UPGRADING-NC.md - draft version

Docker compose doesn't seem to like it and complains now.

templates/docker-compose/borgmatic.env.j2

@@ -1,3 +1,2 @@
 POSTGRES_PASSWORD={{ nextcloud_db_password }}
 BORG_PASSPHRASE={{ borg_passphrase }}
-SMTP_PASSWORD={{ smtp_password }}

templates/docker-compose/borgmatic/Dockerfile

@@ -1,11 +1,4 @@
-FROM b3vis/borgmatic:latest
+FROM b3vis/borgmatic:latest-msmtp
 
-# Install stdbuf, used by backup.sh
-RUN \
-  echo "* Installing Runtime Packages" \
-    && apk upgrade --no-cache \
-  && echo "* Installing Runtime Packages" \
-    && apk add -U --no-cache \
-      coreutils
 COPY --chmod=755 backup.sh /backup.sh
 

templates/docker-compose/borgmatic/backup.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # Run the backup and mail the logs:
 # Depending on parameter 1:
-# - test-smtp: just send a test email using $APPRISE_URI
+# - test-smtp: just send a test email to $MAIL_TO
 # - run: create the backup, no checks
 # - check: prune, compact and check the backup
 # Anything else is an error.
@@ -9,6 +9,8 @@
 set -o pipefail
 
 # Set up environment
+/bin/sh /scripts/msmtprc.sh
+/bin/sh /scripts/env.sh
 RUN_COMMAND="borgmatic --stats -v 2 create"
 CHECK_COMMAND="borgmatic --stats -v 1 prune compact check"
 LOGFILE="/tmp/backup_run_$(date +%s).log"
@@ -29,7 +31,7 @@ indent() {
 log() {
     # Adapted from https://stackoverflow.com/a/31151808
     {
-        stdbuf -oL -eL "$@"   2>&1 1>&3 3>&- | indent " ! "
+        "$@"   2>&1 1>&3 3>&- | indent " ! "
     } 3>&1 1>&2 | indent " | " | tee -a "$LOGFILE"
 }
 
@@ -41,12 +43,14 @@ report() {
         log echo "FAILED: $RESULT"
         PREFIX="$FAILED_PREFIX"
     fi
-    apprise -vv -t "$PREFIX: '$PARAM'" -b "$(cat $LOGFILE)" "$APPRISE_URI&pass=$SMTP_PASSWORD"
+    printf "Subject: %s: '%s'\n\n%s\n" "$PREFIX" "$PARAM" "$(cat $LOGFILE)" |
+        sendmail -t "$MAIL_TO"
     log echo "Report sent."
 }
 
 testmail() {
-    apprise -vv -t "TESTING!" -b "test mail, please ignore." "$APPRISE_URI&pass=$SMTP_PASSWORD"
+    echo -e "Subject: TESTING!\n\ntest mail, please ignore\n" |
+        sendmail -t "$MAIL_TO"
 }
 
 failed() {
@@ -68,7 +72,7 @@ trap cleanup EXIT
 
 case  "$PARAM" in
     test-smtp)
-        echo "Testing mail to via Apprise ($APPRISE_URI)"
+        echo "Testing mail to $MAIL_TO"
         testmail
         echo "Done."
         ;;

templates/docker-compose/docker-compose.yml

@@ -260,18 +260,20 @@ services:
       - ./volumes/borg-ssh-config:/root/.ssh/ # ssh keys; sshd writes knownhosts etc here
 
     environment:
-      # Work around the use of a fancy init system s6:
-      # https://github.com/borgmatic-collective/docker-borgmatic/issues/320#issuecomment-2089003361
-      S6_KEEP_ENV: 1
-      
       POSTGRES_USER: nextcloud
       POSTGRES_DB: nextcloud
       POSTGRES_HOST: postgres
       BORG_ARCHIVE: nick
       BORG_ARCHIVE_LABEL: snackpot
-      APPRISE_URI: "mailtos://mail.noodlefactory.co.uk:25?user=nc.noodlefactory.co.uk&from=borgmatic@snackpot.noodlefactory.co.uk&to=nick@noodlefactory.co.uk"
-      # SMTP_PASSWORD is set via borgmatic.env, created via ansible,
-      # and appended to APPRISE_URL by borgmatic/backup.sh script
+      MAIL_RELAY_HOST: mail.noodlefactory.co.uk
+      MAIL_PORT: 25
+      MAIL_AUTH_METHOD: login
+      MAIL_STARTTLS: 'on'
+      MAIL_USER: nc.noodlefactory.co.uk
+      MAIL_FROM: borgmatic@snackpot.noodlefactory.co.uk
+      MAIL_TO: nick@noodlefactory.co.uk
+      MAIL_SUBJECT: Borgmatic Backup
+      # MAIL_PASSWORD is set via volumes/borgmatic-config/msmtp.env, created via ansible
       # Test SMTP auth on the server https://doc.dovecot.org/admin_manual/debugging/debugging_authentication/
     env_file:
       - ./borgmatic.env

