docker/nextcloud/docker-compose.yml

version: "3.8"

services:
  documentserver:
    image: onlyoffice/documentserver:7.4.1.1
    networks:
      - proxy
    restart: unless-stopped
    env_file: secrets/oo.secrets
    environment:
      - JWT_ENABLED=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.documentserver.entrypoints=websecure"
      - "traefik.http.routers.documentserver.rule=Host(`${OOCN}`)"
      - "traefik.http.middlewares.ds-header.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.documentserver.middlewares=ds-header,allowFrameAndCORS@file"

  redis:
    image: redis:6.2.1
    command: ["sh", "-c", "redis-server --requirepass $${REDIS_HOST_PASSWORD}"]
    restart: unless-stopped
    env_file: secrets/redis.secrets
    volumes:
      - ${DATA_PATH}/redis:/var/lib/redis

  db:
    image: mariadb:10.5.4
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: unless-stopped
    volumes:
      - ${DATA_PATH}/my.cnf:/etc/mysql/my.cnf:ro
      - ${DATA_PATH}/db:/var/lib/mysql
    env_file: secrets/db.secrets
    labels:
      - "co.elastic.logs/module=mysql"

  app:
    image: nextcloud:25.0.13
    depends_on:
      - db
      - redis
    networks:
      - proxy
      - default
    expose:
      - "80"
    links:
      - db
    volumes:
      - ${DATA_PATH}/app/html:/var/www/html
      - ${DATA_PATH}/app/skeleton:/var/www/gnous-skeleton:ro
    restart: unless-stopped
    env_file: secrets/app.secrets
    environment:
      - APACHE_DISABLE_REWRITE_IP=1
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.nc.entrypoints=websecure"
      - "traefik.http.routers.nc.rule=Host(`${NCCN}`,`${SAN1}`)"
      - "traefik.http.middlewares.nc-redirectregex.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
      - "traefik.http.middlewares.nc-redirectregex.redirectregex.replacement=https://$${1}/remote.php/dav/"
      - "traefik.http.middlewares.nc-redirectregex.redirectregex.permanent=true"
      - "traefik.http.routers.nc.middlewares=nc-redirectregex,nc-sts"
      - "traefik.http.middlewares.nc-sts.headers.stsSeconds=15552000"
      - "co.elastic.logs/module=apache"
      - "co.elastic.logs/fileset=access"

networks:
  proxy:
    external: true