From 67abd4ae4542b7bfb082e3dd4a7f0f52f446a5c7 Mon Sep 17 00:00:00 2001
From: Joschka Seydell <joschka@seydell.org>
Date: Sun, 29 Nov 2020 03:35:16 -0800
Subject: [PATCH 01/23] Consolidated var naming and added install path
 variable.

---
 defaults/main.yml | 49 +++++++++++++-------------
 tasks/main.yml    | 90 +++++++++++++++++++++++------------------------
 2 files changed, 70 insertions(+), 69 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index a708a3c..ba6347e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,35 +1,36 @@
 ---
 # defaults file for nextcloud
-mariadb_root_password: changeme
-mysql_host: mysqldb
-mysql_database: nextcloud
+nextcloud_install_user: '{{ ansible_user }}' # This user must be present on the host
+nextcloud_install_path: '/home/{{ nextcloud_install_user }}'
+nextcloud_mariadb_root_password: changeme
+nextcloud_mysql_host: mysqldb
+nextcloud_mysql_database: nextcloud
 nextcloud_mariadb_user: nextcloud
 nextcloud_mariadb_password: nextcloud
 nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
 nextcloud_trusted_domains: localhost
-virtual_host: localhost
-letsencrypt_host:
-letsencrypt_email:
-docker_user: deploy
-smtp_host:
-smtp_secure:
-smtp_port: 25
-smtp_authtype: PLAIN
-smtp_name:
-smtp_password:
-mail_from_address:
-mail_domain:
+nextcloud_virtual_host: localhost
+nextcloud_letsencrypt_host:
+nextcloud_letsencrypt_email:
+nextcloud_smtp_host:
+nextcloud_smtp_secure:
+nextcloud_smtp_port: 25
+nextcloud_smtp_authtype: PLAIN
+nextcloud_smtp_name:
+nextcloud_smtp_password:
+nextcloud_mail_from_address:
+nextcloud_mail_domain:
 nextcloud_overwrite_cli_url:
 nextcloud_overwrite_host:
 nextcloud_overwrite_protocol:
 nextcloud_enable_restic_compose_backup: False
-restic_aws_access_key_id:
-restic_aws_secret_access_key:
-restic_repository:
-restic_password:
-restic_keep_daily: 7
-restic_keep_weekly: 4
-restic_keep_monthly: 12
-restic_keep_yearly: 3
-restic_cron_schedule: "0 1 * * *"
+nextcloud_restic_aws_access_key_id:
+nextcloud_restic_aws_secret_access_key:
+nextcloud_restic_repository:
+nextcloud_restic_password:
+nextcloud_restic_keep_daily: 7
+nextcloud_restic_keep_weekly: 4
+nextcloud_restic_keep_monthly: 12
+nextcloud_restic_keep_yearly: 3
+nextcloud_restic_cron_schedule: "0 1 * * *"
diff --git a/tasks/main.yml b/tasks/main.yml
index 9d246c5..7b0930e 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -2,21 +2,21 @@
 # tasks file for nextcloud
 - name: Ensure nextcloud config directory exists
   file:
-    path: /home/{{ docker_user }}/nextcloud
+    path: "{{ nextcloud_install_path }}/nextcloud"
     state: directory
-    owner: '{{ docker_user }}'
-    group: '{{ docker_user }}'
+    owner: '{{ nextcloud_install_user }}'
+    group: '{{ nextcloud_install_user }}'
 
 - name: Provide docker-compose.yml
   template:
     src: templates/docker-compose.nextcloud.yml.j2
-    dest: /home/{{ docker_user }}/nextcloud/docker-compose.yml
-    owner: "{{ docker_user }}"
-    group: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/docker-compose.yml"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0644'
 
 - name: Output docker-compose.yml
-  shell: cat /home/{{ docker_user }}/nextcloud/docker-compose.yml
+  shell: cat {{ nextcloud_install_path }}/nextcloud/docker-compose.yml
   register: output
 
 - debug:
@@ -24,73 +24,73 @@
 
 - name: Provide database env vars
   copy:
-    dest: /home/{{ docker_user }}/nextcloud/db.env
-    owner: "{{ docker_user }}"
-    group: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/db.env"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
     content: |
       # See https://github.com/docker-library/mariadb/issues/262
       MYSQL_INITDB_SKIP_TZINFO=1
-      MYSQL_ROOT_PASSWORD={{ mariadb_root_password }}
-      MYSQL_DATABASE={{ mysql_database }}
+      MYSQL_ROOT_PASSWORD={{ nextcloud_mariadb_root_password }}
+      MYSQL_DATABASE={{ nextcloud_mysql_database }}
       MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
       MYSQL_USER={{ nextcloud_mariadb_user }}
 
 - name: Provide Nextcloud env vars
   copy:
-    dest: /home/{{ docker_user }}/nextcloud/nextcloud.env
-    owner: "{{ docker_user }}"
-    group: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/nextcloud.env"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
     content: |
-      VIRTUAL_HOST={{ virtual_host }}
-      LETSENCRYPT_HOST={{ letsencrypt_host }}
-      LETSENCRYPT_EMAIL={{ letsencrypt_email }}
-      MYSQL_HOST={{ mysql_host }}
-      MYSQL_DATABASE={{ mysql_database }}
+      VIRTUAL_HOST={{ nextcloud_virtual_host }}
+      LETSENCRYPT_HOST={{ nextcloud_letsencrypt_host }}
+      LETSENCRYPT_EMAIL={{ nextcloud_letsencrypt_email }}
+      MYSQL_HOST={{ nextcloud_mysql_host }}
+      MYSQL_DATABASE={{ nextcloud_mysql_database }}
       MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
       MYSQL_USER={{ nextcloud_mariadb_user }}
       NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
       NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
       NEXTCLOUD_TRUSTED_DOMAINS={{ nextcloud_trusted_domains }}
-      SMTP_HOST={{ smtp_host }}
-      SMTP_SECURE={{ smtp_secure }}
-      SMTP_PORT={{ smtp_port }}
-      SMTP_AUTHTYPE={{ smtp_authtype }}
-      SMTP_NAME={{ smtp_name }}
-      SMTP_PASSWORD={{ smtp_password }}
-      MAIL_FROM_ADDRESS={{ mail_from_address }}
-      MAIL_DOMAIN={{ mail_domain }}
+      SMTP_HOST={{ nextcloud_smtp_host }}
+      SMTP_SECURE={{ nextcloud_smtp_secure }}
+      SMTP_PORT={{ nextcloud_smtp_port }}
+      SMTP_AUTHTYPE={{ nextcloud_smtp_authtype }}
+      SMTP_NAME={{ nextcloud_smtp_name }}
+      SMTP_PASSWORD={{ nextcloud_smtp_password }}
+      MAIL_FROM_ADDRESS={{ nextcloud_mail_from_address }}
+      MAIL_DOMAIN={{ nextcloud_mail_domain }}
 
