feat: add nextcloud, seafile, opencloud, collabora and onlyoffice services

nextcloud/.env.example

@@ -0,0 +1,23 @@
+# Copy to .env and fill in. Never commit .env.
+#
+#   cp .env.example .env
+
+# Admin account, created on first start only.
+# Generate a password with: openssl rand -base64 24
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_ADMIN_PASSWORD=
+
+# Public hostname, without scheme. The only trusted domain and the CLI URL.
+NEXTCLOUD_DOMAIN=nextcloud.example.com
+
+# Space-separated proxy addresses or CIDRs allowed to set X-Forwarded-* headers.
+TRUSTED_PROXIES=10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+
+# PostgreSQL credentials, used by the database and by the first-start install.
+POSTGRES_DB=nextcloud
+POSTGRES_USER=nextcloud
+POSTGRES_PASSWORD=
+
+# PHP limits for the web server.
+PHP_MEMORY_LIMIT=1G
+PHP_UPLOAD_LIMIT=16G

nextcloud/README.md

@@ -0,0 +1,85 @@
+# nextcloud
+
+[Nextcloud](https://github.com/nextcloud/docker) Server: file sync and share,
+calendar, contacts and office apps, with web, desktop and mobile clients.
+
+## Containers
+
+| Service | Image | Internal port | Role |
+| --- | --- | --- | --- |
+| `nextcloud` | `nextcloud:35-apache` | 80 | Web app |
+| `cron` | `nextcloud:35-apache` | none | Background jobs, via `/cron.sh` |
+| `db` | `postgres:18-alpine` | 5432 | Metadata, users and shares |
+| `cache` | `redis:8-alpine` | 6379 | File locking and the distributed cache |
+
+In Coolify, give `nextcloud` the domain from `NEXTCLOUD_DOMAIN` on port `80`.
+`nextcloud` and `cron` wait for `db` and `cache` to pass their health checks.
+
+## Setup
+
+1. Set `NEXTCLOUD_DOMAIN`, `NEXTCLOUD_ADMIN_PASSWORD` and `POSTGRES_PASSWORD`.
+2. Map the domain to port `80` and deploy. The first start installs Nextcloud
+   and creates the admin account.
+3. Log in with `NEXTCLOUD_ADMIN_USER` / `NEXTCLOUD_ADMIN_PASSWORD`. The first
+   run of `cron` switches background jobs to **Cron** on its own.
+
+Office editing is an app from the app store plus an external document server,
+both set up in the admin UI, not in this compose file.
+
+## Variables
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `NEXTCLOUD_ADMIN_USER` / `NEXTCLOUD_ADMIN_PASSWORD` | `admin` / — | Admin account |
+| `NEXTCLOUD_DOMAIN` | — | Public hostname, without scheme |
+| `TRUSTED_PROXIES` | private IPv4 ranges | Proxies allowed to set `X-Forwarded-*` |
+| `POSTGRES_DB` / `POSTGRES_USER` / `POSTGRES_PASSWORD` | `nextcloud` / `nextcloud` / — | Database credentials, read by `db` and by the install |
+| `PHP_MEMORY_LIMIT` | `1G` | PHP `memory_limit` |
+| `PHP_UPLOAD_LIMIT` | `16G` | PHP `upload_max_filesize` and `post_max_size` |
+
+`NEXTCLOUD_DOMAIN` fills `NEXTCLOUD_TRUSTED_DOMAINS` and `OVERWRITECLIURL`.
+Nextcloud rejects requests for any host not on the trusted list.
+
+The admin and database variables are read only by the first-start install.
+The installer creates its own database role and writes it to `config.php`, so
+changing them later changes nothing; use the web UI or `occ`.
+
+## Storage
+
+| Volume | Mount | Holds |
+| --- | --- | --- |
+| `nextcloud-html` | `/var/www/html` | Nextcloud code, apps, `config.php` and user files |
+| `db-data` | `/var/lib/postgresql` | The database |
+| `cache-data` | `/data` | Redis locks and cache |
+
+`cron` mounts the same volume at the same path as `nextcloud`; the two must
+match for background jobs to see the same installation.
+
+The Redis contents are rebuilt after a restart, but the `redis` image declares
+`/data` a volume, so without a named one Docker creates an anonymous volume on
+every recreate.
+
+## Choices
+
+- **Behind a TLS-terminating proxy.** The proxy speaks HTTP to port 80, so
+  `OVERWRITEPROTOCOL=https` keeps generated links and redirects on HTTPS.
+  `APACHE_DISABLE_REWRITE_IP=1` with `TRUSTED_PROXIES` makes Nextcloud read
+  the client IP and host from `X-Forwarded-*`, which brute-force protection
+  and the admin overview's proxy check rely on. No port is published, so only
+  containers on the app's networks can reach port 80; the private ranges cover
+  whatever subnet the proxy network gets.
+- **Larger PHP limits.** The image defaults both to `512M`. The web UI and
+  the desktop and mobile clients upload in chunks, but WebDAV clients that send
+  a file in one request hit `PHP_UPLOAD_LIMIT`, and preview generation for big
+  images needs more memory.
+- **`cron` container.** Nextcloud's recommended background job mode is system
+  cron; the image ships `/cron.sh`, which runs `cron.php` as `www-data` every
+  five minutes.
+- **`nextcloud:35-apache`.** The major tag takes point releases; Nextcloud
+  can only upgrade one major at a time, so a new major is a deliberate change.
+  The `apache` variant serves PHP itself, with no separate web server.
+- **`postgres:18-alpine`** is the version the Nextcloud 35 admin manual
+  recommends. Postgres 18 images keep data under `/var/lib/postgresql/18/`,
+  so the volume mounts at `/var/lib/postgresql`. A new Postgres major cannot
+  read an older data directory without a dump and restore.
+- **`redis:8-alpine`** matches the Redis line upstream's example uses.

