nextcloud.yml

version: "3.8"

services:
  db:
    image: mariadb:10.6
    hostname: db
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    env_file: nextcloud/db/$ENV.env
    volumes:
      - nextcloud-db:/var/lib/mysql
    networks:
      - nextcloud-backend

  redis:
    image: redis:5-alpine
    hostname: redis
    networks:
      - nextcloud-backend

  app:
    image: ghcr.io/zechmeister/agora/nextcloud:140
    hostname: app
    env_file: nextcloud/app/$ENV.env
    volumes:
      - nextcloud-data:/var/www/html
      - nextcloud-apps:/var/www/html/custom_apps
    networks:
      - nextcloud-backend
      - nextcloud-av
    secrets:
      - source: agora-config
        target: /var/www/html/config/agora.config.php
      - source: oidc-config
        target: /var/www/html/config/oidc.config.php

  web:
    image: nginx:1.20-alpine
    hostname: web
    volumes:
      - nextcloud-data:/var/www/html
      - nextcloud-apps:/var/www/html/custom_apps
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.nextcloud.rule=Host(`$HOST`) || Host(`www.$HOST`) || Host(`webcheck.$HOST`)"
        - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
        - "traefik.http.routers.nextcloud.tls=true"
        - "traefik.http.routers.nextcloud.tls.certresolver=myresolver"

        # dav
        - "traefik.http.middlewares.nextcloud-dav.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav"
        - "traefik.http.middlewares.nextcloud-dav.redirectregex.replacement=https://$${1}/remote.php/dav/"
        - "traefik.http.middlewares.nextcloud-dav.redirectregex.permanent=true"
        # well-known
        - "traefik.http.middlewares.nextcloud-wellknown.redirectregex.regex=^https://(.*)agora-oegd.de/.well-known/(.*)"
        - "traefik.http.middlewares.nextcloud-wellknown.redirectregex.replacement=https://$${1}agora-oegd.de/index.php/.well-known/$${2}"
        # /nutzerinnenverwaltung
        - "traefik.http.middlewares.nextcloud-nutzerinnen.redirectregex.regex=^https://$HOST/nutzerinnenverwaltung"
        - "traefik.http.middlewares.nextcloud-nutzerinnen.redirectregex.replacement=https://nutzerinnenverwaltung.$HOST/auth/admin/Agora/console"
        # www
        - "traefik.http.middlewares.nextcloud-www.redirectregex.regex=^https://www.(.*)agora-oegd.de/(.*)"
        - "traefik.http.middlewares.nextcloud-www.redirectregex.replacement=https://$${1}agora-oegd.de/$${2}"

        - "traefik.http.routers.nextcloud.middlewares=nextcloud-www,nextcloud-dav,nextcloud-nutzerinnen,nextcloud-wellknown,secHeaders@file"
    networks:
      - edge
      - nextcloud-backend
    configs:
      - source: web-nginx
        target: /etc/nginx/nginx.conf
    secrets:
      - source: agora-config
        target: /var/www/html/config/agora.config.php
      - source: oidc-config
        target: /var/www/html/config/oidc.config.php

  av:
    image: mkodockx/docker-clamav:1.0.9-alpine
    hostname: av
    volumes:
      - clamav-db:/var/lib/clamav/
    networks:
      - nextcloud-av

  collabora:
    image: collabora/code:21.11.0.6.1
    env_file: nextcloud/collabora/$ENV.env
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.collabora.rule=Host(`collabora.$HOST`)"
        - "traefik.http.services.collabora.loadbalancer.server.port=9980"
        - "traefik.http.routers.collabora.tls=true"
        - "traefik.http.routers.collabora.tls.certresolver=myresolver"
    networks:
      - edge

  # cron:
  #   image: nextcloud:fpm-alpine
  #   hostname: cron
  #   volumes:
  #     - nextcloud-data:/var/www/html
  #   entrypoint: /cron.sh

configs:
  web-nginx:
    file: ./nextcloud/web/nginx.conf
secrets:
  agora-config:
    file: ./nextcloud/app/agora.$ENV.config.php
  oidc-config:
    file: ./nextcloud/app/oidc.$ENV.config.php

volumes:
  nextcloud-db:
  nextcloud-data:
  nextcloud-apps:
  clamav-socket:
  clamav-db:

networks:
  nextcloud-backend:
  nextcloud-av:
  edge:
    external: true