Joakim
89b43180fc
Major architectural changes: - Replace config file templating with unified OCC command script - Remove custom_apps mount overlay that caused Caddy serving issues - Implement script-based configuration for idempotency and clarity Configuration improvements: - Add email/SMTP support with master switch (nextcloud_email_enabled) - Add OIDC/SSO integration with Authentik support - Add apps installation (user_oidc, calendar, contacts) - Enable group provisioning and quota management from OIDC - Set nextcloud_oidc_unique_uid to false per Authentik docs Files removed: - nextcloud.config.php.j2 (replaced by OCC commands) - redis.config.php.j2 (replaced by OCC commands) - optimization.yml (merged into configure.yml) Files added: - configure-nextcloud.sh.j2 (single source of truth for config) - configure.yml (deploys and runs configuration script) Documentation: - Add comprehensive OIDC setup guide with Authentik integration - Document custom scope mapping and group provisioning - Add email configuration examples for common providers - Update vault variables documentation - Explain two-phase deployment approach Host configuration: - Change admin user from 'admin' to 'joakim' - Add admin email configuration
39 lines
1.3 KiB
Plaintext
39 lines
1.3 KiB
Plaintext
[Unit]
|
|
Description=Nextcloud Cloud Storage Container (FPM)
|
|
After=network-online.target postgresql.service valkey.service
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=nextcloud
|
|
Image={{ nextcloud_image }}:{{ nextcloud_version }}
|
|
EnvironmentFile={{ nextcloud_home }}/.env
|
|
|
|
# Note: Container runs as root initially for entrypoint scripts,
|
|
# then switches to www-data (UID 33) for PHP-FPM process.
|
|
# This is the default behavior of the official Nextcloud image.
|
|
# Socket access works via 777 permissions (see infrastructure role docs)
|
|
|
|
# Volume mounts
|
|
# Application files (world-readable for Caddy to serve static assets)
|
|
Volume={{ nextcloud_html_dir }}:/var/www/html:Z
|
|
|
|
# User data (private - only container can access)
|
|
Volume={{ nextcloud_data_dir }}:/var/www/html/data:Z
|
|
|
|
# Configuration (private - contains secrets)
|
|
Volume={{ nextcloud_config_dir }}:/var/www/html/config:Z
|
|
|
|
# Infrastructure sockets (mounted with world-readable permissions on host)
|
|
Volume={{ postgresql_unix_socket_directories }}:{{ postgresql_unix_socket_directories }}:Z
|
|
Volume={{ valkey_unix_socket_path | dirname }}:{{ valkey_unix_socket_path | dirname }}:Z
|
|
|
|
# Expose FPM port to localhost only (Caddy will reverse proxy)
|
|
PublishPort=127.0.0.1:{{ nextcloud_fpm_port }}:9000
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=300
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|