templates/docker-compose/navidrome/Dockerfile

@@ -1,4 +1,4 @@
-FROM deluan/navidrome:0.55.2
+FROM deluan/navidrome:0.54.4
 
 RUN apk add --no-cache mpv
 # Ensure that navidrome has access to these directories

templates/docker-compose/proxy/Dockerfile

@@ -1,3 +1,3 @@
-FROM jwilder/nginx-proxy:1.7-alpine
+FROM jwilder/nginx-proxy:alpine-0.7.0
 
 COPY uploadsize.conf /etc/nginx/conf.d/uploadsize.conf

templates/docker-compose/upmpdcli/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.19
 
 RUN apk update \
   && apk upgrade \

templates/docker-compose/web/Dockerfile

@@ -1,3 +1,3 @@
-FROM nginx:1.28-alpine
+FROM nginx:1.19.6-alpine
 
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY nginx.conf /etc/nginx/nginx.conf

templates/docker-compose/web/nginx.conf

@@ -1,271 +1,173 @@
-# Adapted from https://docs.nextcloud.com/server/31/admin_manual/installation/nginx.html
-# Insert as /etc/nginx/conf.d/default.conf
+worker_processes auto;
 
-# Set .mjs and .wasm MIME types
-# Either include it in the default mime.types list
-# and include that list explicitly or add the file extension
-# only for Nextcloud like below:
-types {
-    text/javascript mjs;
-    application/wasm wasm;
-}
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
 
-upstream php-handler {
-    server nextcloud:9000;
-}
 
-# Set the `immutable` cache control options only for assets with a cache busting `v` argument
-map $arg_v $asset_immutable {
-    "" "";
-    default ", immutable";
+events {
+    worker_connections  1024;
 }
 
 
-server {
-    listen 80;
-    server_name nc.noodlefactory.co.uk;
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
 
-    # Prevent nginx HTTP Server Detection
-    server_tokens off;
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
 
-    # HSTS settings
-    # WARNING: Only add the preload option once you read about
-    # the consequences in https://hstspreload.org/. This option
-    # will add the domain to a hardcoded list that is shipped
-    # in all major browsers and getting removed from this list
-    # could take several months.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+    access_log  /var/log/nginx/access.log  main;
 
-    # Add headers to serve security related headers
-    # Before enabling Strict-Transport-Security headers please read into this
-    # topic first.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
-    #
-    # WARNING: Only add the preload option once you read about
-    # the consequences in https://hstspreload.org/. This option
-    # will add the domain to a hardcoded list that is shipped
-    # in all major browsers and getting removed from this list
-    # could take several months.
-    add_header Referrer-Policy "no-referrer" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Download-Options "noopen" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Permitted-Cross-Domain-Policies "none" always;
-    add_header X-Robots-Tag "noindex, nofollow" always;
-    add_header X-XSS-Protection "1; mode=block" always;
+    sendfile        on;
+    #tcp_nopush     on;
 
-    # Remove X-Powered-By, which is an information leak
-    fastcgi_hide_header X-Powered-By;
+    keepalive_timeout  65;
 
+    set_real_ip_from  10.0.0.0/8;
+    set_real_ip_from  172.16.0.0/12;
+    set_real_ip_from  192.168.0.0/16;
+    real_ip_header    X-Real-IP;
 
-    # Path to the root of your installation
-    root /var/www/html;
+    #gzip  on;
 
-    location = /robots.txt {
-	allow all;
-	log_not_found off;
-	access_log off;
+    upstream php-handler {
+        server nextcloud:9000;
     }
 
-    # The following 2 rules are only needed for the user_webfinger app.
-    # Uncomment it if you're planning to use this app.
-    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+    server {
+        listen 80;
 
-    # The following rule is only needed for the Social app.
-    # Uncomment it if you're planning to use this app.
-    #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
+        # Add headers to serve security related headers
+        # Before enabling Strict-Transport-Security headers please read into this
+        # topic first.
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+        #
+        # WARNING: Only add the preload option once you read about
+        # the consequences in https://hstspreload.org/. This option
+        # will add the domain to a hardcoded list that is shipped
+        # in all major browsers and getting removed from this list
+        # could take several months.
+        add_header Referrer-Policy "no-referrer" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Download-Options "noopen" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
+        add_header X-Robots-Tag "none" always;
+        add_header X-XSS-Protection "1; mode=block" always;
 
