Nextcloud: run cronejob every minute

firefoxsync/docker-compose.yaml

@@ -3,7 +3,7 @@ services:
   syncserver:
     image: mozilla/syncserver:latest
     volumes:
-      - ${VOLUMES_PATH}/firefoxsync_syncserver:/data
+      - ${VOLUMES_PATH}/firefoxsync/syncserver:/data
     user: ${UID}:${GID}
     networks:
       - web
@@ -23,7 +23,7 @@ services:
       - SYNCSERVER_SQLURI=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db/${POSTGRES_DB}
       - SYNCSERVER_BATCH_UPLOAD_ENABLED=true
       - SYNCSERVER_FORCE_WSGI_ENVIRON=true
-      - SYNCSERVER_DEBUG_ENABLED=true
+      - SYNCSERVER_DEBUG_ENABLED=false
       - SYNCSERVER_ALLOW_NEW_USER=true
       - PORT=5000
 
@@ -38,8 +38,12 @@ services:
     networks:
       - firefoxsync
     volumes:
-      - ${VOLUMES_PATH}/firefoxsync_db:/var/lib/postgresql/data
+      - ${VOLUMES_PATH}/firefoxsync/db:/var/lib/postgresql/data
     user: ${UID}:${GID}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=firefoxsync"
 

git/docker-compose.yaml

@@ -11,18 +11,6 @@ services:
     networks:
       - web
       - git
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
-      - "traefik.http.routers.forgejo.entrypoints=websecure"
-      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
-      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
-      - "traefik.http.routers.forgejo.middlewares=gitearedir"
-      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
-      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
-      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
-      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
-      - "docker.group=git"
     depends_on:
       - db
     restart: unless-stopped
@@ -35,6 +23,22 @@ services:
       - DB_NAME=${POSTGRES_DB}
       - DB_USER=${POSTGRES_USER}
       - DB_PASSWD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost:3000/api/healthz"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`gitea.${DOMAIN}`, `git.${DOMAIN}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
+      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
+      - "traefik.http.routers.forgejo.middlewares=gitearedir"
+      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://gitea.${DOMAIN}/(.*)"
+      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://git.${DOMAIN}/$${1}"
+      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
+      - "docker.group=git"
 
 
   db:
@@ -48,6 +52,10 @@ services:
       - git
     volumes:
       - ${VOLUMES_PATH}/git/forgejo_db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=git"
 

monitoring/docker-compose.yaml

@@ -39,7 +39,7 @@ services:
   grafanadb:
     image: postgres:${POSTGRES_VERSION}
     volumes:
-      - ${VOLUMES_PATH}/grafanadb:/var/lib/postgresql/data
+      - ${VOLUMES_PATH}/monitoring/grafanadb:/var/lib/postgresql/data
     networks:
       - grafana
     restart: unless-stopped
@@ -47,6 +47,10 @@ services:
       - POSTGRES_DB=grafana
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
     labels:
       - "docker.group=monitoring"
 
@@ -61,7 +65,7 @@ services:
     environment:
       - INFLUXDB_MONITOR_STORE_ENABLED=false
     volumes:
-      - ${VOLUMES_PATH}/influxdb/:/var/lib/influxdb
+      - ${VOLUMES_PATH}/monitoring/influxdb/:/var/lib/influxdb
       - ${PWD}/influxdb.conf:/etc/influxdb/influxdb.conf:ro
     labels:
       - "traefik.enable=true"
@@ -84,7 +88,7 @@ services:
       - web # also used to get traefik metrics
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
-      - ${VOLUMES_PATH}/prometheus:/prometheus
+      - ${VOLUMES_PATH}/monitoring/prometheus:/prometheus
     labels:
       - "docker.group=monitoring"
 

nextcloud/Dockerfile

@@ -9,3 +9,5 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    ocrmypdf tesseract-ocr-deu \
    procps \
    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /var/spool/cron/crontabs; echo '* * * * * php -f /var/www/html/cron.php' > /var/spool/cron/crontabs/www-data

