docker-compose.yml

# ex: set tabstop=8 softtabstop=0 expandtab shiftwidth=2 smarttab:
---
services:
  ### Use for testing with CockroachDB, but currently blocked by bug
  ### Source: https://help.nextcloud.com/t/any-luck-using-cockroachdb-with-nextcloud-in-docker/143409/2?u=dvaerum
  ### Issue Tracker: https://github.com/cockroachdb/cockroach/issues/94897
  # db:
  #   image: cockroachdb/cockroach:latest
  #   command: >-
  #     start-single-node
  #     --sql-addr :5432
  #     --insecure
  #     --vmodule=exec_log=2

  #   # entrypoint: "bash -x cockroach.sh start-single-node --sql-addr :5432"
  #   restart: always

  #   volumes:
  #     - ./extra-files/cockroachdb/init-scripts:/docker-entrypoint-initdb.d
  #     - database_data:/cockroach/cockroach-data

  #   environment:
  #     COCKROACH_DATABASE: "${MYSQL_DATABASE}"
  #     COCKROACH_USER: "${MYSQL_USER}"
  #     COCKROACH_PASSWORD: "${MYSQL_PASSWORD}"


  db:
    image: postgres:${DATABASE_POSTGRESQL_VERSION}
    command: -c 'max_connections=200'
    restart: always

    volumes:
      - ./extra-files/postgresql/init-scripts:/docker-entrypoint-initdb.d
      - database_postgresql:/var/lib/postgresql/data

    environment:
      POSTGRES_DB: "postgres"
      POSTGRES_USER: "postgres"
      POSTGRES_PASSWORD: "${DATABASE_ROOT_PASSWORD}"

      POSTGRES_NEXTCLOUD_DB: "${DATABASE_NAME}"
      POSTGRES_NEXTCLOUD_USER: "${DATABASE_USER}"
      POSTGRES_NEXTCLOUD_PASSWORD: "${DATABASE_PASSWORD}"

      PGDATA: "/var/lib/postgresql/data/${DATABASE_POSTGRESQL_VERSION}"


#  db:
#    image: mariadb:latest
#    command: >-
#      --transaction-isolation=READ-COMMITTED
#      --binlog-format=ROW
#      --innodb-file-per-table=1
#      --skip-innodb-read-only-compressed
#      --skip-name-resolve
#    restart: always
#
#    volumes:
#      - database_mysql:/var/lib/mysql
#
#    environment:
#      MYSQL_DATABASE: "${DATABASE_NAME}"
#      MYSQL_USER: "${DATABASE_USER}"
#      MYSQL_PASSWORD: "${DATABASE_PASSWORD}"
#      MYSQL_ROOT_PASSWORD: "${DATABASE_ROOT_PASSWORD}"


  redis:
    image: redis
    restart: always
    command: redis-server --requirepass "${REDIS_HOST_PASSWORD}"


  app:
    build: &service_app_build
      context: ./build/app
      args:
        IMAGE_TAG: "${NEXTCLOUD_VERSION}-${NEXTCLOUD_BRANCH}"
        XDEBUG_MODE: "${XDEBUG_MODE:-off}"

    # entrypoint: /bin/sh -x /entrypoint.sh php-fpm

    restart: always
    volumes: &service_app_volumes
      - ./extra-files/nextcloud/post-installation:/docker-entrypoint-hooks.d/post-installation
      - ./extra-files/nextcloud/post-upgrade:/docker-entrypoint-hooks.d/post-upgrade
      - ./extra-files/nextcloud/before-starting:/docker-entrypoint-hooks.d/before-starting
      - nextcloud:/var/www/html
      - nextcloud_apps:/var/www/html/custom_apps
      - nextcloud_config:/var/www/html/config
      - nextcloud_data:/var/www/html/data

    environment: &service_app_environment
      ### For using with PostgreSQL
      POSTGRES_HOST: db
      POSTGRES_DB: "${DATABASE_NAME}"
      POSTGRES_USER: "${DATABASE_USER}"
      POSTGRES_PASSWORD: "${DATABASE_PASSWORD}"

      ### For using with MySQL/MariaDB
      # MYSQL_HOST: db
      # MYSQL_DATABASE: "${DATABASE_NAME}"
      # MYSQL_USER: "${DATABASE_USER}"
      # MYSQL_PASSWORD: "${DATABASE_PASSWORD}"

      REDIS_HOST: redis
      REDIS_HOST_POST: 6379
      REDIS_HOST_PASSWORD: "${REDIS_HOST_PASSWORD}"