-    # set max upload size and increase upload timeout
-    client_max_body_size 10G;
-    client_body_timeout 300s;
-    fastcgi_buffers 64 4K;
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
 
-    # The settings allows you to optimize the HTTP2 bandwidth.
-    # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
-    # for tuning hints
-    client_body_buffer_size 512k;
+        # Path to the root of your installation
+        root /var/www/html;
 
-    # Enable gzip but do not remove ETag headers
-    gzip on;
-    gzip_vary on;
-    gzip_comp_level 4;
-    gzip_min_length 256;
-    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+        location = /robots.txt {
+            allow all;
+            log_not_found off;
+            access_log off;
+        }
 
-    # Pagespeed is not supported by Nextcloud, so if your server is built
-    # with the `ngx_pagespeed` module, uncomment this line to disable it.
-    #pagespeed off;
+        # The following 2 rules are only needed for the user_webfinger app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
 
+        # The following rule is only needed for the Social app.
+        # Uncomment it if you're planning to use this app.
+        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
 
-    # Specify how to handle directories -- specifying `/index.php$request_uri`
-    # here as the fallback means that Nginx always exhibits the desired behaviour
-    # when a client requests a path that corresponds to a directory that exists
-    # on the server. In particular, if that directory contains an index.php file,
-    # that file is correctly served; if it doesn't, then the request is passed to
-    # the front-end controller. This consistent behaviour means that we don't need
-    # to specify custom rules for certain paths (e.g. images and other assets,
-    # `/updater`, `/ocs-provider`), and thus
-    # `try_files $uri $uri/ /index.php$request_uri`
-    # always provides the desired behaviour.
-    index index.php index.html /index.php$request_uri;
+        location = /.well-known/carddav {
+            return 301 $scheme://$host:$server_port/remote.php/dav;
+        }
 
