update nextcloud version

add odoo-dev
fix wrong name
2024-02-16 22:32:36 +01:00 · 2024-02-16 22:31:45 +01:00 · 2024-02-16 22:31:11 +01:00 · 2024-01-20 21:02:38 +01:00 · 2024-01-20 08:49:11 +01:00 · 2024-01-20 08:48:05 +01:00
27 changed files with 671 additions and 356 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.autorestic.env
+.autorestic.lock.yml
--- a/README.md
+++ b/README.md
@@ -0,0 +1,99 @@
+# Installation de l'infrastructure 
+
+### Lancement
+
+#### Certs
+
+Au premier lancement, assurez-vous que :
+
+- Le dossier `/DATA/docker/traefik/certs` existe
+- Créez un fichier `acme.json` à l'intérieur
+- Changez son propriétaire à `root`
+- Changez ses permissions à `600`
+
+C'est dans ce fichier que seront conservés tous les certificats générés par Traefik.
+
+### Migration des données
+
+1. Mettre nextcloud en mode maintenance : 
+```
+sudo -u www-data php occ maintenance:mode --on
+```
+2. Faire un dump de la bdd
+```
+sudo -u postgres pg_dump -Fc  nc > nc.dump
+```
+3. Sauver les données du dossier nextcloud
+```
+mkdir -p /var/lib/backuppc/migration/data
+cp -r /srv/nextcloud/ /var/lib/backuppc/migration/data
+```
+4. Sauver le fichier de configuration de nextcloud
+```
+cp /var/www/nextcloud/public_html/config/config.php /var/lib/backuppc/migration
+```
+
+…
+installation de proxmox, vm, docker.
+…
+
+### Installation des services
+
+1. Cloner le repo de l'infra et le mettre au bon endroit
+``` 
+git clone https://yuno.oiseauroch.fr/gitea/tobias/infra-oasis21.git
+mkdir -p /DATA/docker
+mv infra_oasis21 /DATA/docker/services
+```
+2. copy file `config.php` and change values
+```
+cp /var/lib/backuppc/migration/config.php .
+# change host for redis
+sed -i 's#/run/redis/redis.sock#redis#' config.php
+# change dbhost 
+sed -i 's#localhost#nextcloud-db#' config.php
+# change datadirectory
+sed -i 's#/srv/nextcloud#/var/www/html/data#' config.php
+
+```
+3. Move `secrets/librezo.secrets.example` to `secrets/librezo.secrets` 
+4.Replace **nextcloud** and **collabora** password from vaultwarden
+```
+sed -i 's/__POSTGRES_PASSWORD__/nextcloudstrongpassword/g' config.php secrets/librezo.secrets
+sed -i 's/__COLLABORA_PASSWORD__/collaborastrongpassword/g' config.php secrets/librezo.secrets
+```
+
+4. Start traefik
+```
+cd traefik
+docker-compose up -d
+```
+5.  Create docker containers and volume
+```
+docker-compose up --no-start
+```
+6. Import database
+``` 
+docker cp nc.dump nextcloud-db:/nc.dmp
+docker-compose up -d nextcloud-db
+docker-compose exec nextcloud-db sh -c "pg_restore -d nc -U nc nc.dmp"
+docker-compose exec nextcloud-db rm /nc.dmp
+```
+7. Copy files and set correct rights
+```
+docker cp /var/lib/backuppc/migration/data nextcloud-app:/var/www/html/
+cp config.php nextcloud-app:/var/www/html/config/config.php
+docker-compose up -d nextcloud-app 
+docker-compose exec nextcloud-app chown -R www-data:www-data /var/www/html/data
+docker-compose exec nextcloud-app chown -R www-data:www-data /var/www/html/config/config.php
+```
+8. restart docker-compose
+```
+docker-compose restart
+```
+
+### Configure collabora <!--onlyoffice?-->
+1. connect to nextcloud
+2. go to paramètres->nextcloud office-> utiliser mon propre serveur
+3. choisir `code.oasis21.org`, décocher l'option `ne pas vérifier le certificat`
+4. désinstaller l'application collabora built-in serveur
--- a/backups/.autorestic.yml
+++ b/backups/.autorestic.yml
@@ -0,0 +1,81 @@
+version: 2
+
+
+global:
+  forget:
+    keep-hourly: 24
+    keep-daily: 7
+    keep-weekly: 4
+    keep-monthly: 12
+
+backends:
+  fch:
+    type: sftp
+    path: FCH_serveur:backups/
+
+locations:
+  nextcloud_data:
+    from:
+    - /var/lib/docker/volumes/docker_nextcloud
+    to:
+    - fch
+    cron: 0 0 * * *
+    forget: prune
+
+
+  nextcloud_conf:
+    from:
+    - /var/lib/docker/volumes/docker_nextcloud-conf
+    to:
+    - fch
+    cron: 0 0 * * *
+    forget: prune
+
+  nextcloud_data:
+    from:
+    - /var/lib/docker/volumes/docker_nextcloud
+    to:
+    - fch
+    cron: 0 0 * * *
+    forget: prune
+
+  nextcloud_db:
+    from:
+    - /DATA/dump_bdd/nextcloud-db
+    to:
+    - fch
+    cron: 0 0 * * *
+    forget: prune
+    hooks:
+      before:
+      - /DATA/docker/services/backups/backup_db.sh nextcloud-db  postgresql
+
+  onlyoffice:
+    from:
+    - /var/lib/docker/volumes/docker_onlyoffice-cache
+    - /var/lib/docker/volumes/docker_onlyoffice-data
+    to:
+    - fch
+    cron: 0 0 * * *
+    forget: prune
+
+  traefik-certs:
+     from:
+     - /DATA/docker/services/certs
+     to:
+     - fch
+     cron: 0 0 * * *
+     forget: prune
+
+  repos:
+     from:
+     - /DATA/docker/services/
+     to:
+     - fch
+     options:
+       backup:
+         exclude:
+         - '.git'
+     cron: 0 0 * * *
+     forget: prune
+
--- a/backups/autorestic.service
+++ b/backups/autorestic.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Backups yay
+ 
+[Service]
+Type=oneshot
+ExecStart=autorestic -c /DATA/docker/services/backups/.autorestic.yml --ci cron
+# fail if backup takes more than 1 day
+TimeoutStartSec=86400
+IPAccounting=yes
+MemoryAccounting=yes
--- a/backups/autorestic.timer
+++ b/backups/autorestic.timer
@@ -0,0 +1,9 @@
+[Unit]
+Description=Backups yay
+ 
+[Timer]
+# Trigger every 10 minutes
+OnCalendar=*:0/10:0
+ 
+[Install]
+WantedBy=timers.target
--- a/backups/backup_db.sh
+++ b/backups/backup_db.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+# usage: <script> <container-name> <database-type>
+# 
+# exports the database of a running docker container in a dump in $BACKUP_DIR/$CONTAINER_NAME/
+
+BACKUP_DIR=/DATA/dump_bdd/
+
+# Check container existence
+
+CONTAINER="$1"
+
+if ! docker ps | grep -q "$CONTAINER"
+then
+  echo "The container $CONTAINER doesn't exist or doesn't run"
+  exit 1
+fi
+
+# Check database type
+
+TYPE="$2"
+
+COMMAND=""
+
+case "$TYPE" in
+  postgresql)
+    POSTGRES_USER=$(docker exec "$CONTAINER" env | grep POSTGRES_USER | cut -d= -f2)
+    COMMAND="pg_dumpall -c -U $POSTGRES_USER"
+    EXTENSION=sql
+    ;;
+  mariadb)
+    MARIADB_USER=$(docker exec "$CONTAINER" env | grep MYSQL_USER | cut -d= -f2)
+    MARIADB_PASSWORD=$(docker exec "$CONTAINER" env | grep MYSQL_PASSWORD | cut -d= -f2)
+    COMMAND="mariadb-dump -u $MARIADB_USER --password=$MARIADB_PASSWORD --all-databases"
+    EXTENSION=sql
+    ;;
+  mongodb)
+    COMMAND="mongodump --archive"
+    EXTENSION=mongodump
+    ;;
+  ldap-config)
+    COMMAND="slapcat -n 0"
+    EXTENSION=config.ldif
+    ;;
+  ldap-content)
+    COMMAND="slapcat -n 1"
+    EXTENSION=content.ldif
+    ;;
+  *)
+    echo "I don't know $TYPE database type."
