42 lines
1.4 KiB
Plaintext
42 lines
1.4 KiB
Plaintext
[Unit]
|
|
Description=Nextcloud Cloud Storage Container (FPM)
|
|
After=network-online.target postgresql.service valkey.service
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=nextcloud
|
|
Image={{ nextcloud_image }}:{{ nextcloud_version }}
|
|
EnvironmentFile={{ nextcloud_home }}/.env
|
|
|
|
# Note: Container runs as root initially for entrypoint scripts,
|
|
# then switches to www-data (UID 33) for PHP-FPM process.
|
|
# This is the default behavior of the official Nextcloud image.
|
|
# Socket access works via 777 permissions (see infrastructure role docs)
|
|
|
|
# Volume mounts
|
|
# Application files (world-readable for Caddy to serve static assets)
|
|
Volume={{ nextcloud_html_dir }}:/var/www/html:Z
|
|
|
|
# User data (private - only container can access)
|
|
Volume={{ nextcloud_data_dir }}:/var/www/html/data:Z
|
|
|
|
# Configuration (private - contains secrets)
|
|
Volume={{ nextcloud_config_dir }}:/var/www/html/config:Z
|
|
|
|
# Custom apps (world-readable)
|
|
Volume={{ nextcloud_custom_apps_dir }}:/var/www/html/custom_apps:Z
|
|
|
|
# Infrastructure sockets (mounted with world-readable permissions on host)
|
|
Volume={{ postgresql_unix_socket_directories }}:{{ postgresql_unix_socket_directories }}:Z
|
|
Volume={{ valkey_unix_socket_path | dirname }}:{{ valkey_unix_socket_path | dirname }}:Z
|
|
|
|
# Expose FPM port to localhost only (Caddy will reverse proxy)
|
|
PublishPort=127.0.0.1:{{ nextcloud_fpm_port }}:9000
|
|
|
|
[Service]
|
|
Restart=always
|
|
TimeoutStartSec=300
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|