Bot Updating Package Versions

* php.ini and site config updates

* display real ip in nginx logs with rp

* fixed diffs w/ upstream nextcloud git (#129)

* Bot Updating Package Versions

* fixed diffs w/ nextcloud upstream

Edit line 53, 67 - ocs-provider + ocm-provider, one call:
https://github.com/nextcloud/documentation/commit/3206db9fb8290343753828b10f817cf066cf88bd
https://github.com/nextcloud/documentation/pull/1293

New line 55, edit 58 - try_files resets $fastcgi_path_info, fix so $path_info gets value:  
https://github.com/nextcloud/documentation/commit/8f6c1aa61aa3cd9d9e3e567c0afe4a822d3fc403
https://github.com/nextcloud/documentation/pull/1679

Co-authored-by: Evan Wade <evan+pgp@evanwade.com>

Dockerfile

@@ -5,7 +5,7 @@ ARG BUILD_DATE
 ARG VERSION
 ARG NEXTCLOUD_RELEASE
 LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="sparklyballs"
+LABEL maintainer="aptalca"
 
 # environment settings
 ENV NEXTCLOUD_PATH="/config/www/nextcloud"
@@ -82,6 +82,9 @@ RUN \
 	-e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \
 	-e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \
 	-e 's/memory_limit.*=.*128M/memory_limit=512M/g' \
+	-e 's/max_execution_time.*=.*30/max_execution_time=120/g' \
+	-e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \
+	-e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \
 		/etc/php7/php.ini && \
  sed -i \
 	'/opcache.enable=1/a opcache.enable_cli=1' \

Dockerfile.aarch64

@@ -5,7 +5,7 @@ ARG BUILD_DATE
 ARG VERSION
 ARG NEXTCLOUD_RELEASE
 LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="sparklyballs"
+LABEL maintainer="aptalca"
 
 # environment settings
 ENV NEXTCLOUD_PATH="/config/www/nextcloud"
@@ -82,6 +82,9 @@ RUN \
 	-e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \
 	-e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \
 	-e 's/memory_limit.*=.*128M/memory_limit=512M/g' \
+	-e 's/max_execution_time.*=.*30/max_execution_time=120/g' \
+	-e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \
+	-e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \
 		/etc/php7/php.ini && \
  sed -i \
 	'/opcache.enable=1/a opcache.enable_cli=1' \

Dockerfile.armhf

@@ -5,7 +5,7 @@ ARG BUILD_DATE
 ARG VERSION
 ARG NEXTCLOUD_RELEASE
 LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
-LABEL maintainer="sparklyballs"
+LABEL maintainer="aptalca"
 
 # environment settings
 ENV NEXTCLOUD_PATH="/config/www/nextcloud"
@@ -82,6 +82,9 @@ RUN \
 	-e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \
 	-e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \
 	-e 's/memory_limit.*=.*128M/memory_limit=512M/g' \
+	-e 's/max_execution_time.*=.*30/max_execution_time=120/g' \
+	-e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \
+	-e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \
 		/etc/php7/php.ini && \
  sed -i \
 	'/opcache.enable=1/a opcache.enable_cli=1' \

README.md

@@ -219,6 +219,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **17.01.20:** - Updated php.ini defaults and site config, including an optional HSTS directive (existing users should delete `/config/nginx/site-confs/default` and restart the container).
 * **19.12.19:** - Rebasing to alpine 3.11.
 * **18.11.19:** - Nginx default site config updated for v17 (existing users should delete `/config/nginx/site-confs/default` and restart the container).
 * **28.10.19:** - Change cronjob to run every 5 minutes.