+    exit 1
+esac
+
+# Ensure directory exists
+
+mkdir -p "$BACKUP_DIR/$CONTAINER"
+
+# Export database
+
+docker exec "$CONTAINER" $COMMAND > "$BACKUP_DIR/$CONTAINER/dump.$EXTENSION"
+exit $?
--- a/dump_bdd_volumes.sh
+++ b/dump_bdd_volumes.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+docker exec nextcloud-db pg_dumpall -U nc > /DATA/dump_bdd/nextcloud.sql
--- a/nextcloud-pica/README.md
+++ b/nextcloud-pica/README.md
@@ -1,39 +0,0 @@
-## NextCloud
-
-Ce dossier contient les ressources nécessaires pour lancer une ou plusieurs instances NextCloud.
-
-Voir également le [wiki](https://wiki.picasoft.net/doku.php?id=technique:adminserv:nextcloud).
-
-### Configuration
-
-Quasiment aucune configuration n'est effectuée via les fichiers de ce dépôt, et on préfère l'interface web.
-Le défaut est qu'il n'est pas possible de lancer des instances NextCloud **vraiment** personnalisées depuis ce dépôt, mais c'est parce que le format des fichiers de configuration est amené à évoluer et que NextCloud effectue des migrations automatiques lors des mises à jour.
-
-Versionner les fichiers de configuration serait donc en conflit avec les modifications automatiques effectuées par NextCloud lors des mises à jour et des changements dans l'interface.
-
-Les fichiers `nginx.conf` sont repris de [cet exemple](https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf).
-
-### Lancement
-
-Copier les fichiers `.secrets.example` en `.secrets` et remplacer les valeurs.
-Lancer `docker-compose up -d`.
-
-### Mise à jour
-
-Pour mettre à jour l'instance de Picasoft, il suffit de mettre à jour le tag de l'image officielle de NextCloud.
-
-Attention : **toutes les mises à jour de version majeure doivent se faire une par une**. Les logs applicatifs détaillent la mise à jour.
-Exemple :
-* 15 -> 16, puis
-* 16 -> 17, puis
-* 17 -> 18.
-
-Sinon, il y a risque de casse.
-
-### Mise à jour de MariaDB
-
-[Selon la documentation](https://mariadb.com/kb/en/upgrading-between-major-mariadb-versions/) :
-
-> MariaDB is designed to allow easy upgrades. You should be able to trivially upgrade from ANY earlier MariaDB version to the latest one (for example MariaDB 5.5.x to MariaDB 10.5.x), usually in a few seconds.
-
-L'idée est d'éteindre le conteneur applicatif (NextCloud), puis de lancer la nouvelle version du conteneur, d'entrer dedans, de lancer la commande `mysql_upgrade` et de redémarrer le conteneur.
--- a/nextcloud-pica/nginx.conf
+++ b/nextcloud-pica/nginx.conf
@@ -1,182 +0,0 @@
-worker_processes auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-
-events {
-    worker_connections  1024;
-}
-
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    set_real_ip_from  10.0.0.0/8;
-    set_real_ip_from  172.16.0.0/12;
-    set_real_ip_from  192.168.0.0/16;
-    real_ip_header    X-Real-IP;
-
-    #gzip  on;
-
-    upstream php-handler {
-        server nextcloud-app:9000;
-    }
-
-    server {
-        listen 80;
-
-# HSTS settings
-    # WARNING: Only add the preload option once you read about
-    # the consequences in https://hstspreload.org/. This option
-    # will add the domain to a hardcoded list that is shipped
-    # in all major browsers and getting removed from this list
-    # could take several months.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
-
-    # set max upload size and increase upload timeout:
-    client_max_body_size 512M;
-    client_body_timeout 300s;
-    fastcgi_buffers 64 4K;
-
-    # Enable gzip but do not remove ETag headers
-    gzip on;
-    gzip_vary on;
-    gzip_comp_level 4;
-    gzip_min_length 256;
-    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-    # Pagespeed is not supported by Nextcloud, so if your server is built
-    # with the `ngx_pagespeed` module, uncomment this line to disable it.
-    #pagespeed off;
-
-    # HTTP response headers borrowed from Nextcloud `.htaccess`
-    add_header Referrer-Policy                      "no-referrer"   always;
-    add_header X-Content-Type-Options               "nosniff"       always;
-    add_header X-Download-Options                   "noopen"        always;
-    add_header X-Frame-Options                      "SAMEORIGIN"    always;
-    add_header X-Permitted-Cross-Domain-Policies    "none"          always;
-    add_header X-Robots-Tag                         "none"          always;
-    add_header X-XSS-Protection                     "1; mode=block" always;
-
-    # Remove X-Powered-By, which is an information leak
-    fastcgi_hide_header X-Powered-By;
-
-    # Path to the root of your installation
-    root /var/www/html;
-
-    # Specify how to handle directories -- specifying `/index.php$request_uri`
-    # here as the fallback means that Nginx always exhibits the desired behaviour
-    # when a client requests a path that corresponds to a directory that exists
-    # on the server. In particular, if that directory contains an index.php file,
-    # that file is correctly served; if it doesn't, then the request is passed to
-    # the front-end controller. This consistent behaviour means that we don't need
-    # to specify custom rules for certain paths (e.g. images and other assets,
-    # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
-    # `try_files $uri $uri/ /index.php$request_uri`
-    # always provides the desired behaviour.
-    index index.php index.html /index.php$request_uri;
-
-    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
-    location = / {
-        if ( $http_user_agent ~ ^DavClnt ) {
-            return 302 /remote.php/webdav/$is_args$args;
-        }
-    }
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    # Make a regex exception for `/.well-known` so that clients can still
-    # access it despite the existence of the regex rule
-    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
-    # for `/.well-known`.
-    location ^~ /.well-known {
-        # The rules in this block are an adaptation of the rules
-        # in `.htaccess` that concern `/.well-known`.
-
-        location = /.well-known/carddav { return 301 /remote.php/dav/; }
-        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
-
-        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
-
-        # Let Nextcloud's API for `/.well-known` URIs handle all other
-        # requests by passing them to the front-end controller.
-        return 301 /index.php$request_uri;
-    }
-
-    # Rules borrowed from `.htaccess` to hide certain paths from clients
-    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
-
-    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-    # which handle static assets (as seen below). If this block is not declared first,
-    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
-    # to the URI, resulting in a HTTP 500 error response.
