# nextcloud stack — rieger-getuned, caddy-ready, mit collabora + whiteboard
# läuft im LXC 110. rootfs/app auf NVMe, daten auf tank (/srv/nc_data = tank/nextcloud).
# caddy terminiert TLS und proxyt cloud.deinedomain.ch -> web:80
#                                  office.deinedomain.ch -> collabora:9980
#                                  whiteboard.deinedomain.ch -> whiteboard:3002

services:
  db:
    image: mariadb:11.4
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
      - ./config/mariadb-tuning.cnf:/etc/mysql/conf.d/99-nextcloud.cnf:ro
    environment:
      - MARIADB_ROOT_PASSWORD=${DB_ROOT_PW}
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud
      - MARIADB_PASSWORD=${DB_PW}
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PW}
    volumes:
      - redis:/data

  app:
    image: nextcloud:fpm
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    volumes:
      - nextcloud:/var/www/html
      - /srv/nc_data:/var/www/html/data          # <- tank/nextcloud mount im LXC
      - ./config/php-custom.ini:/usr/local/etc/php/conf.d/zz-nextcloud.ini:ro
    environment:
      - MYSQL_HOST=db
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=${DB_PW}
      - REDIS_HOST=redis
      - REDIS_HOST_PASSWORD=${REDIS_PW}
      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.deinedomain.ch
      - TRUSTED_PROXIES=10.0.0.100          # <- Caddy-IP
      - OVERWRITEPROTOCOL=https
      - OVERWRITECLIURL=https://cloud.deinedomain.ch
      - PHP_MEMORY_LIMIT=1024M
      - PHP_UPLOAD_LIMIT=16G

  web:
    image: nginx:alpine
    restart: unless-stopped
    depends_on: [app]
    volumes:
      - nextcloud:/var/www/html:ro
      - /srv/nc_data:/var/www/html/data:ro
      - ./config/nginx-nextcloud.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "8110:80"          # <- Caddy proxyt hierauf

  cron:
    image: nextcloud:fpm
    restart: unless-stopped
    depends_on: [db, redis]
    volumes:
      - nextcloud:/var/www/html
      - /srv/nc_data:/var/www/html/data
    entrypoint: /cron.sh

  collabora:
    image: collabora/code:latest
    restart: unless-stopped
    cap_add: [MKNOD]
    environment:
      - aliasgroup1=https://cloud\.deinedomain\.ch:443
      - server_name=office.deinedomain.ch
      - username=admin
      - password=${COLLABORA_PW}
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
    ports:
      - "9980:9980"        # <- Caddy proxyt office.deinedomain.ch hierauf

  whiteboard:
    image: ghcr.io/nextcloud-releases/whiteboard:stable
    restart: unless-stopped
    environment:
      - NEXTCLOUD_URL=https://cloud.deinedomain.ch
      - JWT_SECRET_KEY=${WHITEBOARD_JWT}
    ports:
      - "3002:3002"        # <- Caddy proxyt whiteboard.deinedomain.ch hierauf

  # optional, aber rieger-im-geiste: schnellere previews
  imaginary:
    image: nextcloud/aio-imaginary:latest
    restart: unless-stopped
    cap_add: [SYS_NICE]
    environment:
      - PORT=9000

volumes:
  nextcloud:
  db:
  redis: