2026-07-06 22:09:36 +02:00
|
|
|
service:
|
|
|
|
|
name: nextcloud
|
feat(kb): configi Paperless/Nextcloud wg 9 decyzji — NC na PIHA, domeny kapala, Redis requirepass, backup SOLARIA, NC pin 34
Co zrobione:
- Nextcloud host = PIHA (always-on dla aktywnego uzycia), owner_node +
LAN_BIND_IP/TRUSTED_PROXIES w .env, README zaktualizowane
- Redis brokera Paperlessa: requirepass, PAPERLESS_REDIS_PASSWORD w .env
po obu stronach (PIHA + worker@SOLARIA), healthchecki z auth
- Domeny potwierdzone: paper.kapala.org, cloud.kapala.org (Cloudflare
DNS-only -> Tailscale PIHA, wildcard cert juz pokrywa) — udokumentowane,
nic nie utworzone
- Backup Paperlessa zatwierdzony: document_exporter + rsync/borg -> SOLARIA,
retencja 7/4/6, offsite jako future-note
- Nextcloud pin: 34-apache (zweryfikowany aktualny stable, endoflife.date)
- Whoosh fallback-worker: zaakceptowane bez zmian
- Porty/wylaczenie local login/sizing OCR-workera: przeniesione z "decyzji"
na "TODO przy deployu"
- DECYZJE-do-podjecia.md zaktualizowane: wszystko poza portami/loginem/
sizingiem przeniesione do "Rozstrzygniete"
Tylko edycja configow w repo — nic nie zdeployowane, zadne kontenery nie
byly ruszane, DNS/vhosty nie utworzone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-09 16:15:35 +02:00
|
|
|
# Decyzja Oskara: PIHA (nie SOLARIA). Uzasadnienie: Nextcloud jest uzywany
|
|
|
|
|
# aktywnie (telefon, sync, rodzina) -> musi byc always-on, sesyjna
|
|
|
|
|
# dostepnosc SOLARII nie jest akceptowalna dla tego workloadu (w
|
|
|
|
|
# przeciwienstwie do KB-zapytan, ktore i tak czytaja wlasna kopie z
|
|
|
|
|
# archiwum na PIHA niezaleznie od hosta Nextclouda). Patrz
|
|
|
|
|
# docs/kb/modules/DECYZJE-do-podjecia.md #1 i README.md.
|
|
|
|
|
owner_node: piha
|
2026-07-06 22:09:36 +02:00
|
|
|
role: file-sync-drive # Drive replacement + WebDAV source for KB ingest (archiwum = KOPIA)
|
|
|
|
|
exposure: private # LAN/Tailscale only via npm@PIHA (cloud.kapala.org); NO public ingress
|
|
|
|
|
dependencies:
|
|
|
|
|
- forgejo # OIDC identity provider (forgejo.kapala.org), app user_oidc
|
|
|
|
|
ports:
|
|
|
|
|
- container: 80
|
|
|
|
|
host: 8220 # LAN_BIND_IP only, never 0.0.0.0
|
|
|
|
|
protocol: tcp
|
|
|
|
|
healthcheck:
|
|
|
|
|
type: http
|
|
|
|
|
endpoint: http://localhost:8220/status.php # use the node's LAN bind IP — localhost does not answer
|
|
|
|
|
interval: 30s
|
|
|
|
|
timeout: 10s
|
|
|
|
|
retries: 5
|
|
|
|
|
restart_policy: unless-stopped
|
|
|
|
|
persistence:
|
|
|
|
|
# Nextcloud = KOPIA in the kb-02 hybrid: KB snapshots files at ingest, so
|
|
|
|
|
# this data is NOT the KB source of truth. Backup is "warto" (user data),
|
|
|
|
|
# not a KB boundary condition like paperless.
|
|
|
|
|
paths:
|
|
|
|
|
- /opt/homelab/data/nextcloud/html # app + config + user files (html/data/)
|
|
|
|
|
- /opt/homelab/data/nextcloud/db # postgres data
|
|
|
|
|
runtime:
|
|
|
|
|
config_files:
|
|
|
|
|
- .env # secrets (gitignored, from env.example)
|
|
|
|
|
env_vars:
|
|
|
|
|
- LAN_BIND_IP # required — LAN IP of the CHOSEN host node
|
|
|
|
|
- TRUSTED_PROXIES # npm@PIHA as seen from this node
|
|
|
|
|
- POSTGRES_PASSWORD
|
|
|
|
|
- NEXTCLOUD_ADMIN_USER # bootstrap admin (before OIDC is wired)
|
|
|
|
|
- NEXTCLOUD_ADMIN_PASSWORD
|
