onlyoffice: + container_name: nextcloud-onlyoffice + image: onlyoffice/documentserver:latest + stdin_open: true + tty: true + restart: always + networks: + - default + - saibelstefan-vm-01 + expose: + - "80" + - "443" + volumes: + - /srv/data/nextcloud/onlyoffice/data:/var/www/onlyoffice/Data + - /srv/data/nextcloud/onlyoffice/log:/var/log/onlyoffice + + nextcloud-nginx: + container_name: nextcloud-nginx + image: nginx + stdin_open: true + tty: true + restart: always + networks: + - default + - saibelstefan-vm-01 + depends_on: + - nextcloud-app + volumes: + - ./nginx.conf:/etc/nginx/nginx.conf + - /srv/data/nextcloud/nextcloud:/var/www/html + + nextcloud-db: + container_name: nextcloud_db + image: mariadb:latest + environment: + - MYSQL_DATABASE=nextcloud_db + - MYSQL_ROOT_PASSWORD=nextcloud_pw + volumes: + - /srv/data/nextcloud/database/:/var/lib/mysql + networks: + - default + - saibelstefan-vm-01 + +networks: + saibelstefan-vm-01: + external: true + diff --git a/nginx.conf b/nginx.conf new file mode 100644 index 0000000..d290042 --- /dev/null +++ b/nginx.conf @@ -0,0 +1,142 @@ +user www-data; +worker_processes 1; + +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + + upstream backend { + server nextcloud-app:9000; + } + + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + map $http_host $this_host { + "" $host; + default $http_host; + } + + map $http_x_forwarded_proto $the_scheme { + default $http_x_forwarded_proto; + "" $scheme; + } + + map $http_x_forwarded_host $the_host { + default $http_x_forwarded_host; + "" $this_host; + } + + server { + listen 80; + + # Add headers to serve security related headers + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag none; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + + root /var/www/html; + client_max_body_size 10G; # 0=unlimited - set max upload size + fastcgi_buffers 64 4K; + + gzip off; + + index index.php; + error_page 403 /core/templates/403.php; + error_page 404 /core/templates/404.php; + + rewrite ^/.well-known/carddav /remote.php/dav/ permanent; + rewrite ^/.well-known/caldav /remote.php/dav/ permanent; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location ~ ^/(build|tests|config|lib|3rdparty|templates|data)/ { + deny all; + } + + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } + + location / { + rewrite ^/remote/(.*) /remote.php last; + rewrite ^(/core/doc/[^\/]+/)$ $1/index.html; + try_files $uri $uri/ =404; + } + + location ~* ^/ds-vpath/ { + rewrite /ds-vpath/(.*) /$1 break; + proxy_pass http://nextcloud-onlyoffice; + proxy_redirect off; + + client_max_body_size 100m; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $the_host/ds-vpath; + proxy_set_header X-Forwarded-Proto $the_scheme; + } + + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param HTTPS off; + fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice + fastcgi_pass backend; + fastcgi_intercept_errors on; + } + + # Adding the cache control header for js and css files + # Make sure it is BELOW the location ~ \.php(?:$|/) { block + location ~* \.(?:css|js)$ { + add_header Cache-Control "public, max-age=7200"; + # Add headers to serve security related headers + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + add_header X-Content-Type-Options nosniff; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag none; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + # Optional: Don't log access to assets + access_log off; + } + + # Optional: Don't log access to other assets + location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$ { + access_log off; + } + + } +} diff --git a/set_config.sh b/set_config.sh new file mode 100644 index 0000000..33a44e4 --- /dev/null +++ b/set_config.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +set -x + +docker exec -u www-data nextcloud-app php occ --no-warnings config:system:get trusted_domains >> trusted_domain.tmp + +if ! grep -q "nextcloud-app" trusted_domain.tmp; then + TRUSTED_INDEX=$(cat trusted_domain.tmp | wc -l); + docker exec -u www-data nextcloud-app php occ --no-warnings config:system:set trusted_domains $TRUSTED_INDEX --value="nextcloud-nginx" +fi + +rm trusted_domain.tmp + +docker exec -u www-data nextcloud-app php occ --no-warnings app:install onlyoffice + +docker exec -u www-data nextcloud-app php occ --no-warnings config:system:set onlyoffice DocumentServerUrl --value="/ds-vpath/" +docker exec -u www-data nextcloud-app php occ --no-warnings config:system:set onlyoffice DocumentServerInternalUrl --value="http://nextcloud-onlyoffice/" +docker exec -u www-data nextcloud-app php occ --no-warnings config:system:set onlyoffice StorageUrl --value="http://nextcloud-nginx/"