nextcloud/compose.yml

version: '2'
services:
  db:
    image: mariadb:10.6
    restart: always
    hostname: maria-db
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    networks:
      - db-con
    volumes:
      - db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      
  app:
    image: nextcloud:32.0.5
    hostname: nextcloud
    restart: always
    networks:
      - proxy
      - db-con
    volumes:
      - nextcloud:/var/www/html
      - nextcloud_hooks:/docker-entrypoint-hooks.d
      - /etc/localtime:/etc/localtime:ro 
    environment:
      - MYSQL_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=maria-db
      - PHP_MEMORY_LIMIT=4096M
      - PHP_UPLOAD_LIMIT=5120M
    labels:
      traefik.enable: true
      traefik.http.routers.nextcloud.rule: "Host(`nextcloud.urmel.de`)"
      traefik.http.routers.nextcloud.tls: true
      traefik.http.routers.nextcloud.tls.certResolver: hetzner
      traefik.http.services.nextcloud-https.loadbalancer.server.port: 80
      traefik.http.services.nextcloud-https.loadbalancer.passHostHeader: true

      traefik.http.routers.nextcloud.middlewares: nextcloud-dav,nextcloud-header
      traefik.http.middlewares.nextcloud-dav.redirectRegex.regex: https://(.*)/.well-known/(card|cal)dav
      traefik.http.middlewares.nextcloud-dav.redirectRegex.replacement: https://$${1}/remote.php/dav/
      traefik.http.middlewares.nextcloud-dav.redirectRegex.permanent: true
      traefik.http.middlewares.nextcloud-header.headers.stsSeconds: "15552000"
      # traefik.http.middlewares.nextcloud-header.headers.referrerPolicy: no-referrer
      # traefik.http.middlewares.nextcloud-header.headers.forceSTSHeader: true
      # traefik.http.middlewares.nextcloud-header.headers.stsPreload: true
      # traefik.http.middlewares.nextcloud-header.headers.stsIncludeSubdomains: true
      # traefik.http.middlewares.nextcloud-header.headers.browserXssFilter: true
      # traefik.http.middlewares.nextcloud-header.headers.customRequestHeaders.X-Forwarded-Proto: https
  collabora:
    image: collabora/code:25.04.8.1.1
    hostname: collabora
    networks:
      - proxy
    environment:
      - aliasgroup1=https://nextcloud.urmel.de
      - DONT_GEN_SSL_CERT=YES
      - domain=collabora.urmel.de
      - VIRTUAL_HOST=collabora.urmel.de
      - username=someAdmin
      - password=${COLLABORA_PASSWORD}
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:net.wopi.host=nextcloud.urmel.de --o:logging.disable_server_audit=true
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - MKNOD
      - SETFCAP
      - SETGID
      - SETUID
      - SYS_CHROOT
      - SYS_ADMIN
    entrypoint: ['/bin/bash', '-c']
    command: ['coolconfig generate-proof-key && /start-collabora-online.sh']
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9980/hosting/discovery" ]
      interval: 15s
      timeout: 10s
      retries: 5
    labels:
      traefik.enable: true
      traefik.http.routers.collabora.rule: "Host(`collabora.urmel.de`)"
      traefik.http.routers.collabora.tls: true
      traefik.http.routers.collabora.tls.certResolver: hetzner
      traefik.http.services.collabora-https.loadbalancer.server.port: 9980
      traefik.http.services.collabora-https.loadbalancer.passHostHeader: true

      # traefik.http.middlewares.collabora-headers.headers.customrequestheaders.Connection: Upgrade
      # traefik.http.middlewares.collabora-headers.headers.customrequestheaders.Upgrade: websocket
      # traefik.http.middlewares.collabora-headers.headers.customrequestheaders.X-Forwarded-Proto: https
      # traefik.http.middlewares.collabora-headers.headers.customrequestheaders.X-Forwarded-Host: collabora.urmel.de
      # traefik.http.middlewares.collabora-headers.headers.referrerPolicy: no-referrer
      # traefik.http.middlewares.collabora-headers.headers.stsSeconds: 15552000
      # traefik.http.middlewares.collabora-headers.headers.forceSTSHeader: true
      # traefik.http.middlewares.collabora-headers.headers.stsPreload: true
      # traefik.http.middlewares.collabora-headers.headers.stsIncludeSubdomains: true
      # traefik.http.middlewares.collabora-headers.headers.browserXssFilter: true
      # traefik.http.middlewares.collabora-headers.headers.customRequestHeaders.X-Forwarded-Proto: https
      # traefik.http.routers.collabora.middlewares: collabora-headers
  drawio:
    image: jgraph/drawio:29.3.5
    hostname: drawio
    networks:
      - proxy
    labels:
      traefik.enable: true
      traefik.http.routers.drawio.rule: "Host(`drawio.urmel.de`)"
      traefik.http.routers.drawio.tls: true
      traefik.http.routers.drawio.tls.certResolver: hetzner
      traefik.http.services.drawio-https.loadbalancer.server.port: 8080
    
      
volumes:
  nextcloud:
    driver_opts:
        type: nfs4
        o: addr=217.100.0.2,rw,noatime,tcp
        device: ":/mnt/Main/nextcloudData"
  nextcloud_hooks:
  db:

networks:
  proxy:
    name: traefik_exposed
    external: true
  db-con:
    internal: true