diff --git a/Dockerfile b/Dockerfile index 90686a8..f64224d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,7 @@ ARG BUILD_DATE ARG VERSION ARG NEXTCLOUD_RELEASE LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}" -LABEL maintainer="sparklyballs" +LABEL maintainer="aptalca" # environment settings ENV NEXTCLOUD_PATH="/config/www/nextcloud" @@ -82,6 +82,9 @@ RUN \ -e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \ -e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \ -e 's/memory_limit.*=.*128M/memory_limit=512M/g' \ + -e 's/max_execution_time.*=.*30/max_execution_time=120/g' \ + -e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \ + -e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \ /etc/php7/php.ini && \ sed -i \ '/opcache.enable=1/a opcache.enable_cli=1' \ diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 8d6bb23..38fbcb9 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -5,7 +5,7 @@ ARG BUILD_DATE ARG VERSION ARG NEXTCLOUD_RELEASE LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}" -LABEL maintainer="sparklyballs" +LABEL maintainer="aptalca" # environment settings ENV NEXTCLOUD_PATH="/config/www/nextcloud" @@ -82,6 +82,9 @@ RUN \ -e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \ -e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \ -e 's/memory_limit.*=.*128M/memory_limit=512M/g' \ + -e 's/max_execution_time.*=.*30/max_execution_time=120/g' \ + -e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \ + -e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \ /etc/php7/php.ini && \ sed -i \ '/opcache.enable=1/a opcache.enable_cli=1' \ diff --git a/Dockerfile.armhf b/Dockerfile.armhf index 88ee032..5c5ba61 100644 --- a/Dockerfile.armhf +++ b/Dockerfile.armhf @@ -5,7 +5,7 @@ ARG BUILD_DATE ARG VERSION ARG NEXTCLOUD_RELEASE LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}" -LABEL maintainer="sparklyballs" +LABEL maintainer="aptalca" # environment settings ENV NEXTCLOUD_PATH="/config/www/nextcloud" @@ -82,6 +82,9 @@ RUN \ -e 's/;opcache.revalidate_freq.*=.*/opcache.revalidate_freq=1/g' \ -e 's/;always_populate_raw_post_data.*=.*/always_populate_raw_post_data=-1/g' \ -e 's/memory_limit.*=.*128M/memory_limit=512M/g' \ + -e 's/max_execution_time.*=.*30/max_execution_time=120/g' \ + -e 's/upload_max_filesize.*=.*2M/upload_max_filesize=1024M/g' \ + -e 's/post_max_size.*=.*8M/post_max_size=1024M/g' \ /etc/php7/php.ini && \ sed -i \ '/opcache.enable=1/a opcache.enable_cli=1' \ diff --git a/README.md b/README.md index 4e7f4e1..5d4b2e0 100644 --- a/README.md +++ b/README.md @@ -219,6 +219,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **17.01.20:** - Updated php.ini defaults and site config, including an optional HSTS directive (existing users should delete `/config/nginx/site-confs/default` and restart the container). * **19.12.19:** - Rebasing to alpine 3.11. * **18.11.19:** - Nginx default site config updated for v17 (existing users should delete `/config/nginx/site-confs/default` and restart the container). * **28.10.19:** - Change cronjob to run every 5 minutes. diff --git a/readme-vars.yml b/readme-vars.yml index c1c388e..2145643 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -60,6 +60,7 @@ app_setup_block: | # changelog changelogs: + - { date: "17.01.20:", desc: "Updated php.ini defaults and site config, including an optional HSTS directive (existing users should delete `/config/nginx/site-confs/default` and restart the container)." } - { date: "19.12.19:", desc: "Rebasing to alpine 3.11." } - { date: "18.11.19:", desc: "Nginx default site config updated for v17 (existing users should delete `/config/nginx/site-confs/default` and restart the container)." } - { date: "28.10.19:", desc: "Change cronjob to run every 5 minutes." } diff --git a/root/defaults/default b/root/defaults/default index ab41b52..29c548c 100644 --- a/root/defaults/default +++ b/root/defaults/default @@ -13,6 +13,18 @@ server { server_name _; ssl_certificate /config/keys/cert.crt; ssl_certificate_key /config/keys/cert.key; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; @@ -22,16 +34,19 @@ server { add_header Referrer-Policy no-referrer; fastcgi_hide_header X-Powered-By; root /config/www/nextcloud/; + # display real ip in nginx logs when connected through reverse proxy via docker network + set_real_ip_from 172.0.0.0/8; + real_ip_header X-Forwarded-For; location = /robots.txt { allow all; log_not_found off; access_log off; } location = /.well-known/carddav { - return 301 $scheme://$host/remote.php/dav; + return 301 $scheme://$host:$server_port/remote.php/dav; } location = /.well-known/caldav { - return 301 $scheme://$host/remote.php/dav; + return 301 $scheme://$host:$server_port/remote.php/dav; } client_max_body_size 10G; fastcgi_buffers 64 4K; @@ -50,12 +65,13 @@ server { location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { deny all; } - location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|ocm-provider\/.+)\.php(?:$|\/) { + location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; + set $path_info $fastcgi_path_info; try_files $fastcgi_script_name =404; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_INFO $path_info; fastcgi_param HTTPS on; fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; @@ -63,14 +79,23 @@ server { fastcgi_intercept_errors on; fastcgi_request_buffering off; } - - location ~ ^\/(?:updater|ocs-provider|ocm-provider)(?:$|\/) { + location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { try_files $uri/ =404; index index.php; } location ~ \.(?:css|js|woff2?|svg|gif|map)$ { try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none;