diff --git a/nextcloud/files/nginx.conf.j2 b/nextcloud/files/nginx.conf.j2 index bf73ab8..a8cf2d0 100644 --- a/nextcloud/files/nginx.conf.j2 +++ b/nextcloud/files/nginx.conf.j2 @@ -8,9 +8,10 @@ server { location / { - proxy_set_header Host $host:$server_port; - proxy_set_header X-Scheme $scheme; - proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header Host $host:$server_port; + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Forwarded-For $remote_addr; + add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; proxy_pass http://localhost:9080; } diff --git a/nextcloud/playbook.yml b/nextcloud/playbook.yml index 10c2d8c..1647226 100755 --- a/nextcloud/playbook.yml +++ b/nextcloud/playbook.yml @@ -2,95 +2,12 @@ # DO Community Playbooks: Nextcloud ################################################# --- -- hosts: all +- hosts: gondor become: true vars_files: - vars/default.yml - tasks: - - name: Pull Nextcloud image - docker_image: - name: "{{ container_image }}" - source: pull - force_source: yes - - - name: Copy dockerfile - synchronize: src=web dest=/tmp - - - name: Build nginx webserver image - docker_image: - name: nextcloud-web - build: - path: /tmp/web/ - dockerfile: /tmp/web/Dockerfile - pull: yes - state: present - source: build - force_source: yes - - - name: Create Nextcloud container - docker_container: - name: "{{ container_name }}" - image: "{{ container_image }}" - state: started - restart_policy: "unless-stopped" - env: - POSTGRES_DB: "{{ db_name }}" - POSTGRES_USER: "{{ db_user }}" - POSTGRES_PASSWORD: "{{ db_pass }}" - POSTGRES_HOST: "{{ db_host }}" -# REDIS_HOST: "redis" - links: - - "postgres:db" -# - "redis:redis" - published_ports: - - "127.0.0.1:9000:9000" - volumes: - - /var/lib/nextcloud:/var/www/html - - - name: Create webserver container - docker_container: - name: cloud-web - image: nextcloud-web - state: started - restart_policy: "unless-stopped" - links: - - "cloud:app" - published_ports: - - "127.0.0.1:9080:80" - volumes: - - /var/lib/nextcloud:/var/www/html:ro - - - name: Add cron job - cron: - name: Nextcloud cron - minute: "*/5" - job: "docker exec -u www-data {{ container_name }} php cron.php" - - - name: Check if Nginx conf file exists - stat: path="/etc/nginx/sites-available/{{ http_conf }}" - register: status - - - name: No need to reload Nginx - debug: msg= {{ "No need to reload Nginx as sites-available entries have already been created" }} - - - name: Set Nginx conf file - when: status.stat.exists == false - template: - src: "files/nginx.conf.j2" - dest: "/etc/nginx/sites-available/{{ http_conf }}" - - - name: Enable new site - when: status.stat.exists == false - file: - src: "/etc/nginx/sites-available/{{ http_conf }}" - dest: "/etc/nginx/sites-enabled/{{ http_conf }}" - state: link - notify: Reload Nginx - - handlers: - - name: Reload Nginx - service: - name: nginx - state: reloaded - + roles: + - nextcloud + - webserver + - nginx diff --git a/nextcloud/readme.md b/nextcloud/readme.md index f6d7ecc..d3a2039 100644 --- a/nextcloud/readme.md +++ b/nextcloud/readme.md @@ -1,46 +1,2 @@ -# Docker on Ubuntu 18.04 - -This playbook will install Docker an Ubuntu 18.04 machine, as explained in the guide on -[How to Use Ansible to Install and Set Up Docker on Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/how-to-use-ansible-to-install-and-set-up-docker-on-ubuntu-18-04). -A number of containers will be created with the options specified in the `vars/default.yml` variable file. - -## Settings - -- `create_containers`: number of containers to create. -- `default_container_name`: default name for new containers. -- `default_container_image`: default image for new containers. -- `default_container_command`: default command to run on new