-    location ~ \.php(?:$|/) {
-        # Required for legacy support
-        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
-
-        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-        set $path_info $fastcgi_path_info;
-
-        try_files $fastcgi_script_name =404;
-
-        include fastcgi_params;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $path_info;
-        fastcgi_param HTTPS on;
-
-        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-        fastcgi_param front_controller_active true;     # Enable pretty urls
-        fastcgi_pass php-handler;
-
-        fastcgi_intercept_errors on;
-        fastcgi_request_buffering off;
-
-        fastcgi_max_temp_file_size 0;
-    }
-
-    location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
-        try_files $uri /index.php$request_uri;
-        expires 6M;         # Cache-Control policy borrowed from `.htaccess`
-        access_log off;     # Optional: Don't log access to assets
-
-        location ~ \.wasm$ {
-            default_type application/wasm;
-        }
-    }
-
-    location ~ \.woff2?$ {
-        try_files $uri /index.php$request_uri;
-        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
-        access_log off;     # Optional: Don't log access to assets
-    }
-
-    # Rule borrowed from `.htaccess`
-    location /remote {
-        return 301 /remote.php$request_uri;
-    }
-
-    location / {
-        try_files $uri $uri/ /index.php$request_uri;
-    }
-}
-}
--- a/nextcloud-pica/secrets/pica.secrets.example
+++ b/nextcloud-pica/secrets/pica.secrets.example
@@ -1,4 +0,0 @@
-MYSQL_ROOT_PASSWORD=password
-MYSQL_DATABASE=nextcloud
-MYSQL_USER=nextcloud
-MYSQL_PASSWORD=password
--- a/nextcloud-pica/zz-php-custom.ini
+++ b/nextcloud-pica/zz-php-custom.ini
--- a/nextcloud-pica/zz-php-fpm-custom.conf
+++ b/nextcloud-pica/zz-php-fpm-custom.conf
@@ -1,7 +0,0 @@
-[www]
-pm = dynamic
-pm.max_children = 50
-pm.start_servers = 15
-pm.min_spare_servers = 15
-pm.max_spare_servers = 25
-pm.max_requests = 500
--- a/nextcloud-pica/.gitignore
+++ b/nextcloud-pica/.gitignore
@@ -1,2 +1,3 @@
 *.secrets
 .env
+config.php
--- a/nextcloud-pica/.nginx.conf.swp
+++ b/nextcloud-pica/.nginx.conf.swp
--- a/nextcloud-pica/docker-compose.yml
+++ b/nextcloud-pica/docker-compose.yml
@@ -2,9 +2,15 @@ version: '3.7'

 volumes:
  nextcloud-db:
-    name: docker_nextcloud-db
-  nextcloud:
+    name: docker_nextcloud-db-15
+  nextcloud-data:
    name: docker_nextcloud
+  nextcloud:
+    name: docker_nextcloud-conf
+  onlyoffice-cache:
+    name: docker_onlyoffice-cache
+  onlyoffice-db:
+    name: docker_onlyoffice-db

 networks:
  nextcloud:
@@ -13,68 +19,50 @@ networks:

 services:
  nextcloud-app:
-    image: nextcloud:23.0.4-fpm-alpine
+    image: nextcloud-cron:26.0.11
+    build: .
    container_name: nextcloud-app
    restart: unless-stopped
+    extra_hosts :
+      office.oasis21.org : 172.16.7.10
    volumes:
      - nextcloud:/var/www/html
-      - ./zz-php-custom.ini:/usr/local/etc/php/conf.d/zz-php-custom.ini
-      - ./zz-php-fpm-custom.conf:/usr/local/etc/php-fpm.d/zz-php-custom.conf
+      - nextcloud-data:/var/www/html/data
    environment:
      - "TZ=Europe/Paris"
-      - POSTGRES_HOST=nextcloud-db
      - REDIS_HOST=redis
    env_file: ./secrets/librezo.secrets
-    extra_hosts:
-      - code.librezo.xyz:192.168.1.70
    depends_on:
      - nextcloud-db
      - redis
-    networks:
-      - nextcloud
-    restart: unless-stopped
-
-  nextcloud-web:
-    image: nginx:alpine
-    container_name: nextcloud-web
-    volumes:
-      - nextcloud:/var/www/html:ro
-      - ./nginx.conf:/etc/nginx/nginx.conf:ro
-    env_file: ./secrets/librezo.secrets
-    extra_hosts:
-      - code.librezo.xyz:192.168.1.70
-    depends_on:
-      - nextcloud-app
-    environment:
-      TZ: Europe/Paris
    networks:
      - nextcloud
      - proxy
    labels:
      traefik.http.routers.nextcloud-web.entrypoints: websecure
-      traefik.http.routers.nextcloud-web.rule: Host(`cloud.librezo.xyz`)
+      traefik.http.routers.nextcloud-web.rule: Host(`cloud.oasis21.org`)
      traefik.http.services.nextcloud-web.loadbalancer.server.port: 80
      traefik.enable: true
      # https://docs.nextcloud.com/server/16/admin_manual/configuration_server/reverse_proxy_configuration.html
-      traefik.http.routers.nextcloud-web.middlewares: nextcloud-web@docker
+      traefik.http.routers.nextcloud-web.middlewares: nextcloud-web@docker, allowFrameAndCORS@file
      traefik.http.middlewares.nextcloud-web.redirectregex.permanent: true
-      traefik.http.middlewares.nextcloud-web.redirectregex.regex: ^/.well-known/(card|cal)dav
-      traefik.http.middlewares.nextcloud-web.redirectregex.replacement: /remote.php/dav/
-    restart: unless-stopped
+      traefik.http.middlewares.nextcloud-web.redirectregex.regex: "https://(.*)/.well-known/(card|cal)dav"
+      traefik.http.middlewares.nextcloud-web.redirectregex.replacement: "https://$${1}/remote.php/dav/"

  redis:
-    image: redis
-    image: 'bitnami/redis:latest'
+    image: 'bitnami/redis:7.0.10'
    container_name: redis
+    restart: unless-stopped
    environment:
-      - ALLOW_EMPTY_PASSWORD=yes
      - "TZ=Europe/Paris"
+      - ALLOW_EMPTY_PASSWORD=yes
+    env_file: ./secrets/librezo.secrets
    networks:
      - nextcloud


  nextcloud-db:
-    image: postgres:11
+    image: postgres:15-alpine
    container_name: nextcloud-db
    volumes:
      - nextcloud-db:/var/lib/postgresql/data
@@ -85,30 +73,31 @@ services:
      - "TZ=Europe/Paris"
    restart: unless-stopped

-  collabora:
-    image: libreoffice/online:master
-    container_name: collabora
-#    ports:
-#      - 9980:9980
-#    expose:
-#      - "9980" 
+  onlyoffice:
+    build: 
+      context: .
