Add support for NC 34 and PHP 8.5

.github/workflows/build-lxd.yml

@@ -43,7 +43,7 @@ jobs:
           if [[ "${LXD_ARCH}" == "arm64" ]]
           then
             LXC_CMD="incus"
-            RUNNER_LABEL="ubuntu-20.04-arm64"
+            RUNNER_LABEL="ubuntu-26.04-arm64"
             echo "lxd_extra_profile=network" | tee -a "$GITHUB_OUTPUT"
           else
             LXC_CMD="incus"
@@ -71,10 +71,11 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
-          sudo apt-get install -y incus qemu-system incus-tools
+          sudo apt-get install -y incus qemu-system
+          sudo apt-get install -y incus-tools || sudo apt-get install -y incus-extra
           sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
           sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
           sudo incus admin init --auto
@@ -147,7 +148,7 @@ jobs:
           echo "VERSION=$version" >> "$GITHUB_ENV"
           echo "previous_version=${version}" >> $GITHUB_OUTPUT
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -199,7 +200,7 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -254,7 +255,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./${ARTIFACT_FILE?}" --alias "ncp/test" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp
@@ -418,7 +419,7 @@ jobs:
       USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
     steps:
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -474,7 +475,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./ncp.tar.gz" --alias "ncp/update" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp
@@ -547,7 +548,7 @@ jobs:
           echo "Running update to ${VERSION}"
 
           current_nc_version="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
-          latest_nc_version="33.0.3"
+          latest_nc_version="33.0.2"
 
           sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
           sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
@@ -739,7 +740,7 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -794,7 +795,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./${ARTIFACT_FILE?}" --alias "ncp/test" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp
@@ -837,6 +838,8 @@ jobs:
             echo "nextcloud log: "
             datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            echo "opcache.interned_strings_buffer:"
+            sudo "$LXC" exec ncp -- bash -c 'grep -R opcache.interned_strings_buffer /etc/php/*/fpm/conf.d/'
             exit 1
           }
           USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive || {

.github/workflows/build-sd-images.yml

@@ -122,7 +122,7 @@ jobs:
 
   test:
     needs: build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04-arm64
     env:
       VERSION: "${{ inputs.git_ref }}"
       ARTIFACT_ID: ${{ needs.build.outputs.artifact_name }}
@@ -161,6 +161,8 @@ jobs:
       - name: Prepare test
         run: |
           set -x
+
+          PHPVER="$(jq -r .php_version ./etc/ncp.cfg)"
           mv "output/${ARTIFACT_FILE?}" ncp.img
           sudo apt-get update
           sudo apt-get install -y systemd-container
@@ -181,13 +183,30 @@ jobs:
           echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/redis-server.service.d/ncp-ci.conf
           echo 'PrivateUsers=false' | sudo tee -a raspbian_root/etc/systemd/system/redis-server.service.d/ncp-ci.conf
 
-          sudo mkdir -p raspbian_root/etc/systemd/system/php8.3-fpm.service.d
-          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp-ci.conf
-          echo 'ExecStartPre=mkdir -p /var/run/php' | sudo tee -a raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp-ci.conf
+          sudo mkdir -p raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d
+          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d/ncp-ci.conf
+          echo 'ExecStartPre=mkdir -p /var/run/php' | sudo tee -a raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d/ncp-ci.conf
+
+          # Disable ImportCredential and LoadCredential directives to workaround https://gitlab.com/qemu-project/qemu/-/work_items/1962
+          # see https://github.com/systemd/systemd/issues/31219#issuecomment-2846006948
+          for i in raspbian_root/usr/lib/systemd/system/*.service
+          do
+            [[ -f $i ]] || continue
+          	grep -q '^ImportCredential=' "$i" && {
+          	  sudo mkdir -p "${i/usr\/lib/etc}.d"
+          	  echo -e '[Service]\nImportCredential=' | sudo tee "${i/usr\/lib/etc}.d/unset-ImportCredential.conf"
+            }
+            grep -q '^LoadCredenital=' "$i" && {
+          	  sudo mkdir -p "${i/usr\/lib/etc}.d"
+          	  echo -e '[Service]\nLoadCredential=' | sudo tee "${i/usr\/lib/etc}.d/unset-LoadCredential.conf"
+            }
+          done
       - name: Test image
         id: test
         run: |
 
+          PHPVER="$(jq -r .php_version ./etc/ncp.cfg)"
+
           log_err() {
             rc="${1?}"
             msg="${2?}"
@@ -215,7 +234,7 @@ jobs:
             echo -e "${LOG_CICD} Could not reach container. Aborting..."
             "${CONTAINER_CMD[@]}" systemctl status --no-pager redis-server || :;
             "${CONTAINER_CMD[@]}" systemctl status --no-pager mariadb || :;
-            "${CONTAINER_CMD[@]}" systemctl status --no-pager php8.3-fpm || :;
+            "${CONTAINER_CMD[@]}" systemctl status --no-pager php${PHPVER}-fpm :;
             exit 1
           }
 

bin/ncp-restore

@@ -153,6 +153,7 @@ sed -i "s|'datadirectory' =>.*|'datadirectory' => '${DATADIR}',|" "${NCDIR}"/con
 
 # Just in case we moved the opcache dir
 install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+systemctl reload "php${PHPVER}-fpm"
 
 # tmp upload dir
 mkdir -p "$DATADIR/tmp"

bin/ncp-update-nc.d/update-nc.sh

@@ -258,6 +258,12 @@ elif ! is_more_recent_than "29.0.0" "${NCVER}" && is_more_recent_than "8.3.0" "$
 then
   /usr/local/bin/ncp-update-nc.d/upgrade-php-bookworm-8.3.sh
 
+  # Reload library.sh to reset PHPVER
+  source /usr/local/etc/library.sh
+elif ! is_more_recent_than "33.0.0" "${NCVER}" && is_more_recent_than "8.5.0" "${PHPVER}.0" && [[ "$DEBIAN_VERSION" -ge 13 ]]
+then
+  /usr/local/bin/ncp-update-nc.d/upgrade-php-trixie-8.5.sh
+
   # Reload library.sh to reset PHPVER
   source /usr/local/etc/library.sh
 fi

bin/ncp-update-nc.d/upgrade-php-trixie-8.5.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+source /usr/local/etc/library.sh
+
+echo "Upgrading PHP..."
+export DEBIAN_FRONTEND=noninteractive
+PHPVER_OLD="$PHPVER"
+PHPVER_NEW="8.5"
+PHP_PACKAGES_OLD=("php${PHPVER_OLD}" \
+  "php${PHPVER_OLD}"-{curl,gd,fpm,cli,opcache,mbstring,xml,zip,fileinfo,ldap,intl,bz2,mysql,bcmath,gmp,redis,common,apcu})
+PHP_PACKAGES_NEW=("php${PHPVER_NEW}" \
+  "php${PHPVER_NEW}"-{curl,gd,fpm,cli,mbstring,xml,zip,fileinfo,ldap,intl,bz2,mysql,bcmath,gmp,redis,common,apcu})
+
+php_restore() {
+  trap "" INT TERM HUP ERR
+  echo "Something went wrong while upgrading PHP. Rolling back to version ${PHPVER_OLD}..."
+  set +e
+  service "php${PHPVER_NEW}-fpm" stop
+  a2disconf php${PHPVER_NEW}-fpm
+  wget -O /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
+  dpkg -i /tmp/debsuryorg-archive-keyring.deb
+  echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list
+  apt-get update
+  apt-get remove --purge -y "${PHP_PACKAGES_NEW[@]}"
+  apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_OLD[@]}"
+  set_ncpcfg "php_version" "${PHPVER_OLD}"
+  install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_OLD}/mods-available/opcache.ini"
+  phpenmod -v "${PHPVER_OLD}" -s fpm opcache
+  run_app nc-limits
+  a2enconf "php${PHPVER_OLD}-fpm"
+  service "php${PHPVER_OLD}-fpm" start
+  service apache2 restart
+  echo "PHP upgrade has been successfully reverted"
+  set -e
+}
+
+trap php_restore INT TERM HUP ERR
+
+apt-get update
+
+clear_opcache
+
+echo "Stopping apache and  php-fpm..."
+service "php${PHPVER_OLD}-fpm" stop
+service apache2 stop
+
+echo "Remove old PHP (${PHPVER_OLD})..."
+a2disconf "php${PHPVER_OLD}-fpm"
+
+apt-get remove --purge -y "${PHP_PACKAGES_OLD[@]}"
+
+echo "Install PHP ${PHPVER_NEW}..."
+install_with_shadow_workaround --no-install-recommends systemd
+apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_NEW[@]}"
+
+set_ncpcfg "php_version" "${PHPVER_NEW}"
+install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_NEW}/mods-available/opcache.ini"
+phpenmod -v "${PHPVER_NEW}" -s fpm opcache
+( set -e; export PHPVER="${PHPVER_NEW}"; run_app nc-limits )
+
+a2enconf "php${PHPVER_NEW}-fpm"
+
+install_template "systemd/php-fpm.service.d.ncp.conf.sh" "/etc/systemd/system/php${PHPVER_NEW}-fpm.service.d/ncp.conf"
+
+echo "Starting apache and php-fpm..."
+service "php${PHPVER_NEW}-fpm" start
+service apache2 start
+ncc status

bin/ncp/CONFIG/nc-datadir.sh

@@ -142,6 +142,7 @@ configure()
   # opcache dir
   create_opcache_dir
   install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+  systemctl reload "php${PHPVER}-fpm"
 