 - name: Provide restic-compose-backup env vars
   copy:
-    dest: /home/{{ docker_user }}/nextcloud/restic-compose-backup.env
-    owner: "{{ docker_user }}"
-    group: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/restic-compose-backup.env"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
     content: |
-      AWS_ACCESS_KEY_ID={{ restic_aws_access_key_id }}
-      AWS_SECRET_ACCESS_KEY={{ restic_aws_secret_access_key }}
-      RESTIC_REPOSITORY={{ restic_repository }}
-      RESTIC_PASSWORD={{ restic_password }}
+      AWS_ACCESS_KEY_ID={{ nextcloud_restic_aws_access_key_id }}
+      AWS_SECRET_ACCESS_KEY={{ nextcloud_restic_aws_secret_access_key }}
+      RESTIC_REPOSITORY={{ nextcloud_restic_repository }}
+      RESTIC_PASSWORD={{ nextcloud_restic_password }}
       # snapshot prune rules
-      RESTIC_KEEP_DAILY={{ restic_keep_daily}}
-      RESTIC_KEEP_WEEKLY={{ restic_keep_weekly }}
-      RESTIC_KEEP_MONTHLY={{ restic_keep_monthly }}
-      RESTIC_KEEP_YEARLY={{ restic_keep_yearly }}
+      RESTIC_KEEP_DAILY={{ nextcloud_restic_keep_daily}}
+      RESTIC_KEEP_WEEKLY={{ nextcloud_restic_keep_weekly }}
+      RESTIC_KEEP_MONTHLY={{ nextcloud_restic_keep_monthly }}
+      RESTIC_KEEP_YEARLY={{ nextcloud_restic_keep_yearly }}
       # Cron schedule. Run every day at 1am
-      CRON_SCHEDULE="{{ restic_cron_schedule }}"
+      CRON_SCHEDULE="{{ nextcloud_restic_cron_schedule }}"
   when: nextcloud_enable_restic_compose_backup == true
 
 - name: "docker-compose: Teardown existing Nextcloud service"
   docker_compose:
-    project_src: "/home/{{ docker_user }}/nextcloud/"
+    project_src: "{{ nextcloud_install_path }}/nextcloud/"
     state: absent
   tags: ['never', 'teardown']
 
 - name: "docker-compose: Start Nextcloud service"
   docker_compose:
-    project_src: "/home/{{ docker_user }}/nextcloud/"
+    project_src: "{{ nextcloud_install_path }}/nextcloud/"
   register: output
   tags: service_start
 
@@ -113,18 +113,18 @@
 
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
 
 - name: "docker-compose: Set overwritehost using occ"
   shell:
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
 
 - name: "Test whether Nextcloud is healthy from the outside"
   when: not ansible_check_mode

From 4992e21ecf10f5a9a8f64fd5a96aff8a8415977e Mon Sep 17 00:00:00 2001
From: Joschka Seydell <joschka@seydell.org>
Date: Mon, 30 Nov 2020 13:39:29 -0800
Subject: [PATCH 02/23] Adjusted variables and docker-compose file to account
 for multitenancy setups.

---
 defaults/main.yml                         |  3 ++
 templates/docker-compose.nextcloud.yml.j2 | 55 ++++++++++++-----------
 2 files changed, 33 insertions(+), 25 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index ba6347e..d77de5f 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -2,6 +2,7 @@
 # defaults file for nextcloud
 nextcloud_install_user: '{{ ansible_user }}' # This user must be present on the host
 nextcloud_install_path: '/home/{{ nextcloud_install_user }}'
+nextcloud_multitenant_label: 
 nextcloud_mariadb_root_password: changeme
 nextcloud_mysql_host: mysqldb
 nextcloud_mysql_database: nextcloud
@@ -34,3 +35,5 @@ nextcloud_restic_keep_weekly: 4
 nextcloud_restic_keep_monthly: 12
 nextcloud_restic_keep_yearly: 3
 nextcloud_restic_cron_schedule: "0 1 * * *"
+# Internal variables
+nextcloud_multitenant_postfix: "{{ '_' + nextcloud_multitenant_label if (nextcloud_multitenant_label) else '' }}"
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index d419b56..5c7a142 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -8,9 +8,11 @@ networks:
 services:
   mysqldb:
     image: mariadb:10.4.11
+    container_name: mysqldb{{ nextcloud_multitenant_postfix }}
+    hostname: mysqldb{{ nextcloud_multitenant_postfix }}
     command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
     volumes:
-      - mysqldb:/var/lib/mysql
+      - mysqldb{{ nextcloud_multitenant_postfix }}:/var/lib/mysql
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - db.env
@@ -22,38 +24,39 @@ services:
 
   nextcloud-app:
     image: nextcloud:apache
-    container_name: nextcloud-app
+    container_name: nextcloud-app{{ nextcloud_multitenant_postfix }}
+    hostname: nextcloud-app{{ nextcloud_multitenant_postfix }}
     networks:
       - public
       - default
     depends_on:
       - mysqldb
     volumes:
-      - nextcloud:/var/www/html
+      - nextcloud{{ nextcloud_multitenant_postfix }}:/var/www/html
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - nextcloud.env
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik_public"
-      - "traefik.http.routers.nextcloud.rule=Host(`{{ nextcloud_virtual_host }}`)"
-      - "traefik.http.routers.nextcloud.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud.tls=true"
-      - "traefik.http.routers.nextcloud.tls.certresolver=defaultresolver"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.replacement=https://$$1/remote.php/dav/"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.permanent=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.SSLRedirect=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.browserXSSFilter=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.contentTypeNosniff=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.forceSTSHeader=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSSeconds=315360000"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSIncludeSubdomains=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSPreload=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.featurePolicy=payment 'none'"
-      - "traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=SAMEORIGIN"
-      #- "traefik.http.middlewares.nextcloud-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
-      - "traefik.http.routers.nextcloud.middlewares=nextcloud-rep,nextcloud-headers"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.rule=Host(`{{ nextcloud_virtual_host }}`)"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.tls=true"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.tls.certresolver=defaultresolver"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.replacement=https://$$1/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.permanent=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.SSLRedirect=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.browserXSSFilter=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.contentTypeNosniff=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.forceSTSHeader=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSSeconds=315360000"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSIncludeSubdomains=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSPreload=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.featurePolicy=payment 'none'"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}.headers.customFrameOptionsValue=SAMEORIGIN"
+      #- "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.middlewares=nextcloud{{ nextcloud_multitenant_postfix }}-rep,nextcloud{{ nextcloud_multitenant_postfix }}-headers"
 {% if nextcloud_enable_restic_compose_backup %}
       - "restic-compose-backup.volumes=true"
       - "restic-compose-backup.volumes.include=nextcloud"
@@ -64,18 +67,20 @@ services:
   # The backup service
   backup:
     image: zettaio/restic-compose-backup:0.4.2
+    container_name: backup{{ nextcloud_multitenant_postfix }}
+    hostname: backup{{ nextcloud_multitenant_postfix }}
     env_file:
       - restic-compose-backup.env
     volumes:
       # We need to communicate with docker
       - /var/run/docker.sock:/tmp/docker.sock:ro
       # Persistent storage of restic cache (greatly speeds up all restic operations)
-      - backup-cache:/cache
+      - backup-cache{{ nextcloud_multitenant_postfix }}:/cache
 {% endif %}
 
 volumes:
-  mysqldb:
-  nextcloud:
+  mysqldb{{ nextcloud_multitenant_postfix }}:
+  nextcloud{{ nextcloud_multitenant_postfix }}:
 {% if nextcloud_enable_restic_compose_backup %}
-  backup-cache:
+  backup-cache{{ nextcloud_multitenant_postfix }}:
 {% endif %}
\ No newline at end of file

From d860a9c086b72b55c401cd9d5d5f31e8368710aa Mon Sep 17 00:00:00 2001
From: Jan Beilicke <jotbe@noreply.jotbe.io>
Date: Sat, 28 Oct 2023 23:38:27 +0200
Subject: [PATCH 03/23] Pins Nextcloud to version 27 and switches from Apache
 to Nginx to improve performance esp. of video streaming (#2)

Streaming videos had been a pain with the default Nextcloud Docker image which uses Apache. This PR will replace that Docker image with Nextcloud 27 FPM and provides an Nginx to serve the app.

