initial commit

README.md

@@ -0,0 +1,36 @@
+# Installation de l'infrastructure 
+
+### Lancement
+
+#### Certs
+
+Au premier lancement, assurez-vous que :
+
+- Le dossier `/DATA/docker/traefik/certs` existe
+- Créez un fichier `acme.json` à l'intérieur
+- Changez son propriétaire à `root`
+- Changez ses permissions à `600`
+
+C'est dans ce fichier que seront conservés tous les certificats générés par Traefik.
+
+### Migration des données
+
+1. Mettre nextcloud en mode maintenance : 
+```
+sudo -u www-data php occ maintenance:mode --on
+```
+2. Faire un dump de la bdd
+```
+sudo -u postgres pg_dump -Fc  nc > nc.dump
+```
+3. Sauver les données du dossier nextcloud
+```
+mkdir /var/lib/backuppc/migration
+tar caf /var/lib/backuppc/migration/nextcloud.tar.xz /srv/nextcloud/
+```
+4. Sauver le fichier de configuration de nextcloud
+```
+# par précaution, ne devrait pas être utile
+cp /var/www/nextcloud/public_html/config/config.php /var/lib/backuppc/migration
+```
+

nextcloud-pica/README.md

@@ -1,39 +0,0 @@
-## NextCloud
-
-Ce dossier contient les ressources nécessaires pour lancer une ou plusieurs instances NextCloud.
-
-Voir également le [wiki](https://wiki.picasoft.net/doku.php?id=technique:adminserv:nextcloud).
-
-### Configuration
-
-Quasiment aucune configuration n'est effectuée via les fichiers de ce dépôt, et on préfère l'interface web.
-Le défaut est qu'il n'est pas possible de lancer des instances NextCloud **vraiment** personnalisées depuis ce dépôt, mais c'est parce que le format des fichiers de configuration est amené à évoluer et que NextCloud effectue des migrations automatiques lors des mises à jour.
-
-Versionner les fichiers de configuration serait donc en conflit avec les modifications automatiques effectuées par NextCloud lors des mises à jour et des changements dans l'interface.
-
-Les fichiers `nginx.conf` sont repris de [cet exemple](https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf).
-
-### Lancement
-
-Copier les fichiers `.secrets.example` en `.secrets` et remplacer les valeurs.
-Lancer `docker-compose up -d`.
-
-### Mise à jour
-
-Pour mettre à jour l'instance de Picasoft, il suffit de mettre à jour le tag de l'image officielle de NextCloud.
-
-Attention : **toutes les mises à jour de version majeure doivent se faire une par une**. Les logs applicatifs détaillent la mise à jour.
-Exemple :
-* 15 -> 16, puis
-* 16 -> 17, puis
-* 17 -> 18.
-
-Sinon, il y a risque de casse.
-
-### Mise à jour de MariaDB
-
-[Selon la documentation](https://mariadb.com/kb/en/upgrading-between-major-mariadb-versions/) :
-
-> MariaDB is designed to allow easy upgrades. You should be able to trivially upgrade from ANY earlier MariaDB version to the latest one (for example MariaDB 5.5.x to MariaDB 10.5.x), usually in a few seconds.
-
-L'idée est d'éteindre le conteneur applicatif (NextCloud), puis de lancer la nouvelle version du conteneur, d'entrer dedans, de lancer la commande `mysql_upgrade` et de redémarrer le conteneur.

nextcloud-pica/nginx.conf

@@ -1,182 +0,0 @@
-worker_processes auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-
-events {
-    worker_connections  1024;
-}
-
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    set_real_ip_from  10.0.0.0/8;
-    set_real_ip_from  172.16.0.0/12;
-    set_real_ip_from  192.168.0.0/16;
-    real_ip_header    X-Real-IP;
-
-    #gzip  on;
-
-    upstream php-handler {
-        server nextcloud-app:9000;
-    }
-
-    server {
-        listen 80;
-
-# HSTS settings
-    # WARNING: Only add the preload option once you read about
-    # the consequences in https://hstspreload.org/. This option
-    # will add the domain to a hardcoded list that is shipped
-    # in all major browsers and getting removed from this list
-    # could take several months.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
-
-    # set max upload size and increase upload timeout:
-    client_max_body_size 512M;
-    client_body_timeout 300s;
-    fastcgi_buffers 64 4K;
-
-    # Enable gzip but do not remove ETag headers
-    gzip on;
-    gzip_vary on;
-    gzip_comp_level 4;
-    gzip_min_length 256;
-    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-    # Pagespeed is not supported by Nextcloud, so if your server is built
-    # with the `ngx_pagespeed` module, uncomment this line to disable it.
-    #pagespeed off;
-
-    # HTTP response headers borrowed from Nextcloud `.htaccess`
-    add_header Referrer-Policy                      "no-referrer"   always;
-    add_header X-Content-Type-Options               "nosniff"       always;
-    add_header X-Download-Options                   "noopen"        always;
-    add_header X-Frame-Options                      "SAMEORIGIN"    always;
-    add_header X-Permitted-Cross-Domain-Policies    "none"          always;
-    add_header X-Robots-Tag                         "none"          always;
-    add_header X-XSS-Protection                     "1; mode=block" always;
-
-    # Remove X-Powered-By, which is an information leak
-    fastcgi_hide_header X-Powered-By;
-
-    # Path to the root of your installation
-    root /var/www/html;
-
-    # Specify how to handle directories -- specifying `/index.php$request_uri`
-    # here as the fallback means that Nginx always exhibits the desired behaviour
-    # when a client requests a path that corresponds to a directory that exists
-    # on the server. In particular, if that directory contains an index.php file,
-    # that file is correctly served; if it doesn't, then the request is passed to
-    # the front-end controller. This consistent behaviour means that we don't need
-    # to specify custom rules for certain paths (e.g. images and other assets,
-    # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
-    # `try_files $uri $uri/ /index.php$request_uri`
-    # always provides the desired behaviour.
-    index index.php index.html /index.php$request_uri;
-
-    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
-    location = / {
-        if ( $http_user_agent ~ ^DavClnt ) {
-            return 302 /remote.php/webdav/$is_args$args;
-        }
-    }
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    # Make a regex exception for `/.well-known` so that clients can still
-    # access it despite the existence of the regex rule
-    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
-    # for `/.well-known`.
-    location ^~ /.well-known {
-        # The rules in this block are an adaptation of the rules
-        # in `.htaccess` that concern `/.well-known`.
-
-        location = /.well-known/carddav { return 301 /remote.php/dav/; }
-        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
-
-        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
-
-        # Let Nextcloud's API for `/.well-known` URIs handle all other
-        # requests by passing them to the front-end controller.
-        return 301 /index.php$request_uri;
-    }
-
-    # Rules borrowed from `.htaccess` to hide certain paths from clients
-    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
-
-    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-    # which handle static assets (as seen below). If this block is not declared first,
-    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
-    # to the URI, resulting in a HTTP 500 error response.
-    location ~ \.php(?:$|/) {
-        # Required for legacy support
-        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
-
-        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-        set $path_info $fastcgi_path_info;
-
-        try_files $fastcgi_script_name =404;
-
-        include fastcgi_params;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $path_info;
-        fastcgi_param HTTPS on;
-
-        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-        fastcgi_param front_controller_active true;     # Enable pretty urls
-        fastcgi_pass php-handler;
-
-        fastcgi_intercept_errors on;
-        fastcgi_request_buffering off;
-
-        fastcgi_max_temp_file_size 0;
-    }
-
-    location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
-        try_files $uri /index.php$request_uri;
-        expires 6M;         # Cache-Control policy borrowed from `.htaccess`
-        access_log off;     # Optional: Don't log access to assets
-
-        location ~ \.wasm$ {
-            default_type application/wasm;
-        }
-    }
-
-    location ~ \.woff2?$ {
-        try_files $uri /index.php$request_uri;
-        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
-        access_log off;     # Optional: Don't log access to assets
-    }
-
-    # Rule borrowed from `.htaccess`
-    location /remote {
-        return 301 /remote.php$request_uri;
-    }
-
-    location / {
-        try_files $uri $uri/ /index.php$request_uri;
-    }
-}
-}