   # update fail2ban logpath
   [[ -f /etc/fail2ban/jail.local ]] && \

bin/ncp/CONFIG/nc-init.sh

@@ -195,7 +195,7 @@ EOF
   ncc config:system:set jpeg_quality --value 60
 
   # other
-  ncc config:system:set serverid --value="$((RANDOM % 1024))" --type=integer
+  ncc config:system:set serverid --value="$((RANDOM % 512))" --type=integer
   ncc config:system:set overwriteprotocol --value=https
   ncc config:system:set overwrite.cli.url --value="https://nextcloudpi/"
 

bin/ncp/CONFIG/nc-nextcloud.sh

@@ -180,10 +180,12 @@ configure()
   if [[ -z "${OPCACHEDIR}" ]]
   then
     install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini" --defaults
+    systemctl reload "php${PHPVER}-fpm"
   else
     mkdir -p "$OPCACHEDIR"
     chown -R www-data:www-data "$OPCACHEDIR"
     install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+    systemctl reload "php${PHPVER}-fpm"
   fi
 
   ## RE-CREATE DATABASE TABLE

build/build-LXD.sh

@@ -39,7 +39,7 @@ LXC_CMD=(lxc)
 "${LXC_CMD[@]}" info || LXC_CMD=(sudo "${LXC_CMD[0]}")
 
 "${LXC_CMD[@]}" delete -f ncp 2>/dev/null || true
-LXC_CREATE=("${LXC_CMD[@]}" init -p default)
+LXC_CREATE=("${LXC_CMD[@]}" init -p default -c security.nesting=true)
 [[ -n "$LXD_EXTRA_PROFILE" ]] && LXC_CREATE+=(-p "$LXD_EXTRA_PROFILE")
 if [[ -n "$LXD_ARCH" ]] && [[ "$LXD_ARCH" != "x86" ]]
 then

etc/library.sh

@@ -256,7 +256,7 @@ install_template() {
   local target="${2?}"
   local bkp="$(mktemp)"
 
-  echo "Installing template '$template'..."
+  echo "Installing template '$template' to '$target'..."
 
   mkdir -p "$(dirname "$target")"
   [[ -f "$target" ]] && cp -a "$target" "$bkp"

etc/ncp-config.d/nc-nextcloud.cfg

@@ -9,7 +9,7 @@
     {
       "id": "VER",
       "name": "Version",
-      "value": "33.0.2"
+      "value": "34.0.2"
     },
     {
       "id": "MAXFILESIZE",

etc/ncp-templates/php/opcache.ini.sh

@@ -23,10 +23,12 @@ mkdir -p "$TMP_DIR"
 
 cat <<EOF
 zend_extension=opcache.so
+
+[opcache]
 opcache.enable=1
 opcache.enable_cli=0
 opcache.fast_shutdown=1
-opcache.interned_strings_buffer=12
+opcache.interned_strings_buffer=32
 opcache.max_accelerated_files=10000
 opcache.memory_consumption=128
 opcache.save_comments=1

etc/ncp.cfg

@@ -1,5 +1,5 @@
 {
-	"nextcloud_version": "33.0.2",
-	"php_version": "8.3",
+	"nextcloud_version": "34.0.2",
+	"php_version": "8.5",
 	"release": "trixie"
 }

lamp.sh

@@ -39,7 +39,7 @@ install()
 
     # Create systemd users to keep uids persistent between containers
     install_with_shadow_workaround --no-install-recommends systemd
-    $APTINSTALL -t $RELEASE php${PHPVER} php${PHPVER}-curl php${PHPVER}-gd php${PHPVER}-fpm php${PHPVER}-cli php${PHPVER}-opcache \
+    $APTINSTALL -t $RELEASE php${PHPVER} php${PHPVER}-curl php${PHPVER}-gd php${PHPVER}-fpm php${PHPVER}-cli \
                             php${PHPVER}-mbstring php${PHPVER}-xml php${PHPVER}-zip php${PHPVER}-fileinfo php${PHPVER}-ldap \
                             php${PHPVER}-intl php${PHPVER}-bz2 php${PHPVER}-apcu
 
@@ -65,6 +65,8 @@ install()
     ##########################################
 
     install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini" --defaults
+    phpenmod -v "${PHPVER}" -s fpm opcache
+    systemctl reload "php${PHPVER}-fpm"
 
     # systemd drop-in: allow write access to NCP paths blocked by ProtectSystem=full
     mkdir -p /var/www/ncp-web
@@ -120,6 +122,11 @@ y
 y
 y
 EOF
+
+  php --version | grep "PHP ${PHPVER}" || {
+    echo "Unexpected default PHP version (expected: ${PHPVER})!"
+    return 1
+  }
 }
 
 configure() { :; }

ncp-app/appinfo/info.xml

@@ -12,7 +12,7 @@
     <category>tools</category>
     <bugs>https://github.com/nextcloud/nextcloudpi/issues</bugs>
     <dependencies>
-        <nextcloud min-version="22" max-version="33"/>
+        <nextcloud min-version="22" max-version="34"/>
     </dependencies>
     <navigations>
         <navigation>