1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

version: '3.7'

services:
  nextcloud:
    image: nextcloud:18.0.3-apache
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      - postgres
    ports:
      - '8080:80'
    volumes:
      - ./nextcloud:/var/www/html:rw
    logging:
      driver: json-file
      options:
        max-size: 100m

  postgres:
    image: postgres:11.7-alpine
    container_name: postgres
    restart: unless-stopped
    networks:
      - nextcloud
    volumes:
      - ./postgres:/var/lib/postgresql/data:rw
    environment:
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=94dbd6b2-bd9f-4867-99af-37f8e4444640
    logging:
      driver: json-file
      options:
        max-size: 100m

1

sudo docker-compose exec -u www-data nextcloud php occ user:delete admin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

global
	log 127.0.0.1 local0
	stats socket /var/run/haproxy.sock mode 660 level admin expose-fd listeners
	stats timeout 30s
	user root
	group root
	daemon
	maxconn	4096
	nbproc 1
	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private
	# general SSL config
	ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
	tune.ssl.default-dh-param 4096
	ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets

defaults
	log	global
	mode	http
	option	http-buffer-request
	option	httplog
	option	dontlognull
	option forwardfor
	timeout connect 5s
	timeout client  25s
	timeout server  25s
	timeout tunnel        3600s
	timeout http-keep-alive  1s
	timeout http-request    15s
	timeout queue           30s
	timeout tarpit          60s
	compression algo gzip
	compression type text/plain text/css text/xml text/javascript application/javascript application/x-javascript application/xml application/json
	errorfile 400 /usr/local/etc/haproxy/errors/400.http
	errorfile 403 /usr/local/etc/haproxy/errors/403.http
	errorfile 408 /usr/local/etc/haproxy/errors/408.http
	errorfile 500 /usr/local/etc/haproxy/errors/500.http
	errorfile 502 /usr/local/etc/haproxy/errors/502.http
	errorfile 503 /usr/local/etc/haproxy/errors/503.http
	errorfile 504 /usr/local/etc/haproxy/errors/504.http

frontend http_https
	bind :80
	bind :443 ssl crt /certificates/cloudflare.haproxy alpn h2,http/1.1
	# acls
	acl dav path_reg -i ^/.well-known/(carddav|caldav).*$
	acl webfinger path_reg -i ^/.well-known/(carddav|caldav).*$
	# proxy headers
	http-request set-header X-Forwarded-Port %[dst_port] if forwarded_port
	# http-response set-header Access-Control-Allow-Credentials "true"
	http-request add-header X-Forwarded-Proto https if https forwarded_proto
	http-request replace-path (.*) /remote.php/dav if dav
	http-request replace-path (.*) /public.php?service=webfinger if webfinger
	default_backend cloud

backend nextcloud
	http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;"
	server default nextcloud:80 check