Repository navigation

Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach - #396

Open

markuslf wants to merge 33 commits into

mainfrom

fix/nextcloud

Open

Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach#396
markuslf wants to merge 33 commits into
mainfrom
fix/nextcloud

Commits on Oct 2, 2026
- feat(roles/valkey): listen on a Unix socket that the valkey group may use
  
  markuslf
  authored and
  NavidSassan
  committed
  92c8500
- feat(roles/redis): listen on a Unix socket that the redis group may use
  
  markuslf
  authored and
  NavidSassan
  committed
  4b009ac
- feat(roles/redis): add meta/argument_specs.yml
  
  markuslf
  authored and
  NavidSassan
  committed
  2688f0d
- fix(roles/valkey): keep the ownership of valkey.conf that the package sets
  
  markuslf
  authored and
  NavidSassan
  committed
  5d12e17
- fix(roles/redis): keep the ownership of redis.conf that the package sets
  
  markuslf
  authored and
  NavidSassan
  committed
  0b1ac9e
- test(molecule): assert the valkey Unix socket and the config ownership
  
  markuslf
  authored and
  NavidSassan
  committed
  222b5f1
- fix(roles/nextcloud): start the LDAP remnants report from its own timer
  
  markuslf
  authored and
  NavidSassan
  committed
  f915739
- fix(roles/nextcloud): apply ownership and SELinux label to nextcloud__datadir
  
  markuslf
  authored and
  NavidSassan
  committed
  0f80183
- fix(roles/nextcloud): add missing primary keys and run expensive repairs in nextcloud-update
  
  markuslf
  authored and
  NavidSassan
  committed
  390c264
- fix(roles/nextcloud): pass the passwords to occ on stdin
  
  markuslf
  authored and
  NavidSassan
  committed
  704dd8e
- fix(roles/nextcloud): make nextcloud-update readable by root only
  
  markuslf
  authored and
  NavidSassan
  committed
  dca8f36
- fix(roles/nextcloud)!: verify the certificate of the SMTP server
  
  markuslf
  authored and
  NavidSassan
  committed
  e133657
- docs(roles/nextcloud): document the subkeys of nextcloud__apps and nextcloud__app_configs
  
  markuslf
  authored and
  NavidSassan
  committed
  36f00f4
- refactor(roles/nextcloud): drop forbidden filename characters Nextcloud forbids anyway
  
  markuslf
  authored and
  NavidSassan
  committed
  c3235c3
- feat(roles/fail2ban): add a nextcloud filter and jail
  
  markuslf
  authored and
  NavidSassan
  committed
  b35b2c0
- feat(roles/nextcloud)!: log to /var/log/nextcloud
  
  markuslf
  authored and
  NavidSassan
  committed
  36f9d81
- feat(playbooks/setup_nextcloud): optionally run fail2ban, never ban the trusted proxies
  
  markuslf
  authored and
  NavidSassan
  committed
  4a9e9c5
- feat(roles/nextcloud)!: abort when PHP or MariaDB do not fit the installed Nextcloud
  
  markuslf
  authored and
  NavidSassan
  committed
  ace4f4c
- fix(playbooks/setup_nextcloud): configure SELinux before the services
  
  markuslf
  authored and
  NavidSassan
  committed
  8bbf3ce
- feat(roles/nextcloud)!: connect to Redis / Valkey through the Unix socket
  
  markuslf
  authored and
  NavidSassan
  committed
  76110af
- fix(roles/nextcloud): restart PHP-FPM and switch to cron only on a change
  
  markuslf
  authored and
  NavidSassan
  committed
  fa1d651
- fix(roles/nextcloud): retry the installer after a failed attempt
  
  markuslf
  authored and
  NavidSassan
  committed
  77322f7
- fix(roles/nextcloud): keep the Icinga API password out of the process list
  
  markuslf
  authored and
  NavidSassan
  committed
  9deef41
- feat(roles/nextcloud)!: make nextcloud__version mandatory
  