+      dockerfile: ./dockerfile-oo
+    container_name: onlyoffice
+    image: onlyoffice:7.5.1
+    restart: unless-stopped
+    extra_hosts :
+      cloud.oasis21.org : 172.16.7.10
    environment:
-      - "TZ=Europe/Paris"
-      - domain=cloud\.librezo\.xyz
-      - username=nextcloud
-      - password=password
-      - serveur_name=code\.librezo\.xyz
-      - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
-    networks:
+      - JWT_ENABLED=true
+      - JWT_SECRET=MvaG9zdHMgCnN1ZG8gbmFubyAvZXRjL2hvc3RzIApzY3AgVMOpbMOpY
+      - FORCESAVE_ENABLE=true
+      - FORCESAVE_INTERVAL=2m
+      - FORCESAVE_STEP=5m
+    volumes:
+      - onlyoffice-cache:/var/lib/onlyoffice/documentserver/App_Data
+      - onlyoffice-db:/var/lib/postgresql
+    labels:
+      traefik.http.routers.onlyoffice.entrypoints: websecure
+      traefik.http.routers.onlyoffice.rule: Host(`office.oasis21.org`)
+      traefik.http.services.onlyoffice.loadbalancer.server.port: 80
+      traefik.enable: true
+      traefik.http.routers.onlyoffice.middlewares: allowFrameAndCORS@file, onlyoffice-sslheaders
+      traefik.http.middlewares.onlyoffice-sslheaders.headers.customrequestheaders.X-Forwarded-Proto: "https"
+    networks: 
      - nextcloud
      - proxy
-    cap_add:
-      - MKNOD
-    restart:
-      unless-stopped
-    labels:
-      traefik.http.routers.collabora.entrypoints: websecure
-      traefik.http.routers.collabora.rule: Host(`code.librezo.xyz`)
-      traefik.http.services.collabora.loadbalancer.server.port: 9980
-      traefik.enable: true
-
--- a/nextcloud/dockerfile
+++ b/nextcloud/dockerfile
@@ -0,0 +1,15 @@
+FROM nextcloud:26.0.11-apache
+
+ARG VERSION
+
+RUN apt-get update && apt-get install -y \
+    supervisor \
+    libmagickcore-6.q16-6-extra \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir /var/log/supervisord /var/run/supervisord
+
+COPY supervisord.conf /
+
+ENV NEXTCLOUD_UPDATE=1
+
+CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
--- a/nextcloud/dockerfile-oo
+++ b/nextcloud/dockerfile-oo
@@ -0,0 +1,9 @@
+FROM thomisus/onlyoffice-documentserver-unlimited:7.5.1
+
+ARG VERSION
+
+RUN sed -i '27i FORCESAVE_ENABLE=${FORCESAVE_ENABLE:-false}\nFORCESAVE_INTERVAL=${FORCESAVE_INTERVAL:-5m}\nFORCESAVE_STEP=${FORCESAVE_STEP:-1m}\n' /app/ds/run-document-server.sh
+RUN sed -i '340i  ${JSON} -I -e "if(this.services.CoAuthoring.autoAssembly===undefined)this.services.CoAuthoring.autoAssembly={};"' /app/ds/run-document-server.sh
+RUN sed -i '341i  ${JSON} -I -e "this.services.CoAuthoring.autoAssembly.enable = ${FORCESAVE_ENABLE}"' /app/ds/run-document-server.sh
+RUN sed -i '342i  ${JSON} -I -e "this.services.CoAuthoring.autoAssembly.interval = \x27${FORCESAVE_INTERVAL}\x27"' /app/ds/run-document-server.sh
+RUN sed -i '343i  ${JSON} -I -e "this.services.CoAuthoring.autoAssembly.step = \x27${FORCESAVE_STEP}\x27"\n' /app/ds/run-document-server.sh
--- a/nextcloud/onlyoffice.tar.gz
+++ b/nextcloud/onlyoffice.tar.gz
--- a/nextcloud/secrets/librezo.secrets.example
+++ b/nextcloud/secrets/librezo.secrets.example
@@ -0,0 +1,6 @@
+POSTGRES_PASSWORD=__POSTGRES_PASSWORD__
+POSTGRES_DB=nc
+POSTGRES_USER=nc
+POSTGRES_HOST=nextcloud-db
+username=nextcloud
+password=__COLLABORA_PASSWORD__
--- a/nextcloud/share.sql
+++ b/nextcloud/share.sql
@@ -0,0 +1,270 @@
+--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 11.16 (Debian 11.16-1.pgdg90+1)
+-- Dumped by pg_dump version 11.16 (Debian 11.16-1.pgdg90+1)
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+SET default_tablespace = '';
+
+SET default_with_oids = false;
+
+--
+-- Name: oc_share; Type: TABLE; Schema: public; Owner: nc
+--
+
+CREATE TABLE public.oc_share (
+    id bigint NOT NULL,
+    share_type smallint DEFAULT 0 NOT NULL,
+    share_with character varying(255) DEFAULT NULL::character varying,
+    password character varying(255) DEFAULT NULL::character varying,
+    uid_owner character varying(64) DEFAULT ''::character varying NOT NULL,
+    uid_initiator character varying(64) DEFAULT NULL::character varying,
+    parent bigint,
+    item_type character varying(64) DEFAULT ''::character varying NOT NULL,
+    item_source character varying(255) DEFAULT NULL::character varying,
+    item_target character varying(255) DEFAULT NULL::character varying,
+    file_source bigint,
+    file_target character varying(512) DEFAULT NULL::character varying,
+    permissions smallint DEFAULT 0 NOT NULL,
+    stime bigint DEFAULT 0 NOT NULL,
+    accepted smallint DEFAULT 0 NOT NULL,
+    expiration timestamp(0) without time zone DEFAULT NULL::timestamp without time zone,
+    token character varying(32) DEFAULT NULL::character varying,
+    mail_send smallint DEFAULT 0 NOT NULL,
+    share_name character varying(64) DEFAULT NULL::character varying,
+    password_by_talk boolean DEFAULT false,
+    note text,
+    hide_download smallint DEFAULT 0,
+    label character varying(255) DEFAULT NULL::character varying
+);
+
+
+ALTER TABLE public.oc_share OWNER TO nc;
+
+--
+-- Name: oc_share_id_seq; Type: SEQUENCE; Schema: public; Owner: nc
+--
+
+CREATE SEQUENCE public.oc_share_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+
+ALTER TABLE public.oc_share_id_seq OWNER TO nc;
+
+--
+-- Name: oc_share_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: nc
+--
+
+ALTER SEQUENCE public.oc_share_id_seq OWNED BY public.oc_share.id;
+
+
+--
+-- Name: oc_share id; Type: DEFAULT; Schema: public; Owner: nc
+--
+
+ALTER TABLE ONLY public.oc_share ALTER COLUMN id SET DEFAULT nextval('public.oc_share_id_seq'::regclass);
+
+
+--
+-- Data for Name: oc_share; Type: TABLE DATA; Schema: public; Owner: nc
+--
+
+COPY public.oc_share (id, share_type, share_with, password, uid_owner, uid_initiator, parent, item_type, item_source, item_target, file_source, file_target, permissions, stime, accepted, expiration, token, mail_send, share_name, password_by_talk, note, hide_download, label) FROM stdin;
+1	3	\N	\N	admin.local	admin.local	\N	file	1314	\N	1314	/Test feuille.xlsx	19	1644510958	0	\N	RiHyHyWRBw4qAQH	0	\N	f		0	
+2	3	\N	\N	admin.local	admin.local	\N	folder	2504	\N	2504	/Comité d'engagement	17	1648638034	0	\N	5AJWRE2aaqSJZrW	0	\N	f	\N	0	
+3	6	fredj@merlinsystem.com/nextcloud	\N	Frederic Jozon	Frederic Jozon	\N	folder	1342	\N	1342		31	1649147646	0	\N	ePDMGozFDzRfsrl	0	\N	f	\N	0	\N
+6	3	\N	\N	admin.local	admin.local	\N	folder	2761	\N	2761	/Comité d'engagement	17	1649753193	0	\N	cE3i7ngpnCkNiKG	0	\N	f	\N	0	
+8	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	13201	\N	13201	/Rencontres Oasis septembre 2022 - Modèle économique et tarification.ods	19	1649779159	0	\N	4KkdJRCcE3aZ3Qn	0	\N	f		0	
+7	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	13202	\N	13202	/Rencontres Oasis à Oasis du 22-24 septembre 2022 - modèle.odt	19	1649779067	0	\N	FK7jRfJQNDbkxzT	0	\N	f		0	
+9	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	16898	\N	16898	/Rencontres oasis à oasis 22-24 septembre - Rôles et redevabilités.ods	19	1649927426	0	\N	apsEJtEQsa9rxAz	0	\N	f		0	
+10	3	\N	\N	admin.local	admin.local	\N	file	22287	\N	22287	/Organisation Nextcloud - Coopérative Oasis.ods	19	1650448091	0	\N	5BokzgJBko3pFfx	0	\N	f		0	
+12	3	\N	\N	admin.local	admin.local	\N	file	22287	\N	22287	/Organisation Nextcloud - Coopérative Oasis.ods	17	1650448199	0	\N	DC3nRSCK4NWRNJT	0	\N	f	\N	0	
+13	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	23231	\N	23231	/Matrice lieux d'accueil 2021.ods	17	1650449222	0	\N	iK2Be9HPynaqwwL	0	\N	f	\N	0	
+14	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	23230	\N	23230	/Coop oasis - modèle économique Ramïn.ods	17	1650449289	0	\N	cPiqttifmYx72Hx	0	\N	f	\N	0	
+15	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	23453	\N	23453	/Cercle 0 - le Noyau.ods	17	1650449384	0	\N	GkcGngL43NgyZzq	0	\N	f	\N	0	
+16	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	23454	\N	23454	/Cercle 1 - Oasis à Oasis.ods	17	1650449409	0	\N	DociBAAsP3YkXCi	0	\N	f	\N	0	
+17	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	23450	\N	23450	/Coop Oasis - design webinaires et lettres OàO à partir de mai 2022.odt	17	1650449488	0	\N	QKbEkPZb7soGzR3	0	\N	f	\N	0	
+18	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24699	\N	24699	/Rencontres 2022 - Est - Modèle économique et tarification.ods	17	1650554473	0	\N	ogPgApGFEyfgDJx	0	\N	f	\N	0	
+19	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24911	\N	24911	/Rencontres 2022 - Est - Cadre général et programme.odt	19	1650555825	0	\N	eWMAG8MGC6zZHoD	0	\N	f		0	
+20	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24894	\N	24894	/Rencontres 2022 - Est - Modèle économique et tarification.ods	17	1650555983	0	\N	DrzTjS6B4anTnTe	0	\N	f	\N	0	
+21	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24898	\N	24898	/Rencontres 2022 - Sud - Modèle économique et tarification.ods	19	1650562138	0	\N	57mf2RGFELMpFdF	0	\N	f		0	
+22	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24906	\N	24906	/Rencontres 2022 - Sud - Cadre général et programme.odt	19	1650562315	0	\N	8Toq2YgwA2Sn2Ni	0	\N	f		0	
+27	1	Coopérative Oasis	\N	Mathieu Labonne	Mathieu Labonne	\N	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	0	\N	\N	0	\N	f	\N	0	\N
+28	2	admin.local	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+29	2	Aurore Borowik	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+32	2	Fabrice Perez	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+33	2	Fabrice Tournier-Courtes	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+34	2	Frederic Jozon	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+35	2	Gabrielle Paoli	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+36	2	Ludovic Simon	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+37	2	Mathieu Labonne	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+39	2	Ramin Farhangi	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+40	3	\N	\N	Fabrice Perez	Fabrice Perez	\N	file	9867	\N	9867	/Cooperative-Oasis-Dossier-presse-juin-2021.pdf	17	1650966233	0	\N	oycXHPJz95Z85Mi	0	\N	f	\N	0	
+41	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	24753	\N	24753	/Rencontres 2022 - Est - Rôles et redevabilités.ods	17	1650975010	0	\N	pEFKH3e72GnkJeP	0	\N	f	\N	0	
+42	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	27471	\N	27471	/Rencontres 2022 - Ouest - Modèle économique et tarification.ods	19	1650986878	0	\N	FNYfwYTaqmZCymY	0	\N	f		0	
+43	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	27472	\N	27472	/Rencontres 2022 - Ouest - Rôles et redevabilités.ods	19	1650986902	0	\N	G5bbrtWEfFSyt89	0	\N	f		0	
+44	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	27473	\N	27473	/Rencontres 2022 - Ouest - Cadre général et programme.odt	19	1650986912	0	\N	R5foCAtH2wEbP8g	0	\N	f		0	
+45	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	23624	\N	23624	/Pad réunions d'équipe.md	19	1651002550	0	\N	yobqRirJwdxNQ4M	0	\N	f		0	
+47	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	29498	\N	29498	/Coop Oasis - organisation, rôles et redevabilités.ods	19	1651053500	0	\N	rLjcxCRFW6GywDn	0	\N	f		0	
+48	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	44086	\N	44086	/Curriculum Vitae du représentant légal de la Coopérative Oasis.pdf	17	1651151428	0	\N	mBgSj3n24ot6MoX	0	\N	f	\N	0	
+49	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56294	\N	56294	/Levées de fonds Coopérative Oasis.ods	17	1651502448	0	\N	BMHK8b2KjT9wR7Q	0	\N	f	\N	0	
+50	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56317	\N	56317	/Rapport Du commissaire aux comptes sur les comptes annuels _ exercice clos le 31 décembre 2020.pdf	17	1651502525	0	\N	3x7QodjTHetMQd6	0	\N	f	\N	0	
+51	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56318	\N	56318	/COOPERATIVE OASIS - Comptes annuels 31_12_2020.pdf	17	1651502612	0	\N	8t2iRz5bHqnceZY	0	\N	f	\N	0	
+52	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56310	\N	56310	/Échéancier de l’endettement sur 5 ans _ Coopérative Oasis.ods	17	1651502700	0	\N	XReCHP6DGN3boqY	0	\N	f	\N	0	
+53	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56295	\N	56295	/Prévisionnel d'activité _ Coopérative Oasis.ods	17	1651502753	0	\N	Lm4zfy3bcLz8yY5	0	\N	f	\N	0	
+54	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56309	\N	56309	/Curriculum Vitae du représentant légal de la Coopérative Oasis.pdf	17	1651502798	0	\N	cJeybXSe45ijqt8	0	\N	f	\N	0	
+55	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56354	\N	56354	/PV CA_Coop OASIS_2018_12_11.pdf	17	1651502911	0	\N	9qjbxAg6X5iCB7s	0	\N	f	\N	0	
+56	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56347	\N	56347	/Tableau de répartition de l'actionnariat _ Coopérative Oasis.ods	17	1651502967	0	\N	HjjTZwSEzA7xqtm	0	\N	f	\N	0	
+57	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56366	\N	56366	/Articles 17 et 20 des statuts de la SCIC SA COOPERATIVE OASIS.pdf	17	1651503040	0	\N	9bQwdrtxzr6WHn3	0	\N	f	\N	0	
+58	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56375	\N	56375	/Articles 12 et 15 des statuts de la SCIC SA COOPERATIVE OASIS.pdf	17	1651503104	0	\N	sEXQxRWWHaWEnHt	0	\N	f	\N	0	
+59	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56387	\N	56387	/Articles 8 et 11 des statuts de la SCIC SA COOPERATIVE OASIS.pdf	17	1651503166	0	\N	BMmNzxpNKsqBj74	0	\N	f	\N	0	
+60	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56388	\N	56388	/Bulletin-personne-physique.pdf	17	1651503271	0	\N	kG8Xd44MzzE4XjM	0	\N	f	\N	0	
+61	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56389	\N	56389	/Bulletin-personne-morale.pdf	17	1651503294	0	\N	cATQLYqiLSKxrLW	0	\N	f	\N	0	
+62	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	56596	\N	56596	/Tableau des congés.ods	17	1651514240	0	\N	z5y8GMyGfqg47se	0	\N	f	\N	0	
+63	3	\N	\N	Fabrice Perez	Fabrice Perez	\N	folder	13641	\N	13641	/Kit Com Oasis Convention	17	1651593789	0	\N	4RoPNQi4LtdBEWg	0	\N	f	\N	0	
+76	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	file	90674	\N	90674	/CAP SUR LES OASIS Communqué de lancement.odt	19	1652263931	0	\N	Q3xoozjSTnCasFp	0	\N	f		0	
+67	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	83251	\N	83251	/Comité stratégique 2022-05-06.odt	17	1651858176	0	\N	5XQ5ft26xMb35jf	0	\N	f	\N	0	
+69	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	83691	\N	83691	/COOPERATIVE OASIS - COMPTES ANNUELS_2021.pdf	17	1652168085	0	\N	MfQYqj7o9RZ3j2S	0	\N	f	\N	0	
+71	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	file	90259	\N	90259	/Cap sur les Oasis Dossier de présentation.pdf	17	1652261112	0	\N	zDWBmS4pxyFxBDb	0	\N	f	\N	0	
+72	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	file	90266	\N	90266	/Cap sur les Oasis du Sud-Ouest - Saison 1 - Bande-annonce.mp4	17	1652261177	0	\N	pytgTxtkmnEqNQc	0	\N	f	\N	0	
+73	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	folder	90495	\N	90495	/Bannières et titres	17	1652261644	0	\N	gKTkmFRsCksj2Qe	0	\N	f	\N	0	
+74	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	folder	90317	\N	90317	/Vignettes	17	1652261666	0	\N	fdmbaNRAKnHHfbt	0	\N	f	\N	0	
+75	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	folder	90318	\N	90318	/Photos	17	1652261677	0	\N	3bFd64fdH5CgCyQ	0	\N	f	\N	0	
+77	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	file	90255	\N	90255	/CAP SUR LES OASIS Kit de communication.odt	19	1652264032	0	\N	bTp4zkCQo2HXzBr	0	\N	f		0	
+78	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	90720	\N	90720	/Invités Rencontres 2022.ods	17	1652265835	0	\N	B2Q2e4qKm2sCiaP	0	\N	f	\N	0	
+79	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	folder	86204	\N	86204	/TERRE DE MILPA	17	1652290862	0	\N	CCY97ajdT5XQ26k	0	\N	f	\N	0	
+80	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	91288	\N	91288	/TDM_présentation_Ferme_des_Seignes.pdf	17	1652290928	0	\N	ANXpRJDtzDtWQ9i	0	\N	f	\N	0	
+70	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	folder	90253	\N	90253	/Kit Com Cap sur les oasis	17	1652261040	0	\N	ZZi7XzXJg6jpoR5	0	\N	f		0	
+81	3	\N	\N	Mathieu Labonne	Fabrice Perez	27	file	90260	\N	90260	/CAP SUR LES OASIS Calendrier de diffusion.jpg	17	1652789736	0	\N	FAfKtgHoyGA9JBC	0	\N	f	\N	0	
+83	3	\N	\N	serveur	serveur	\N	file	1314	\N	1314	/Test feuille.xlsx	17	1652968350	0	\N	ingaEtoE3gSZQFw	0	\N	f	\N	0	
+86	2	daphne_vialan	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+87	3	\N	\N	admin.local	admin.local	\N	file	166356	\N	166356	/Quartier circulaire.odt	17	1653038891	0	\N	Sdgd3f6YnYx8EAC	0	\N	f	\N	0	
+90	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	166448	\N	166448	/Suivi contacts Oasis (hors ou avant prêt).xlsx	17	1653300018	0	\N	5p8wFonaNPWds59	0	\N	f	\N	0	
+93	2	nathalie_boquien	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+94	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	177009	\N	177009	/Fiche de rôle Communication et inspiration.docx	17	1653413869	0	\N	StXYQ6QBffdRYTs	0	\N	f	\N	0	
+95	2	coralie_darsy	\N	Mathieu Labonne	Mathieu Labonne	27	folder	8954	\N	8954	/INSPIRATION DOCUMENTATION	31	1650965478	1	\N	\N	0	\N	f	\N	0	\N
+88	3	\N	\N	daphne_vialan	daphne_vialan	\N	file	25818	\N	25818	/Mandat Rôle Prendre soin de l'Humain.xlsx	17	1653147142	0	\N	zP7YxQPRjkR2nyH	0	\N	f		0	pour les oasis
+96	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	file	186155	\N	186155	/Fiche de rôle Communication et inspiration.pdf	17	1653998560	0	\N	i9G3RZECZoKfmXJ	0	\N	f	\N	0	
+97	3	\N	\N	daphne_vialan	daphne_vialan	\N	file	176905	\N	176905	/Coop Oasis - organisation, rôles et redevabilités.ods	17	1654028293	0	\N	mj75WDXG8GmSB3M	0	\N	f	\N	0	
+98	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	folder	183238	\N	183238	/Docs finaux pour Comité engagement - Petite Graine	17	1654201973	0	\N	3LnrDmeATnsGH2g	0	\N	f	\N	0	
+99	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	folder	183238	\N	183238	/Docs finaux pour Comité engagement - Petite Graine	17	1654201983	0	\N	kbNeASGgiBxoWEC	0	\N	f	\N	0	
+100	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	folder	23684	\N	23684	/Comite engagement	17	1654430328	0	\N	XjDKqknYNNjEFkt	0	\N	f	\N	0	
+101	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	195081	\N	195081	/Oasis de Kernours - Coop Oasis.ods	19	1654672970	0	\N	xAEjFqwoHAMNMPZ	0	\N	f		0	
+103	3	\N	\N	event	event	\N	file	196005	\N	196005	/Grille tarifaire OASIS 21.xlsx	17	1654776825	0	\N	i4F6BS2DMxtr6Dc	0	\N	f	\N	0	
+104	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	file	204819	\N	204819	/CR CE Petite graine.docx	19	1654786801	0	\N	2cq4o9ZGfzqeLpE	0	\N	f		0	
+105	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	file	18427	\N	18427	/Devis 2022-NB-6_PetiteGraine signé 8-04-2022.pdf	17	1655130350	0	\N	iqm6kPCXkFALJ7z	0	\N	f	\N	0	
+106	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	file	189055	\N	189055	/proposition de document cadre vie de lequipe.odt	17	1655214144	0	\N	HYAy9qaLffc5Sxb	0	\N	f	\N	0	
+107	3	\N	\N	Fabrice Perez	Fabrice Perez	\N	folder	13637	\N	13637	/RVB	17	1655245076	0	\N	pLdeMnpXKdLyecF	0	\N	f	\N	0	
+108	3	\N	\N	daphne_vialan	daphne_vialan	\N	file	246082	\N	246082	/remuneration proposition.odt	17	1655283100	0	\N	oSSsq5ocP2jtETp	0	\N	f	\N	0	
+109	10	pn8z9muv	\N	serveur	serveur	\N	file	2482	\N	2482	/{TALK_PLACEHOLDER}/Readme.md	19	1655803587	0	\N	RyLqXNn6piiT3Pc	0	\N	f	\N	0	\N
+110	11	transfert	\N	serveur	serveur	109	file	2482	\N	2482	/Readme.md	19	1655803587	0	\N	\N	0	\N	f	\N	0	\N
+111	10	k7sa78si	\N	serveur	serveur	\N	file	2404	\N	2404	/{TALK_PLACEHOLDER}/toto.ods	19	1655919198	0	\N	YmCHdAFWRidc9Ln	0	\N	f	\N	0	\N
+112	11	Anne Tavernier	\N	serveur	serveur	111	file	2404	\N	2404	/toto.ods	19	1655919198	0	\N	\N	0	\N	f	\N	0	\N
+113	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	folder	204432	\N	204432	/CE	17	1656100171	0	\N	BpnQoA58NnSo3KL	0	\N	f	\N	0	
+114	3	\N	\N	daphne_vialan	daphne_vialan	\N	file	259638	\N	259638	/ingrid leduc.md	17	1656485529	0	\N	tRDWkoGYNfcHN8A	0	\N	f	\N	0	
