From 9a00c904d4910f9239f2fac3936b5132ab42ae2d Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Wed, 24 Jun 2026 12:42:07 +0200 Subject: [PATCH 1/6] ship harp also for manual-install Signed-off-by: Simon L. --- manual-install/update-yaml.sh | 4 ---- php/containers.json | 3 +++ 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/manual-install/update-yaml.sh b/manual-install/update-yaml.sh index 9d966a9d9ea..3b1a5a9d3cb 100644 --- a/manual-install/update-yaml.sh +++ b/manual-install/update-yaml.sh @@ -27,8 +27,6 @@ OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "next OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-borgbackup"))')" OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-docker-socket-proxy"))')" OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-docker-socket-proxy"]) then del(.[index("nextcloud-aio-docker-socket-proxy")]) else . end else . end')" -OUTPUT="$(echo "$OUTPUT" | jq 'del(.services[] | select(.container_name == "nextcloud-aio-harp"))')" -OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= if contains(["nextcloud-aio-harp"]) then del(.[index("nextcloud-aio-harp")]) else . end else . end')" OUTPUT="$(echo "$OUTPUT" | jq '.services[] |= if has("depends_on") then .depends_on |= map({ (.): { "condition": "service_started", "required": false } }) else . end' | jq '.services[] |= if has("depends_on") then .depends_on |= reduce .[] as $item ({}; . + $item) else . end')" sudo snap install yq @@ -47,8 +45,6 @@ sed -i 's|- ip_binding: |- |' containers.yml sed -i '/AIO_TOKEN/d' containers.yml sed -i '/AIO_URL/d' containers.yml sed -i '/DOCKER_SOCKET_PROXY_ENABLED/d' containers.yml -sed -i '/HARP_ENABLED/d' containers.yml -sed -i '/HARP_HOST/d' containers.yml sed -i '/HP_SHARED_KEY/d' containers.yml sed -i '/ADDITIONAL_TRUSTED_PROXY/d' containers.yml sed -i '/TURN_DOMAIN/d' containers.yml diff --git a/php/containers.json b/php/containers.json index a63f5d16a82..d8900c4507b 100644 --- a/php/containers.json +++ b/php/containers.json @@ -970,6 +970,9 @@ ], "cap_drop": [ "NET_RAW" + ], + "profiles": [ + "harp" ] }, { From c40cb1cffe891863c75a586940fd7aa981959862 Mon Sep 17 00:00:00 2001 From: szaimen <42591237+szaimen@users.noreply.github.com> Date: Wed, 24 Jun 2026 10:45:12 +0000 Subject: [PATCH 2/6] Yaml updates Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Simon L. --- manual-install/latest.yml | 29 +++++++++++++++++++++++++++++ manual-install/sample.conf | 2 ++ 2 files changed, 31 insertions(+) diff --git a/manual-install/latest.yml b/manual-install/latest.yml index 0d1411d773c..327f2680082 100644 --- a/manual-install/latest.yml +++ b/manual-install/latest.yml @@ -19,6 +19,9 @@ services: nextcloud-aio-whiteboard: condition: service_started required: false + nextcloud-aio-harp: + condition: service_started + required: false nextcloud-aio-nextcloud: condition: service_started required: false @@ -50,6 +53,7 @@ services: - APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME} - NOTIFY_PUSH_HOST=nextcloud-aio-notify-push - WHITEBOARD_HOST=nextcloud-aio-whiteboard + - HARP_HOST=nextcloud-aio-harp volumes: - nextcloud_aio_nextcloud:/var/www/html:ro - nextcloud_aio_apache:/mnt/data:rw @@ -193,6 +197,7 @@ services: - IMAGINARY_SECRET - WHITEBOARD_SECRET - WHITEBOARD_ENABLED + - HARP_ENABLED stop_grace_period: 600s restart: unless-stopped shm_size: 134217728 @@ -504,6 +509,28 @@ services: cap_drop: - NET_RAW + nextcloud-aio-harp: + image: ghcr.io/nextcloud/nextcloud-appapi-harp:latest + init: true + expose: + - "8780" + environment: + - NC_INSTANCE_URL=https://${NC_DOMAIN} + - HP_FRP_DISABLE_TLS=true + - TZ=${TIMEZONE} + volumes: + - ${WATCHTOWER_DOCKER_SOCKET_PATH}:/var/run/docker.sock:ro + - nextcloud_aio_harp:/certs:rw + restart: unless-stopped + read_only: true + tmpfs: + - /tmp + - /run/harp + cap_drop: + - NET_RAW + profiles: + - harp + nextcloud-aio-whiteboard: image: ghcr.io/nextcloud-releases/aio-whiteboard:latest user: "65534" @@ -549,6 +576,8 @@ volumes: name: nextcloud_aio_elasticsearch nextcloud_aio_eurooffice: name: nextcloud_aio_eurooffice + nextcloud_aio_harp: + name: nextcloud_aio_harp nextcloud_aio_nextcloud: name: nextcloud_aio_nextcloud nextcloud_aio_onlyoffice: diff --git a/manual-install/sample.conf b/manual-install/sample.conf index d4da3604661..584d72ca2c5 100644 --- a/manual-install/sample.conf +++ b/manual-install/sample.conf @@ -11,12 +11,14 @@ SIGNALING_SECRET= # TODO! This needs to be a unique and good password! TALK_INTERNAL_SECRET= # TODO! This needs to be a unique and good password! TIMEZONE=Europe/Berlin # TODO! This is the timezone that your containers will use. TURN_SECRET= # TODO! This needs to be a unique and good password! +WATCHTOWER_DOCKER_SOCKET_PATH= # TODO! This needs to be a unique and good password! WHITEBOARD_SECRET= # TODO! This needs to be a unique and good password! CLAMAV_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. COLLABORA_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. EUROOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. FULLTEXTSEARCH_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. +HARP_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. IMAGINARY_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. ONLYOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. TALK_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. From 45297ac60ea43df4a10a580911b0a324968c935a Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Wed, 24 Jun 2026 13:05:44 +0200 Subject: [PATCH 3/6] Make harp Kubernetes backend configurable in helm chart When harp syncs over from the manual-install to the helm chart it needs the Kubernetes backend (HP_K8S_*) instead of the docker backend. The update-helm script now injects these env vars into the harp deployment, templated to values.yaml, and the chart readme documents them. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Simon L. --- nextcloud-aio-helm-chart/readme.md | 17 ++++++++++++++++ nextcloud-aio-helm-chart/update-helm.sh | 26 +++++++++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/nextcloud-aio-helm-chart/readme.md b/nextcloud-aio-helm-chart/readme.md index cb31e601ea6..0fdc4f0190c 100755 --- a/nextcloud-aio-helm-chart/readme.md +++ b/nextcloud-aio-helm-chart/readme.md @@ -36,6 +36,23 @@ helm install nextcloud-aio nextcloud-aio/nextcloud-aio-helm-chart -f values.yaml And after a while, everything should be set up. +## HaRP / AppAPI (ExApps) configuration + +When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API. + +> [!IMPORTANT] +> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup. + +The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP: + +| Value | Default | Description | +| --- | --- | --- | +| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. | +| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. | +| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. | +| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. | +| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. | + ## How to update? Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it. 1. Stop all running pods diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index 8c99fc212b3..ecb865641bf 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -343,6 +343,27 @@ EOL # shellcheck disable=SC1083 find ./ -name '*talk-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-talk.config" \{} \; +# Additional config for HaRP +# The manual-install (docker) only configures HaRP with the docker backend. In the +# helm chart HaRP needs to talk to the Kubernetes API instead, so we enable the +# Kubernetes backend here and expose its settings via values.yaml. +cat << EOL > /tmp/additional-harp.config + - name: HP_K8S_ENABLED + value: "true" + - name: HP_K8S_NAMESPACE + value: "{{ .Values.HARP_K8S_NAMESPACE }}" + - name: HP_K8S_STORAGE_CLASS + value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}" + - name: HP_K8S_DEFAULT_STORAGE_SIZE + value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}" + - name: HP_K8S_BEARER_TOKEN_FILE + value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}" + - name: HP_K8S_HOST_ALIASES + value: "{{ .Values.HARP_K8S_HOST_ALIASES }}" +EOL +# shellcheck disable=SC1083 +find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \; + cat << EOL > templates/nextcloud-aio-networkpolicy.yaml {{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }} # https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md @@ -443,6 +464,11 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed. TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb +HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it. +HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. +HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps. +HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. +HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. ADDITIONAL_CONFIG mv /tmp/sample.conf ../helm-chart/values.yaml From cea187d6cb2cf24d340160271990cf9ceee38cd3 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Wed, 24 Jun 2026 13:17:08 +0200 Subject: [PATCH 4/6] harp helm: drop redundant token file, add service account, fix host aliases docs - Remove HARP_K8S_BEARER_TOKEN_FILE: HaRP already defaults it to the in-cluster service account token path, so templating it added nothing. - Add HARP_SERVICE_ACCOUNT_NAME so the harp pod can run under a service account the user grants the required RBAC to, and document the setup. - Correct the HARP_K8S_HOST_ALIASES docs: it is a comma-separated list of hostname:ip pairs, not JSON. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Simon L. --- nextcloud-aio-helm-chart/readme.md | 11 ++++++++--- nextcloud-aio-helm-chart/update-helm.sh | 16 ++++++++++++---- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/nextcloud-aio-helm-chart/readme.md b/nextcloud-aio-helm-chart/readme.md index 0fdc4f0190c..583a5ec1396 100755 --- a/nextcloud-aio-helm-chart/readme.md +++ b/nextcloud-aio-helm-chart/readme.md @@ -41,7 +41,12 @@ And after a while, everything should be set up. When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API. > [!IMPORTANT] -> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup. +> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to: +> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists. +> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod. +> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`. +> +> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions. The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP: @@ -50,8 +55,8 @@ The following values in `values.yaml` allow you to adjust the Kubernetes backend | `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. | | `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. | | `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. | -| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. | -| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. | +| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. | +| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. | ## How to update? Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it. diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index ecb865641bf..06f7ba899b6 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -356,13 +356,21 @@ cat << EOL > /tmp/additional-harp.config value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}" - name: HP_K8S_DEFAULT_STORAGE_SIZE value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}" - - name: HP_K8S_BEARER_TOKEN_FILE - value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}" - name: HP_K8S_HOST_ALIASES value: "{{ .Values.HARP_K8S_HOST_ALIASES }}" EOL # shellcheck disable=SC1083 find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \; +# HaRP authenticates against the Kubernetes API with the service account that is +# mounted into its pod. Allow the service account name to be set via values.yaml +# so that the user can grant it the required RBAC permissions (see the readme). +cat << EOL > /tmp/additional-harp-sa.config + {{- if .Values.HARP_SERVICE_ACCOUNT_NAME }} + serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}" + {{- end }} +EOL +# shellcheck disable=SC1083 +find ./ -name '*harp-deployment.yaml' -exec sed -i "/^ spec:$/r /tmp/additional-harp-sa.config" \{} \; cat << EOL > templates/nextcloud-aio-networkpolicy.yaml {{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }} @@ -467,8 +475,8 @@ TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max strea HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it. HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps. -HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. -HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. +HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases. +HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account. ADDITIONAL_CONFIG