110 lines
3.4 KiB
YAML
110 lines
3.4 KiB
YAML
|
volumes:
|
||
|
|
mysql:
|
||
|
|
driver: local
|
||
|
|
redis:
|
||
|
|
driver: local
|
||
|
|
nextcloud:
|
||
|
|
driver: local
|
||
|
|
|
||
|
|
networks:
|
||
|
|
traefik:
|
||
|
|
external: true
|
||
|
|
name: traefik_default
|
||
|
|
internal:
|
||
|
|
driver: bridge
|
||
|
|
|
||
|
|
services:
|
||
|
|
nextcloud:
|
||
|
|
image: nextcloud:latest
|
||
|
|
container_name: nextcloud_server
|
||
|
|
restart: unless-stopped
|
||
|
|
depends_on:
|
||
|
|
- mariadb
|
||
|
|
- redis
|
||
|
|
networks:
|
||
|
|
- traefik
|
||
|
|
- internal
|
||
|
|
environment:
|
||
|
|
MYSQL_HOST: mariadb
|
||
|
|
MYSQL_DATABASE: nextcloud
|
||
|
|
MYSQL_USER: nextcloud
|
||
|
|
MYSQL_PASSWORD: nextcloud
|
||
|
|
REDIS_HOST: redis
|
||
|
|
REDIS_HOST_PASSWORD: nextcloud
|
||
|
|
NEXTCLOUD_ADMIN_USER: ${ADMIN_USERNAME}
|
||
|
|
NEXTCLOUD_ADMIN_PASSWORD: ${ADMIN_PASSWORD}
|
||
|
|
NEXTCLOUD_TRUSTED_DOMAINS: ${NEXTCLOUD_DOMAIN}
|
||
|
|
OVERWRITEPROTOCOL: https
|
||
|
|
OVERWRITEHOST: ${NEXTCLOUD_DOMAIN}
|
||
|
|
OVERWRITECLIURL: https://${NEXTCLOUD_DOMAIN}
|
||
|
|
TRUSTED_PROXIES: 172.16.0.0/12
|
||
|
|
volumes:
|
||
|
|
- nextcloud:/var/www/html
|
||
|
|
- /mnt/nextcloud:/var/www/html/data
|
||
|
|
labels:
|
||
|
|
- "traefik.enable=true"
|
||
|
|
- "traefik.docker.network=traefik_default"
|
||
|
|
|
||
|
|
# HTTP → HTTPS redirect
|
||
|
|
- "traefik.http.routers.nextcloud.entrypoints=web"
|
||
|
|
- "traefik.http.routers.nextcloud.rule=Host(`nextcloud.rozic-dev.com`)"
|
||
|
|
- "traefik.http.routers.nextcloud.middlewares=nextcloud-https-redirect"
|
||
|
|
- "traefik.http.middlewares.nextcloud-https-redirect.redirectscheme.scheme=https"
|
||
|
|
- "traefik.http.middlewares.nextcloud-https-redirect.redirectscheme.permanent=true"
|
||
|
|
|
||
|
|
# HTTPS Router
|
||
|
|
- "traefik.http.routers.nextcloud-secure.entrypoints=websecure"
|
||
|
|
- "traefik.http.routers.nextcloud-secure.rule=Host(`nextcloud.rozic-dev.com`)"
|
||
|
|
- "traefik.http.routers.nextcloud-secure.tls=true"
|
||
|
|
- "traefik.http.routers.nextcloud-secure.tls.certresolver=letsencrypt"
|
||
|
|
- "traefik.http.routers.nextcloud-secure.service=nextcloud"
|
||
|
|
- "traefik.http.routers.nextcloud-secure.middlewares=nextcloud-headers"
|
||
|
|
|
||
|
|
# Nextcloud-specific security headers
|
||
|
|
- "traefik.http.middlewares.nextcloud-headers.headers.customFrameOptionsValue=SAMEORIGIN"
|
||
|
|
- "traefik.http.middlewares.nextcloud-headers.headers.customResponseHeaders.Strict-Transport-Security=max-age=15552000; includeSubDomains"
|
||
|
|
|
||
|
|
# Internal port inside container
|
||
|
|
- "traefik.http.services.nextcloud.loadbalancer.server.port=80"
|
||
|
|
|
||
|
|
mariadb:
|
||
|
|
image: mariadb:10.11
|
||
|
|
container_name: nextcloud_mariadb
|
||
|
|
restart: unless-stopped
|
||
|
|
networks:
|
||
|
|
- internal
|
||
|
|
environment:
|
||
|
|
MYSQL_ROOT_PASSWORD: nextcloud
|
||
|
|
MYSQL_USER: nextcloud
|
||
|
|
MYSQL_PASSWORD: nextcloud
|
||
|
|
MYSQL_DATABASE: nextcloud
|
||
|
|
MARIADB_AUTO_UPGRADE: 1
|
||
|
|
command:
|
||
|
|
- "--max-allowed-packet=128M"
|
||
|
|
- "--innodb-log-file-size=64M"
|
||
|
|
- "--transaction-isolation=READ-COMMITTED"
|
||
|
|
- "--binlog-format=ROW"
|
||
|
|
- "--innodb-file-per-table=1"
|
||
|
|
- "--skip-innodb-read-only-compressed"
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "mysqladmin", "ping", "-u", "root", "--password=nextcloud"]
|
||
|
|
interval: 10s
|
||
|
|
timeout: 5s
|
||
|
|
retries: 5
|
||
|
|
volumes:
|
||
|
|
- mysql:/var/lib/mysql
|
||
|
|
|
||
|
|
redis:
|
||
|
|
image: redis:6-alpine
|
||
|
|
container_name: nextcloud_redis
|
||
|
|
restart: unless-stopped
|
||
|
|
networks:
|
||
|
|
- internal
|
||
|
|
command: ["redis-server", "--requirepass", "nextcloud"]
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "redis-cli", "ping"]
|
||
|
|
interval: 10s
|
||
|
|
timeout: 5s
|
||
|
|
retries: 5
|
||
|
|
volumes:
|
||
|
|
- redis:/data
|