  markuslf
  authored and
  NavidSassan
  committed
  8981116
- feat(roles/nextcloud)!: connect to MariaDB as a dedicated user
  
  markuslf
  authored and
  NavidSassan
  committed
  28604b2
- docs(roles/nextcloud): describe how to connect Collabora Online
  
  markuslf
  authored and
  NavidSassan
  committed
  ae978c9
- fix(roles/nextcloud): stop installing the APCu PHP extension
  
  markuslf
  authored and
  NavidSassan
  committed
  a563dfb
- feat(roles/nextcloud)!: remove the PHP modules Nextcloud does not use
  
  markuslf
  authored and
  NavidSassan
  committed
  54d4bbf
- test(molecule): assert nextcloud-update is readable by root only
  
  markuslf
  authored and
  NavidSassan
  committed
  9c0702d
- docs(roles/nextcloud): describe the requirements without naming versions
  
  markuslf
  authored and
  NavidSassan
  committed
  bb8fab9
- fix(roles/nextcloud): look up the MariaDB socket for the platform
  NavidSassan
  committed
  e55918b
- docs(roles/nextcloud): list fail2ban as off by default and align the version description
  NavidSassan
  committed
  d4ecc13
- test(molecule): assert the Redis / Valkey socket and config ownership in setup_nextcloud
  NavidSassan
  committed
  77eefb1

Navigation Menu

Repository navigation

Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach - #396

Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach#396
markuslf wants to merge 33 commits into
mainfrom
fix/nextcloud

Commits on Oct 2, 2026

feat(roles/valkey): listen on a Unix socket that the valkey group may use

feat(roles/redis): listen on a Unix socket that the redis group may use

feat(roles/redis): add meta/argument_specs.yml

fix(roles/valkey): keep the ownership of valkey.conf that the package sets

fix(roles/redis): keep the ownership of redis.conf that the package sets

test(molecule): assert the valkey Unix socket and the config ownership

fix(roles/nextcloud): start the LDAP remnants report from its own timer

fix(roles/nextcloud): apply ownership and SELinux label to nextcloud__datadir

fix(roles/nextcloud): add missing primary keys and run expensive repairs in nextcloud-update

fix(roles/nextcloud): pass the passwords to occ on stdin

fix(roles/nextcloud): make nextcloud-update readable by root only

fix(roles/nextcloud)!: verify the certificate of the SMTP server

docs(roles/nextcloud): document the subkeys of nextcloudapps and nextcloudapp_configs

refactor(roles/nextcloud): drop forbidden filename characters Nextcloud forbids anyway

feat(roles/fail2ban): add a nextcloud filter and jail

feat(roles/nextcloud)!: log to /var/log/nextcloud

feat(playbooks/setup_nextcloud): optionally run fail2ban, never ban the trusted proxies

feat(roles/nextcloud)!: abort when PHP or MariaDB do not fit the installed Nextcloud

fix(playbooks/setup_nextcloud): configure SELinux before the services

feat(roles/nextcloud)!: connect to Redis / Valkey through the Unix socket

fix(roles/nextcloud): restart PHP-FPM and switch to cron only on a change

fix(roles/nextcloud): retry the installer after a failed attempt

fix(roles/nextcloud): keep the Icinga API password out of the process list

feat(roles/nextcloud)!: make nextcloud__version mandatory

feat(roles/nextcloud)!: connect to MariaDB as a dedicated user

docs(roles/nextcloud): describe how to connect Collabora Online

fix(roles/nextcloud): stop installing the APCu PHP extension

feat(roles/nextcloud)!: remove the PHP modules Nextcloud does not use

test(molecule): assert nextcloud-update is readable by root only

docs(roles/nextcloud): describe the requirements without naming versions

fix(roles/nextcloud): look up the MariaDB socket for the platform

docs(roles/nextcloud): list fail2ban as off by default and align the version description

test(molecule): assert the Redis / Valkey socket and config ownership in setup_nextcloud