66 lines
3.9 KiB
Markdown
66 lines
3.9 KiB
Markdown
# 114 — `nextcloud`
|
|
|
|
Personal cloud / file collaboration. Source-of-truth for the photo libraries surfaced by [mulita (120)](120-mule-images.md).
|
|
|
|
## At a glance
|
|
- **Hostname:** `nextcloud`
|
|
- **IP:** `192.168.8.224`
|
|
- **Privilege:** privileged
|
|
- **Resources:** 4 cores / 6 GiB RAM / 25 GiB rootfs
|
|
- **Mounts:** `/mnt/library` ↔ `/mnt/library` (Nextcloud user files under `/mnt/library/homecloud`)
|
|
- **Public hostname:** [`cloud.hubris.network`](../infrastructure/dns.md) → [caddy](121-caddy.md)
|
|
|
|
## Auth
|
|
Native OIDC via `user_oidc` app. **Username override pattern**: Authentik user `dtoro` maps to local Nextcloud user `admin` via the `nc_uid` custom-claim scope. Configured via `occ user_oidc:provider <name> --mapping-uid=nc_uid` and `--scope="openid profile email <app>-uid"`. See [Authentik](124-authentik.md#per-app-username-override-pattern-authentik) for the full pattern.
|
|
|
|
Redirect URI: `/index.php/apps/user_oidc/code` (NOT `/apps/...` — pretty URLs aren't on).
|
|
|
|
## DNS workaround (load-bearing)
|
|
Nextcloud's PHP HTTP client (`OC\Http\Client\DnsPinMiddleware`) calls `dns_get_record()` directly — it bypasses `/etc/hosts`. So the Authentik OIDC discovery URL needs **real DNS** answering with `192.168.8.175` for `auth.hubris.network`. Recipe applied:
|
|
- Local `dnsmasq` listening on `127.0.0.1:53`, `/etc/dnsmasq.d/hubris-internal.conf` with `address=/auth.hubris.network/192.168.8.175`, `server=192.168.8.1`, `server=1.1.1.1`, `interface=lo`, `bind-interfaces`, `no-hosts`, `no-resolv`.
|
|
- `pct set 114 --nameserver "127.0.0.1 192.168.8.1 1.1.1.1"` so the LXC starts with the right resolver order.
|
|
- `/etc/hosts` override kept as belt-and-suspenders.
|
|
|
|
Also needs `allow_local_remote_servers=true` in `config.php`.
|
|
|
|
> Once internal DNS at the router level handles `*.hubris.network`, this LXC-local dnsmasq can go away. See [DNS](../infrastructure/dns.md).
|
|
|
|
## Storage
|
|
Files at `/mnt/library/homecloud`. Owned by Nextcloud's own permission model — **deliberately not on the `media` group**, NC manages it itself and would complain. See [media permissions](../infrastructure/media-permissions.md).
|
|
|
|
## PHP upload tuning
|
|
Apache uses `mod_php` (not FPM). Limits raised from distro defaults in both `/etc/php/8.4/apache2/php.ini` and `/etc/php/8.4/cli/php.ini` (the latter so `occ`/cron honor the same):
|
|
|
|
| key | value |
|
|
|---|---|
|
|
| `upload_max_filesize` | `16G` |
|
|
| `post_max_size` | `16G` |
|
|
| `memory_limit` | `512M` |
|
|
| `max_execution_time` | `3600` |
|
|
| `max_input_time` | `3600` |
|
|
| `output_buffering` | `0` |
|
|
|
|
Reload Apache after edits: `systemctl reload apache2`. Caddy in front (`cloud.hubris.network`) imposes no body-size limit, so these are the effective ceiling.
|
|
|
|
## Related
|
|
- [mulita (120)](120-mule-images.md) — reads NC user trees + writes back via WebDAV
|
|
- [Authentik (124)](124-authentik.md)
|
|
- [Caddy (121)](121-caddy.md)
|
|
- [DNS](../infrastructure/dns.md)
|
|
- [Mesh migration (DNS overrides explained)](../infrastructure/mesh.md)
|
|
- [Media permissions](../infrastructure/media-permissions.md)
|
|
|
|
## Changelog
|
|
|
|
### 2026-05-10 — PHP upload limits raised
|
|
Apache + CLI php.ini bumped from distro defaults (`upload_max_filesize=2M`, `post_max_size=8M`, `memory_limit=128M`, `max_execution_time=30`) to NC-recommended (`16G/16G/512M/3600`). Backups at `/etc/php/8.4/{apache2,cli}/php.ini.bak-20260510-*`. Was causing slow/failing uploads via web UI.
|
|
|
|
### 2026-04-28 — wiki entry created
|
|
Initial documentation.
|
|
|
|
### 2026-04-26 — Nextcloud-rooted libraries shipped (mulita)
|
|
[mulita (120)](120-mule-images.md) now reads photos from `/nextcloud-users/<nc_user>/files/...` and writes mutations back via WebDAV. Pre-migration DB dump kept at `/root/snapshots/mulita-pre-nc-migration-20260426-075132.dump`.
|
|
|
|
### 2026-04-21 — wired into Authentik (native OIDC + nc_uid override)
|
|
Local `dnsmasq` added on this LXC because Guzzle bypasses `/etc/hosts`. Resolver order set to `127.0.0.1 192.168.8.1 1.1.1.1`. Username override `dtoro → admin`.
|