      NEXTCLOUD_ADMIN_USER: "${NEXTCLOUD_ADMIN_USERNAME}"
      NEXTCLOUD_ADMIN_PASSWORD: "${NEXTCLOUD_ADMIN_PASSWORD}"

      NEXTCLOUD_TRUSTED_DOMAINS: "${NEXTCLOUD_TRUSTED_DOMAINS}"
      TRUSTED_PROXIES: "${NEXTCLOUD_TRUSTED_PROXIES}"

      NC_default_phone_region: "${NC_DEFAULT_PHONE_REGION}"
      NC_default_locale: "${NC_DEFAULT_LOCALE}"
      NC_query_log_file: "${NC_QUERY_LOG_FILE:-}"

      DOMAIN_NEXTCLOUD:  "${DOMAIN_NEXTCLOUD:-}"
      DOMAIN_COLLABORA:  "${DOMAIN_COLLABORA:-}"
      DOMAIN_ONLYOFFICE: "${DOMAIN_ONLYOFFICE:-}"

    depends_on:
      - db
      - redis

  app-inner-services:
    build: *service_app_build
    user: www-data
    entrypoint:
      - "/usr/bin/env"
      - "bash"
      - "-c"
      - >-
        epoch=$$(date +%s);
        touch_file_scan_path=files-scan-all.touch;
        touch_preview_generate_path=preview-generate-all.touch;
        if [[ ! -f $$touch_file_scan_path ]]        || [[ $$(( $$epoch - 3600 * 24 * 6 )) -gt $$(stat --format=%Y $$touch_file_scan_path) ]]; then
          php occ files:scan --all && touch $$touch_file_scan_path;
        fi;
        if [[ ! -f $$touch_preview_generate_path ]] || [[ $$(( $$epoch - 3600 * 24 * 6 )) -gt $$(stat --format=%Y $$touch_preview_generate_path) ]]; then
          php occ preview:generate-all && touch $$touch_preview_generate_path;
        fi;
        while sleep 180; do
          php cron.php;
          php occ preview:pre-generate;
        done;
    restart: always
    volumes: *service_app_volumes
    environment: *service_app_environment
    depends_on:
      - app

  app-nginx:
    build:
      context: ./build/nginx
      dockerfile: Containerfile

    restart: always

    networks:
      default:
        aliases:
          - "${DOMAIN_NEXTCLOUD}"

    volumes:
      - nextcloud:/var/www/html
      - nextcloud_apps:/var/www/html/custom_apps
      - nextcloud_config:/var/www/html/config
      - nextcloud_data:/var/www/html/data

    depends_on:
      - app

    ### NOTES for labels: ###
    # These labels are used to configure the container Traefik (https://doc.traefik.io/traefik/).
    # Traefik is used as our LB (Load Balander) for handling incoming connection and forward them
    # to the correct containers.
    labels:
      # Enable this container to be load balancered by Traefik
      - "traefik.enable=true"

      # Create middleware for redirect all HTTP connections to HTTPS
      - "traefik.http.middlewares.nextcloud_redirect_http2https.redirectscheme.scheme=https"
      # Make the redirect permanent
      - "traefik.http.middlewares.nextcloud_redirect_http2https.redirectscheme.permanent=true"

      # Select the endpoint from Traefik which is used for incoming connection.
      # Normally the endpoint `web` is going to be on port 80 (HTTP).
      - "traefik.http.routers.nextcloud_http.entrypoints=web"
      # List of all the domains there will forwarded to this container
      - "traefik.http.routers.nextcloud_http.rule=Host(`${DOMAIN_NEXTCLOUD}`)"
      # Select the middleware from Traefik which is used for incoming connection.
      - "traefik.http.routers.nextcloud_http.middlewares=nextcloud_redirect_http2https"

      # Create middleware to replace the path for well-known requests
      - "traefik.http.middlewares.nextcloud_known_dav.replacepathregex.regex=^/.well-known/(cal|card)dav"
      - "traefik.http.middlewares.nextcloud_known_dav.replacepathregex.replacement=/remote.php/dav/"
      - "traefik.http.middlewares.nextcloud_known_others.replacepathregex.regex=^/.well-known/(webfinger|nodeinfo)"
      - "traefik.http.middlewares.nextcloud_known_others.replacepathregex.replacement=/index.php/.well-known/$$1"

      # Select the endpoint from Traefik which is used for incoming connection.
      # Normally the endpoint `websecure` is going to be on port 443 (HTTPS).
      - "traefik.http.routers.nextcloud_https.entrypoints=websecure"
      # List of all the domains there will forwarded to this container
      - "traefik.http.routers.nextcloud_https.rule=Host(`${DOMAIN_NEXTCLOUD}`)"
      # Get SSL/TLS certificate from Let's Encrypt by resolving the HTTPS challenge.
      - "traefik.http.routers.nextcloud_https.tls.certresolver=http_challenge_resolver"

