docker-compose.yml

version: '3.5'

services:
  nextcloud:
    hostname: nextcloud
    init: true
    privileged: false
    restart: ${DOCKER_OPT_RESTART:-unless-stopped}
    build:
      context: ./nextcloud
      args:
        # use GFARM_SRC_GIT_URL if GFARM_SRC_URL is empty
        - GFARM_SRC_URL=${GFARM_SRC_URL-https://github.com/oss-tsukuba/gfarm/archive/refs/tags/2.7.20.tar.gz}
        - GFARM_SRC_GIT_URL=${GFARM_SRC_GIT_URL:-https://github.com/oss-tsukuba/gfarm.git}
        - GFARM_SRC_GIT_BRANCH=${GFARM_SRC_GIT_BRANCH:-2.8}

        # use GFARM2FS_SRC_GIT_URL if GFARM2FS_SRC_URL is empty
        - GFARM2FS_SRC_URL=${GFARM2FS_SRC_URL-https://github.com/oss-tsukuba/gfarm2fs/archive/refs/tags/1.2.16.tar.gz}
        - GFARM2FS_SRC_GIT_URL=${GFARM2FS_SRC_GIT_URL:-https://github.com/oss-tsukuba/gfarm2fs.git}
        - GFARM2FS_SRC_GIT_BRANCH=${GFARM2FS_SRC_GIT_BRANCH:-master}

        ### mandatory
        - NEXTCLOUD_VERSION=${NEXTCLOUD_VERSION:-23}
        ### optional
        - http_proxy=${http_proxy:-}
        - https_proxy=${https_proxy:-}
    ### need to override in docker-compose.override.yml
    #ports:
    #  - ${HTTP_PORT:?HTTP_PORT}:80
    environment:
      - REDIS_HOST=redis

      ### mandatory
      - SERVER_NAME=${SERVER_NAME:?SERVER_NAME}
      - PROTOCOL=${PROTOCOL:?PROTOCOL}
      - GFARM_USER=${GFARM_USER:?GFARM_USER}
      - GFARM_DATA_PATH=${GFARM_DATA_PATH:?GFARM_DATA_PATH}
      - GFARM_BACKUP_PATH=${GFARM_BACKUP_PATH:?GFARM_BACKUP_PATH}

      ### Gfarm parameters (if necessary)
      - MYPROXY_SERVER=${MYPROXY_SERVER:-}
      - MYPROXY_USER=${MYPROXY_USER:-}
      - GSI_PROXY_HOURS=${GSI_PROXY_HOURS:-168}

      ### optional
      - HTTP_PORT=${HTTP_PORT:-80}
      - HTTPS_PORT=${HTTPS_PORT:-443}

      - NEXTCLOUD_UPDATE=${NEXTCLOUD_UPDATE:-1}
      - NEXTCLOUD_GFARM_DEBUG=${NEXTCLOUD_GFARM_DEBUG:-0}
      - NEXTCLOUD_GFARM_DEBUG_SLEEP=${NEXTCLOUD_GFARM_DEBUG_SLEEP:-0}
      - http_proxy=${http_proxy:-}
      - https_proxy=${https_proxy:-}
      - HTTP_ACCESS_LOG=${HTTP_ACCESS_LOG:-0}
      - TZ=${TZ:-Asia/Tokyo}
      #### empty means disabled
      - NEXTCLOUD_FILES_SCAN_TIME=${NEXTCLOUD_FILES_SCAN_TIME-0 5 * * *}
      #### empty means disabled
      - NEXTCLOUD_BACKUP_TIME=${NEXTCLOUD_BACKUP_TIME-0 2 * * *}
      - NEXTCLOUD_TRUSTED_DOMAINS=${NEXTCLOUD_TRUSTED_DOMAINS:-}
      - NEXTCLOUD_DEFAULT_PHONE_REGION=${NEXTCLOUD_DEFAULT_PHONE_REGION:-JP}
      #### empty means disabled
      - GFARM_CHECK_ONLINE_TIME=${GFARM_CHECK_ONLINE_TIME-*/5 * * * *}
      - GFARM_CREDENTIAL_EXPIRATION_THRESHOLD=${GFARM_CREDENTIAL_EXPIRATION_THRESHOLD:-600}
      - GFARM_ATTR_CACHE_TIMEOUT=${GFARM_ATTR_CACHE_TIMEOUT:-60}
      - FUSE_ENTRY_TIMEOUT=${FUSE_ENTRY_TIMEOUT:-60}
      - FUSE_NEGATIVE_TIMEOUT=${FUSE_NEGATIVE_TIMEOUT:-5}
      - FUSE_ATTR_TIMEOUT=${FUSE_ATTR_TIMEOUT:-60}
      - GFARM2FS_LOGLEVEL=${GFARM2FS_LOGLEVEL:-info}