Additionally, with moving from the latest Nextcloud (-Apache) image to a pinned version, it will be way clearer, which version is about to be deployed, major upgrades have to be done consciously and without skipping major versions which Nextcloud does not support.

Co-authored-by: Jan Beilicke <dev@jotbe.io>
Reviewed-on: https://git.jotbe.io/jotbe/ansible-role-nextcloud-docker/pulls/2
---
 files/docker/proxy/Dockerfile             |   3 -
 files/docker/proxy/uploadsize.conf        |   2 -
 files/nginx.conf                          | 172 ++++++++++++++++++++++
 tasks/main.yml                            |  21 ++-
 templates/docker-compose.nextcloud.yml.j2 |  18 ++-
 5 files changed, 200 insertions(+), 16 deletions(-)
 delete mode 100644 files/docker/proxy/Dockerfile
 delete mode 100644 files/docker/proxy/uploadsize.conf
 create mode 100644 files/nginx.conf

diff --git a/files/docker/proxy/Dockerfile b/files/docker/proxy/Dockerfile
deleted file mode 100644
index 0c066d0..0000000
--- a/files/docker/proxy/Dockerfile
+++ /dev/null
@@ -1,3 +0,0 @@
-FROM jwilder/nginx-proxy:alpine
-
-COPY uploadsize.conf /etc/nginx/conf.d/uploadsize.conf
\ No newline at end of file
diff --git a/files/docker/proxy/uploadsize.conf b/files/docker/proxy/uploadsize.conf
deleted file mode 100644
index 70a739d..0000000
--- a/files/docker/proxy/uploadsize.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-client_max_body_size 10G;
-proxy_request_buffering off;
\ No newline at end of file
diff --git a/files/nginx.conf b/files/nginx.conf
new file mode 100644
index 0000000..0f134fa
--- /dev/null
+++ b/files/nginx.conf
@@ -0,0 +1,172 @@
+worker_processes auto;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    # Prevent nginx HTTP Server Detection
+    server_tokens   off;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    upstream php-handler {
+        server nextcloud-app:9000;
+    }
+
+    server {
+        listen 80;
+
+        # HSTS settings
+        # WARNING: Only add the preload option once you read about
+        # the consequences in https://hstspreload.org/. This option
+        # will add the domain to a hardcoded list that is shipped
+        # in all major browsers and getting removed from this list
+        # could take several months.
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+
+        # set max upload size
+        client_max_body_size 512M;
+        fastcgi_buffers 64 4K;
+
+        # Enable gzip but do not remove ETag headers
+        gzip on;
+        gzip_vary on;
+        gzip_comp_level 4;
+        gzip_min_length 256;
+        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+        # Pagespeed is not supported by Nextcloud, so if your server is built
+        # with the `ngx_pagespeed` module, uncomment this line to disable it.
+        #pagespeed off;
+
+        # HTTP response headers borrowed from Nextcloud `.htaccess`
+        add_header Referrer-Policy                      "no-referrer"       always;
+        add_header X-Content-Type-Options               "nosniff"           always;
+        add_header X-Frame-Options                      "SAMEORIGIN"        always;
+        add_header X-Permitted-Cross-Domain-Policies    "none"              always;
+        add_header X-Robots-Tag                         "noindex, nofollow" always;
+        add_header X-XSS-Protection                     "1; mode=block"     always;
+
+        # Remove X-Powered-By, which is an information leak
+        fastcgi_hide_header X-Powered-By;
+
+        # Path to the root of your installation
+        root /var/www/html;
+
+        # Specify how to handle directories -- specifying `/index.php$request_uri`
+        # here as the fallback means that Nginx always exhibits the desired behaviour
+        # when a client requests a path that corresponds to a directory that exists
+        # on the server. In particular, if that directory contains an index.php file,
+        # that file is correctly served; if it doesn't, then the request is passed to
+        # the front-end controller. This consistent behaviour means that we don't need
+        # to specify custom rules for certain paths (e.g. images and other assets,
+        # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+        # `try_files $uri $uri/ /index.php$request_uri`
+        # always provides the desired behaviour.
+        index index.php index.html /index.php$request_uri;
+
+        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+        location = / {
+            if ( $http_user_agent ~ ^DavClnt ) {
+                return 302 /remote.php/webdav/$is_args$args;
+            }
+        }
+
+        location = /robots.txt {
+            allow all;
+            log_not_found off;
+            access_log off;
+        }
+
+        # Make a regex exception for `/.well-known` so that clients can still
+        # access it despite the existence of the regex rule
+        # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+        # for `/.well-known`.
+        location ^~ /.well-known {
+            # The rules in this block are an adaptation of the rules
+            # in `.htaccess` that concern `/.well-known`.
+
+            location = /.well-known/carddav { return 301 /remote.php/dav/; }
+            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
+            # Let Nextcloud's API for `/.well-known` URIs handle all other
+            # requests by passing them to the front-end controller.
+            return 301 /index.php$request_uri;
+        }
+
+        # Rules borrowed from `.htaccess` to hide certain paths from clients
+        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
+        # which handle static assets (as seen below). If this block is not declared first,
+        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
+        # to the URI, resulting in a HTTP 500 error response.
+        location ~ \.php(?:$|/) {
+            # Required for legacy support
+            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+
+            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+            set $path_info $fastcgi_path_info;
+
+            try_files $fastcgi_script_name =404;
+
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $path_info;
+            #fastcgi_param HTTPS on;
+
+            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
+            fastcgi_param front_controller_active true;     # Enable pretty urls
+            fastcgi_pass php-handler;
+
+            fastcgi_intercept_errors on;
+            fastcgi_request_buffering off;
+        }
+
+        location ~ \.(?:css|js|svg|gif)$ {
+            try_files $uri /index.php$request_uri;
+            expires 6M;         # Cache-Control policy borrowed from `.htaccess`
+            access_log off;     # Optional: Don't log access to assets
+        }
+
+        location ~ \.woff2?$ {
+            try_files $uri /index.php$request_uri;
+            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+            access_log off;     # Optional: Don't log access to assets
+        }
+
+        # Rule borrowed from `.htaccess`
+        location /remote {
+            return 301 /remote.php$request_uri;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.php$request_uri;
+        }
+    }
+}
diff --git a/tasks/main.yml b/tasks/main.yml
index 9d246c5..79d2fab 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -7,6 +7,14 @@
     owner: '{{ docker_user }}'
     group: '{{ docker_user }}'
 
+- name: Provide nginx.conf
+  copy:
+    src: nginx.conf
+    dest: /home/{{ docker_user }}/nextcloud/nginx.conf
+    owner: "{{ docker_user }}"
+    group: "{{ docker_user }}"
+    mode: '0644'
+
 - name: Provide docker-compose.yml
   template:
     src: templates/docker-compose.nextcloud.yml.j2
@@ -99,11 +107,12 @@
 
 - assert:
     that:
-      - "output.ansible_facts['nextcloud-app']['nextcloud-app'].state.running"
+      - "output.services['nextcloud-app']['nextcloud-app'].state.running"
+      - "output.services['web']['nextcloud_web_1'].state.running"
 
 - name: Get container IP
   set_fact:
-    nextcloud_ip: "{{ output.ansible_facts['nextcloud-app']['nextcloud-app'].networks.nextcloud_default.IPAddress }}"
+    nextcloud_ip: "{{ output.services['web']['nextcloud_web_1'].networks.nextcloud_default.IPAddress }}"
 
 - name: "Waiting for Nextcloud container to become available"
   become: false
@@ -131,16 +140,14 @@
   become: false
   uri:
     url: "{{ nextcloud_overwrite_cli_url }}/login"
-    return_content: yes
-    timeout: 300
-    validate_certs: no
   register: url_check
   delegate_to: localhost
-  until: "'Nextcloud' in url_check.content"
   retries: 5
   delay: 10
   tags: health
 
 - debug:
     var: url_check
-  tags: debug
+  tags:
+    - never
+    - debug
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index d419b56..57e2e21 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -21,11 +21,8 @@ services:
     restart: unless-stopped
 
   nextcloud-app:
-    image: nextcloud:apache
+    image: nextcloud:27-fpm
     container_name: nextcloud-app
-    networks:
-      - public
-      - default
     depends_on:
       - mysqldb
     volumes:
@@ -33,6 +30,19 @@ services:
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - nextcloud.env
+
+  web:
+    image: nginx
+    restart: always
+    depends_on:
+      - nextcloud-app
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - /etc/localtime:/etc/localtime:ro
+      - nextcloud:/var/www/html
+    networks:
+      - public
+      - default
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik_public"

From 13e163913a7fac2f62f5d44ac1bad50ef578ccf6 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <jotbe@noreply.jotbe.io>
Date: Sun, 29 Oct 2023 11:32:14 +0100
Subject: [PATCH 04/23] Switches Nextcloud image to Alpine (#3)

Co-authored-by: Jan Beilicke <dev@jotbe.io>
Reviewed-on: https://git.jotbe.io/jotbe/ansible-role-nextcloud-docker/pulls/3
---
 tasks/main.yml                            | 11 ++++++++---
 templates/docker-compose.nextcloud.yml.j2 |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/tasks/main.yml b/tasks/main.yml
index 79d2fab..919b317 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -123,17 +123,22 @@
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
+    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
+    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
 
 - name: "docker-compose: Set overwritehost using occ"
   shell:
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
     chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
+
+- name: "docker-compose: Fix ownership of /var/www/html"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: "docker-compose exec --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'"
 
 - name: "Test whether Nextcloud is healthy from the outside"
   when: not ansible_check_mode
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index 57e2e21..3c62020 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -21,7 +21,7 @@ services:
     restart: unless-stopped
 
   nextcloud-app:
-    image: nextcloud:27-fpm
+    image: nextcloud:27-fpm-alpine
     container_name: nextcloud-app
     depends_on:
       - mysqldb

From 9ffd149c651255800d97a7b6ecd7f57d22d5991a Mon Sep 17 00:00:00 2001
From: Jan Beilicke <jotbe@noreply.jotbe.io>
Date: Sun, 29 Oct 2023 19:40:26 +0100
Subject: [PATCH 05/23] Adds Redis cache (#4)

Requires adding a Redis host password through `redis_host_password`.

If you are updating you existing Nextcloud, you might have to manually update the `<nextcloud-data-volume>/config/config.php` and replace `memcache...` properties with:

```
  'memcache.distributed' => '\OC\Memcache\Redis',
  'memcache.local' => '\OC\Memcache\Redis',
  'memcache.locking' => '\OC\Memcache\Redis',
  'redis' => array(
     'host' => 'redis',
     'port' => 6379,
     ),
```

Co-authored-by: Jan Beilicke <dev@jotbe.io>
Reviewed-on: https://git.jotbe.io/jotbe/ansible-role-nextcloud-docker/pulls/4
---
 tasks/main.yml                            | 11 +++++++++++
 templates/docker-compose.nextcloud.yml.j2 | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 919b317..572fe16 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -69,6 +69,17 @@
       SMTP_PASSWORD={{ smtp_password }}
       MAIL_FROM_ADDRESS={{ mail_from_address }}
       MAIL_DOMAIN={{ mail_domain }}
+      REDIS_HOST=redis
+      REDIS_HOST_PASSWORD={{ redis_host_password }}
+
+- name: Provide Redis env vars
+  copy:
+    dest: /home/{{ docker_user }}/nextcloud/redis.env
+    owner: "{{ docker_user }}"
+    group: "{{ docker_user }}"
+    mode: '0640'
+    content: |
+      REDIS_PASSWORD={{ redis_host_password }}
 
 - name: Provide restic-compose-backup env vars
   copy:
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index 3c62020..156b020 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -25,12 +25,21 @@ services:
     container_name: nextcloud-app
     depends_on:
       - mysqldb
+      - redis
     volumes:
       - nextcloud:/var/www/html
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - nextcloud.env
 
+  redis:
+    image: bitnami/redis:latest
+    restart: unless-stopped
+    volumes:
+      - redis:/data
+    env_file:
+      - redis.env
+
   web:
     image: nginx
     restart: always
@@ -85,6 +94,7 @@ services:
 
 volumes:
   mysqldb:
+  redis:
   nextcloud:
 {% if nextcloud_enable_restic_compose_backup %}
   backup-cache:

From 1961184f93a703a1fea169f08d2481b0c8f15614 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sun, 29 Oct 2023 21:56:57 +0100
Subject: [PATCH 06/23] Fixes container restart policy

---
 templates/docker-compose.nextcloud.yml.j2 | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index 156b020..4626bdc 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -22,6 +22,7 @@ services:
 
   nextcloud-app:
     image: nextcloud:27-fpm-alpine
+    restart: unless-stopped
     container_name: nextcloud-app
     depends_on:
       - mysqldb
@@ -42,7 +43,7 @@ services:
 
   web:
     image: nginx
-    restart: always
+    restart: unless-stopped
     depends_on:
       - nextcloud-app
     volumes:

From 51636d95380b26e5f6f1a9bb6e8ed1304abfe9f0 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sun, 10 Dec 2023 10:35:30 +0100
Subject: [PATCH 07/23] Various Nginx improvements

---
 files/nginx.conf | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/files/nginx.conf b/files/nginx.conf
index 0f134fa..96f6873 100644
--- a/files/nginx.conf
+++ b/files/nginx.conf
@@ -20,7 +20,17 @@ http {
     access_log  /var/log/nginx/access.log  main;
 
     sendfile        on;
-    #tcp_nopush     on;
+    send_timeout 3600;
+    tcp_nopush     on;
+    tcp_nodelay    on;
+
+    open_file_cache max=500 inactive=10m;
+    open_file_cache_errors on;
+    reset_timedout_connection on;
+
+    set_real_ip_from revproxy;
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;
 
     # Prevent nginx HTTP Server Detection
     server_tokens   off;
@@ -46,7 +56,21 @@ http {
 
         # set max upload size
         client_max_body_size 512M;
-        fastcgi_buffers 64 4K;
+
+        # Do not limit download file size (default: 1G)
+        fastcgi_max_temp_file_size 0;
+
+        #fastcgi_buffers 64 4K;
+        fastcgi_buffers 64 64K;
+        fastcgi_buffer_size 256k;
+        fastcgi_busy_buffers_size 3840K;
+        fastcgi_read_timeout 3600;
+        fastcgi_send_timeout 3600;
+        fastcgi_connect_timeout 3600;
+        fastcgi_cache_key $http_cookie$request_method$host$request_uri;
+        fastcgi_cache_use_stale error timeout invalid_header http_500;
+        fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
+
 
         # Enable gzip but do not remove ETag headers
         gzip on;
@@ -55,6 +79,7 @@ http {
         gzip_min_length 256;
         gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
         gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+        gzip_disable "MSIE [1-6]\."
 
