Improve nginx configs

README.md

@@ -33,7 +33,8 @@ sudo apt update && sudo apt upgrade -y
 ```bash
 sudo usermod -a -G render,video $LOGNAME
 sudo loginctl enable-linger $USER
-sudo sh -c "echo 'net.ipv4.ip_unprivileged_port_start=80' >> /etc/sysctl.conf"
+echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee /etc/sysctl.d/99-rootless-ports.conf
+sudo sysctl --system
 ```
 
 ##### 3. Installare Podman e strumenti utili

containers/gitea/gitea.container

@@ -15,7 +15,11 @@ Network=internal.network
 PublishPort=3000:3000
 PublishPort=2222:22
 
+
+# mkdir -p /srv/containers/gitea/{data,repositories,config}
+# podman unshare chown -R 1000:1000 /srv/containers/gitea/data /srv/containers/gitea/repositories /srv/containers/gitea/config
 Volume=/srv/containers/gitea/data:/data
+Volume=/srv/containers/gitea/repositories:/data/git/repositories
 Volume=/srv/containers/gitea/config:/data/gitea/conf
 
 [Service]

containers/gitea/gitea.nginx

@@ -1,3 +1,12 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name code.[DOMAIN];
+
+    # Redirect HTTP to HTTPS
+    return 301 https://$server_name$request_uri;
+}
+
 server {
     listen 443 ssl http2;
     server_name code.[DOMAIN];
@@ -7,8 +16,15 @@ server {
 
     client_max_body_size 1G;
 
+    # Re-resolve gitea's DNS name at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     location / {
-        proxy_pass http://gitea:3000;
+        set $gitea_upstream http://gitea:3000;
+        proxy_pass $gitea_upstream;
 
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;

containers/mattermost/mattermost.container

@@ -31,6 +31,7 @@ Environment=MM_LOGSETTINGS_ENABLEFILE=true
 Environment=MM_LOGSETTINGS_FILELEVEL=info
 
 # mkdir -p /srv/containers/mattermost/{config,data,logs,plugins,client-plugins,bleve-indexes}
+# podman unshare chown -R 2000:2000 /srv/containers/mattermost/config /srv/containers/mattermost/data /srv/containers/mattermost/logs /srv/containers/mattermost/plugins /srv/containers/mattermost/client-plugins /srv/containers/mattermost/bleve-indexes
 Volume=/srv/containers/mattermost/config:/mattermost/config
 Volume=/srv/containers/mattermost/data:/mattermost/data
 Volume=/srv/containers/mattermost/logs:/mattermost/logs

containers/mattermost/mattermost.nginx

@@ -24,9 +24,16 @@ server {
     # Proxy Settings
     client_max_body_size 50M;
 
+    # Re-resolve mattermost's DNS name at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     # Mattermost upstream
     location / {
-        proxy_pass http://mattermost:8065;
+        set $mattermost_upstream http://mattermost:8065;
+        proxy_pass $mattermost_upstream;
         proxy_http_version 1.1;
         proxy_buffering off;
 

containers/navidrome/navidrome.nginx

@@ -0,0 +1,57 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name music.[DOMAIN];
+
+    # Redirect HTTP to HTTPS
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name music.[DOMAIN];
+
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/music.[DOMAIN]/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/music.[DOMAIN]/privkey.pem;
+
+    # SSL Settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    # Proxy Settings
+    client_max_body_size 50M;
+
+    # Re-resolve navidrome's DNS name at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
+    # Navidrome upstream
+    location / {
+        set $navidrome_upstream http://navidrome:4533;
+        proxy_pass $navidrome_upstream;
+        proxy_http_version 1.1;
+        proxy_buffering off;
+
+        # Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $server_name;
+        proxy_set_header X-Forwarded-Port $server_port;
+
+        # WebSocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Timeouts (long-lived streaming connections)
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
+    }
+}

containers/nextcloud/collaboraoffice.nginx

@@ -5,23 +5,33 @@ server {
     ssl_certificate /etc/letsencrypt/live/[DOMAIN]/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/[DOMAIN]/privkey.pem;
 