      # In order to select which port on this container the connections from Traefik should be farwarded to,
      # there needs to be defined a service.
      # This service defineds that we load balancer should farward connections to port 80
      - "traefik.http.services.nextcloud_https.loadbalancer.server.port=80"
      # Select the middleware from Traefik which is used for incoming connection.
      - "traefik.http.routers.nextcloud_https.middlewares=nextcloud_known_dav,nextcloud_known_others"


  onlyoffice:
    ### READ The onlyoffice/Dockerfile for more info!
    build: ./build/onlyoffice
    restart: always
    stdin_open: true
    tty: true

    networks:
      default:
        aliases:
          - "${DOMAIN_ONLYOFFICE}"

    environment:
      JWT_ENABLED: "false"

    volumes:
      - onlyoffice_data:/var/www/onlyoffice/Data
      - onlyoffice_log:/var/log/onlyoffice

    ### NOTES for labels:
    # These labels are used to configure the container Traefik (https://doc.traefik.io/traefik/).
    # Traefik is used as our LB (Load Balander) for handling incoming connection and forward them
    # to the correct containers.
    labels:
      # Enable this container to be load balancered by Traefik
      - "traefik.enable=true"

      # Create middleware for redirect all HTTP connections to HTTPS
      - "traefik.http.middlewares.onlyoffice_redirect_http2https.redirectscheme.scheme=https"
      # Make the redirect permanent
      - "traefik.http.middlewares.onlyoffice_redirect_http2https.redirectscheme.permanent=true"

      # Select the endpoint from Traefik which is used for incoming connection.
      # Normally the endpoint `web` is going to be on port 80 (HTTP).
      - "traefik.http.routers.onlyoffice_http.entrypoints=web"
      # List of all the domains there will forwarded to this container
      - "traefik.http.routers.onlyoffice_http.rule=Host(`${DOMAIN_ONLYOFFICE}`)"
      # Select the middleware from Traefik which is used for incoming connection.
      - "traefik.http.routers.onlyoffice_http.middlewares=onlyoffice_redirect_http2https"

      # Select the endpoint from Traefik which is used for incoming connection.
      # Normally the endpoint `websecure` is going to be on port 443 (HTTPS).
      - "traefik.http.routers.onlyoffice_https.entrypoints=websecure"
      # List of all the domains there will forwarded to this container
      - "traefik.http.routers.onlyoffice_https.rule=Host(`${DOMAIN_ONLYOFFICE}`)"

      # Workaround a bug in OnlyOffice, see the issue tracker: https://github.com/ONLYOFFICE/DocumentServer/issues/2186
      - "traefik.http.middlewares.onlyoffice_redirect_http2https_header.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.http.routers.onlyoffice_https.middlewares=onlyoffice_redirect_http2https_header"

      # Get SSL/TLS certificate from Let's Encrypt by resolving the HTTPS challenge.
      - "traefik.http.routers.onlyoffice_https.tls.certresolver=http_challenge_resolver"
      # In order to select which port on this container the connections from Traefik should be farwarded to,
      # there needs to be defined a service.
      # This service defineds that we load balancer should farward connections to port 80
      - "traefik.http.services.onlyoffice_https.loadbalancer.server.port=80"


  elasticsearch:
    image: elasticsearch:${ELASTIC_SEARCH_VERSION}
#   build:
#      context: ./build/elasticsearch
#      args:
#        IMAGE_TAG: "${ELASTIC_SEARCH_VERSION}"
    restart: always
    environment:
      discovery.type: single-node

      xpack.security.enabled: "false"
      xpack.security.transport.ssl.enabled: "false"

      ES_JAVA_OPTS: "${ELASTIC_JAVA_OPTS:-}"

    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data


volumes:
  nextcloud:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/nextcloud"


  nextcloud_apps:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/nextcloud_apps"


  nextcloud_config:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/nextcloud_config"


  nextcloud_data:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/nextcloud_data"


#  database_mysql:
#    driver: local
#    driver_opts:
#      o: bind
#      type: none
#      device: "${DATA_PATH:-./data}/database_data/mysql"

        
  database_postgresql:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/database_data/postgresql"


  onlyoffice_data:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/onlyoffice_data"


  onlyoffice_log:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/onlyoffice_log"


  elasticsearch_data:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: "${DATA_PATH:-./data}/elasticsearch_data"