+115	3	\N	\N	Ramin Farhangi	Ramin Farhangi	\N	file	261546	\N	261546	/Extrait AG Coop Oasis - pages 5 à 9.pdf	17	1656502984	0	\N	QAMPnoHrmd5LjJZ	0	\N	f	\N	0	
+116	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	folder	261615	\N	261615	/Juin 2022_Photos Forge du Vallon	17	1656506802	0	\N	6cys6AgEmZ2LBb2	0	\N	f	\N	0	
+117	3	\N	\N	coralie_darsy	coralie_darsy	\N	file	259064	\N	259064	/Présentation WE Forge du Vallon.odp	17	1656649765	0	\N	R8J6izxYE2tbBt5	0	\N	f	\N	0	
+118	3	\N	\N	nathalie_boquien	nathalie_boquien	\N	file	264120	\N	264120	/CR CE Les Commun.es.docx	19	1656668815	0	\N	FadPpRdz5sTtiLY	0	\N	f		0	
+119	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	folder	25365	\N	25365	/LES COMMUN.E.S	17	1656697632	0	\N	65NMaGL3e96ArE9	0	\N	f	\N	0	
+120	3	\N	\N	Mathieu Labonne	Mathieu Labonne	\N	folder	204432	\N	204432	/CE	17	1656697825	0	\N	ArQ7EActTqHqKsC	0	\N	f	\N	0	
+121	3	\N	\N	Fabrice Perez	Fabrice Perez	\N	file	264464	\N	264464	/Audiences et bilan.ods	19	1656712578	0	\N	CPpmAAGgWcfC7eY	0	\N	f		0	
+122	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	71102	\N	71102	/oasis-infographie VDEF Horizontal 1 partie.pdf	17	1657114911	0	\N	48pZWYwfBNfYCEm	0	\N	f	\N	0	
+123	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	71099	\N	71099	/oasis-infographie VDEF Vertical 2 partie.pdf	17	1657115014	0	\N	kQCxJE7SzbY6FeC	0	\N	f	\N	0	
+124	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	9878	\N	9878	/Dossier-presse-juin-2021.pdf	17	1657115613	0	\N	z44Fxijz5K5CGR7	0	\N	f	\N	0	
+125	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	267540	\N	267540	/Pad ambassadeurs et ambassadrices.md	17	1657121026	0	\N	zkJ79jcy5xRLPq7	0	\N	f	\N	0	
+126	0	Tobias Ollive	\N	serveur	serveur	\N	file	268352	\N	268352	/test.odt	19	1657230654	1	\N	\N	0	\N	f	\N	0	\N
+127	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	277937	\N	277937	/oasis-infographie VDEF Horizontal 1 partie.pdf	17	1657535403	0	\N	5zNYy6BSa5cmNsK	0	\N	f	\N	0	
+128	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	277939	\N	277939	/oasis-infographie VDEF Vertical 2 partie.pdf	17	1657535436	0	\N	EgsXDSNyDbQzQbm	0	\N	f	\N	0	
+129	3	\N	\N	Aurore Borowik	Aurore Borowik	\N	file	278048	\N	278048	/Dossier-presse-juin-2021.pdf	17	1657535549	0	\N	MwXJyAfqi7Z4E6A	0	\N	f	\N	0	
+132	3	\N	\N	serveur	serveur	\N	file	269160	\N	269160	/Nextcloud flyer.pdf	17	1657618310	0	\N	MddLc7CoPxZK2Bc	0	\N	f	\N	0	
+133	3	\N	\N	serveur	serveur	\N	file	269164	\N	269164	/Welcome to Nextcloud Hub.docx	17	1657618326	0	\N	ACkXB5RDqzDCnFJ	0	\N	f	\N	0	
+131	3	\N	\N	serveur	serveur	\N	file	376132	\N	376132	/encore.odt	17	1657618225	0	\N	encoreunfois	0	\N	f		0	
+135	3	\N	\N	serveur	serveur	\N	file	269116	\N	269116	/Readme.md	17	1657620978	0	\N	xAb4Kiyxq2sfrNQ	0	\N	f	\N	0	
+\.
+
+
+--
+-- Name: oc_share_id_seq; Type: SEQUENCE SET; Schema: public; Owner: nc
+--
+
+SELECT pg_catalog.setval('public.oc_share_id_seq', 135, true);
+
+
+--
+-- Name: oc_share oc_share_pkey; Type: CONSTRAINT; Schema: public; Owner: nc
+--
+
+ALTER TABLE ONLY public.oc_share
+    ADD CONSTRAINT oc_share_pkey PRIMARY KEY (id);
+
+
+--
+-- Name: file_source_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX file_source_index ON public.oc_share USING btree (file_source);
+
+
+--
+-- Name: initiator_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX initiator_index ON public.oc_share USING btree (uid_initiator);
+
+
+--
+-- Name: item_share_type_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX item_share_type_index ON public.oc_share USING btree (item_type, share_type);
+
+
+--
+-- Name: owner_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX owner_index ON public.oc_share USING btree (uid_owner);
+
+
+--
+-- Name: parent_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX parent_index ON public.oc_share USING btree (parent);
+
+
+--
+-- Name: share_with_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX share_with_index ON public.oc_share USING btree (share_with);
+
+
+--
+-- Name: token_index; Type: INDEX; Schema: public; Owner: nc
+--
+
+CREATE INDEX token_index ON public.oc_share USING btree (token);
+
+
+--
+-- PostgreSQL database dump complete
+--
+
--- a/nextcloud/supervisord.conf
+++ b/nextcloud/supervisord.conf
@@ -0,0 +1,22 @@
+[supervisord]
+nodaemon=true
+logfile=/var/log/supervisord/supervisord.log
+pidfile=/var/run/supervisord/supervisord.pid
+childlogdir=/var/log/supervisord/
+logfile_maxbytes=50MB                           ; maximum size of logfile before rotation
+logfile_backups=10                              ; number of backed up logfiles
+loglevel=error
+
+[program:apache2]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=apache2-foreground
+
+[program:cron]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=/cron.sh
--- a/traefik/docker-compose.yml
+++ b/traefik/docker-compose.yml
@@ -6,27 +6,18 @@ networks:

 services:
  traefik:
-    image: traefik:2.6
+    image: traefik:2.10.7
    container_name: traefik
    ports:
      - 80:80
      - 443:443
-      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
      - ./traefik_dynamic.toml:/traefik_dynamic.toml
-      - /DATA/docker/traefik/certs:/certs
+      - /DATA/docker/services/certs:/certs
    environment:
      TZ: Europe/Paris
-#    labels:
-#      traefik.http.routers.traefik-metrics.entrypoints: websecure
-#      traefik.http.routers.traefik-metrics.rule: "Host(`${SERVER_NAME}`) && PathPrefix(`/metrics`)"
-#      traefik.http.routers.traefik-metrics.service: traefik-metrics
-#      traefik.http.routers.traefik-metrics.middlewares: "traefik-metrics-auth@docker"
-#      traefik.http.middlewares.traefik-metrics-auth.basicauth.users: "${METRICS_AUTH}"
-#      traefik.http.services.traefik-metrics.loadbalancer.server.port: 8082
-#      traefik.enable: true
    networks:
      - proxy
    restart: unless-stopped
--- a/traefik/traefik.toml
+++ b/traefik/traefik.toml
@@ -13,27 +13,24 @@
    [entryPoints.websecure.http]
      middlewares = ["hardening@file", "compression@file"]
      [entryPoints.websecure.http.tls]
-#        certResolver = "letsencrypt"
+        certResolver = "letsencrypt"
        options = "tls12@file"
- # [entryPoints.metrics]
- #   address = ":8082"
+  [entryPoints.metrics]
+    address = ":8082"

 [providers]
  providersThrottleDuration = "2s"
  [providers.docker]
    watch = true
    endpoint = "unix:///var/run/docker.sock"
-    exposedByDefault = true
+    exposedByDefault = false
    network = "proxy"
  [providers.file]
    filename = "/traefik_dynamic.toml"