mv /tmp/sample.conf ../helm-chart/values.yaml From ab45f17aeed80a9e1a27cc88421a536466b3e326 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Tue, 4 Aug 2026 13:38:39 +0200 Subject: [PATCH 5/6] some additional changes Signed-off-by: Simon L. --- .github/dependabot.yml | 1 + Containers/harp/Dockerfile | 17 +++++++++++++++++ manual-install/update-yaml.sh | 1 + nextcloud-aio-helm-chart/update-helm.sh | 2 ++ php/containers.json | 12 ++++++++++-- 5 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 Containers/harp/Dockerfile diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 446794621b1..f9026f2883d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,6 +33,7 @@ updates: - "/Containers/domaincheck" - "/Containers/eurooffice" - "/Containers/fulltextsearch" + - "/Containers/harp" - "/Containers/imaginary" - "/Containers/mastercontainer" - "/Containers/nextcloud" diff --git a/Containers/harp/Dockerfile b/Containers/harp/Dockerfile new file mode 100644 index 00000000000..0a9318461e3 --- /dev/null +++ b/Containers/harp/Dockerfile @@ -0,0 +1,17 @@ +# syntax=docker/dockerfile:latest +FROM ghcr.io/nextcloud/nextcloud-appapi-harp:v0.4.3 + +# USER root is probably used + +LABEL com.centurylinklabs.watchtower.enable="false" \ + wud.watch="false" \ + dockhand.update="false" \ + org.opencontainers.image.title="Nextcloud AppAPI HARP for Nextcloud AIO" \ + org.opencontainers.image.description="Nextcloud AppAPI HARP for Nextcloud All-in-One" \ + org.opencontainers.image.url="https://github.com/nextcloud/all-in-one" \ + org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \ + org.opencontainers.image.vendor="Nextcloud" \ + org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md" + +# Copied from upstream +HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh diff --git a/manual-install/update-yaml.sh b/manual-install/update-yaml.sh index 3b1a5a9d3cb..88e5b3ab80a 100644 --- a/manual-install/update-yaml.sh +++ b/manual-install/update-yaml.sh @@ -92,6 +92,7 @@ sed -i 's|NEXTCLOUD_TRUSTED_CACERTS_DIR=|NEXTCLOUD_TRUSTED_CACERTS_DIR=/usr/loca sed -i 's|UPDATE_NEXTCLOUD_APPS=|UPDATE_NEXTCLOUD_APPS="no" # When setting to "yes" (with quotes), it will automatically update all installed Nextcloud apps upon container startup on saturdays.|' sample.conf sed -i 's|APACHE_PORT=|APACHE_PORT=443 # Changing this to a different value than 443 will allow you to run it behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else).|' sample.conf sed -i 's|APACHE_IP_BINDING=|APACHE_IP_BINDING=0.0.0.0 # This can be changed to e.g. 127.0.0.1 if you want to run AIO behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) and if that is running on the same host and using localhost to connect|' sample.conf +sed -i 's|WATCHTOWER_DOCKER_SOCKET_PATH=|WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # This can be changed depending on where the docker socket is located on your host|' sample.conf sed -i 's|TALK_PORT=|TALK_PORT=3478 # This allows to adjust the port that the talk container is using. It should be set to something higher than 1024! Otherwise it might not work!|' sample.conf sed -i 's|NC_DOMAIN=|NC_DOMAIN=yourdomain.com # TODO! Needs to be changed to the domain that you want to use for Nextcloud.|' sample.conf sed -i 's|NEXTCLOUD_PASSWORD=|NEXTCLOUD_PASSWORD= # TODO! This is the password of the initially created Nextcloud admin with username "admin".|' sample.conf diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index 06f7ba899b6..9e4d9a6a3cb 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -44,6 +44,7 @@ sed -i "s|- \${TALK_PORT}|- $TALK_PORT|" latest.yml sed -i "s|\${NEXTCLOUD_DATADIR}|$NEXTCLOUD_DATADIR|" latest.yml sed -i "s|\${ADDITIONAL_COLLABORA_OPTIONS}|ADDITIONAL_COLLABORA_OPTIONS_PLACEHOLDER|" latest.yml sed -i "/name: nextcloud-aio/,$ d" latest.yml +sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" latest.yml sed -i "/NEXTCLOUD_DATADIR/d" latest.yml sed -i "/\${NEXTCLOUD_MOUNT}/d" latest.yml sed -i "/^volumes:/a\ \ nextcloud_aio_nextcloud_trusted_cacerts:\n \ \ \ \ name: nextcloud_aio_nextcloud_trusted_cacerts" latest.yml @@ -432,6 +433,7 @@ sed -i 's|= |: |' /tmp/sample.conf sed -i '/^NEXTCLOUD_DATADIR/d' /tmp/sample.conf sed -i '/^APACHE_IP_BINDING/d' /tmp/sample.conf sed -i '/^NEXTCLOUD_MOUNT/d' /tmp/sample.conf +sed -i "/WATCHTOWER_DOCKER_SOCKET_PATH/d" /tmp/sample.conf sed -i 's/ yes / "yes" /' /tmp/sample.conf sed -i 's/ no / "no" /' /tmp/sample.conf sed -i 's/"no" authentication/no authentication/' /tmp/sample.conf diff --git a/php/containers.json b/php/containers.json index d8900c4507b..8284777eb01 100644 --- a/php/containers.json +++ b/php/containers.json @@ -933,14 +933,22 @@ }, { "container_name": "nextcloud-aio-harp", - "image_tag": "release", + "image_tag": "%AIO_CHANNEL%", "display_name": "HaRP", - "image": "ghcr.io/nextcloud/nextcloud-appapi-harp", + "image": "ghcr.io/nextcloud-releases/aio-harp", "init": true, "internal_port": "8780", "expose": [ "8780" ], + "healthcheck": { + "start_period": "0s", + "test": "/healthcheck.sh", + "interval": "10s", + "timeout": "10s", + "start_interval": "5s", + "retries": 9 + }, "environment": [ "HP_SHARED_KEY=%HP_SHARED_KEY%", "NC_INSTANCE_URL=https://%NC_DOMAIN%", From 553ce89fc3cfa8a98599117bd94cbf37b81ccdeb Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Tue, 4 Aug 2026 13:38:55 +0200 Subject: [PATCH 6/6] Revert "Yaml updates" This reverts commit c40cb1cffe891863c75a586940fd7aa981959862. Signed-off-by: Simon L. --- manual-install/latest.yml | 29 ----------------------------- manual-install/sample.conf | 2 -- 2 files changed, 31 deletions(-) diff --git a/manual-install/latest.yml b/manual-install/latest.yml index 327f2680082..0d1411d773c 100644 --- a/manual-install/latest.yml +++ b/manual-install/latest.yml @@ -19,9 +19,6 @@ services: nextcloud-aio-whiteboard: condition: service_started required: false - nextcloud-aio-harp: - condition: service_started - required: false nextcloud-aio-nextcloud: condition: service_started required: false @@ -53,7 +50,6 @@ services: - APACHE_MAX_TIME=${NEXTCLOUD_MAX_TIME} - NOTIFY_PUSH_HOST=nextcloud-aio-notify-push - WHITEBOARD_HOST=nextcloud-aio-whiteboard - - HARP_HOST=nextcloud-aio-harp volumes: - nextcloud_aio_nextcloud:/var/www/html:ro - nextcloud_aio_apache:/mnt/data:rw @@ -197,7 +193,6 @@ services: - IMAGINARY_SECRET - WHITEBOARD_SECRET - WHITEBOARD_ENABLED - - HARP_ENABLED stop_grace_period: 600s restart: unless-stopped shm_size: 134217728 @@ -509,28 +504,6 @@ services: cap_drop: - NET_RAW - nextcloud-aio-harp: - image: ghcr.io/nextcloud/nextcloud-appapi-harp:latest - init: true - expose: - - "8780" - environment: - - NC_INSTANCE_URL=https://${NC_DOMAIN} - - HP_FRP_DISABLE_TLS=true - - TZ=${TIMEZONE} - volumes: - - ${WATCHTOWER_DOCKER_SOCKET_PATH}:/var/run/docker.sock:ro - - nextcloud_aio_harp:/certs:rw - restart: unless-stopped - read_only: true - tmpfs: - - /tmp - - /run/harp - cap_drop: - - NET_RAW - profiles: - - harp - nextcloud-aio-whiteboard: image: ghcr.io/nextcloud-releases/aio-whiteboard:latest user: "65534" @@ -576,8 +549,6 @@ volumes: name: nextcloud_aio_elasticsearch nextcloud_aio_eurooffice: name: nextcloud_aio_eurooffice - nextcloud_aio_harp: - name: nextcloud_aio_harp nextcloud_aio_nextcloud: name: nextcloud_aio_nextcloud nextcloud_aio_onlyoffice: diff --git a/manual-install/sample.conf b/manual-install/sample.conf index 584d72ca2c5..d4da3604661 100644 --- a/manual-install/sample.conf +++ b/manual-install/sample.conf @@ -11,14 +11,12 @@ SIGNALING_SECRET= # TODO! This needs to be a unique and good password! TALK_INTERNAL_SECRET= # TODO! This needs to be a unique and good password! TIMEZONE=Europe/Berlin # TODO! This is the timezone that your containers will use. TURN_SECRET= # TODO! This needs to be a unique and good password! -WATCHTOWER_DOCKER_SOCKET_PATH= # TODO! This needs to be a unique and good password! WHITEBOARD_SECRET= # TODO! This needs to be a unique and good password! CLAMAV_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. COLLABORA_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. EUROOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. FULLTEXTSEARCH_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. -HARP_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. IMAGINARY_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. ONLYOFFICE_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically. TALK_ENABLED="no" # Setting this to "yes" (with quotes) enables the option in Nextcloud automatically.