package_versions.txt

@@ -10,8 +10,8 @@ avahi-libs-0.7-r4
 bash-5.0.11-r1
 busybox-1.31.1-r9
 c-client-2007f-r11
-ca-certificates-20191127-r0
-ca-certificates-cacert-20191127-r0
+ca-certificates-20191127-r1
+ca-certificates-cacert-20191127-r1
 cairo-1.16.0-r2
 coreutils-8.31-r0
 cups-libs-2.2.12-r1
@@ -27,7 +27,7 @@ fribidi-1.0.8-r0
 gdk-pixbuf-2.40.0-r0
 ghostscript-9.50-r0
 git-2.24.1-r0
-glib-2.62.4-r0
+glib-2.62.6-r0
 gmp-6.1.2-r1
 gnutls-3.6.10-r0
 graphite2-1.3.13-r1
@@ -41,7 +41,7 @@ lame-3.100-r0
 lcms2-2.9-r1
 ldb-2.0.8-r0
 libacl-2.2.53-r0
-libarchive-3.4.0-r0
+libarchive-3.4.2-r0
 libass-0.14.0-r0
 libattr-2.4.48-r0
 libblkid-2.34-r1
@@ -56,7 +56,7 @@ libde265-1.0.3-r0
 libdrm-2.4.100-r0
 libedit-20191211.3.1-r0
 libffi-3.2.1-r6
-libgcc-9.2.0-r3
+libgcc-9.2.0-r4
 libheif-1.6.0-r0
 libice-1.0.10-r0
 libintl-0.20.1-r2
@@ -70,16 +70,16 @@ libmount-2.34-r1
 libogg-1.3.4-r0
 libpciaccess-0.16-r0
 libpng-1.6.37-r1
-libpq-12.1-r0
+libpq-12.2-r0
 libressl3.0-libcrypto-3.0.2-r0
 libressl3.0-libssl-3.0.2-r0
 librsvg-2.46.4-r0
 libsasl-2.1.27-r5
 libsm-1.2.3-r0
-libsmbclient-4.11.4-r1
+libsmbclient-4.11.5-r0
 libsodium-1.0.18-r0
 libssl1.1-1.1.1d-r3
-libstdc++-9.2.0-r3
+libstdc++-9.2.0-r4
 libtasn1-4.15.0-r0
 libtheora-1.1.1-r14
 libtls-standalone-2.9.1-r0
@@ -89,7 +89,7 @@ libva-2.6.0-r0
 libvdpau-1.3-r0
 libvorbis-1.3.6-r2
 libvpx-1.8.1-r0
-libwbclient-4.11.4-r1
+libwbclient-4.11.5-r0
 libwebp-1.0.3-r0
 libx11-1.6.9-r0
 libxau-1.0.9-r0
@@ -98,7 +98,7 @@ libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
 libxfixes-5.0.3-r2
 libxft-2.3.3-r0
-libxml2-2.9.10-r1
+libxml2-2.9.10-r2
 libxpm-3.5.13-r0
 libxrender-0.9.10-r3
 libxt-1.2.0-r0
@@ -107,83 +107,82 @@ linux-pam-1.3.1-r1
 lmdb-0.9.24-r1
 logrotate-3.15.1-r0
 lz4-libs-1.9.2-r0
-musl-1.1.24-r0
-musl-utils-1.1.24-r0
+musl-1.1.24-r2
+musl-utils-1.1.24-r1
 nano-4.6-r0
-ncurses-libs-6.1_p20191130-r0
-ncurses-terminfo-6.1_p20191130-r0
-ncurses-terminfo-base-6.1_p20191130-r0
+ncurses-libs-6.1_p20200118-r2
+ncurses-terminfo-base-6.1_p20200118-r2
 nettle-3.5.1-r0
 nghttp2-libs-1.40.0-r0
-nginx-1.16.1-r4
+nginx-1.16.1-r6
 openssl-1.1.1d-r3
 opus-1.3.1-r0
 p11-kit-0.23.18.1-r0
 pango-1.44.7-r0
 pcre-8.43-r0
 pcre2-10.34-r1
-php7-7.3.13-r0
-php7-bz2-7.3.13-r0
-php7-common-7.3.13-r0
-php7-ctype-7.3.13-r0
-php7-curl-7.3.13-r0
-php7-dom-7.3.13-r0
-php7-exif-7.3.13-r0
-php7-fileinfo-7.3.13-r0
-php7-fpm-7.3.13-r0
-php7-ftp-7.3.13-r0
-php7-gd-7.3.13-r0
-php7-gmp-7.3.13-r0
-php7-iconv-7.3.13-r0
-php7-imap-7.3.13-r0
-php7-intl-7.3.13-r0
-php7-json-7.3.13-r0
-php7-ldap-7.3.13-r0
-php7-mbstring-7.3.13-r0
-php7-mysqlnd-7.3.13-r0
-php7-opcache-7.3.13-r0
-php7-openssl-7.3.13-r0
-php7-pcntl-7.3.13-r0
-php7-pdo-7.3.13-r0
-php7-pdo_mysql-7.3.13-r0
-php7-pdo_pgsql-7.3.13-r0
-php7-pdo_sqlite-7.3.13-r0
+php7-7.3.16-r0
+php7-bz2-7.3.16-r0
+php7-common-7.3.16-r0
+php7-ctype-7.3.16-r0
+php7-curl-7.3.16-r0
+php7-dom-7.3.16-r0
+php7-exif-7.3.16-r0
+php7-fileinfo-7.3.16-r0
+php7-fpm-7.3.16-r0
+php7-ftp-7.3.16-r0
+php7-gd-7.3.16-r0
+php7-gmp-7.3.16-r0
+php7-iconv-7.3.16-r0
+php7-imap-7.3.16-r0
+php7-intl-7.3.16-r0
+php7-json-7.3.16-r0
+php7-ldap-7.3.16-r0
+php7-mbstring-7.3.16-r0
+php7-mysqlnd-7.3.16-r0
+php7-opcache-7.3.16-r0
+php7-openssl-7.3.16-r0
+php7-pcntl-7.3.16-r0
+php7-pdo-7.3.16-r0
+php7-pdo_mysql-7.3.16-r0
+php7-pdo_pgsql-7.3.16-r0
+php7-pdo_sqlite-7.3.16-r0
 php7-pecl-apcu-5.1.18-r0
 php7-pecl-igbinary-3.0.1-r1
 php7-pecl-imagick-3.4.4-r2
 php7-pecl-mcrypt-1.0.3-r0
 php7-pecl-memcached-3.1.5-r0
 php7-pecl-redis-5.1.1-r0
-php7-pgsql-7.3.13-r0
-php7-phar-7.3.13-r0
-php7-posix-7.3.13-r0
-php7-session-7.3.13-r0
-php7-simplexml-7.3.13-r0
-php7-sodium-7.3.13-r0
-php7-sqlite3-7.3.13-r0
-php7-xml-7.3.13-r0
-php7-xmlreader-7.3.13-r0
-php7-xmlwriter-7.3.13-r0
-php7-zip-7.3.13-r0
+php7-pgsql-7.3.16-r0
+php7-phar-7.3.16-r0
+php7-posix-7.3.16-r0
+php7-session-7.3.16-r0
+php7-simplexml-7.3.16-r0
+php7-sodium-7.3.16-r0
+php7-sqlite3-7.3.16-r0
+php7-xml-7.3.16-r0
+php7-xmlreader-7.3.16-r0
+php7-xmlwriter-7.3.16-r0
+php7-zip-7.3.16-r0
 pixman-0.38.4-r0
 pkgconf-1.6.3-r0
 popt-1.16-r7
 readline-8.0.1-r0
-samba-client-4.11.4-r1
-samba-client-libs-4.11.4-r1
-samba-common-4.11.4-r1
-samba-common-libs-4.11.4-r1
-samba-common-server-libs-4.11.4-r1
-samba-heimdal-libs-4.11.4-r1
-samba-libs-4.11.4-r1
-samba-server-libs-4.11.4-r1
+samba-client-4.11.5-r0
+samba-client-libs-4.11.5-r0
+samba-common-4.11.5-r0
+samba-common-libs-4.11.5-r0
+samba-common-server-libs-4.11.5-r0
+samba-heimdal-libs-4.11.5-r0
+samba-libs-4.11.5-r0
+samba-server-libs-4.11.5-r0
 scanelf-1.2.4-r0
 sdl2-2.0.10-r0
 shadow-4.7-r1
 shared-mime-info-1.15-r0
 sqlite-libs-3.30.1-r1
 ssl_client-1.31.1-r9
-sudo-1.8.29-r0
+sudo-1.8.31-r0
 talloc-2.3.1-r0
 tar-1.32-r1
 tdb-libs-1.4.3-r0

readme-vars.yml

@@ -60,6 +60,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "17.01.20:", desc: "Updated php.ini defaults and site config, including an optional HSTS directive (existing users should delete `/config/nginx/site-confs/default` and restart the container)." }
   - { date: "19.12.19:", desc: "Rebasing to alpine 3.11." }
   - { date: "18.11.19:", desc: "Nginx default site config updated for v17 (existing users should delete `/config/nginx/site-confs/default` and restart the container)." }
   - { date: "28.10.19:", desc: "Change cronjob to run every 5 minutes." }

root/defaults/default

@@ -13,6 +13,18 @@ server {
     server_name _;
     ssl_certificate /config/keys/cert.crt;
     ssl_certificate_key /config/keys/cert.key;
+
+    # Add headers to serve security related headers
+    # Before enabling Strict-Transport-Security headers please read into this
+    # topic first.
+    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+    #
+    # WARNING: Only add the preload option once you read about
+    # the consequences in https://hstspreload.org/. This option
+    # will add the domain to a hardcoded list that is shipped
+    # in all major browsers and getting removed from this list
+    # could take several months.
+
     add_header X-Content-Type-Options nosniff;
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Robots-Tag none;
@@ -22,16 +34,19 @@ server {
     add_header Referrer-Policy no-referrer;
     fastcgi_hide_header X-Powered-By;
     root /config/www/nextcloud/;
+    # display real ip in nginx logs when connected through reverse proxy via docker network
+    set_real_ip_from 172.0.0.0/8;
+    real_ip_header X-Forwarded-For;
     location = /robots.txt {
         allow all;
         log_not_found off;
         access_log off;
     }
     location = /.well-known/carddav {
-      return 301 $scheme://$host/remote.php/dav;
+      return 301 $scheme://$host:$server_port/remote.php/dav;
     }
     location = /.well-known/caldav {
-      return 301 $scheme://$host/remote.php/dav;
+      return 301 $scheme://$host:$server_port/remote.php/dav;
     }
     client_max_body_size 10G;
     fastcgi_buffers 64 4K;
@@ -50,12 +65,13 @@ server {
     location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
         deny all;
     }
-    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|ocm-provider\/.+)\.php(?:$|\/) {
+    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
         fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+        set $path_info $fastcgi_path_info;
         try_files $fastcgi_script_name =404;
         include /etc/nginx/fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param PATH_INFO $path_info;
         fastcgi_param HTTPS on;
         fastcgi_param modHeadersAvailable true;
         fastcgi_param front_controller_active true;
@@ -63,14 +79,23 @@ server {
         fastcgi_intercept_errors on;
         fastcgi_request_buffering off;
     }
-
-    location ~ ^\/(?:updater|ocs-provider|ocm-provider)(?:$|\/) {
+    location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
         try_files $uri/ =404;
         index index.php;
     }
     location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
         try_files $uri /index.php$request_uri;
         add_header Cache-Control "public, max-age=15778463";
+        # Add headers to serve security related headers
+        # Before enabling Strict-Transport-Security headers please read into this
+        # topic first.
+        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+        #
+        # WARNING: Only add the preload option once you read about
+        # the consequences in https://hstspreload.org/. This option
+        # will add the domain to a hardcoded list that is shipped
+        # in all major browsers and getting removed from this list
+        # could take several months.
         add_header X-Content-Type-Options nosniff;
         add_header X-XSS-Protection "1; mode=block";
         add_header X-Robots-Tag none;