homelab-codex-ws/services/nextcloud/docker-compose.yml

# Nextcloud (self-hosted Drive, WebDAV) — KB module 4.
#
# Second document source for KB pillar #2: arbitrary files + phone/desktop
# sync. KB ingest (module 5) SNAPSHOTS files into the KB archive (Nextcloud =
# KOPIA in the kb-02 hybrid) — Nextcloud is NOT a source of truth, which
# relaxes its backup and availability requirements vs paperless.
#
# TODO DECYZJA OSKARA: host — PIHA (always-on, ale ciasno) czy SOLARIA
# (mocna, sesyjna; sync dogania sie po wybudzeniu)? Modul 4 sklania sie ku
# SOLARIA. Compose jest przenosne: wszystkie sciezki po konwencji
# /opt/homelab/data, bind IP i proxy z .env — decyzja wybiera tylko node
# i wartosci w .env.
#
# EXPOSURE: LAN/Tailscale only przez npm@PIHA (cloud.kapala.org), zero public.
# Jesli host=SOLARIA, npm@PIHA proxuje po LAN do 192.168.31.70:8220.
services:
  nextcloud:
    # Multi-arch (arm64 + amd64) — runs on either candidate host.
    # TODO DECYZJA OSKARA: przy deployu przypiac konkretna wersje major
    # (np. nextcloud:31-apache) zamiast ruchomego "stable" — Nextcloud NIE
    # wspiera przeskakiwania wersji major przy upgrade.
    image: nextcloud:stable-apache
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    # OIDC discovery against Forgejo over the LAN (same lesson as vikunja).
    extra_hosts:
      - "forgejo.kapala.org:192.168.31.5"
    env_file:
      - .env
    environment:
      - POSTGRES_HOST=db
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      # Redis: PHP session locking + file locking cache.
      - REDIS_HOST=redis
      # TODO DECYZJA OSKARA: potwierdzic domene cloud.kapala.org + DNS + vhost npm.
      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.kapala.org
      # Behind npm@PIHA (TLS terminated there); without these Nextcloud
      # generates http:// links and login loops.
      - OVERWRITEPROTOCOL=https
      - OVERWRITEHOST=cloud.kapala.org
      - OVERWRITECLIURL=https://cloud.kapala.org
      # npm@PIHA as seen by this container: LAN IP of PIHA when Nextcloud
      # runs on SOLARIA; docker bridge subnet when it runs on PIHA itself —
      # hence configurable via .env.
      - TRUSTED_PROXIES=${TRUSTED_PROXIES}
      - PHP_MEMORY_LIMIT=512M
      - PHP_UPLOAD_LIMIT=4G
      - TZ=Europe/Warsaw
    volumes:
      # Whole app dir (code + config + user data in html/data). Runtime path
      # convention: /opt/homelab/data/<service>/ on the chosen node's NVMe.
      - /opt/homelab/data/nextcloud/html:/var/www/html
    ports:
      # Bind to the node's LAN IP only, never 0.0.0.0 — npm@PIHA is the sole
      # entry point (LAN/Tailscale). Port 8220 free on PIHA per the 2026-06-30
      # inventory; free on SOLARIA (nearly empty host).
      # TODO DECYZJA OSKARA: potwierdzic port na zywym hoscie: ss -tlnp | grep 8220
      - "${LAN_BIND_IP}:8220:80"
    healthcheck:
      test: ["CMD", "curl", "-fs", "--max-time", "5", "http://localhost:80/status.php"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s

  # Background jobs (file scans, trash/versions cleanup, app jobs) — the
  # official image's dedicated cron entrypoint on the same code/data volume.
  cron:
    image: nextcloud:stable-apache
    container_name: nextcloud-cron
    restart: unless-stopped
    entrypoint: /cron.sh
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file:
      - .env
    environment:
      - POSTGRES_HOST=db
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - REDIS_HOST=redis
      - TZ=Europe/Warsaw
    volumes:
      - /opt/homelab/data/nextcloud/html:/var/www/html

  db:
    image: postgres:16-alpine
    container_name: nextcloud-db
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - TZ=Europe/Warsaw
    volumes:
      - /opt/homelab/data/nextcloud/db:/var/lib/postgresql/data
    # No published port — only this stack talks to it.
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nextcloud -d nextcloud"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    # Pure cache/locking — no persistence needed, no published port.
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5