From d406a95c562bcb67c164b28a04d55d9fbc2036e3 Mon Sep 17 00:00:00 2001 From: BadStorm Date: Sat, 4 Jul 2026 22:16:59 +0200 Subject: [PATCH] Improve nginx configs --- README.md | 3 +- containers/gitea/gitea.container | 4 ++ containers/gitea/gitea.nginx | 18 +++++- containers/mattermost/mattermost.container | 1 + containers/mattermost/mattermost.nginx | 9 ++- containers/navidrome/navidrome.nginx | 57 +++++++++++++++++++ containers/nextcloud/collaboraoffice.nginx | 24 ++++++-- containers/nextcloud/nextcloud-cron.service | 7 +++ containers/nextcloud/nextcloud-cron.timer | 10 ++++ .../nextcloud/nextcloud-taskworker@.service | 11 ++++ containers/nextcloud/nextcloud.README | 25 ++++---- containers/nextcloud/nextcloud.container | 2 + containers/nextcloud/nextcloud.nginx | 12 +++- containers/nginx/certbot.README | 3 + containers/nginx/nginx.container | 7 ++- containers/postgres/postgres.README | 14 +++++ containers/qwentts/qwentts.nginx | 13 +++-- containers/vibevoice/vibevoice.nginx | 9 ++- 18 files changed, 201 insertions(+), 28 deletions(-) create mode 100644 containers/navidrome/navidrome.nginx create mode 100644 containers/nextcloud/nextcloud-cron.service create mode 100644 containers/nextcloud/nextcloud-cron.timer create mode 100644 containers/nextcloud/nextcloud-taskworker@.service diff --git a/README.md b/README.md index 1fa9cb1..eba3fb2 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,8 @@ sudo apt update && sudo apt upgrade -y ```bash sudo usermod -a -G render,video $LOGNAME sudo loginctl enable-linger $USER -sudo sh -c "echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf" +echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee /etc/sysctl.d/99-rootless-ports.conf +sudo sysctl --system ``` ##### 3. Installare Podman e strumenti utili diff --git a/containers/gitea/gitea.container b/containers/gitea/gitea.container index 97faa16..875e51f 100644 --- a/containers/gitea/gitea.container +++ b/containers/gitea/gitea.container @@ -15,7 +15,11 @@ Network=internal.network PublishPort=3000:3000 PublishPort=2222:22 + +# mkdir -p /srv/containers/gitea/{data,repositories,config} +# podman unshare chown -R 1000:1000 /srv/containers/gitea/data /srv/containers/gitea/repositories /srv/containers/gitea/config Volume=/srv/containers/gitea/data:/data +Volume=/srv/containers/gitea/repositories:/data/git/repositories Volume=/srv/containers/gitea/config:/data/gitea/conf [Service] diff --git a/containers/gitea/gitea.nginx b/containers/gitea/gitea.nginx index c145da8..46ae05b 100644 --- a/containers/gitea/gitea.nginx +++ b/containers/gitea/gitea.nginx @@ -1,3 +1,12 @@ +server { + listen 80; + listen [::]:80; + server_name code.[DOMAIN]; + + # Redirect HTTP to HTTPS + return 301 https://$server_name$request_uri; +} + server { listen 443 ssl http2; server_name code.[DOMAIN]; @@ -7,8 +16,15 @@ server { client_max_body_size 1G; + # Re-resolve gitea's DNS name at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + location / { - proxy_pass http://gitea:3000; + set $gitea_upstream http://gitea:3000; + proxy_pass $gitea_upstream; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; diff --git a/containers/mattermost/mattermost.container b/containers/mattermost/mattermost.container index b26ddd5..7684b6e 100644 --- a/containers/mattermost/mattermost.container +++ b/containers/mattermost/mattermost.container @@ -31,6 +31,7 @@ Environment=MM_LOGSETTINGS_ENABLEFILE=true Environment=MM_LOGSETTINGS_FILELEVEL=info # mkdir -p /srv/containers/mattermost/{config,data,logs,plugins,client-plugins,bleve-indexes} +# podman unshare chown -R 2000:2000 /srv/containers/mattermost/config /srv/containers/mattermost/data /srv/containers/mattermost/logs /srv/containers/mattermost/plugins /srv/containers/mattermost/client-plugins /srv/containers/mattermost/bleve-indexes Volume=/srv/containers/mattermost/config:/mattermost/config Volume=/srv/containers/mattermost/data:/mattermost/data Volume=/srv/containers/mattermost/logs:/mattermost/logs diff --git a/containers/mattermost/mattermost.nginx b/containers/mattermost/mattermost.nginx index 2a8241b..a80401e 100644 --- a/containers/mattermost/mattermost.nginx +++ b/containers/mattermost/mattermost.nginx @@ -24,9 +24,16 @@ server { # Proxy Settings client_max_body_size 50M; + # Re-resolve mattermost's DNS name at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + # Mattermost upstream location / { - proxy_pass http://mattermost:8065; + set $mattermost_upstream http://mattermost:8065; + proxy_pass $mattermost_upstream; proxy_http_version 1.1; proxy_buffering off; diff --git a/containers/navidrome/navidrome.nginx b/containers/navidrome/navidrome.nginx new file mode 100644 index 0000000..ace65ca --- /dev/null +++ b/containers/navidrome/navidrome.nginx @@ -0,0 +1,57 @@ +server { + listen 80; + listen [::]:80; + server_name music.[DOMAIN]; + + # Redirect HTTP to HTTPS + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name music.[DOMAIN]; + + # SSL Configuration + ssl_certificate /etc/letsencrypt/live/music.[DOMAIN]/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/music.[DOMAIN]/privkey.pem; + + # SSL Settings + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + # Proxy Settings + client_max_body_size 50M; + + # Re-resolve navidrome's DNS name at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + + # Navidrome upstream + location / { + set $navidrome_upstream http://navidrome:4533; + proxy_pass $navidrome_upstream; + proxy_http_version 1.1; + proxy_buffering off; + + # Headers + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Forwarded-Port $server_port; + + # WebSocket support + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + # Timeouts (long-lived streaming connections) + proxy_connect_timeout 7d; + proxy_send_timeout 7d; + proxy_read_timeout 7d; + } +} diff --git a/containers/nextcloud/collaboraoffice.nginx b/containers/nextcloud/collaboraoffice.nginx index eb661a6..1025b06 100644 --- a/containers/nextcloud/collaboraoffice.nginx +++ b/containers/nextcloud/collaboraoffice.nginx @@ -5,23 +5,33 @@ server { ssl_certificate /etc/letsencrypt/live/[DOMAIN]/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/[DOMAIN]/privkey.pem; + # Re-resolve collaboraoffice's DNS name at request time so a container + # restart (new IP on internal.network) doesn't leave nginx stuck on a + # stale address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + location ^~ /browser { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Host $http_host; } location ^~ /hosting/discovery { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Host $http_host; } location ^~ /hosting/capabilities { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Host $http_host; } location ~ ^/cool/(.*)/ws$ { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $http_host; @@ -29,12 +39,14 @@ server { } location ~ ^/(c|l)ool { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Host $http_host; } location ^~ /cool/adminws { - proxy_pass http://collaboraoffice:9980; + set $collabora_upstream http://collaboraoffice:9980; + proxy_pass $collabora_upstream; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $http_host; diff --git a/containers/nextcloud/nextcloud-cron.service b/containers/nextcloud/nextcloud-cron.service new file mode 100644 index 0000000..784c3bf --- /dev/null +++ b/containers/nextcloud/nextcloud-cron.service @@ -0,0 +1,7 @@ +[Unit] +Description=Nextcloud cron.php background job +After=nextcloud.service + +[Service] +Type=oneshot +ExecStart=/usr/bin/podman exec -u www-data nextcloud php -f /var/www/html/cron.php diff --git a/containers/nextcloud/nextcloud-cron.timer b/containers/nextcloud/nextcloud-cron.timer new file mode 100644 index 0000000..eaa0626 --- /dev/null +++ b/containers/nextcloud/nextcloud-cron.