+    # Re-resolve collaboraoffice's DNS name at request time so a container
+    # restart (new IP on internal.network) doesn't leave nginx stuck on a
+    # stale address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     location ^~ /browser {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Host $http_host;
     }
 
     location ^~ /hosting/discovery {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Host $http_host;
     }
 
     location ^~ /hosting/capabilities {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Host $http_host;
     }
 
     location ~ ^/cool/(.*)/ws$ {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
         proxy_set_header Host $http_host;
@@ -29,12 +39,14 @@ server {
     }
 
     location ~ ^/(c|l)ool {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Host $http_host;
     }
 
     location ^~ /cool/adminws {
-        proxy_pass http://collaboraoffice:9980;
+        set $collabora_upstream http://collaboraoffice:9980;
+        proxy_pass $collabora_upstream;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
         proxy_set_header Host $http_host;

containers/nextcloud/nextcloud-cron.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Nextcloud cron.php background job
+After=nextcloud.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/podman exec -u www-data nextcloud php -f /var/www/html/cron.php

containers/nextcloud/nextcloud-cron.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run Nextcloud cron.php every 5 minutes
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=5min
+Unit=nextcloud-cron.service
+
+[Install]
+WantedBy=timers.target

containers/nextcloud/nextcloud-taskworker@.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Nextcloud Task Processing Worker %i
+After=nextcloud.service
+
+[Service]
+ExecStart=/usr/bin/podman exec -u www-data nextcloud php occ taskprocessing:worker -v -t 60
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=default.target

containers/nextcloud/nextcloud.README

@@ -10,20 +10,25 @@ podman exec -it nextcloud php occ config:system:set trusted_proxies 0 --value="1
 podman exec -it nextcloud php occ config:system:set forwarded_for_headers 0 --value="HTTP_X_FORWARDED_FOR"
 
 # Push Notification
+podman exec -u www-data nextcloud php occ app:install notify_push 2>&1 || podman exec -u www-data nextcloud php occ app:enable notify_push
 podman exec -u www-data nextcloud php occ config:system:set memcache.local --value='\OC\Memcache\APCu'
 podman exec -u www-data nextcloud php occ config:system:set memcache.locking --value='\OC\Memcache\Redis'
 podman exec -u www-data nextcloud php occ config:system:set redis host --value='redis'
 podman exec -u www-data nextcloud php occ config:system:set redis port --type=integer --value=6379
 
 
-# OLD
-podman exec -it nextcloud php occ config:system:set trusted_domains 1 --value="cloud.[DOMAIN]"
+# Rescan
+podman exec -u www-data nextcloud php occ files:scan nome_utente
+podman exec -u www-data nextcloud php occ files:scan --path="nome_utente/files/sottocartella"
+podman exec -u www-data nextcloud php occ files:scan --all
+
+# Creazione
+mkdir -p ~/.config/systemd/user
+nano ~/.config/containers/systemd/nextcloud-cron.service 
+nano ~/.config/containers/systemd/nextcloud-cron.timer
+nano ~/.config/containers/systemd/nextcloud-taskworker@.service
+
+systemctl --user daemon-reload
+systemctl --user enable --now nextcloud-cron.timer
+systemctl --user enable --now nextcloud-taskworker@1 nextcloud-taskworker@2 nextcloud-taskworker@3 nextcloud-taskworker@4
 
-podman exec -it nextcloud php occ config:system:set overwritehost --value="cloud.[DOMAIN]"
-podman exec -it nextcloud php occ config:system:set overwrite.cli.url --value="https://cloud.[DOMAIN]"
-podman exec -it nextcloud php occ config:system:set htaccess.RewriteBase --value="/"
-podman exec -it nextcloud php occ maintenance:update:htaccess
-podman exec -it nextcloud php occ config:app:set richdocuments wopi_url --value="https://office.[DOMAIN]"
-podman exec -it nextcloud php occ config:app:set richdocuments public_wopi_url --value="https://office.[DOMAIN]"
-podman exec -it nextcloud php occ config:app:delete richdocuments wopi_discovery
-podman exec -it nextcloud php occ config:app:delete richdocuments wopi_capabilities

containers/nextcloud/nextcloud.container

@@ -9,6 +9,8 @@ Network=internal.network
 
 PublishPort=8080:80
 
+# mkdir -p /srv/containers/nextcloud/{config,custom_apps,data}
+# podman unshare chown -R 33:33 /srv/containers/nextcloud/config /srv/containers/nextcloud/custom_apps /srv/containers/nextcloud/data
 Volume=/srv/containers/nextcloud/config:/var/www/html/config
 Volume=/srv/containers/nextcloud/custom_apps:/var/www/html/custom_apps
 Volume=/srv/containers/nextcloud/data:/var/www/html/data

containers/nextcloud/nextcloud.nginx

@@ -13,9 +13,16 @@ server {
     # Warning HSTS Nextcloud
     add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
 
+    # Re-resolve upstream DNS names at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     # Nextcloud Push
     location ^~ /push/ {
-        proxy_pass http://nextcloud:7867/;
+        set $nextcloud_push_upstream http://nextcloud-push:7867;
+        proxy_pass $nextcloud_push_upstream/;
 
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
@@ -32,7 +39,8 @@ server {
     }
 
     location / {
-        proxy_pass http://nextcloud:8080; # o :80 se rete del container
+        set $nextcloud_upstream http://nextcloud:80;
+        proxy_pass $nextcloud_upstream;
 
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;

containers/nginx/certbot.README

@@ -1,3 +1,6 @@
 podman pull certbot/certbot
 
+# Or use integrated container:
+podma pull jonasal/nginx-certbot
+
 podman run -it -v /srv/containers/nginx/ssl:/etc/letsencrypt certbot certonly --manual --preferred-challenges dns -d *.[DOMAIN]

containers/nginx/nginx.container

@@ -15,10 +15,15 @@ Image=nginx:latest
 #AutoUpdate=registry
 Network=internal.network
 
+
+# mkdir -p /srv/containers/nginx/{conf,html,ssl}
 Volume=/srv/containers/nginx/conf:/etc/nginx/conf.d:ro
 Volume=/srv/containers/nginx/html:/usr/share/nginx/html:ro
-
 Volume=/srv/containers/nginx/ssl:/etc/nginx/ssl:ro
+# Let's Encrypt
+#Volume=/srv/containers/nginx/ssl:/etc/letsencrypt:ro
+
+
 
 PublishPort=80:80
 PublishPort=443:443

containers/postgres/postgres.README

@@ -27,3 +27,17 @@ podman exec -it postgres psql -U postgres -c "GRANT ALL privileges ON DATABASE [
 podman exec -it postgres psql -U postgres -d [nome_progetto] -c "GRANT CREATE ON SCHEMA public TO [nome_progetto];"
 ```
 
+----
+
+# Backup e Restore
+
+Backup (pg_dump) del database su file sull'host:
+```bash
+podman exec -e PGPASSWORD="[password_db_progetto]" postgres pg_dump -U [nome_progetto] -d [nome_progetto] > backup.sql
+```
+
+Restore da file sull'host nel database:
+```bash
+podman exec -i -e PGPASSWORD="[password_db_progetto]" postgres psql -U [nome_progetto] -d [nome_progetto] < backup.sql
+```
+

containers/qwentts/qwentts.nginx

@@ -1,7 +1,3 @@
-upstream qwentts {
-    server qwentts:8080;
-}
-
 server {
     listen 80;
     server_name qwentts.example.com;
@@ -20,12 +16,19 @@ server {
 
     client_max_body_size 100m;
 
+    # Re-resolve qwentts's DNS name at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     # Logging
     access_log /var/log/nginx/qwentts_access.log;
     error_log /var/log/nginx/qwentts_error.log;
 
     location / {
-        proxy_pass http://qwentts;
+        set $qwentts_upstream http://qwentts:8080;
+        proxy_pass $qwentts_upstream;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";

containers/vibevoice/vibevoice.nginx

@@ -24,9 +24,16 @@ server {
     # Large file support for audio
     client_max_body_size 100M;
 
+    # Re-resolve vibevoice's DNS name at request time so a container restart
+    # (new IP on internal.network) doesn't leave nginx stuck on a stale
+    # address until nginx itself is restarted.
+    resolver 10.10.0.1 valid=10s;
+    resolver_timeout 5s;
+
     # Vibevoice upstream (TTS/ASR API)
     location / {
-        proxy_pass http://vibevoice:8080;
+        set $vibevoice_upstream http://vibevoice:8080;
+        proxy_pass $vibevoice_upstream;
         proxy_http_version 1.1;
         proxy_buffering off;