-    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
-    location = / {
-	if ( $http_user_agent ~ ^DavClnt ) {
-	    return 302 /remote.php/webdav/$is_args$args;
-	}
+        location = /.well-known/caldav {
+            return 301 $scheme://$host:$server_port/remote.php/dav;
+        }
+
+        # set max upload size
+        client_max_body_size 10G;
+        fastcgi_buffers 64 4K;
+
+        # Enable gzip but do not remove ETag headers
+        gzip on;
+        gzip_vary on;
+        gzip_comp_level 4;
+        gzip_min_length 256;
+        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+        # Uncomment if your server is build with the ngx_pagespeed module
+        # This module is currently not supported.
+        #pagespeed off;
+
+        location / {
+            rewrite ^ /index.php;
+        }
+
+        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
+            deny all;
+        }
+        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
+            deny all;
+        }
+
+        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
+            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $path_info;
+            # fastcgi_param HTTPS on;
+
+            # Avoid sending the security headers twice
+            fastcgi_param modHeadersAvailable true;
+
+            # Enable pretty urls
+            fastcgi_param front_controller_active true;
+            fastcgi_pass php-handler;
+            fastcgi_intercept_errors on;
+            fastcgi_request_buffering off;
+        }
+
+        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
+            try_files $uri/ =404;
+            index index.php;
+        }
+
+        # Adding the cache control header for js, css and map files
+        # Make sure it is BELOW the PHP block
+        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463";
+            # Add headers to serve security related headers (It is intended to
+            # have those duplicated to the ones above)
+            # Before enabling Strict-Transport-Security headers please read into
+            # this topic first.
+            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+            #
+            # WARNING: Only add the preload option once you read about
+            # the consequences in https://hstspreload.org/. This option
+            # will add the domain to a hardcoded list that is shipped
+            # in all major browsers and getting removed from this list
+            # could take several months.
+            add_header Referrer-Policy "no-referrer" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-Download-Options "noopen" always;
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Permitted-Cross-Domain-Policies "none" always;
+            add_header X-Robots-Tag "none" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+
+            # Optional: Don't log access to assets
+            access_log off;
+        }
+
+        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ {
+            try_files $uri /index.php$request_uri;
+            # Optional: Don't log access to other assets
+            access_log off;
+        }
     }
-
-    # Make a regex exception for `/.well-known` so that clients can still
-    # access it despite the existence of the regex rule
-    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
-    # for `/.well-known`.
-    location ^~ /.well-known {
-	# The rules in this block are an adaptation of the rules
-	# in `.htaccess` that concern `/.well-known`.
-
-	location = /.well-known/carddav { return 301 /remote.php/dav/; }
-	location = /.well-known/caldav  { return 301 /remote.php/dav/; }
-
-	location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-	location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
-
-	# Let Nextcloud's API for `/.well-known` URIs handle all other
-	# requests by passing them to the front-end controller.
-	return 301 /index.php$request_uri;
-    }
-
-    # Rules borrowed from `.htaccess` to hide certain paths from clients
-    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
-
-    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-    # which handle static assets (as seen below). If this block is not declared first,
-    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
-    # to the URI, resulting in a HTTP 500 error response.
-    location ~ \.php(?:$|/) {
-	# Required for legacy support
-	rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
-
-	fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-	set $path_info $fastcgi_path_info;
-
-	try_files $fastcgi_script_name =404;
-
-	include fastcgi_params;
-	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-	fastcgi_param PATH_INFO $path_info;
-	fastcgi_param HTTPS on;
-
-	fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-	fastcgi_param front_controller_active true;     # Enable pretty urls
-	fastcgi_pass php-handler;
-
-	fastcgi_intercept_errors on;
-	fastcgi_request_buffering off;
-
-	fastcgi_max_temp_file_size 0;
-    }
-
-    # Serve static files
-    location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
-	try_files $uri /index.php$request_uri;
-	# HTTP response headers borrowed from Nextcloud `.htaccess`
-	add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
-	add_header Referrer-Policy                   "no-referrer"       always;
-	add_header X-Content-Type-Options            "nosniff"           always;
-	add_header X-Frame-Options                   "SAMEORIGIN"        always;
-	add_header X-Permitted-Cross-Domain-Policies "none"              always;
-	add_header X-Robots-Tag                      "noindex, nofollow" always;
-	add_header X-XSS-Protection                  "1; mode=block"     always;
-	access_log off;     # Optional: Don't log access to assets
-    }
-
-    location ~ \.(otf|woff2?)$ {
-	try_files $uri /index.php$request_uri;
-	expires 7d;         # Cache-Control policy borrowed from `.htaccess`
-	access_log off;     # Optional: Don't log access to assets
-    }
-
-    # Rule borrowed from `.htaccess`
-    location /remote {
-	return 301 /remote.php$request_uri;
-    }
-
-    location / {
-	try_files $uri $uri/ /index.php$request_uri;
-    }
-##
-##        location / {
-##            rewrite ^ /index.php;
-##        }
-##
-##        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
-##            deny all;
-##        }
-##        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
-##            deny all;
-##        }
-##
-##        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
-##            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
-##            set $path_info $fastcgi_path_info;
-##            try_files $fastcgi_script_name =404;
-##            include fastcgi_params;
-##            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-##            fastcgi_param PATH_INFO $path_info;
-##            # fastcgi_param HTTPS on;
-##
-##            # Avoid sending the security headers twice
-##            fastcgi_param modHeadersAvailable true;
-##
-##            # Enable pretty urls
-##            fastcgi_param front_controller_active true;
-##            fastcgi_pass php-handler;
-##            fastcgi_intercept_errors on;
-##            fastcgi_request_buffering off;
-##        }
-##
-##        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
-##            try_files $uri/ =404;
-##            index index.php;
-##        }
-##
-##        # Adding the cache control header for js, css and map files
-##        # Make sure it is BELOW the PHP block
-##        location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
-##            try_files $uri /index.php$request_uri;
-##            add_header Cache-Control "public, max-age=15778463";
-##            # Add headers to serve security related headers (It is intended to
-##            # have those duplicated to the ones above)
-##            # Before enabling Strict-Transport-Security headers please read into
-##            # this topic first.
-##            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
-##            #
-##            # WARNING: Only add the preload option once you read about
-##            # the consequences in https://hstspreload.org/. This option
-##            # will add the domain to a hardcoded list that is shipped
-##            # in all major browsers and getting removed from this list
-##            # could take several months.
-##            add_header Referrer-Policy "no-referrer" always;
-##            add_header X-Content-Type-Options "nosniff" always;
-##            add_header X-Download-Options "noopen" always;
-##            add_header X-Frame-Options "SAMEORIGIN" always;
-##            add_header X-Permitted-Cross-Domain-Policies "none" always;
-##            add_header X-Robots-Tag "none" always;
-##            add_header X-XSS-Protection "1; mode=block" always;
-##
-##            # Optional: Don't log access to assets
-##            access_log off;
-##        }
-##
-##        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ {
-##            try_files $uri /index.php$request_uri;
-##            # Optional: Don't log access to other assets
-##            access_log off;
-##        }
 }
-
-