93ce586b94
This commit implements a complete Nextcloud deployment with PostgreSQL, Redis, automated installation, and preparation for OIDC/SSO integration with Zitadel. ## Nextcloud Deployment ### New Ansible Role (ansible/roles/nextcloud/) - Complete Nextcloud v30 deployment with Docker Compose - PostgreSQL 16 backend with persistent volumes - Redis 7 for caching and file locking - Automated installation via Docker environment variables - Post-installation configuration via occ commands ### Features Implemented - **Database**: PostgreSQL with proper credentials and persistence - **Caching**: Redis for memory caching and file locking - **HTTPS**: Traefik integration with Let's Encrypt SSL - **Security**: Proper security headers and HSTS - **WebDAV**: CalDAV/CardDAV redirect middleware - **Configuration**: Automated trusted domain, reverse proxy, and Redis setup - **OIDC Preparation**: user_oidc app installed and enabled ### Traefik Updates - Added Nextcloud routing to dynamic.yml (static file-based config) - Configured CalDAV/CardDAV redirect middleware - Added Nextcloud-specific security headers ### Configuration Tasks - Automated trusted domain configuration for nextcloud.test.vrije.cloud - Reverse proxy overwrite settings (protocol, host, CLI URL) - Redis cache and locking configuration - Default phone region (NL) - Background jobs via cron ## Deployment Status ✅ Successfully deployed and tested: - Nextcloud: https://nextcloud.test.vrije.cloud/ - Admin login working - PostgreSQL database initialized - Redis caching operational - HTTPS with Let's Encrypt SSL - user_oidc app installed (ready for Zitadel integration) ## Next Steps To complete OIDC/SSO integration: 1. Create OIDC application in Zitadel console 2. Use redirect URI: https://nextcloud.test.vrije.cloud/apps/user_oidc/code 3. Configure provider in Nextcloud with Zitadel credentials Partially addresses #4 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
79 lines
1.8 KiB
Django/Jinja
79 lines
1.8 KiB
Django/Jinja
# Traefik dynamic configuration
|
|
# Managed by Ansible - do not edit manually
|
|
|
|
http:
|
|
routers:
|
|
# Zitadel identity provider
|
|
zitadel:
|
|
rule: "Host(`zitadel.test.vrije.cloud`)"
|
|
service: zitadel
|
|
entryPoints:
|
|
- websecure
|
|
tls:
|
|
certResolver: letsencrypt
|
|
middlewares:
|
|
- zitadel-headers
|
|
|
|
# Nextcloud file sync/share
|
|
nextcloud:
|
|
rule: "Host(`nextcloud.test.vrije.cloud`)"
|
|
service: nextcloud
|
|
entryPoints:
|
|
- websecure
|
|
tls:
|
|
certResolver: letsencrypt
|
|
middlewares:
|
|
- nextcloud-headers
|
|
- nextcloud-redirectregex
|
|
|
|
services:
|
|
# Zitadel service
|
|
zitadel:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "h2c://zitadel:8080"
|
|
|
|
# Nextcloud service
|
|
nextcloud:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://nextcloud:80"
|
|
|
|
middlewares:
|
|
# Zitadel-specific headers
|
|
zitadel-headers:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
|
|
# Nextcloud-specific headers
|
|
nextcloud-headers:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
|
|
# CalDAV/CardDAV redirect for Nextcloud
|
|
nextcloud-redirectregex:
|
|
redirectRegex:
|
|
permanent: true
|
|
regex: "https://(.*)/.well-known/(card|cal)dav"
|
|
replacement: "https://$1/remote.php/dav/"
|
|
|
|
# Security headers
|
|
security-headers:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
forceSTSHeader: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: 31536000
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
|
|
# Rate limiting
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 200
|