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run Nextcloud cron.php every 5 minutes + +[Timer] +OnBootSec=5min +OnUnitActiveSec=5min +Unit=nextcloud-cron.service + +[Install] +WantedBy=timers.target diff --git a/containers/nextcloud/nextcloud-taskworker@.service b/containers/nextcloud/nextcloud-taskworker@.service new file mode 100644 index 0000000..31e7f77 --- /dev/null +++ b/containers/nextcloud/nextcloud-taskworker@.service @@ -0,0 +1,11 @@ +[Unit] +Description=Nextcloud Task Processing Worker %i +After=nextcloud.service + +[Service] +ExecStart=/usr/bin/podman exec -u www-data nextcloud php occ taskprocessing:worker -v -t 60 +Restart=always +RestartSec=1 + +[Install] +WantedBy=default.target diff --git a/containers/nextcloud/nextcloud.README b/containers/nextcloud/nextcloud.README index 9c08e7e..811e9b8 100644 --- a/containers/nextcloud/nextcloud.README +++ b/containers/nextcloud/nextcloud.README @@ -10,20 +10,25 @@ podman exec -it nextcloud php occ config:system:set trusted_proxies 0 --value="1 podman exec -it nextcloud php occ config:system:set forwarded_for_headers 0 --value="HTTP_X_FORWARDED_FOR" # Push Notification +podman exec -u www-data nextcloud php occ app:install notify_push 2>&1 || podman exec -u www-data nextcloud php occ app:enable notify_push podman exec -u www-data nextcloud php occ config:system:set memcache.local --value='\OC\Memcache\APCu' podman exec -u www-data nextcloud php occ config:system:set memcache.locking --value='\OC\Memcache\Redis' podman exec -u www-data nextcloud php occ config:system:set redis host --value='redis' podman exec -u www-data nextcloud php occ config:system:set redis port --type=integer --value=6379 -# OLD -podman exec -it nextcloud php occ config:system:set trusted_domains 1 --value="cloud.[DOMAIN]" +# Rescan +podman exec -u www-data nextcloud php occ files:scan nome_utente +podman exec -u www-data nextcloud php occ files:scan --path="nome_utente/files/sottocartella" +podman exec -u www-data nextcloud php occ files:scan --all + +# Creazione +mkdir -p ~/.config/systemd/user +nano ~/.config/containers/systemd/nextcloud-cron.service +nano ~/.config/containers/systemd/nextcloud-cron.timer +nano ~/.config/containers/systemd/nextcloud-taskworker@.service + +systemctl --user daemon-reload +systemctl --user enable --now nextcloud-cron.timer +systemctl --user enable --now nextcloud-taskworker@1 nextcloud-taskworker@2 nextcloud-taskworker@3 nextcloud-taskworker@4 -podman exec -it nextcloud php occ config:system:set overwritehost --value="cloud.[DOMAIN]" -podman exec -it nextcloud php occ config:system:set overwrite.cli.url --value="https://cloud.[DOMAIN]" -podman exec -it nextcloud php occ config:system:set htaccess.RewriteBase --value="/" -podman exec -it nextcloud php occ maintenance:update:htaccess -podman exec -it nextcloud php occ config:app:set richdocuments wopi_url --value="https://office.[DOMAIN]" -podman exec -it nextcloud php occ config:app:set richdocuments public_wopi_url --value="https://office.[DOMAIN]" -podman exec -it nextcloud php occ config:app:delete richdocuments wopi_discovery -podman exec -it nextcloud php occ config:app:delete richdocuments wopi_capabilities \ No newline at end of file diff --git a/containers/nextcloud/nextcloud.container b/containers/nextcloud/nextcloud.container index b17b5c7..35a6566 100644 --- a/containers/nextcloud/nextcloud.container +++ b/containers/nextcloud/nextcloud.container @@ -9,6 +9,8 @@ Network=internal.network PublishPort=8080:80 +# mkdir -p /srv/containers/nextcloud/{config,custom_apps,data} +# podman unshare chown -R 33:33 /srv/containers/nextcloud/config /srv/containers/nextcloud/custom_apps /srv/containers/nextcloud/data Volume=/srv/containers/nextcloud/config:/var/www/html/config Volume=/srv/containers/nextcloud/custom_apps:/var/www/html/custom_apps Volume=/srv/containers/nextcloud/data:/var/www/html/data diff --git a/containers/nextcloud/nextcloud.nginx b/containers/nextcloud/nextcloud.nginx index 30e5298..fa01558 100644 --- a/containers/nextcloud/nextcloud.nginx +++ b/containers/nextcloud/nextcloud.nginx @@ -13,9 +13,16 @@ server { # Warning HSTS Nextcloud