nextcloud-pica/secrets/pica.secrets.example

@@ -1,4 +0,0 @@
-MYSQL_ROOT_PASSWORD=password
-MYSQL_DATABASE=nextcloud
-MYSQL_USER=nextcloud
-MYSQL_PASSWORD=password

nextcloud-pica/zz-php-fpm-custom.conf

@@ -1,7 +0,0 @@
-[www]
-pm = dynamic
-pm.max_children = 50
-pm.start_servers = 15
-pm.min_spare_servers = 15
-pm.max_spare_servers = 25
-pm.max_requests = 500

nextcloud/config.php

@@ -0,0 +1,62 @@
+<?php
+$CONFIG = array (
+  'instanceid' => 'oc00cptraqej',
+  'passwordsalt' => 'QDWCIlUPIxBCPkOPapq39bHhFtrADT',
+  'secret' => 'xfKWpSH0/UV4PYUClkDRyaeiYc2SugcEe0/mZVB7/6lElAQE',
+  'trusted_domains' => 
+  array (
+    0 => 'cloud.oasis21.org',
+  ),
+  'apps_paths' =>
+  array (
+    0 =>
+    array (
+       'path' => '/var/www/html/apps',
+       'url' => '/apps',
+       'writable' => false,
+   	),
+    1 =>
+    array (
+       'path' => '/var/www/html/custom_apps',
+       'url' => '/custom_apps',
+       'writable' => true,
+   	),
+    ),
+  'datadirectory' => '/var/www/html/data',
+  'dbtype' => 'pgsql',
+  'version' => '23.0.0.10',
+  'overwrite.cli.url' => 'https://cloud.oasis21.org',
+  'dbname' => 'nc',
+  'dbhost' => 'nextcloud-db',
+  'dbport' => '',
+  'dbtableprefix' => 'oc_',
+  'dbuser' => 'nc',
+  'dbpassword' => '__POSTGRES_PASSWORD__',
+  'installed' => true,
+  'logfile' => '/var/log/nextcloud/nextcloud.log',
+  'log_type' => 'file',
+  'htaccess.RewriteBase' => '/',
+  'skeletondirectory' => '',
+  'memcache.local' => '\\OC\\Memcache\\APCu',
+  'memcache.locking' => '\\OC\\Memcache\\Redis',
+  'memcache.distributed' => '\\OC\\Memcache\\Redis',
+  'redis' => 
+  array (
+    'host' => '/redis',
+    'password' => '__REDIS_PASSWORD__',
+    'port' => 6379,
+  ),
+  'default_phone_region' => 'FR',
+  'defaultapp' => 'files',
+  'encryption.legacy_format_support' => false,
+  'simpleSignUpLink.shown' => false,
+  'updater.release.channel' => 'stable',
+  'mail_domain' => 'oasis21.org',
+  'mail_from_address' => 'nextcloud',
+  'mail_smtpmode' => 'smtp',
+  'loglevel' => 0,
+  'integrity.check.disabled' => false,
+  'ldapUserCleanupInterval' => '10',
+  'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
+  'maintenance' => true,
+);

nextcloud/docker-compose.yml

@@ -13,46 +13,28 @@ networks:
 
 services:
   nextcloud-app:
-    image: nextcloud:23.0.4-fpm-alpine
+    image: nextcloud:23.0
     container_name: nextcloud-app
     restart: unless-stopped
     volumes:
       - nextcloud:/var/www/html
-      - ./zz-php-custom.ini:/usr/local/etc/php/conf.d/zz-php-custom.ini
-      - ./zz-php-fpm-custom.conf:/usr/local/etc/php-fpm.d/zz-php-custom.conf
+      #- ./config.php:/var/www/html/config/config.php
+      #- ./zz-php-custom.ini:/usr/local/etc/php/conf.d/zz-php-custom.ini
+      #- ./zz-php-fpm-custom.conf:/usr/local/etc/php-fpm.d/zz-php-custom.conf
     environment:
       - "TZ=Europe/Paris"
-      - POSTGRES_HOST=nextcloud-db
       - REDIS_HOST=redis
     env_file: ./secrets/librezo.secrets
-    extra_hosts:
-      - code.librezo.xyz:192.168.1.70
     depends_on:
       - nextcloud-db
       - redis
-    networks:
-      - nextcloud
-    restart: unless-stopped
-
-  nextcloud-web:
-    image: nginx:alpine
-    container_name: nextcloud-web
-    volumes:
-      - nextcloud:/var/www/html:ro
-      - ./nginx.conf:/etc/nginx/nginx.conf:ro
-    env_file: ./secrets/librezo.secrets
-    extra_hosts:
-      - code.librezo.xyz:192.168.1.70
-    depends_on:
-      - nextcloud-app
-    environment:
-      TZ: Europe/Paris
     networks:
       - nextcloud
       - proxy
+    restart: unless-stopped
     labels:
       traefik.http.routers.nextcloud-web.entrypoints: websecure
-      traefik.http.routers.nextcloud-web.rule: Host(`cloud.librezo.xyz`)
+      traefik.http.routers.nextcloud-web.rule: Host(`cloud.oasis21.org`)
       traefik.http.services.nextcloud-web.loadbalancer.server.port: 80
       traefik.enable: true
       # https://docs.nextcloud.com/server/16/admin_manual/configuration_server/reverse_proxy_configuration.html
@@ -88,27 +70,31 @@ services:
   collabora:
     image: libreoffice/online:master
     container_name: collabora
+    volumes:
+      - ./loolwsd.xml:/etc/loolwsd/loolwsd.xml
+     #- ./zz-php-fpm-custom.conf:/usr/local/etc/php-fpm.d/zz-php-custom.conf
 #    ports:
 #      - 9980:9980
 #    expose:
 #      - "9980" 
     environment:
       - "TZ=Europe/Paris"
-      - domain=cloud\.librezo\.xyz
-      - username=nextcloud
-      - password=password
-      - serveur_name=code\.librezo\.xyz
+      - domain=cloud\.calad\.re
+#      - username=${COLLABORA_USER}
+#      - password=${COLLABORA_PASSWORD}
+      - serveur_name=code\.calad\.re
       - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
     networks:
       - nextcloud
       - proxy
+    env_file: ./secrets/librezo.secrets
     cap_add:
       - MKNOD
     restart:
       unless-stopped
     labels:
       traefik.http.routers.collabora.entrypoints: websecure
-      traefik.http.routers.collabora.rule: Host(`code.librezo.xyz`)
+      traefik.http.routers.collabora.rule: Host(`code.oasis21.org`)
       traefik.http.services.collabora.loadbalancer.server.port: 9980
       traefik.enable: true
 

nextcloud/loolwsd.xml

@@ -0,0 +1,166 @@
+<config>
+
+    <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
+    <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
+
+    <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">en_GB en_US fr_FR </allowed_languages>
+
+    <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
+    <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
+
+    <server_name desc="External hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default="">code.oasis21.org</server_name>
+    <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path>
+
+    <memproportion desc="The maximum percentage of system memory consumed by all of the LibreOffice Online, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
+    <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children>
+    <per_document desc="Document-specific settings, including LO Core settings.">
+        <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
+        <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority>
+        <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url>
+        <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments>
+        <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
+        <!-- Idle save and auto save are checked every 30 seconds -->
+        <!-- They are disabled when the value is zero or negative. -->
+        <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs>
+        <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs>
+        <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit>
+        <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb>
+        <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
+        <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
+        <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
+        <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs>
+        <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs>
+    </per_document>
+
+    <per_view desc="View-specific settings.">
+        <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs>
+        <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs>
+    </per_view>
+
+    <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html>
+
+    <logging>
+        <color type="bool">true</color>
+        <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">debug</level>
+        <protocol type="bool" descr="Enable minimal client-site JS protocol logging from the start">true</protocol>
+        <file enable="false">
+            <property name="path" desc="Log file path.">/var/log/loolwsd.log</property>
+            <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">50M</property>
+            <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
+            <property name="compress" desc="Enable/disable log file compression.">true</property>
+            <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
+            <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
+            <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
+            <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
+        </file>
+        <anonymize>
+            <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data>
+            <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt>
+        </anonymize>
+    </logging>
+
+    <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging>
+
+    <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false">
+        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path>
+        <filter>
+            <message desc="Regex pattern of messages to exclude"></message>
+        </filter>
+        <outgoing>
+            <record desc="Whether or not to record outgoing messages" default="false">false</record>
+        </outgoing>
+    </trace>
+
+    <net desc="Network settings">
+      <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only.
+           You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
+      <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
+      <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
+      <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root>
+      <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix>
+      <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
+        <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
+        <host desc="The IPv6 loopback (localhost) address.">::1</host>
+        <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
+      </post_allow>
+      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space.">cloud.oasis21.org</frame_ancestors>
+    </net>
+
+    <ssl desc="SSL settings">
+        <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable>
+        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
+        <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path>
+        <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path>
+        <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path>
+        <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
+        <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
+            <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
+            <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
+            <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
+            <pin></pin>
+            </pins>
+        </hpkp>
+    </ssl>
+
+    <security desc="Altering these defaults potentially opens you to significant risk">
+      <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp>
+      <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities>
+    </security>
+
+    <watermark>
+      <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity>
+      <text desc="Watermark text to be displayed on the document if entered" type="string"></text>
+    </watermark>
+
+    <welcome>
+      <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="false">false</enable>
+      <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button>
+      <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path>
+    </welcome>
+
+    <storage desc="Backend storage">
+        <filesystem allow="false" />
+        <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true">
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">cloud.oasis21.org</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="true">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+            <host desc="Regex pattern of hostname to allow or deny." allow="false">192\.168\.1\.1</host>
+            <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
+            <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies>
+            <locking desc="Locking settings">
+                <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh>
+            </locking>
+        </wopi>
+        <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false">
+            <host desc="Hostname to allow" allow="true">cloud.oasis21.org</host>
+        </webdav>
+        <ssl desc="SSL settings">
+	    <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme>
+            <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable>
+            <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path>
+            <key_file_path desc="Path to the key file" relative="false"></key_file_path>
+            <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path>
+            <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list>
+        </ssl>
+    </storage>
+
+    <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent>
+
+    <admin_console desc="Web admin console settings.">
+        <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable>
+        <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam>
+        <username desc="The username of the admin console. Ignored if PAM is enabled.">nextcloud</username>
+        <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">o!NdFB7fpQAbXG</password>
+    </admin_console>
+
+    <monitors desc="Addresses of servers we connect to on start for monitoring">
+    </monitors>
+
+</config>

nextcloud/secrets/librezo.secrets.example

@@ -0,0 +1,6 @@
+POSTGRES_PASSWORD=__POSTGRES_PASSWORD__
+POSTGRES_DB=nc
+POSTGRES_USER=nc
+POSTGRES_HOST=nextcloud-db
+username=nextcloud
+password=__COLLABORA_PASSWORD__

traefik/docker-compose.yml

@@ -6,27 +6,18 @@ networks:
 