containers. - - -## Running this Playbook - -Quick Steps: - -### 1. Obtain the playbook -```shell -git clone https://github.com/do-community/ansible-playbooks.git -cd ansible-playbooks/docker_ubuntu1804 -``` - -### 2. Customize Options - -```shell -nano vars/default.yml -``` - -```yml -#vars/default.yml ---- -create_containers: 4 -default_container_name: docker -default_container_image: ubuntu -default_container_command: sleep 1d -``` - -### 3. Run the Playbook - -```command -ansible-playbook -l [target] -i [inventory file] -u [remote user] playbook.yml -``` - -For more information on how to run this Ansible setup, please check this guide: [How to Use Ansible to Install and Set Up Docker on Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/how-to-use-ansible-to-install-and-set-up-docker-on-ubuntu-18-04). \ No newline at end of file +The web/nginx.conf is from +https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf \ No newline at end of file diff --git a/nextcloud/roles/nextcloud/tasks/main.yaml b/nextcloud/roles/nextcloud/tasks/main.yaml new file mode 100644 index 0000000..54e5bea --- /dev/null +++ b/nextcloud/roles/nextcloud/tasks/main.yaml @@ -0,0 +1,39 @@ +--- +# Tasks for Nextcloud role +- name: Pull Nextcloud image + docker_image: + name: "{{ container_image }}" + source: pull + force_source: yes + +- name: Ensure Nextcloud Directory exists + file: + path: "/var/lib/{{ host_directory }}" + state: directory + mode: 0755 + +- name: Create Nextcloud container + docker_container: + name: "{{ container_name }}" + image: "{{ container_image }}" + state: started + restart_policy: "unless-stopped" + env: + POSTGRES_DB: "{{ db_name }}" + POSTGRES_USER: "{{ db_user }}" + POSTGRES_PASSWORD: "{{ db_pass }}" + POSTGRES_HOST: "{{ db_host }}" + REDIS_HOST: "redis" + links: + - "postgres:db" + - "redis:redis" + published_ports: + - "127.0.0.1:9000:9000" + volumes: + - "/var/lib/{{ host_directory }}:/var/www/html" + +- name: Add cron job + cron: + name: Nextcloud cron + minute: "*/5" + job: "docker exec -u www-data {{ container_name }} php cron.php" diff --git a/nextcloud/roles/nginx/handlers/main.yaml b/nextcloud/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..622fd36 --- /dev/null +++ b/nextcloud/roles/nginx/handlers/main.yaml @@ -0,0 +1,6 @@ +--- +# Handlers for Nginx role +- name: Reload Nginx + service: + name: nginx + state: reloaded diff --git a/nextcloud/roles/nginx/tasks/main.yaml b/nextcloud/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..4441fe7 --- /dev/null +++ b/nextcloud/roles/nginx/tasks/main.yaml @@ -0,0 +1,24 @@ +--- +# Tasks for Nginx role +- name: Check if Nginx conf file exists + stat: + path: "/etc/nginx/sites-available/{{ http_conf }}" + register: status + +- name: No need to reload Nginx + debug: + msg: "No need to reload Nginx as sites-available entries have already been created" + +- name: Set Nginx conf file + when: status.stat.exists == false + template: + src: "files/nginx.conf.j2" + dest: "/etc/nginx/sites-available/{{ http_conf }}" + +- name: Enable new site + when: status.stat.exists == false + file: + src: "/etc/nginx/sites-available/{{ http_conf }}" + dest: "/etc/nginx/sites-enabled/{{ http_conf }}" + state: link + notify: Reload Nginx diff --git a/nextcloud/roles/webserver/tasks/main.yaml b/nextcloud/roles/webserver/tasks/main.yaml new file mode 100644 index 0000000..2297652 --- /dev/null +++ b/nextcloud/roles/webserver/tasks/main.yaml @@ -0,0 +1,28 @@ +--- +# Tasks for Nextcloud webserver role +- name: Copy dockerfile + synchronize: src=web dest=/tmp + +- name: Build nginx webserver image + docker_image: + name: "{{ web_container_image }}" + build: + path: /tmp/web/ + dockerfile: /tmp/web/Dockerfile + pull: yes + state: present + source: build + force_source: yes + +- name: Create webserver container + docker_container: + name: "{{ web_container_name }}" + image: "{{ web_container_image }}" + state: started + restart_policy: "unless-stopped" + links: + - "{{ container_name }}:app" + published_ports: + - "127.0.0.1:9080:80" + volumes: + - "/var/lib/{{ host_directory }}:/var/www/html:ro" diff --git a/nextcloud/vars/default.yml b/nextcloud/vars/default.yml index f85a6ec..0c6a1de 100644 --- a/nextcloud/vars/default.yml +++ b/nextcloud/vars/default.yml @@ -5,6 +5,11 @@ http_conf: "cloud.hopsngrains.com.conf" container_name: cloud container_image: nextcloud:fpm +web_container_name: cloud-web +web_container_image: nextcloud-web + +host_directory: nextcloud + db_name: "nextcloud" db_user: "postgres" db_pass: "123456" diff --git a/nextcloud/web/nginx.conf b/nextcloud/web/nginx.conf index 24cbf78..95b49f0 100644 --- a/nextcloud/web/nginx.conf +++ b/nextcloud/web/nginx.conf @@ -32,18 +32,18 @@ http { set_real_ip_from 192.168.0.0/16; real_ip_header X-Forwarded-For; - #gzip on; - - upstream php-handler { - server app:9000; - } - # Set the `immutable` cache control options only for assets with a cache busting `v` argument map $arg_v $asset_immutable { "" ""; default "immutable"; } + #gzip on; + + upstream php-handler { + server app:9000; + } + server { listen 80; @@ -57,8 +57,14 @@ http { #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; # set max upload size - client_max_body_size 1024M; + client_max_body_size 512M; proxy_request_buffering off; + fastcgi_buffers 64 4K; + + # The settings allows you to optimize the HTTP2 bandwidth. + # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/ + # for tuning hints + client_body_buffer_size 512k; # Enable gzip but do not remove ETag headers gzip on; @@ -66,7 +72,7 @@ http { gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; - gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; # Pagespeed is not supported by Nextcloud, so if your server is built # with the `ngx_pagespeed` module, uncomment this line to disable it. @@ -75,7 +81,6 @@ http { # HTTP response headers borrowed from Nextcloud `.htaccess` add_header Referrer-Policy "no-referrer" always; add_header X-Content-Type-Options "nosniff" always; - add_header X-Download-Options "noopen" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Permitted-Cross-Domain-Policies "none" always; add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always; @@ -159,7 +164,7 @@ http { include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $path_info; - #fastcgi_param HTTPS on; + fastcgi_param HTTPS on; fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice fastcgi_param front_controller_active true; # Enable pretty urls @@ -167,12 +172,32 @@ http { fastcgi_intercept_errors on; fastcgi_request_buffering off; + + fastcgi_max_temp_file_size 0; } - location ~ \.(?:css|js|svg|gif)$ { + # Javascript mimetype fixes for nginx + # Note: The block below should be removed, and the js|mjs section should be + # added to the block below this one. This is a temporary fix until Nginx + # upstream fixes the js mime-type + location ~* \.(?:js|mjs)$ { + types { + text/javascript js mjs; + } try_files $uri /index.php$request_uri; - expires 6M; # Cache-Control policy borrowed from `.htaccess` + add_header Cache-Control "public, max-age=15778463, $asset_immutable"; + access_log off; + } + + # Serve static files + location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ { + try_files $uri /index.php$request_uri; + add_header Cache-Control "public, max-age=15778463, $asset_immutable"; access_log off; # Optional: Don't log access to assets + + location ~ \.wasm$ { + default_type application/wasm; + } } location ~ \.woff2?$ {