nextcloud/crontab

@@ -1,3 +0,0 @@
-*/5 * * * * php -f /var/www/html/cron.php
-
-

nextcloud/docker-compose.yaml

@@ -5,12 +5,16 @@ services:
     depends_on:
       - app
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_html:/var/www/html:ro
+      - ${VOLUMES_PATH}/nextcloud/html:/var/www/html:ro
       - $PWD/nginx.conf:/etc/nginx/nginx.conf:ro
     restart: unless-stopped
     networks:
       - web
       - nextcloud
+    healthcheck:
+      test: curl -sSf 'http://localhost/status.php' | grep '"installed":true' | grep '"maintenance":false' | grep '"needsDbUpgrade":false' || exit 1
+      interval: 5s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nextcloud.rule=Host(`cloud.${DOMAIN}`)"
@@ -34,8 +38,8 @@ services:
       args:
         - NC_MAIN_VERSION=${NC_MAIN_VERSION}
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_html:/var/www/html
-      - ${VOLUMES_PATH}/nextcloud_data:/var/www/html/data
+      - ${VOLUMES_PATH}/nextcloud/html:/var/www/html
+      - ${VOLUMES_PATH}/nextcloud/data:/var/www/html/data
       - type: tmpfs
         target: /tmp
     restart: unless-stopped
@@ -66,14 +70,8 @@ services:
     networks:
       - nextcloud
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_html:/var/www/html
-      - ${VOLUMES_PATH}/nextcloud_data:/var/www/html/data
-# If I mount my crontab into the container crond is not working any more :( 
-# docker log should print 11110001 lines
-# https://github.com/nextcloud/docker/issues/1775
-# https://github.com/nextcloud/docker/issues/1695
-# build own cron image?
-#      - $PWD/crontab:/var/spool/cron/crontabs/www-data
+      - ${VOLUMES_PATH}/nextcloud/html:/var/www/html
+      - ${VOLUMES_PATH}/nextcloud/data:/var/www/html/data
     entrypoint: /cron.sh
     depends_on:
       - db
@@ -91,8 +89,8 @@ services:
       - web
       - nextcloud
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_html:/var/www/html:ro
-      - ${VOLUMES_PATH}/nextcloud_data:/var/www/html/data:ro
+      - ${VOLUMES_PATH}/nextcloud/html:/var/www/html:ro
+      - ${VOLUMES_PATH}/nextcloud/data:/var/www/html/data:ro
     environment:
       - PORT=7867
       - NEXTCLOUD_URL=http://web
@@ -113,7 +111,7 @@ services:
     image: mariadb:10
     command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_db:/var/lib/mysql
+      - ${VOLUMES_PATH}/nextcloud/db:/var/lib/mysql
     restart: unless-stopped
     environment:
       - PUID=1000
@@ -123,6 +121,7 @@ services:
       - MYSQL_PASSWORD=${MYSQL_PASSWORD}
       - MYSQL_DATABASE=${MYSQL_DATABASE}
       - MYSQL_USER=${MYSQL_USER}
+      - MARIADB_AUTO_UPGRADE=1
     logging:
       driver: "json-file"
       options:
@@ -131,6 +130,10 @@ services:
     networks:
       - nextcloud
       - mariadb
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 20s
+      timeout: 3s
     labels: 
       - "docker.group=netxtcloud"
 
@@ -165,7 +168,11 @@ services:
       - nextcloud
       - monitoring
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_redis:/data
+      - ${VOLUMES_PATH}/nextcloud/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
     labels: 
       - "docker.group=netxtcloud"
 
@@ -205,7 +212,7 @@ services:
     networks:
       - nextcloud
     volumes:
-      - ${VOLUMES_PATH}/nextcloud_fonts:/usr/share/fonts/drawio 
+      - ${VOLUMES_PATH}/nextcloud/fonts:/usr/share/fonts/drawio 
     restart: unless-stopped
     labels:
       - "docker.group=netxtcloud"

nextcloud/nginx.conf

@@ -22,6 +22,9 @@ http {
     sendfile        on;
     #tcp_nopush     on;
 
+    # Prevent nginx HTTP Server Detection
+    server_tokens   off;
+
     keepalive_timeout  65;
 
     #gzip  on;
@@ -48,7 +51,7 @@ http {
         add_header X-Download-Options "noopen" always;
         add_header X-Frame-Options "SAMEORIGIN" always;
         add_header X-Permitted-Cross-Domain-Policies "none" always;
-        add_header X-Robots-Tag "none" always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
         add_header X-XSS-Protection "1; mode=block" always;
 
         # Remove X-Powered-By, which is an information leak

proxy/docker-compose.yaml

@@ -18,6 +18,7 @@ services:
       #- "--log.level=DEBUG"
       - "--log.level=INFO"
       #- "--accesslog=true"
+      - "--ping=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
@@ -40,8 +41,12 @@ services:
       - web
       - dockersocket
     volumes:
-      - ${VOLUMES_PATH}/letsencrypt:/letsencrypt
+      - ${VOLUMES_PATH}/proxy/letsencrypt:/letsencrypt
       - $PWD/tls.toml:/etc/traefik/tls.toml
+    healthcheck:
+      test: traefik healthcheck --ping
+      interval: 3s
+      timeout: 1s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN}`)"
@@ -66,11 +71,15 @@ services:
       - INFO=1
     networks:
       - dockersocket
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
+      interval: 10s
+      timeout: 3s
     privileged: true
 
 
   whoami:
-    image: containous/whoami
+    image: traefik/whoami
     networks:
       - web
     labels:

start-all.sh

@@ -7,7 +7,7 @@ function up {
 up proxy --scale whoami=3;
 up monitoring;
 up nextcloud;
-up gitea;
+up git;
 up wallabag;
 up www;
 up firefoxsync;

wallabag/docker-compose.yaml

@@ -20,7 +20,11 @@ services:
       - web
       - wallabag
     volumes:
-      - /var/dockervolumes/wallabag_images:/var/www/wallabag/web/assets/images
+      - /var/dockervolumes/wallabag/images:/var/www/wallabag/web/assets/images
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost"]
+      interval: 10s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.wallabag.rule=Host(`wallabag.${DOMAIN}`)"
@@ -40,15 +44,25 @@ services:
     networks:
       - wallabag
     volumes:
-      - /var/dockervolumes/wallabag_db:/var/lib/mysql
+      - /var/dockervolumes/wallabag/db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 10s
+      timeout: 3s
     labels:
       - "docker.group=wallabag"
   
   redis:
-    image: redis:alpine
+    image: redis
     restart: unless-stopped
     networks:
       - wallabag
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "docker.group=wallabag"
 
 
 networks:

www/docker-compose.yaml

@@ -7,6 +7,10 @@ services:
     networks:
       - web
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost"]
+      interval: 5s
+      timeout: 3s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS