Move dotfile denial up

Signed-off-by: Eric Nemchik <eric@nemchik.com>

Jenkinsfile

@@ -283,7 +283,7 @@ pipeline {
                   -v ${WORKSPACE}:/mnt \
                   -e AWS_ACCESS_KEY_ID=\"${S3_KEY}\" \
                   -e AWS_SECRET_ACCESS_KEY=\"${S3_SECRET}\" \
-                  ghcr.io/linuxserver/baseimage-alpine:3.23 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
+                  ghcr.io/linuxserver/baseimage-alpine:3 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
                     apk add --no-cache python3 && \
                     python3 -m venv /lsiopy && \
                     pip install --no-cache-dir -U pip && \

README.md

@@ -135,7 +135,7 @@ If you are using a reverse proxy which validates certificates, you need to [disa
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
 
 >[!NOTE]
->Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided.
+>Unless a parameter is flaged as 'optional', it is *mandatory* and a value must be provided.
 
 ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 

package_versions.txt

@@ -117,7 +117,7 @@ glslang-libs                         1.4.309.0-r0          apk
 gmp                                  6.3.0-r3              apk                           
 gnu-libiconv                         1.17-r2               apk                           
 gnu-libiconv-libs                    1.17-r2               apk                           
-gnutls                               3.8.12-r0             apk                           
+gnutls                               3.8.8-r0              apk                           
 graphite2                            1.3.14-r6             apk                           
 guzzlehttp/guzzle                    7.10.0                php-composer                  
 guzzlehttp/promises                  2.3.0                 php-composer                  
@@ -132,12 +132,12 @@ icewind/smb                          3.8.1                 php-composer
 icewind/streams                      v0.7.8                php-composer                  
 icu-data-en                          76.1-r1               apk                           
 icu-libs                             76.1-r1               apk                           
-imagemagick                          7.1.2.15-r0           apk                           
-imagemagick-jpeg                     7.1.2.15-r0           apk                           
-imagemagick-jxl                      7.1.2.15-r0           apk                           
-imagemagick-libs                     7.1.2.15-r0           apk                           
-imagemagick-openexr                  7.1.2.15-r0           apk                           
-imagemagick-webp                     7.1.2.15-r0           apk                           
+imagemagick                          7.1.2.8-r0            apk                           
+imagemagick-jpeg                     7.1.2.8-r0            apk                           
+imagemagick-jxl                      7.1.2.8-r0            apk                           
+imagemagick-libs                     7.1.2.8-r0            apk                           
+imagemagick-openexr                  7.1.2.8-r0            apk                           
+imagemagick-webp                     7.1.2.8-r0            apk                           
 imath                                3.1.12-r0             apk                           
 interpolate_name                     0.2.4                 rust-crate                    
 itertools                            0.10.5                rust-crate                    
@@ -202,8 +202,8 @@ libopenmpt                           0.7.15-r0             apk
 libpanelw                            6.5_p20250503-r0      apk                           
 libpciaccess                         0.18.1-r0             apk                           
 libplacebo                           6.338.2-r3            apk                           
-libpng                               1.6.55-r0             apk                           
-libpq                                17.9-r0               apk                           
+libpng                               1.6.54-r0             apk                           
+libpq                                17.7-r0               apk                           
 libproc2                             4.0.4-r3              apk                           
 libpsl                               0.21.5-r3             apk                           
 libpulse                             17.0-r5               apk                           
@@ -270,7 +270,7 @@ nano                                 8.4-r0                apk
 ncurses-terminfo-base                6.5_p20250503-r0      apk                           
 nelexa/buffer                        1.3.0                 php-composer                  
 netcat-openbsd                       1.229.1-r0            apk                           
-nettle                               3.10.2-r0             apk                           
+nettle                               3.10.1-r0             apk                           
 new_debug_unreachable                1.0.4                 rust-crate                    
 nextcloud                            1.0.0                 npm                           
 nextcloud/lognormalizer              v3.0.0                php-composer                  
@@ -464,7 +464,7 @@ thiserror                            1.0.56                rust-crate
 thiserror-impl                       1.0.56                rust-crate                    
 tinyvec                              1.9.0                 rust-crate                    
 twofactor_totp                       15.0.0-dev.0          npm                           
-tzdata                               2026a-r0              apk                           
+tzdata                               2025c-r0              apk                           
 unicode-ident                        1.0.12                rust-crate                    
 unicode-width                        0.1.11                rust-crate                    
 utf8parse                            0.2.1                 rust-crate                    

readme-vars.yml

@@ -144,6 +144,7 @@ init_diagram: |
   "nextcloud:develop" <- Base Images
 # changelog
 changelogs:
+  - {date: "08.02.26:", desc: "Existing users should update: site-confs/default.conf - Deny access to all dotfiles."}
   - {date: "10.07.25:", desc: "Rebase to Alpine 3.22."}
   - {date: "12.02.25:", desc: "Rebase to Alpine 3.21."}
   - {date: "09.01.25:", desc: "Fix uploading large files. Existing users should update their nginx confs."}

root/defaults/nginx/site-confs/default.conf.sample

@@ -1,4 +1,4 @@
-## Version 2025/07/10 - Changelog: https://github.com/linuxserver/docker-nextcloud/commits/master/root/defaults/nginx/site-confs/default.conf.sample
+## Version 2026/05/05 - Changelog: https://github.com/linuxserver/docker-nextcloud/commits/master/root/defaults/nginx/site-confs/default.conf.sample
 
 # Set the `immutable` cache control options only for assets with a cache busting `v` argument
 map $arg_v $asset_immutable {
@@ -20,6 +20,13 @@ server {
 
     root /app/www/public;
 
+    # deny access to all dotfiles
+    location ~ /\. {
+        access_log off;
+        log_not_found off;
+        return 404;
+    }
+
     # display real ip in nginx logs when connected through reverse proxy via docker network
     set_real_ip_from 172.16.0.0/12;
     real_ip_header X-Forwarded-For;
@@ -49,12 +56,12 @@ server {
     client_body_buffer_size 512k;
 
     # HTTP response headers borrowed from Nextcloud `.htaccess`
-    add_header Referrer-Policy                   "no-referrer"       always;
-    add_header X-Content-Type-Options            "nosniff"           always;
-    add_header X-Frame-Options                   "SAMEORIGIN"        always;
-    add_header X-Permitted-Cross-Domain-Policies "none"              always;
-    add_header X-Robots-Tag                      "noindex, nofollow" always;
-    add_header X-XSS-Protection                  "1; mode=block"     always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Permitted-Cross-Domain-Policies "none" always;
+    add_header X-Robots-Tag "noindex, nofollow" always;
+    add_header X-XSS-Protection "1; mode=block" always;
 
     # Remove X-Powered-By, which is an information leak
     fastcgi_hide_header X-Powered-By;
@@ -92,11 +99,19 @@ server {
         # The rules in this block are an adaptation of the rules
         # in `.htaccess` that concern `/.well-known`.
 
-        location = /.well-known/carddav { return 301 /remote.php/dav/; }
-        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+        location = /.well-known/carddav {
+            return 301 /remote.php/dav/;
+        }
+        location = /.well-known/caldav {
+            return 301 /remote.php/dav/;
+        }
 
-        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+        location /.well-known/acme-challenge {
+            try_files $uri $uri/ =404;
+        }
+        location /.well-known/pki-validation {
+            try_files $uri $uri/ =404;
+        }
 
         # Let Nextcloud's API for `/.well-known` URIs handle all other
         # requests by passing them to the front-end controller.
@@ -104,8 +119,12 @@ server {
     }
 
     # Rules borrowed from `.htaccess` to hide certain paths from clients
-    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
+        return 404;
+    }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+        return 404;
+    }
 
     # Ensure this block, which passes PHP files to the PHP process, is above the blocks
     # which handle static assets (as seen below). If this block is not declared first,
@@ -124,8 +143,8 @@ server {
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         fastcgi_param PATH_INFO $path_info;
 
-        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
-        fastcgi_param front_controller_active true;     # Enable pretty urls
+        fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
+        fastcgi_param front_controller_active true; # Enable pretty urls
         fastcgi_pass 127.0.0.1:9000;
 
         fastcgi_intercept_errors on;
@@ -138,7 +157,7 @@ server {
     location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
         try_files $uri /index.php$request_uri;
         add_header Cache-Control "public, max-age=15778463, $asset_immutable";
-        access_log off;     # Optional: Don't log access to assets
+        access_log off; # Optional: Don't log access to assets
 
         location ~ \.wasm$ {
             default_type application/wasm;
@@ -148,8 +167,8 @@ server {
 
     location ~ \.woff2?$ {
         try_files $uri /index.php$request_uri;
-        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
-        access_log off;     # Optional: Don't log access to assets
+        expires 7d; # Cache-Control policy borrowed from `.htaccess`
+        access_log off; # Optional: Don't log access to assets
     }
 
     # Rule borrowed from `.htaccess`
@@ -157,6 +176,14 @@ server {
         return 301 /remote.php$request_uri;
     }
 
+    # Support for the Client Push (notify_push) plugin, needs mod installed https://github.com/linuxserver/docker-mods/tree/nextcloud-notify-push
+    location ^~ /push/ {
+        proxy_pass http://127.0.0.1:7867/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+    }
+
     location / {
         # enable for basic auth
         #auth_basic "Restricted";
@@ -164,9 +191,4 @@ server {
 
         try_files $uri $uri/ /index.php$request_uri;
     }
-
-    # deny access to .htaccess/.htpasswd files
-    location ~ /\.ht {
-        deny all;
-    }
 }