 services:
   traefik:
-    image: traefik:2.6
+    image: traefik:2.5
     container_name: traefik
     ports:
       - 80:80
       - 443:443
-      - 8080:8080
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./traefik.toml:/traefik.toml
       - ./traefik_dynamic.toml:/traefik_dynamic.toml
-      - /DATA/docker/traefik/certs:/certs
+      - /DATA/docker/services/certs:/certs
     environment:
       TZ: Europe/Paris
-#    labels:
-#      traefik.http.routers.traefik-metrics.entrypoints: websecure
-#      traefik.http.routers.traefik-metrics.rule: "Host(`${SERVER_NAME}`) && PathPrefix(`/metrics`)"
-#      traefik.http.routers.traefik-metrics.service: traefik-metrics
-#      traefik.http.routers.traefik-metrics.middlewares: "traefik-metrics-auth@docker"
-#      traefik.http.middlewares.traefik-metrics-auth.basicauth.users: "${METRICS_AUTH}"
-#      traefik.http.services.traefik-metrics.loadbalancer.server.port: 8082
-#      traefik.enable: true
     networks:
       - proxy
     restart: unless-stopped

traefik/traefik.toml

@@ -13,27 +13,24 @@
     [entryPoints.websecure.http]
       middlewares = ["hardening@file", "compression@file"]
       [entryPoints.websecure.http.tls]
-#        certResolver = "letsencrypt"
+        certResolver = "letsencrypt"
         options = "tls12@file"
- # [entryPoints.metrics]
- #   address = ":8082"
+  [entryPoints.metrics]
+    address = ":8082"
 
 [providers]
   providersThrottleDuration = "2s"
   [providers.docker]
     watch = true
     endpoint = "unix:///var/run/docker.sock"
-    exposedByDefault = true
+    exposedByDefault = false
     network = "proxy"
   [providers.file]
     filename = "/traefik_dynamic.toml"
     watch = true
 
-[api]
-  insecure = true
-
 [log]
-  level = "DEBUG"
+  level = "INFO"
 
 [accessLog]
   format = "json"
@@ -44,14 +41,10 @@
       "StartUTC" = "drop"
       "ClientUsername" = "drop"
 
-#[certificatesResolvers]
-#  [certificatesResolvers.letsencrypt]
-#    [certificatesResolvers.letsencrypt.acme]
-#      email = "picasoft@assos.utc.fr"
-#      storage = "/certs/acme.json"
-#      [certificatesResolvers.letsencrypt.acme.httpChallenge]
-#        entryPoint = "web"
-
-#[metrics]
-#  [metrics.prometheus]
-#    entryPoint = "metrics"
+[certificatesResolvers]
+  [certificatesResolvers.letsencrypt]
+    [certificatesResolvers.letsencrypt.acme]
+      email = "serveur@oasis21.org"
+      storage = "/certs/acme.json"
+      [certificatesResolvers.letsencrypt.acme.httpChallenge]
+        entryPoint = "web"

website/.gitignore

@@ -1,3 +0,0 @@
-*.secrets
-.env
-certs

website/docker-compose.yml

@@ -1,24 +0,0 @@
-version: "3.7"
-
-volumes:
-  website:
-    name: website
-
-networks:
-  proxy:
-    external: true
-
-services:
-  website:
-    container_name: website
-    image: nginx:1.21-alpine
-    volumes:
-      - website:/usr/share/nginx/html
-    labels:
-      traefik.http.routers.website.entrypoints: web, websecure
-      traefik.http.routers.website.rule: Host(`www.librezo.xyz`)
-      traefik.http.services.website.loadbalancer.server.port: 80
-      traefik.enable: true
-    networks:
-      - proxy
-    restart: unless-stopped

website/index.html

@@ -1,7 +0,0 @@
-<html>
-<body>
-le monocycle c'est la vie
-</body>
-
-
-</html>