         # Pagespeed is not supported by Nextcloud, so if your server is built
         # with the `ngx_pagespeed` module, uncomment this line to disable it.
@@ -142,6 +167,11 @@ http {
 
             fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
             fastcgi_param front_controller_active true;     # Enable pretty urls
+            
+            fastcgi_cache_valid 404 1m;
+            fastcgi_cache_valid any 1h;
+            fastcgi_cache_methods GET HEAD;
+            
             fastcgi_pass php-handler;
 
             fastcgi_intercept_errors on;

From 7513615b6fce48edde6513ac4a0ef638d716c60a Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sun, 10 Dec 2023 10:41:26 +0100
Subject: [PATCH 08/23] Switching from geerlingguy.docker to community.docker

---
 README.md     | 2 ++
 meta/main.yml | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c17ee1c..253fc46 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,8 @@ TODO
 Dependencies
 ------------
 
+- Collection: community.docker
+
 Example Playbook
 ----------------
 
diff --git a/meta/main.yml b/meta/main.yml
index a52e2b3..9461006 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -49,7 +49,6 @@ galaxy_info:
 
 dependencies:
   - geerlingguy.pip
-  - geerlingguy.docker
   # List your role dependencies here, one per line. Be sure to remove the '[]' above,
   # if you add dependencies to this list.
   
\ No newline at end of file

From edf24dd5a6043578bb8a66663332f6cf4dc726b5 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sun, 10 Dec 2023 11:34:42 +0100
Subject: [PATCH 09/23] Adds task to install a list of Nextcloud apps

---
 defaults/main.yml |  1 +
 tasks/main.yml    | 13 +++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/defaults/main.yml b/defaults/main.yml
index a708a3c..9dbe9b1 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -24,6 +24,7 @@ nextcloud_overwrite_cli_url:
 nextcloud_overwrite_host:
 nextcloud_overwrite_protocol:
 nextcloud_enable_restic_compose_backup: False
+nextcloud_app_list_to_install: []
 restic_aws_access_key_id:
 restic_aws_secret_access_key:
 restic_repository:
diff --git a/tasks/main.yml b/tasks/main.yml
index 572fe16..97754f4 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -151,6 +151,19 @@
     chdir: /home/{{ docker_user }}/nextcloud/
     cmd: "docker-compose exec --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'"
 
+- name: "docker-compose: Install Nextcloud apps (will not fail)"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ app:install "{{ item }}"'
+  loop: "{{ nextcloud_app_list_to_install }}"
+  when: nextcloud_app_list_to_install | count
+  failed_when: false
+  register: nextcloud_app_install_result
+
+- name: "Output app install result"
+  debug:
+    var: "{{ nextcloud_app_install_result }}"
+
 - name: "Test whether Nextcloud is healthy from the outside"
   when: not ansible_check_mode
   become: false

From 520ee33b0e24895e72b15e650acfd0c95007922b Mon Sep 17 00:00:00 2001
From: Joschka Seydell <joschka@seydell.org>
Date: Sun, 14 Jan 2024 16:40:45 +0100
Subject: [PATCH 10/23] Fixed file permissions and multitenancy feature
 (manually tested).

---
 LICENSE                                   |  0
 README.md                                 |  0
 defaults/main.yml                         |  2 +-
 files/docker/proxy/Dockerfile             |  0
 files/docker/proxy/uploadsize.conf        |  0
 handlers/main.yml                         |  0
 meta/main.yml                             |  0
 tasks/main.yml                            | 71 ++++++++---------------
 templates/db.env.j2                       |  6 ++
 templates/docker-compose.nextcloud.yml.j2 |  6 --
 templates/env.j2                          |  5 ++
 templates/nextcloud.env.j2                | 21 +++++++
 templates/restic-compose-backup.env.j2    | 11 ++++
 tests/inventory                           |  0
 tests/test.yml                            |  0
 vars/main.yml                             |  0
 16 files changed, 68 insertions(+), 54 deletions(-)
 mode change 100644 => 100755 LICENSE
 mode change 100644 => 100755 README.md
 mode change 100644 => 100755 defaults/main.yml
 mode change 100644 => 100755 files/docker/proxy/Dockerfile
 mode change 100644 => 100755 files/docker/proxy/uploadsize.conf
 mode change 100644 => 100755 handlers/main.yml
 mode change 100644 => 100755 meta/main.yml
 mode change 100644 => 100755 tasks/main.yml
 create mode 100755 templates/db.env.j2
 mode change 100644 => 100755 templates/docker-compose.nextcloud.yml.j2
 create mode 100755 templates/env.j2
 create mode 100755 templates/nextcloud.env.j2
 create mode 100755 templates/restic-compose-backup.env.j2
 mode change 100644 => 100755 tests/inventory
 mode change 100644 => 100755 tests/test.yml
 mode change 100644 => 100755 vars/main.yml

diff --git a/LICENSE b/LICENSE
old mode 100644
new mode 100755
diff --git a/README.md b/README.md
old mode 100644
new mode 100755
diff --git a/defaults/main.yml b/defaults/main.yml
old mode 100644
new mode 100755
index d77de5f..d35f859
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -10,8 +10,8 @@ nextcloud_mariadb_user: nextcloud
 nextcloud_mariadb_password: nextcloud
 nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
-nextcloud_trusted_domains: localhost
 nextcloud_virtual_host: localhost
+nextcloud_trusted_domains: "localhost {{ ansible_host }} {{ nextcloud_virtual_host }}"
 nextcloud_letsencrypt_host:
 nextcloud_letsencrypt_email:
 nextcloud_smtp_host:
diff --git a/files/docker/proxy/Dockerfile b/files/docker/proxy/Dockerfile
old mode 100644
new mode 100755
diff --git a/files/docker/proxy/uploadsize.conf b/files/docker/proxy/uploadsize.conf
old mode 100644
new mode 100755
diff --git a/handlers/main.yml b/handlers/main.yml
old mode 100644
new mode 100755
diff --git a/meta/main.yml b/meta/main.yml
old mode 100644
new mode 100755
diff --git a/tasks/main.yml b/tasks/main.yml
old mode 100644
new mode 100755
index 7b0930e..8f08c4d
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -22,64 +22,41 @@
 - debug:
     var: output
 
+- name: Provide compose project env vars
+  template:
+    src: templates/env.j2
+    dest: "{{ nextcloud_install_path }}/nextcloud/.env"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
+    mode: '0640'
+  tags: config
+
 - name: Provide database env vars
-  copy:
+  template:
+    src: templates/db.env.j2
     dest: "{{ nextcloud_install_path }}/nextcloud/db.env"
     owner: "{{ nextcloud_install_user }}"
     group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
-      # See https://github.com/docker-library/mariadb/issues/262
-      MYSQL_INITDB_SKIP_TZINFO=1
-      MYSQL_ROOT_PASSWORD={{ nextcloud_mariadb_root_password }}
-      MYSQL_DATABASE={{ nextcloud_mysql_database }}
-      MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
-      MYSQL_USER={{ nextcloud_mariadb_user }}
+  tags: config
 
 - name: Provide Nextcloud env vars
-  copy:
+  template:
+    src: templates/nextcloud.env.j2
     dest: "{{ nextcloud_install_path }}/nextcloud/nextcloud.env"
     owner: "{{ nextcloud_install_user }}"
     group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
-      VIRTUAL_HOST={{ nextcloud_virtual_host }}
-      LETSENCRYPT_HOST={{ nextcloud_letsencrypt_host }}
-      LETSENCRYPT_EMAIL={{ nextcloud_letsencrypt_email }}
-      MYSQL_HOST={{ nextcloud_mysql_host }}
-      MYSQL_DATABASE={{ nextcloud_mysql_database }}
-      MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
-      MYSQL_USER={{ nextcloud_mariadb_user }}
-      NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
-      NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
-      NEXTCLOUD_TRUSTED_DOMAINS={{ nextcloud_trusted_domains }}
-      SMTP_HOST={{ nextcloud_smtp_host }}
-      SMTP_SECURE={{ nextcloud_smtp_secure }}
-      SMTP_PORT={{ nextcloud_smtp_port }}
-      SMTP_AUTHTYPE={{ nextcloud_smtp_authtype }}
-      SMTP_NAME={{ nextcloud_smtp_name }}
-      SMTP_PASSWORD={{ nextcloud_smtp_password }}
-      MAIL_FROM_ADDRESS={{ nextcloud_mail_from_address }}
-      MAIL_DOMAIN={{ nextcloud_mail_domain }}
+  tags: config
 
 - name: Provide restic-compose-backup env vars
-  copy:
+  template:
+    src: templates/restic-compose-backup.env.j2
     dest: "{{ nextcloud_install_path }}/nextcloud/restic-compose-backup.env"
     owner: "{{ nextcloud_install_user }}"
     group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
-      AWS_ACCESS_KEY_ID={{ nextcloud_restic_aws_access_key_id }}
-      AWS_SECRET_ACCESS_KEY={{ nextcloud_restic_aws_secret_access_key }}
-      RESTIC_REPOSITORY={{ nextcloud_restic_repository }}
-      RESTIC_PASSWORD={{ nextcloud_restic_password }}
-      # snapshot prune rules
-      RESTIC_KEEP_DAILY={{ nextcloud_restic_keep_daily}}
-      RESTIC_KEEP_WEEKLY={{ nextcloud_restic_keep_weekly }}
-      RESTIC_KEEP_MONTHLY={{ nextcloud_restic_keep_monthly }}
-      RESTIC_KEEP_YEARLY={{ nextcloud_restic_keep_yearly }}
-      # Cron schedule. Run every day at 1am
-      CRON_SCHEDULE="{{ nextcloud_restic_cron_schedule }}"
+  tags: config
   when: nextcloud_enable_restic_compose_backup == true
 
 - name: "docker-compose: Teardown existing Nextcloud service"
@@ -99,11 +76,11 @@
 
 - assert:
     that:
-      - "output.ansible_facts['nextcloud-app']['nextcloud-app'].state.running"
+      - "output.ansible_facts['nextcloud-app']['nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1'].state.running"
 
-- name: Get container IP
+- name: "Get container IP"
   set_fact:
-    nextcloud_ip: "{{ output.ansible_facts['nextcloud-app']['nextcloud-app'].networks.nextcloud_default.IPAddress }}"
+    nextcloud_ip: "{{ output.ansible_facts['nextcloud-app']['nextcloud' + nextcloud_multitenant_postfix + '_nextcloud-app_1'].networks['nextcloud' + nextcloud_multitenant_postfix + '_default'].IPAddress }}"
 
 - name: "Waiting for Nextcloud container to become available"
   become: false
@@ -114,16 +91,16 @@
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
     chdir: "{{ nextcloud_install_path }}/nextcloud/"
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:
     chdir: "{{ nextcloud_install_path }}/nextcloud/"
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
 
 - name: "docker-compose: Set overwritehost using occ"
   shell:
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
     chdir: "{{ nextcloud_install_path }}/nextcloud/"
 
 - name: "Test whether Nextcloud is healthy from the outside"
diff --git a/templates/db.env.j2 b/templates/db.env.j2
new file mode 100755
index 0000000..33d6e25
--- /dev/null
+++ b/templates/db.env.j2
@@ -0,0 +1,6 @@
+# See https://github.com/docker-library/mariadb/issues/262
+MYSQL_INITDB_SKIP_TZINFO=1
+MYSQL_ROOT_PASSWORD={{ nextcloud_mariadb_root_password }}
+MYSQL_DATABASE={{ nextcloud_mysql_database }}
+MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
+MYSQL_USER={{ nextcloud_mariadb_user }}
\ No newline at end of file
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
old mode 100644
new mode 100755
index 5c7a142..e0ec9f0
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -8,8 +8,6 @@ networks:
 services:
   mysqldb:
     image: mariadb:10.4.11
-    container_name: mysqldb{{ nextcloud_multitenant_postfix }}
-    hostname: mysqldb{{ nextcloud_multitenant_postfix }}
     command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
     volumes:
       - mysqldb{{ nextcloud_multitenant_postfix }}:/var/lib/mysql
@@ -24,8 +22,6 @@ services:
 
   nextcloud-app:
     image: nextcloud:apache
-    container_name: nextcloud-app{{ nextcloud_multitenant_postfix }}
-    hostname: nextcloud-app{{ nextcloud_multitenant_postfix }}
     networks:
       - public
       - default
@@ -67,8 +63,6 @@ services:
   # The backup service
   backup:
     image: zettaio/restic-compose-backup:0.4.2
-    container_name: backup{{ nextcloud_multitenant_postfix }}
-    hostname: backup{{ nextcloud_multitenant_postfix }}
     env_file:
       - restic-compose-backup.env
     volumes:
diff --git a/templates/env.j2 b/templates/env.j2
new file mode 100755
index 0000000..afce52c
--- /dev/null
+++ b/templates/env.j2
@@ -0,0 +1,5 @@
+#
+# Docker Compose configuration
+#
+# Project name for this Docker Compose setup
+COMPOSE_PROJECT_NAME=nextcloud{{ nextcloud_multitenant_postfix }}
\ No newline at end of file
diff --git a/templates/nextcloud.env.j2 b/templates/nextcloud.env.j2
new file mode 100755
index 0000000..4494642
--- /dev/null
+++ b/templates/nextcloud.env.j2
@@ -0,0 +1,21 @@
+# See https://github.com/nextcloud/docker/ for available env vars
+VIRTUAL_HOST={{ nextcloud_virtual_host }}
+LETSENCRYPT_HOST={{ nextcloud_letsencrypt_host }}
+LETSENCRYPT_EMAIL={{ nextcloud_letsencrypt_email }}
+MYSQL_HOST={{ nextcloud_mysql_host }}
+MYSQL_DATABASE={{ nextcloud_mysql_database }}
+MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
+MYSQL_USER={{ nextcloud_mariadb_user }}
+NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
+NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
+NEXTCLOUD_TRUSTED_DOMAINS={{ nextcloud_trusted_domains }}
+OVERWRITEPROTOCOL=https
+OVERWRITECLIURL=https://{{ nextcloud_virtual_host }}
+SMTP_HOST={{ nextcloud_smtp_host }}
+SMTP_SECURE={{ nextcloud_smtp_secure }}
+SMTP_PORT={{ nextcloud_smtp_port }}
+SMTP_AUTHTYPE={{ nextcloud_smtp_authtype }}
+SMTP_NAME={{ nextcloud_smtp_name }}
+SMTP_PASSWORD={{ nextcloud_smtp_password }}
+MAIL_FROM_ADDRESS={{ nextcloud_mail_from_address }}
+MAIL_DOMAIN={{ nextcloud_mail_domain }}
\ No newline at end of file
diff --git a/templates/restic-compose-backup.env.j2 b/templates/restic-compose-backup.env.j2
new file mode 100755
index 0000000..574fe94
--- /dev/null
+++ b/templates/restic-compose-backup.env.j2
@@ -0,0 +1,11 @@
+AWS_ACCESS_KEY_ID={{ nextcloud_restic_aws_access_key_id }}
+AWS_SECRET_ACCESS_KEY={{ nextcloud_restic_aws_secret_access_key }}
+RESTIC_REPOSITORY={{ nextcloud_restic_repository }}
+RESTIC_PASSWORD={{ nextcloud_restic_password }}
+# snapshot prune rules
+RESTIC_KEEP_DAILY={{ nextcloud_restic_keep_daily}}
+RESTIC_KEEP_WEEKLY={{ nextcloud_restic_keep_weekly }}
+RESTIC_KEEP_MONTHLY={{ nextcloud_restic_keep_monthly }}
+RESTIC_KEEP_YEARLY={{ nextcloud_restic_keep_yearly }}
+# Cron schedule. Run every day at 1am
+CRON_SCHEDULE="{{ nextcloud_restic_cron_schedule }}"
\ No newline at end of file
diff --git a/tests/inventory b/tests/inventory
old mode 100644
new mode 100755
diff --git a/tests/test.yml b/tests/test.yml
old mode 100644
new mode 100755
diff --git a/vars/main.yml b/vars/main.yml
old mode 100644
new mode 100755

From 365e166cbf381d13397fe5666b47e2a793b7e1e5 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sat, 14 Sep 2024 10:03:27 +0200
Subject: [PATCH 11/23] Provides Nextcloud Hub 8 (Nextcloud 29)

---
 files/nginx.conf                          | 4 ++++
 templates/docker-compose.nextcloud.yml.j2 | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/files/nginx.conf b/files/nginx.conf
index 96f6873..31a5023 100644
--- a/files/nginx.conf
+++ b/files/nginx.conf
@@ -11,6 +11,10 @@ events {
 
 http {
     include       /etc/nginx/mime.types;
+    types {
+        application/javascript js mjs;
+    }
+
     default_type  application/octet-stream;
 
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index 4626bdc..8b7f730 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -21,7 +21,7 @@ services:
     restart: unless-stopped
 
   nextcloud-app:
-    image: nextcloud:27-fpm-alpine
+    image: nextcloud:29-fpm-alpine
     restart: unless-stopped
     container_name: nextcloud-app
     depends_on:
@@ -71,6 +71,7 @@ services:
       - "traefik.http.middlewares.nextcloud-headers.headers.STSIncludeSubdomains=true"
       - "traefik.http.middlewares.nextcloud-headers.headers.STSPreload=true"
       - "traefik.http.middlewares.nextcloud-headers.headers.featurePolicy=payment 'none'"
+      - "traefik.http.middlewares.nextcloud-headers.headers.referrerPolicy=no-referrer"
       - "traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=SAMEORIGIN"
       #- "traefik.http.middlewares.nextcloud-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
       - "traefik.http.routers.nextcloud.middlewares=nextcloud-rep,nextcloud-headers"

From 08fb8594794f0a493fa9dc8e895652859b097406 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sat, 14 Sep 2024 10:39:34 +0200
Subject: [PATCH 12/23] Adds support to provision trusted_proxies

---
 defaults/main.yml |  1 +
 tasks/main.yml    | 18 +++++++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 9dbe9b1..fe3716d 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -8,6 +8,7 @@ nextcloud_mariadb_password: nextcloud
 nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
 nextcloud_trusted_domains: localhost
+nextcloud_trusted_proxies: [ '172.18.0.0/16' ]
 virtual_host: localhost
 letsencrypt_host:
 letsencrypt_email:
diff --git a/tasks/main.yml b/tasks/main.yml
index 97754f4..5644ca4 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -134,27 +134,35 @@
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud-app ./occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
 
 - name: "docker-compose: Set overwritehost using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
+
+- name: "docker-compose: Set trusted_proxies using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set trusted_proxies {{ idx }} --value="{{ item }}"'
+  loop: "{{ nextcloud_trusted_proxies }}"
+  loop_control:
+    index_var: idx
 
 - name: "docker-compose: Fix ownership of /var/www/html"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: "docker-compose exec --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'"
+    cmd: "docker-compose exec -T --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'"
 
 - name: "docker-compose: Install Nextcloud apps (will not fail)"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ app:install "{{ item }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ app:install "{{ item }}"'
   loop: "{{ nextcloud_app_list_to_install }}"
   when: nextcloud_app_list_to_install | count
   failed_when: false

From 0be8dd75b4b9b09161943b3edde86e70b867a703 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Sat, 14 Sep 2024 10:47:28 +0200
Subject: [PATCH 13/23] Restores a /bin/sh wrapper

---
 tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tasks/main.yml b/tasks/main.yml
index 5644ca4..93780d2 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -134,7 +134,7 @@
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
-    cmd: docker-compose exec -T -u www-data nextcloud-app ./occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:

From 11fe863b6dd78469d0293a0470e976e7e59c2446 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 14:56:02 +0200
Subject: [PATCH 14/23] Updates Nextcloud image to 31

---
 templates/docker-compose.nextcloud.yml.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index 8b7f730..d0b7553 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -21,7 +21,7 @@ services:
     restart: unless-stopped
 
   nextcloud-app:
-    image: nextcloud:29-fpm-alpine
+    image: nextcloud:31-fpm-alpine
     restart: unless-stopped
     container_name: nextcloud-app
     depends_on:

From 93ed612a65f1b38fe9c05d36b493b02efb555029 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:11:32 +0200
Subject: [PATCH 15/23] Explicitly handles maintenance mode around instance
 setup; Provides and runs database utils scripts

---
 defaults/main.yml                             |  2 +
 ...xtcloud-mysql-innodb-convert-row-format.sh | 16 ++++++++
 tasks/main.yml                                | 38 +++++++++++++++++++
 templates/docker-compose.nextcloud.yml.j2     |  1 +
 4 files changed, 57 insertions(+)
 create mode 100755 files/nextcloud-mysql-innodb-convert-row-format.sh

diff --git a/defaults/main.yml b/defaults/main.yml
index fe3716d..889c32e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -9,6 +9,8 @@ nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
 nextcloud_trusted_domains: localhost
 nextcloud_trusted_proxies: [ '172.18.0.0/16' ]
+nextcloud_database_utils:
+  - nextcloud-mysql-innodb-convert-row-format.sh
 virtual_host: localhost
 letsencrypt_host:
 letsencrypt_email:
diff --git a/files/nextcloud-mysql-innodb-convert-row-format.sh b/files/nextcloud-mysql-innodb-convert-row-format.sh
new file mode 100755
index 0000000..e6360c4
--- /dev/null
+++ b/files/nextcloud-mysql-innodb-convert-row-format.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Source: https://help.nextcloud.com/t/upgrade-to-nextcloud-hub-10-31-0-0-incorrect-row-format-found-in-your-database/218366/13
+
+# # Prompt for database credentials
+# read -p "Enter Database Name: " MYSQL_DATABASE
+# read -p "Enter Username: " MYSQL_USER
+# read -s -p "Enter Password: " MYSQL_PASSWORD
+# echo
+
+mysql -u "$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" -Bse "
+SELECT CONCAT('ALTER TABLE \`', TABLE_NAME, '\` ROW_FORMAT=DYNAMIC;') 
+FROM INFORMATION_SCHEMA.TABLES 
+WHERE TABLE_SCHEMA = '$MYSQL_DATABASE' 
+AND ENGINE = 'InnoDB'
+" | mysql -u "$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"
\ No newline at end of file
diff --git a/tasks/main.yml b/tasks/main.yml
index 93780d2..402aaa6 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -15,6 +15,25 @@
     group: "{{ docker_user }}"
     mode: '0644'
 
+- name: Ensure database utils scripts directory exists
+  file:
+    path: /home/{{ docker_user }}/nextcloud/utils
+    state: directory
+    owner: '{{ docker_user }}'
+    group: '{{ docker_user }}'
+
+- name: Provide database utils scripts
+  copy:
+    src: "{{ item }}"
+    dest: /home/{{ docker_user }}/nextcloud/utils/
+    owner: "{{ docker_user }}"
+    group: "{{ docker_user }}"
+    mode: '0644'
+  loop: "{{ nextcloud_database_utils }}"
+  when: 
+    - nextcloud_database_utils is defined
+    - nextcloud_database_utils | length > 0
+
 - name: Provide docker-compose.yml
   template:
     src: templates/docker-compose.nextcloud.yml.j2
@@ -131,6 +150,11 @@
     host: "{{ nextcloud_ip }}"
     port: 80
 
+- name: "docker-compose: Enable maintenance mode using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:mode --on'
+
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/
@@ -172,6 +196,20 @@
   debug:
     var: "{{ nextcloud_app_install_result }}"
 
+- name: "docker-compose: Run database utils"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T mysqldb /bin/sh '/opt/utils/{{ item }}'
+  loop: "{{ nextcloud_database_utils }}"
+  when:
+    - nextcloud_database_utils is defined
+    - nextcloud_database_utils | length > 0
+
+- name: "docker-compose: Disable maintenance mode using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:mode --off'
+
 - name: "Test whether Nextcloud is healthy from the outside"
   when: not ansible_check_mode
   become: false
diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2
index d0b7553..fc48522 100644
--- a/templates/docker-compose.nextcloud.yml.j2
+++ b/templates/docker-compose.nextcloud.yml.j2
@@ -12,6 +12,7 @@ services:
     volumes:
       - mysqldb:/var/lib/mysql
       - /etc/localtime:/etc/localtime:ro
+      - ./utils/:/opt/utils:ro
     env_file:
       - db.env
 {% if nextcloud_enable_restic_compose_backup %}

From abbf7b50dc120f559cdd64d1e9b4b1789ba9d165 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:12:21 +0200
Subject: [PATCH 16/23] Docker Compose should always pull

---
 tasks/main.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 402aaa6..f1e1173 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -129,6 +129,7 @@
 - name: "docker-compose: Start Nextcloud service"
   docker_compose:
     project_src: "/home/{{ docker_user }}/nextcloud/"
+    pull: true
   register: output
   tags: service_start
 

From 16304bd7c4921b4f10c035d69db4ed846d997295 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:19:52 +0200
Subject: [PATCH 17/23] Sets default_phone_region

---
 defaults/main.yml | 1 +
 tasks/main.yml    | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/defaults/main.yml b/defaults/main.yml
index 889c32e..6a4693b 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -9,6 +9,7 @@ nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
 nextcloud_trusted_domains: localhost
 nextcloud_trusted_proxies: [ '172.18.0.0/16' ]
+nextcloud_default_phone_region: DE
 nextcloud_database_utils:
   - nextcloud-mysql-innodb-convert-row-format.sh
 virtual_host: localhost
diff --git a/tasks/main.yml b/tasks/main.yml
index f1e1173..04fbfcb 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -197,6 +197,11 @@
   debug:
     var: "{{ nextcloud_app_install_result }}"
 
+- name: "docker-compose: Set default_phone_region using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set default_phone_region --value="{{ nextcloud_default_phone_region }}"'
+
 - name: "docker-compose: Run database utils"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/

From 81b86deddcd0e158aa57def9488e53fe53835b8c Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:20:37 +0200
Subject: [PATCH 18/23] Maintenance activities should run at night between
 01:00-05:00 UTC

---
 tasks/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 04fbfcb..d92e9d0 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -202,6 +202,11 @@
     chdir: /home/{{ docker_user }}/nextcloud/
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set default_phone_region --value="{{ nextcloud_default_phone_region }}"'
 
+- name: "docker-compose: Set maintenance_window_start to 1 using occ (This will run maintenance tasks between 01:00-05:00 UTC)"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set maintenance_window_start --value=1 --type=integer'
+
 - name: "docker-compose: Run database utils"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/

From a70efcf8e9e938b60d91dd99c80a0a8fafc3b426 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:25:30 +0200
Subject: [PATCH 19/23] Runs maintenance:repair --include-expensive

---
 tasks/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index d92e9d0..3a500bd 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -207,6 +207,11 @@
     chdir: /home/{{ docker_user }}/nextcloud/
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set maintenance_window_start --value=1 --type=integer'
 
+- name: "docker-compose: Run maintenance:repair --include-expensive using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:repair --include-expensive'
+
 - name: "docker-compose: Run database utils"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/

From b8acfca98ea5b7209ff61d877da8d6ee473f35eb Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:36:15 +0200
Subject: [PATCH 20/23] Add missing indices

---
 tasks/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 3a500bd..b8493dc 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -207,6 +207,11 @@
     chdir: /home/{{ docker_user }}/nextcloud/
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set maintenance_window_start --value=1 --type=integer'
 
+- name: "docker-compose: Add missing indices using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ db:add-missing-indices'
+
 - name: "docker-compose: Run maintenance:repair --include-expensive using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/

From f36c602a0e0312b16cd70664c0268247646f7d64 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:37:23 +0200
Subject: [PATCH 21/23] Update all apps

---
 tasks/main.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index b8493dc..cc5888b 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -207,6 +207,11 @@
     chdir: /home/{{ docker_user }}/nextcloud/
     cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set maintenance_window_start --value=1 --type=integer'
 
+- name: "docker-compose: Update all apps using occ"
+  shell:
+    chdir: /home/{{ docker_user }}/nextcloud/
+    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ app:update --all'
+
 - name: "docker-compose: Add missing indices using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/

From 23e504e481dc4d3a170944a59fcb9eefd9feaf23 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 21:57:59 +0200
Subject: [PATCH 22/23] Always teardown the Docker Compose stack before
 updating it (will not delete any data)

---
 tasks/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tasks/main.yml b/tasks/main.yml
index cc5888b..850dd63 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -120,11 +120,11 @@
       CRON_SCHEDULE="{{ restic_cron_schedule }}"
   when: nextcloud_enable_restic_compose_backup == true
 
-- name: "docker-compose: Teardown existing Nextcloud service"
+- name: "docker-compose: Teardown existing Nextcloud service (will keep your volumes)"
   docker_compose:
     project_src: "/home/{{ docker_user }}/nextcloud/"
     state: absent
-  tags: ['never', 'teardown']
+  tags: ['teardown']
 
 - name: "docker-compose: Start Nextcloud service"
   docker_compose:

From 8f3f6dd3d52f9a706542b0a512cf252f050c6ff8 Mon Sep 17 00:00:00 2001
From: Jan Beilicke <dev@jotbe.io>
Date: Fri, 18 Apr 2025 22:54:35 +0200
Subject: [PATCH 23/23] Adds tasks to gather and run open background jobs on
 demand (run with `--tags run_background_jobs`)

---
 tasks/main.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 850dd63..2fc162d 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -231,6 +231,30 @@
     - nextcloud_database_utils is defined
     - nextcloud_database_utils | length > 0
 
+- name: Run background jobs
+  tags: ['never', 'run_background_jobs']
+  block:
+    - name: Get list of background jobs
+      shell:
+        chdir: /home/{{ docker_user }}/nextcloud/
+        cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ background-job:list --output=json'
+      register: background_jobs
+
+    - name: Output background jobs
+      debug:
+        msg: "{{ background_jobs.stdout }}"
+    
+    - name: Run background jobs
+      shell:
+        chdir: /home/{{ docker_user }}/nextcloud/
+        cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ background-job:execute --force-execute {{ item.id }}'
+      loop: "{{ background_jobs.stdout }}"
+      register: background_jobs_execution_result  
+    
+    - name: Output background jobs execution result
+      debug:
+        msg: "{{ background_jobs_execution_result }}"
+
 - name: "docker-compose: Disable maintenance mode using occ"
   shell:
     chdir: /home/{{ docker_user }}/nextcloud/