      ### https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html
      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-}
      # empty means SERVER_NAME:HTTPS_PORT or SERVER_NAME:HTTP_PORT
      # (specified automatically in nextcloud/entrypoint0.sh)
      - OVERWRITEHOST=${OVERWRITEHOST:-}
      # empty means PROTOCOL
      # (specified automatically in nextcloud/entrypoint0.sh)
      - OVERWRITEPROTOCOL=${OVERWRITEPROTOCOL:-}
      - OVERWRITEWEBROOT=${OVERWRITEWEBROOT:-}
      - OVERWRITECONDADDR=${OVERWRITECONDADDR:-}
    volumes:
      - nextcloud:/var/www/html
      - gsi_proxy:/gsi_proxy
      - log:/var/log
      ### mandatory
      - ${GFARM_CONF_DIR:?GFARM_CONF_DIR}:/gfarm_conf:ro

      ### Gfarm parameters (if necessary)
      - ${GFARM_CONF_USER_DIR:-/dev/null}:/gfarm_conf_user:ro
      - ${GSI_CERTIFICATES_DIR:-/dev/null}:/etc/grid-security/certificates:ro
      - ${GSI_USER_DIR:-/dev/null}:/gsi_user:ro
    depends_on:
      - mariadb
      - redis
    security_opt:
      ### for fuse
      - apparmor:unconfined
    cap_add:
      ### for fuse
      - SYS_ADMIN
    devices:
      - /dev/fuse:/dev/fuse
    privileged: false
    secrets:
      - nextcloud_admin_password
      - db_password
      # - myproxy_password
      # - grid_proxy_password
    networks:
      - mynet1
      - mynet2

  mariadb:
    hostname: mariadb
    privileged: false
    restart: ${DOCKER_OPT_RESTART:-unless-stopped}
    environment:
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_password
    image: mariadb:10.5
    volumes:
      - db:/var/lib/mysql
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    secrets:
      - db_password
    networks:
      - mynet1

  redis:
    image: redis:alpine
    privileged: false
    restart: ${DOCKER_OPT_RESTART:-unless-stopped}
    command:
      - --loglevel warning
    networks:
      - mynet1

secrets:
  nextcloud_admin_password:
    file: ./secrets/nextcloud_admin_password
  db_password:
    file: ./secrets/db_password
  # myproxy_password:
  #   file: ./secrets/myproxy_password
  # grid_proxy_password:
  #   file: ./secrets/grid_proxy_password

volumes:
  nextcloud:
  gsi_proxy:
  log:
  db:

networks:
  mynet1:
    # (internal tier)
    # external (outside of Docker Compose) network name
    # overridable
    name: ${NETWORK1_NAME:-nextcloud-gfarm_internal}
    external: ${NETWORK1_EXTERNAL:-false}
    ipam:
      config:
        - subnet: ${NETWORK1_SUBNET:-10.123.101.0/24}
  mynet2:
    # (reverse proxy tier)
    # external (outside of Docker Compose) network name
    # overridable
    name: ${NETWORK2_NAME:-nextcloud-gfarm_revproxy}
    external: ${NETWORK2_EXTERNAL:-false}
    ipam:
      config:
        - subnet: ${NETWORK2_SUBNET:-10.123.102.0/24}