replace apache with a second caddy by Zoey2936 · Pull Request #7006 · nextcloud/all-in-one

Zoey2936 · 2025-10-17T19:03:22Z

Signed-off-by: Zoey zoey@z0ey.de

see #6998

szaimen

Hey, thanks for working on this! I have an initial comment below. Will look more into detail into this next week.

Containers/mastercontainer/internal.Caddyfile

Containers/mastercontainer/supervisord.conf

szaimen · 2025-10-20T11:54:29Z

Containers/mastercontainer/start.sh

-# Don't allow access to the AIO interface from the Nextcloud container
-# Probably more cosmetic than anything but at least an attempt
-if ! grep -q '# nextcloud-aio-block' /etc/apache2/httpd.conf; then
-    cat << APACHE_CONF >> /etc/apache2/httpd.conf
-# nextcloud-aio-block-start
-<Location />
-order allow,deny
-deny from nextcloud-aio-nextcloud.nextcloud-aio
-allow from all
-</Location>
-# nextcloud-aio-block-end
-APACHE_CONF
-fi


can we do something comparable with caddy?

we could resolve the ip for example with dig and block the ip(s) we get

we could resolve the ip for example with dig and block the ip(s) we get

I fear this is not going to work as the ip-addresses of the nextcloud-aio-nextcloud container might change or might not exist when the mastercontainer starts. Is there any other way to do this?

I think not

Looks like there is a caddy plugin that could do this: https://github.com/muety/caddy-remote-host

Is it worth recompiling caddy for this? also the last commit is 4 years ago, so is it still compatible with latest caddy?

We can make Caddy only allow requests from the "mastercontainer's" IP-gateway. Which will always be the container host, as far as I understand.

That IP-Adress is trivial to get in the container's entrypoint (ip r | awk '/^default via/ { print $3 }'), and should be easy enough to set into the environment so that Caddy can use it:

https://:8443 { @denied not remote_ip {$CONTAINER_HOST_IP} abort @denied …

That would disable access to the web UI from all other containers in the network, which would goes even beyond the current solution.

Containers/mastercontainer/start.sh

szaimen · 2025-10-20T11:57:21Z

Containers/mastercontainer/Dockerfile

-    sed -i 's|;listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1|' /usr/local/etc/php-fpm.d/www.conf; \
+    grep -q 'listen =' /usr/local/etc/php-fpm.d/www.conf; \
+    sed -i 's|listen =.*|;listen = /run/php.sock # handled in zz-docker.conf|' /usr/local/etc/php-fpm.d/www.conf; \
+    grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \


Suggested change

grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \

grep -q '^listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \

only for the zz-docker.conf?

I'd say so, yes. Or we comment listen in zz-docker and add listen to the www-conf which might be better

currently it is set twice:

/var/www/html # grep -r /usr/local/etc/ -e "listen\s=" /usr/local/etc/php-fpm.d/www.conf.default:listen = 127.0.0.1:9000 /usr/local/etc/php-fpm.d/www.conf.default:;pm.status_listen = 127.0.0.1:9001 /usr/local/etc/php-fpm.d/www.conf:listen = 127.0.0.1:9000 /usr/local/etc/php-fpm.d/www.conf:;pm.status_listen = 127.0.0.1:9001 /usr/local/etc/php-fpm.d/zz-docker.conf:listen = 9000

in zz-docker.conf and www.conf, files ending with .default are ignored by fpm

hm... lets maybe only set it in www.conf and comment it in zz-docker.conf

can you adjust this please/create a suggestion?

Containers/mastercontainer/internal.Caddyfile

szaimen · 2025-10-20T13:01:27Z

@Zoey2936 please also update

all-in-one/Containers/mastercontainer/README.md

Line 15 in 1a4c4bd

    
           - An Apache service for accessing the AIO interface via a self-signed HTTPS VirtualHost on 8080/tcp

Thanks in advance! :)

Zoey2936 · 2025-10-20T16:39:24Z

@Zoey2936 please also update

all-in-one/Containers/mastercontainer/README.md

Line 15 in 1a4c4bd

- An Apache service for accessing the AIO interface via a self-signed HTTPS VirtualHost on 8080/tcp

Thanks in advance! :)

should be done

Containers/mastercontainer/start.sh

Croydon · 2025-11-04T18:07:45Z

Is the only advantage that the mastercontainer is a bit smaller? 🤔

szaimen · 2025-11-12T10:16:22Z

Hey @Zoey2936, my plan is to release AIO v12 beta tomorrow. Unfortunately I don't have enough time for this PR until then. So will need to postpone this. Sorry for that!

Zoey2936 · 2026-02-03T13:45:47Z

Hey @Zoey2936, my plan is to release AIO v12 beta tomorrow. Unfortunately I don't have enough time for this PR until then. So will need to postpone this. Sorry for that!

what is the current state of the review?

Signed-off-by: Zoey <zoey@z0ey.de>

szaimen · 2026-02-06T08:55:50Z

Hey @Zoey2936, my plan is to release AIO v12 beta tomorrow. Unfortunately I don't have enough time for this PR until then. So will need to postpone this. Sorry for that!

what is the current state of the review?

I'll discuss the PR with my new colleague @pabzm :)

szaimen · 2026-02-06T14:01:02Z

Containers/mastercontainer/start.sh

-# nextcloud-aio-block-start
-<Location />
-order allow,deny
-deny from nextcloud-aio-nextcloud.nextcloud-aio


Check with Pablo if we can simply block the whole network range

As suggested in the thread above we can make Caddy only serve its IP-gateway pretty easily, I think.

pabzm · 2026-02-12T14:03:46Z

@Zoey2936 Do I understand correctly that using two Caddy instances with separate config files is due to Caddy's inability to have multiple blocks with catch-all host matchers as discussed in caddyserver/caddy#7311?

In my spontaneous test it is possible to have one catch-all matcher (using on-demand internal TLS) side-by-side with blocks that include hostnames (using Let's Encrypt TLS).

So if we configure Caddy initially only with the block for the AIO web UI, and only after we obtained the domain name from the web UI dynamically (e.g. via its HTTP API) inject the config blocks for ports 80 and 8443 – then we could get away with only one caddy instance, I think.

Or do I miss something important?

Zoey2936 · 2026-02-12T16:05:49Z

Yes the reason is caddyserver/caddy#7311

Croydon · 2026-02-12T17:05:11Z

My previously question was kinda ignored, so I would like to ask again what the motivation is for this change.
So far, the entire discussion seems to circle around the question if this is technical possible, not what the advantage of it is.

pabzm · 2026-02-13T07:44:30Z

@Croydon Removing Apache would reduce the image size as well as the overall complexity, which we consider progress. If you see any arguments against this, please speak up.

Zoey2936 requested a review from szaimen October 17, 2025 19:03

szaimen reviewed Oct 17, 2025

View reviewed changes

Containers/mastercontainer/internal.Caddyfile Show resolved Hide resolved

Zoey2936 force-pushed the replace-apache-with-caddy branch 2 times, most recently from 59e4a6c to 0664ec8 Compare October 17, 2025 19:30

Zoey2936 commented Oct 17, 2025

View reviewed changes

Containers/mastercontainer/supervisord.conf Show resolved Hide resolved

szaimen mentioned this pull request Oct 20, 2025

publish new images after recent PRs are merged and tested #6947

Closed

27 tasks

szaimen reviewed Oct 20, 2025

View reviewed changes

Containers/mastercontainer/start.sh Show resolved Hide resolved

szaimen reviewed Oct 20, 2025

View reviewed changes

szaimen added 2. developing Work in progress enhancement New feature or request labels Oct 20, 2025

szaimen modified the milestone: next Oct 20, 2025

szaimen mentioned this pull request Oct 20, 2025

updating all existing instances to Nextcloud Hub 25 Autumn (nc32) #6920

Closed

36 tasks

Zoey2936 commented Oct 20, 2025

View reviewed changes

Containers/mastercontainer/internal.Caddyfile Show resolved Hide resolved

szaimen force-pushed the replace-apache-with-caddy branch from 0664ec8 to bf02678 Compare October 20, 2025 13:00

szaimen reviewed Oct 23, 2025

View reviewed changes

Containers/mastercontainer/start.sh Show resolved Hide resolved

szaimen mentioned this pull request Nov 4, 2025

publish new images after recent PRs are merged and tested #7027

Closed

51 tasks

Zoey2936 added 4 commits February 3, 2026 14:46

replace apache with a second caddy

c6c9d8a

Signed-off-by: Zoey <zoey@z0ey.de>

mastercontainer/README.md: apache=>caddy

dc03f95

Signed-off-by: Zoey <zoey@z0ey.de>

Remove unused certs from docker-aio-config

7351fc1

Signed-off-by: Zoey <zoey@z0ey.de>

set skip_install_trust in all Caddyfiles

7c093f3

Signed-off-by: Zoey <zoey@z0ey.de>

Zoey2936 force-pushed the replace-apache-with-caddy branch from 396acf3 to 7c093f3 Compare February 3, 2026 13:46

szaimen reviewed Feb 6, 2026

View reviewed changes

szaimen mentioned this pull request Feb 6, 2026

publish new images after recent PRs are merged and tested #7535

Closed

28 tasks

szaimen added this to the next milestone Feb 13, 2026

szaimen mentioned this pull request Feb 13, 2026

publish new images after recent PRs are merged and tested #7588

Open

31 tasks

szaimen modified the milestones: v12.7.0, next Feb 13, 2026

szaimen modified the milestones: v12.8.0, next Feb 26, 2026

szaimen mentioned this pull request Feb 26, 2026

publish new images after recent PRs are merged and tested #7665

Open

31 tasks

	grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \
	grep -q '^listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \

Conversation

Zoey2936 commented Oct 17, 2025

Uh oh!

szaimen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

szaimen Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

szaimen commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zoey2936 commented Oct 20, 2025

Uh oh!

Uh oh!

Croydon commented Nov 4, 2025

Uh oh!

szaimen commented Nov 12, 2025

Uh oh!

Zoey2936 commented Feb 3, 2026

Uh oh!

szaimen commented Feb 6, 2026

Uh oh!

szaimen Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pabzm commented Feb 12, 2026

Uh oh!

Zoey2936 commented Feb 12, 2026

Uh oh!

Croydon commented Feb 12, 2026

Uh oh!

pabzm commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

szaimen Oct 23, 2025 •

edited

Loading

szaimen commented Oct 20, 2025 •

edited

Loading

szaimen Feb 6, 2026 •

edited

Loading