Skip to content

Commit

Permalink
Add ability to specify additional docker network and update documenta…
Browse files Browse the repository at this point in the history 
…tion for it.

Signed-off-by: Apoorv Parle <[email protected]>
  • Loading branch information
@apparle
apparle committed Nov 2, 2024
1 parent a02d164 commit f644e83
Show file tree
Hide file tree
Showing 5 changed files with 66 additions and 27 deletions.
8 changes: 8 additions & 0 deletions Containers/mastercontainer/start.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,14 @@ It is set to '$APACHE_IP_BINDING'."
exit 1
fi
fi
if [ -n "$APACHE_ADDITIONAL_NETWORK" ]; then
if ! echo "$APACHE_ADDITIONAL_NETWORK" | grep -q "^[a-zA-Z0-9_-]\+$"; then
print_red "You've set APACHE_ADDITIONAL_NETWORK but not to an allowed value.
It needs to be a string with letters, numbers, hyphens and underscores.
It is set to '$APACHE_ADDITIONAL_NETWORK'."
exit 1
fi
fi
if [ -n "$TALK_PORT" ]; then
if ! check_if_number "$TALK_PORT"; then
print_red "You provided an Talk port but did not only use numbers.
Expand Down
1 change: 1 addition & 0 deletions compose.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ services:
# AIO_COMMUNITY_CONTAINERS: # With this variable, you can add community containers very easily. See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers
# APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# APACHE_IP_BINDING: 127.0.0.1 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# APACHE_ADDITIONAL_NETWORK: frontend_net # (Optional) Connect the apache container to an additional docker network. Needed when behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) running in a different docker network on same server. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
# COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
# NEXTCLOUD_DATADIR: /mnt/ncdata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
Expand Down
7 changes: 7 additions & 0 deletions php/src/Data/ConfigurationManager.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -888,6 +888,13 @@ public function DeleteCollaboraDictionaries() : void {
$this->WriteConfig($config);
}

public function GetApacheAdditionalNetwork() : string {
$envVariableName = 'APACHE_ADDITIONAL_NETWORK';
$configName = 'apache_additional_network';
$defaultValue = '';
return $this->GetEnvironmentalVariableOrConfig($envVariableName, $configName, $defaultValue);
}

public function GetApacheIPBinding() : string {
$envVariableName = 'APACHE_IP_BINDING';
$configName = 'apache_ip_binding';
Expand Down
70 changes: 46 additions & 24 deletions php/src/Docker/DockerActionManager.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -844,44 +844,49 @@ private function DisconnectContainerFromBridgeNetwork(string $id) : void
}
}

private function ConnectContainerIdToNetwork(string $id, string $internalPort, string $network = 'nextcloud-aio') : void
private function ConnectContainerIdToNetwork(string $id, string $internalPort, string $network = 'nextcloud-aio', bool $createNetwork = true, string $alias = '') : void
{
if ($internalPort === 'host') {
return;
}

$url = $this->BuildApiUrl('networks/create');
try {
$this->guzzleClient->request(
'POST',
$url,
[
'json' => [
'Name' => $network,
'CheckDuplicate' => true,
'Driver' => 'bridge',
'Internal' => false,
]
]
);
} catch (RequestException $e) {
// 409 is undocumented and gets thrown if the network already exists.
if ($e->getCode() !== 409) {
throw new \Exception("Could not create the nextcloud-aio network: " . $e->getMessage());
}
if($createNetwork) {
$url = $this->BuildApiUrl('networks/create');
try {
$this->guzzleClient->request(
'POST',
$url,
[
'json' => [
'Name' => $network,
'CheckDuplicate' => true,
'Driver' => 'bridge',
'Internal' => false,
]
]
);
} catch (RequestException $e) {
// 409 is undocumented and gets thrown if the network already exists.
if ($e->getCode() !== 409) {
throw new \Exception("Could not create the nextcloud-aio network: " . $e->getMessage());
}
}
}

$url = $this->BuildApiUrl(
sprintf('networks/%s/connect', $network)
);
$json_payload = [ 'Container' => $id ];
if ($alias !== '' ) {
$json_payload['EndpointConfig'] = [ 'Aliases' => [ $alias ] ];
}

try {
$this->guzzleClient->request(
'POST',
$url,
[
'json' => [
'container' => $id,
]
'json' => $json_payload
]
);
} catch (RequestException $e) {
Expand All @@ -897,11 +902,28 @@ public function ConnectMasterContainerToNetwork() : void
$this->ConnectContainerIdToNetwork('nextcloud-aio-mastercontainer', '');
// Don't disconnect here since it slows down the initial login by a lot. Is getting done during cron.sh instead.
// $this->DisconnectContainerFromBridgeNetwork('nextcloud-aio-mastercontainer');

$apacheAdditionalNetwork = $this->configurationManager->GetApacheAdditionalNetwork();
if ($apacheAdditionalNetwork !== '') {
$this->ConnectContainerIdToNetwork('nextcloud-aio-mastercontainer', '', $apacheAdditionalNetwork, false);
}
}

public function ConnectContainerToNetwork(Container $container) : void
{
$this->ConnectContainerIdToNetwork($container->GetIdentifier(), $container->GetInternalPort());
// Add a secondary alias for domaincheck container, to keep it as similar to actual apache controller as possible.
// If a reverse-proxy is relying on container name as hostname this allows it to operate as usual and still validate the domain
// The domaincheck container and apache container are never supposed to be active at the same time because they use the same APACHE_PORT anyway, so this doesn't add any new constraints.
$alias = ($container->GetIdentifier() === 'nextcloud-aio-domaincheck') ? 'nextcloud-aio-apache' : '';

$this->ConnectContainerIdToNetwork($container->GetIdentifier(), $container->GetInternalPort(), alias: $alias);

if ($container->GetIdentifier() === 'nextcloud-aio-apache' || $container->GetIdentifier() === 'nextcloud-aio-domaincheck') {
$apacheAdditionalNetwork = $this->configurationManager->GetApacheAdditionalNetwork();
if ($apacheAdditionalNetwork !== '') {
$this->ConnectContainerIdToNetwork($container->GetIdentifier(), $container->GetInternalPort(), $apacheAdditionalNetwork, false, alias: $alias);
}
}
}

public function StopContainer(Container $container) : void {
Expand Down
7 changes: 4 additions & 3 deletions reverse-proxy.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,10 @@ All examples below will use port `11000` as `APACHE_PORT`. This port will be exp

<summary>On the same server in a Docker container</summary>

For this setup, you can use as target `host.docker.internal:$APACHE_PORT` instead of `localhost:$APACHE_PORT`. **⚠️ Important:** In order to make this work on Docker for Linux, you need to add `--add-host=host.docker.internal:host-gateway` to the docker run command of your reverse proxy container or `extra_hosts: ["host.docker.internal:host-gateway"]` in docker compose (it works on Docker Desktop by default).

Another option (actually the recommended way) in this case is to use `--network host` option (or `network_mode: host` for docker-compose) as setting for the reverse proxy container to connect it to the host network. If you are using a firewall on the server, you need to open ports 80 and 443 for the reverse proxy manually. By doing so, the default sample configurations that point at `localhost:$APACHE_PORT` should work without having to modify them.
The reverse-proxy container needs to be connected to the nextcloud containers. This can be achieved one of these 3 ways:
1. Utilize host networking instead of docker bridge networking: Specify `--network host` option (or `network_mode: host` for docker-compose) as setting for the reverse proxy container to connect it to the host network. If you are using a firewall on the server, you need to open ports 80 and 443 for the reverse proxy manually. With this setup, the default sample configurations with reverse-proxy pointing to `localhost:$APACHE_PORT` should work directly.
1. Connect nextcloud's external-facing containers to the reverse-proxy's docker network by specifying env variable APACHE_ADDITIONAL_NETWORK. With this setup, the reverse proxy can utilize Docker bridge network's DNS name resolution to access nextcloud at `http://nextcloud-aio-apache:$APACHE_PORT`. Note, the specified network must already exist before Nextcloud AIO is started.
1. Connect the reverse-proxy container to the `nextcloud-aio` network by specifying it as a secondary (external) network for the reverse proxy container. With this setup also, the reverse proxy can utilize Docker bridge network's DNS name resolution to access nextcloud at `http://nextcloud-aio-apache:$APACHE_PORT` .

</details>

Expand Down

0 comments on commit f644e83

Please sign in to comment.