nextcloud/compose.yml

@@ -0,0 +1,72 @@
+services:
+  nextcloud:
+    image: nextcloud:35-apache
+    restart: unless-stopped
+    environment:
+      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER:-admin}
+      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD:?required}
+      - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_DOMAIN:?required}
+      - OVERWRITEPROTOCOL=https
+      - OVERWRITECLIURL=https://${NEXTCLOUD_DOMAIN:?required}
+      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-10.0.0.0/8 172.16.0.0/12 192.168.0.0/16}
+      - APACHE_DISABLE_REWRITE_IP=1
+      - POSTGRES_HOST=db
+      - POSTGRES_DB=${POSTGRES_DB:-nextcloud}
+      - POSTGRES_USER=${POSTGRES_USER:-nextcloud}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?required}
+      - REDIS_HOST=cache
+      - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-1G}
+      - PHP_UPLOAD_LIMIT=${PHP_UPLOAD_LIMIT:-16G}
+    volumes:
+      - nextcloud-html:/var/www/html
+    depends_on:
+      db:
+        condition: service_healthy
+      cache:
+        condition: service_healthy
+
+  # Runs Nextcloud background jobs every five minutes.
+  cron:
+    image: nextcloud:35-apache
+    restart: unless-stopped
+    entrypoint: /cron.sh
+    volumes:
+      - nextcloud-html:/var/www/html
+    depends_on:
+      db:
+        condition: service_healthy
+      cache:
+        condition: service_healthy
+
+  # PostgreSQL for file metadata, users and shares.
+  db:
+    image: postgres:18-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_DB=${POSTGRES_DB:-nextcloud}
+      - POSTGRES_USER=${POSTGRES_USER:-nextcloud}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?required}
+    volumes:
+      - db-data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h localhost -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # Redis for file locking and the distributed cache.
+  cache:
+    image: redis:8-alpine
+    restart: unless-stopped
+    volumes:
+      - cache-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+volumes:
+  nextcloud-html:
+  db-data:
+  cache-data: