Nextcloud: instala tu propio Google Drive en casa o en el trabajo

version: '3.8'

services:
  nextcloud-db:
    image: mariadb:11.2
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    volumes:
      - nextcloud_db:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: rootpass_seguro
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: ncpass_seguro

  nextcloud-redis:
    image: redis:7-alpine
    restart: unless-stopped

  nextcloud:
    image: nextcloud:28-apache
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - nextcloud_data:/var/www/html
      - /mnt/datos:/mnt/datos    # directorio de datos externo opcional
    environment:
      MYSQL_HOST: nextcloud-db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: ncpass_seguro
      REDIS_HOST: nextcloud-redis
      NEXTCLOUD_ADMIN_USER: admin
      NEXTCLOUD_ADMIN_PASSWORD: adminpass_seguro
      NEXTCLOUD_TRUSTED_DOMAINS: "cloud.miempresa.com 192.168.1.100"
      PHP_MEMORY_LIMIT: 512M
      PHP_UPLOAD_LIMIT: 10G
    depends_on:
      - nextcloud-db
      - nextcloud-redis

volumes:
  nextcloud_db:
  nextcloud_data:

docker compose up -d

server {
    listen 80;
    server_name cloud.miempresa.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name cloud.miempresa.com;

    ssl_certificate /etc/letsencrypt/live/cloud.miempresa.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.miempresa.com/privkey.pem;

    # Headers de seguridad requeridos por Nextcloud
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy no-referrer;

    client_max_body_size 10G;
    proxy_read_timeout 86400;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /.well-known/carddav { return 301 /remote.php/dav; }
    location /.well-known/caldav  { return 301 /remote.php/dav; }
}

docker exec -u www-data nextcloud php occ status

docker exec -u www-data nextcloud php occ app:install calendar
docker exec -u www-data nextcloud php occ app:install contacts
docker exec -u www-data nextcloud php occ app:install talk        # videoconferencias
docker exec -u www-data nextcloud php occ app:install onlyoffice  # ofimática online
docker exec -u www-data nextcloud php occ app:install twofactor_totp

docker exec -u www-data nextcloud php occ background:cron

/5    * docker exec -u www-data nextcloud php -f /var/www/html/cron.php

docker exec -u www-data nextcloud php occ user:add --password-from-env --display-name="Juan García" jgarcia

docker exec -u www-data nextcloud php occ group:add Marketing

docker exec -u www-data nextcloud php occ group:adduser Marketing jgarcia

docker exec -u www-data nextcloud php occ user:list

Servidor: ldap://controlador-dominio.miempresa.local
Puerto: 389
Usuario base DN: OU=_Usuarios,DC=miempresa,DC=local
Filtro de usuario: (&(objectClass=user)(memberOf=CN=GRP-Nextcloud,OU=_Grupos,DC=miempresa,DC=local))

sudo mount -t davfs https://cloud.miempresa.com/remote.php/dav/files/admin/ /mnt/nextcloud

docker compose pull
docker compose up -d