    watch = true

-[api]
-  insecure = true
-
 [log]
-  level = "DEBUG"
+  level = "INFO"

 [accessLog]
  format = "json"
@@ -44,14 +41,10 @@
      "StartUTC" = "drop"
      "ClientUsername" = "drop"

-#[certificatesResolvers]
-#  [certificatesResolvers.letsencrypt]
-#    [certificatesResolvers.letsencrypt.acme]
-#      email = "picasoft@assos.utc.fr"
-#      storage = "/certs/acme.json"
-#      [certificatesResolvers.letsencrypt.acme.httpChallenge]
-#        entryPoint = "web"
-
-#[metrics]
-#  [metrics.prometheus]
-#    entryPoint = "metrics"
+[certificatesResolvers]
+  [certificatesResolvers.letsencrypt]
+    [certificatesResolvers.letsencrypt.acme]
+      email = "serveur@oasis21.org"
+      storage = "/certs/acme.json"
+      [certificatesResolvers.letsencrypt.acme.httpChallenge]
+        entryPoint = "web"
--- a/traefik/traefik_dynamic.toml
+++ b/traefik/traefik_dynamic.toml
@@ -18,7 +18,7 @@
    frameDeny = true
    stsIncludeSubdomains = true
    stsPreload = true
-    customFrameOptionsValue = "SAMEORIGIN"
+    customFrameOptionsValue = "ALLOW-FROM https://odoo.cooperative-oasis.org https://cloud.oasis21.org"
    referrerPolicy = "same-origin"
    permissionsPolicy = "vibrate='self'"
    stsSeconds = 315360000
@@ -27,8 +27,28 @@
    excludedContentTypes = ["text/event-stream"]

  [http.middlewares.allowFrameAndCORS.headers]
-    contentSecurityPolicy = "frame-ancestors *"
+    customFrameOptionsValue = "ALLOW-FROM https://code.oasis21.org https://odoo.cooperative-oasis.org"
+    contentSecurityPolicy = "frame-ancestors * cloud.oasis21.org https://odoo.cooperative-oasis.org"
    accessControlAllowHeaders = ["*"]
    accessControlAllowMethods = ["GET", "POST", "OPTIONS"]
    accessControlAllowOriginList = ["*"]
    accessControlExposeHeaders = ["*"]
+
+  [http.routers]
+    [http.routers.coopoasis]
+      entrypoints = "websecure"
+      rule = "Host(`odoo.cooperative-oasis.org`) || Host(`pad.cooperative-oasis.org`) || Host(`odoo-dev.cooperative-oasis.org`) || Host(`test-odoo.cooperative-oasis.org`)"
+      service = "coopoasis"
+    [http.routers.papercut]
+      entrypoints = "websecure"
+      rule = "Host(`papercut.oasis21.org`)"
+      service = "papercut"
+
+  [http.services]
+    [http.services.coopoasis.loadBalancer]
+      [[http.services.coopoasis.loadBalancer.servers]]
+        url = "http://172.16.7.12/"
+    [http.services.papercut.loadBalancer]
+      [[http.services.papercut.loadBalancer.servers]]
+        url = "http://172.16.7.13:9191/"
+
--- a/website/.gitignore
+++ b/website/.gitignore
@@ -1,3 +0,0 @@
-*.secrets
-.env
-certs
--- a/website/docker-compose.yml
+++ b/website/docker-compose.yml
@@ -1,24 +0,0 @@
-version: "3.7"
-
-volumes:
-  website:
-    name: website
-
-networks:
-  proxy:
-    external: true
-
-services:
-  website:
-    container_name: website
-    image: nginx:1.21-alpine
-    volumes:
-      - website:/usr/share/nginx/html
-    labels:
-      traefik.http.routers.website.entrypoints: web, websecure
-      traefik.http.routers.website.rule: Host(`www.librezo.xyz`)
-      traefik.http.services.website.loadbalancer.server.port: 80
-      traefik.enable: true
-    networks:
-      - proxy
-    restart: unless-stopped
--- a/website/index.html
+++ b/website/index.html
@@ -1,7 +0,0 @@
-<html>
-<body>
-le monocycle c'est la vie
-</body>
-
-
-</html>
Author	SHA1	Message	Date
root	fc2b45ad16	update nextcloud version	2024-02-16 22:32:36 +01:00
root	13c55a9f43	add odoo-dev	2024-02-16 22:31:45 +01:00
root	138591839e	fix wrong name	2024-02-16 22:31:11 +01:00
root	9420f6875e	add restic config	2024-01-20 21:02:38 +01:00
root	0715bdafd4	add backup db.sh	2024-01-20 08:49:11 +01:00
root	c2907b543a	add papercut config	2024-01-20 08:48:05 +01:00
root	21491b9ebc	update traefik	2024-01-18 23:29:18 +01:00
root	31ed45b81d	update nextcloud and oo version	2024-01-18 23:24:14 +01:00
root	8ce6a85f6a	update version	2023-09-21 15:54:21 +02:00
root	e52e1b52ab	update to version 2.10	2023-06-29 10:48:27 +02:00
root	5046b4fcbc	update postgres version	2023-03-27 22:07:56 +02:00
oiseauroch	9da2d870f4	upgrade stack è	2023-03-27 20:26:31 +02:00
root	b4e53d0523	sev user limit to 1000	2022-12-29 23:15:22 +01:00
root	9a829d0ffb	update nextcloud 24.0.8	2022-12-29 23:14:54 +01:00
root	791bfa1a59	update version 23.0.11	2022-12-29 22:20:48 +01:00
root	176017a569	add test-odoo domain	2022-12-29 22:09:22 +01:00
root	579b7cbb61	fix ip address	2022-12-19 12:55:13 +01:00
root	2f10fdbce6	add host pad.cooperative-oasis.org to myceliandre VM	2022-12-19 12:53:08 +01:00
root	bb9d6b1967	enable forcesave	2022-12-19 12:53:08 +01:00
ppom	8431eb0809	Gitea test (sry)	2022-11-24 11:48:00 +01:00
root	98d5bb68e6	update traefik to version 2.9.7	2022-11-10 09:50:58 +01:00
root	7e5f5fb6fb	apply post-mortem 6 november policies	2022-11-09 13:24:10 +01:00
root	83d044d1b7	restart directives fix	2022-11-08 10:16:45 +01:00
root	e49675de6b	- update to version 23.0.11 - remove collabora from docker-compose.yml - add restart policy for redis - add odoo.cooperative-oasis.org as allow from	2022-11-06 12:30:46 +01:00
root	9feb8f9f2b	use locally build version of onlyoffice	2022-10-05 21:01:19 +02:00
root	9d4a330a52	change hostname for odoo VM	2022-10-04 11:08:44 +02:00
ppom	53633e1373	[traefik] ajout proxying coopoasis.oasis21.org	2022-09-23 14:41:28 +02:00
root	656744bdf8	use onlyoffice instead of collabora	2022-09-14 01:04:20 +02:00
root	ace9ab6887	Maj nextcloud + fix cors	2022-09-13 19:50:02 +02:00
oiseauroch	7d8bb7ae4e	update to 23.0.9	2022-09-11 13:28:53 +02:00
root	d54d279570	working install of oasis21 infra	2022-07-13 14:58:11 +02:00
Tobias Ollive	e53a26bd2e	improve readme	2022-05-06 12:10:23 +02:00
Tobias Ollive	a38983072f	improve doc	2022-05-06 09:54:27 +02:00
serveur	c4ae96976a	remove comment and redis password	2022-05-06 07:53:39 +00:00
serveur	510eb9c929	Merge branch 'master' of ssh://yuno.oiseauroch.fr:6969/tobias/infra-oasis21	2022-05-05 18:20:59 +00:00
Tobias Ollive	0adf079fdf	add redis password and improve documentation	2022-05-05 19:58:04 +02:00
Tobias Ollive	82aaf24b52	update README.md	2022-05-05 16:27:41 +02:00
Tobias Ollive	3366a28aa2	working configuration	2022-05-05 14:21:15 +02:00
Tobias Ollive	98a1c12067	improve README	2022-05-05 13:07:12 +02:00
Tobias Ollive	a979a1c600	add secret example files	2022-05-05 13:01:32 +02:00
Tobias Ollive	42c3312fe9	change url to oasis21 one	2022-05-05 11:23:40 +02:00
Tobias Ollive	3945167e9d	remove unused docker-compose	2022-05-05 11:19:25 +02:00
Tobias Ollive	b95acdcba3	working infra	2022-05-05 11:17:28 +02:00