add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; + # Re-resolve upstream DNS names at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + # Nextcloud Push location ^~ /push/ { - proxy_pass http://nextcloud:7867/; + set $nextcloud_push_upstream http://nextcloud-push:7867; + proxy_pass $nextcloud_push_upstream/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -32,7 +39,8 @@ server { } location / { - proxy_pass http://nextcloud:8080; # o :80 se rete del container + set $nextcloud_upstream http://nextcloud:80; + proxy_pass $nextcloud_upstream; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; diff --git a/containers/nginx/certbot.README b/containers/nginx/certbot.README index b0deb9e..79f21d4 100644 --- a/containers/nginx/certbot.README +++ b/containers/nginx/certbot.README @@ -1,3 +1,6 @@ podman pull certbot/certbot +# Or use integrated container: +podma pull jonasal/nginx-certbot + podman run -it -v /srv/containers/nginx/ssl:/etc/letsencrypt certbot certonly --manual --preferred-challenges dns -d *.[DOMAIN] \ No newline at end of file diff --git a/containers/nginx/nginx.container b/containers/nginx/nginx.container index bcb1d1e..031c657 100644 --- a/containers/nginx/nginx.container +++ b/containers/nginx/nginx.container @@ -15,10 +15,15 @@ Image=nginx:latest #AutoUpdate=registry Network=internal.network + +# mkdir -p /srv/containers/nginx/{conf,html,ssl} Volume=/srv/containers/nginx/conf:/etc/nginx/conf.d:ro Volume=/srv/containers/nginx/html:/usr/share/nginx/html:ro - Volume=/srv/containers/nginx/ssl:/etc/nginx/ssl:ro +# Let's Encrypt +#Volume=/srv/containers/nginx/ssl:/etc/letsencrypt:ro + + PublishPort=80:80 PublishPort=443:443 diff --git a/containers/postgres/postgres.README b/containers/postgres/postgres.README index 15e2315..3274aaa 100644 --- a/containers/postgres/postgres.README +++ b/containers/postgres/postgres.README @@ -27,3 +27,17 @@ podman exec -it postgres psql -U postgres -c "GRANT ALL privileges ON DATABASE [ podman exec -it postgres psql -U postgres -d [nome_progetto] -c "GRANT CREATE ON SCHEMA public TO [nome_progetto];" ``` +---- + +# Backup e Restore + +Backup (pg_dump) del database su file sull'host: +```bash +podman exec -e PGPASSWORD="[password_db_progetto]" postgres pg_dump -U [nome_progetto] -d [nome_progetto] > backup.sql +``` + +Restore da file sull'host nel database: +```bash +podman exec -i -e PGPASSWORD="[password_db_progetto]" postgres psql -U [nome_progetto] -d [nome_progetto] < backup.sql +``` + diff --git a/containers/qwentts/qwentts.nginx b/containers/qwentts/qwentts.nginx index 3326aca..2df21ea 100644 --- a/containers/qwentts/qwentts.nginx +++ b/containers/qwentts/qwentts.nginx @@ -1,7 +1,3 @@ -upstream qwentts { - server qwentts:8080; -} - server { listen 80; server_name qwentts.example.com; @@ -20,12 +16,19 @@ server { client_max_body_size 100m; + # Re-resolve qwentts's DNS name at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + # Logging access_log /var/log/nginx/qwentts_access.log; error_log /var/log/nginx/qwentts_error.log; location / { - proxy_pass http://qwentts; + set $qwentts_upstream http://qwentts:8080; + proxy_pass $qwentts_upstream; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; diff --git a/containers/vibevoice/vibevoice.nginx b/containers/vibevoice/vibevoice.nginx index fa2854a..a6bae2c 100644 --- a/containers/vibevoice/vibevoice.nginx +++ b/containers/vibevoice/vibevoice.nginx @@ -24,9 +24,16 @@ server { # Large file support for audio client_max_body_size 100M; + # Re-resolve vibevoice's DNS name at request time so a container restart + # (new IP on internal.network) doesn't leave nginx stuck on a stale + # address until nginx itself is restarted. + resolver 10.10.0.1 valid=10s; + resolver_timeout 5s; + # Vibevoice upstream (TTS/ASR API) location / { - proxy_pass http://vibevoice:8080; + set $vibevoice_upstream http://vibevoice:8080; + proxy_pass $vibevoice_upstream; proxy_http_version 1.1; proxy_buffering off;