Skip to content

Commit 717ccdd

Browse files
ntninjantninja
committed
Add complete Caddy sample configuration inspired by the NGINX one
Signed-off-by: Yuki Schlarb <erin-dev@ninetailed.ninja>
1 parent 7fdc8e6 commit 717ccdd

3 files changed

Lines changed: 222 additions & 0 deletions

File tree

‎admin_manual/installation/Caddyfile.sample‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
cloud.example.com # Public server hostname
2+
3+
request_body {
4+
max_size 10G
5+
}
6+
7+
# Enable gzip but do not remove ETag headers
8+
encode {
9+
zstd
10+
gzip 4
11+
12+
minimum_length 256
13+
14+
match {
15+
header Content-Type application/atom+xml
16+
header Content-Type application/javascript
17+
header Content-Type application/json
18+
header Content-Type application/ld+json
19+
header Content-Type application/manifest+json
20+
header Content-Type application/rss+xml
21+
header Content-Type application/vnd.geo+json
22+
header Content-Type application/vnd.ms-fontobject
23+
header Content-Type application/wasm
24+
header Content-Type application/x-font-ttf
25+
header Content-Type application/x-web-app-manifest+json
26+
header Content-Type application/xhtml+xml
27+
header Content-Type application/xml
28+
header Content-Type font/opentype
29+
header Content-Type image/bmp
30+
header Content-Type image/svg+xml
31+
header Content-Type image/x-icon
32+
header Content-Type text/cache-manifest
33+
header Content-Type text/css
34+
header Content-Type text/plain
35+
header Content-Type text/vcard
36+
header Content-Type text/vnd.rim.location.xloc
37+
header Content-Type text/vtt
38+
header Content-Type text/x-component
39+
header Content-Type text/x-cross-domain-policy
40+
}
41+
}
42+
43+
# Add headers to serve security related headers
44+
header Referrer-Policy no-referrer
45+
header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"
46+
header X-Content-Type-Options nosniff
47+
header X-Download-Options noopen
48+
header X-Frame-Options SAMEORIGIN
49+
header X-Permitted-Cross-Domain-Policies none
50+
header X-Robots-Tag none
51+
header X-XSS-Protection "1; mode=block"
52+
53+
# Path to the root of your installation
54+
root * /var/www/nextcloud
55+
56+
route {
57+
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
58+
@msftdavclient {
59+
header User-Agent DavClnt*
60+
path /
61+
}
62+
redir @msftdavclient /remote.php/webdav/ temporary
63+
64+
route /robots.txt {
65+
skip_log
66+
file_server
67+
}
68+
69+
# Add exception for `/.well-known` so that clients can still access it
70+
# despite the existence of the `error @internal 404` rule which would
71+
# otherwise handle requests for `/.well-known` below
72+
route /.well-known/* {
73+
redir /.well-known/carddav /remote.php/dav/ permanent
74+
redir /.well-known/caldav /remote.php/dav/ permanent
75+
76+
@well-known-static path \
77+
/.well-known/acme-challenge /.well-known/acme-challenge/* \
78+
/.well-known/pki-validation /.well-known/pki-validation/*
79+
route @well-known-static {
80+
try_files {path} {path}/ =404
81+
file_server
82+
}
83+
84+
redir * /index.php{path} permanent
85+
}
86+
87+
@internal path \
88+
/build /build/* \
89+
/tests /tests/* \
90+
/config /config/* \
91+
/lib /lib/* \
92+
/3rdparty /3rdparty/* \
93+
/templates /templates/* \
94+
/data /data/* \
95+
\
96+
/.* \
97+
/autotest* \
98+
/occ* \
99+
/issue* \
100+
/indie* \
101+
/db_* \
102+
/console*
103+
error @internal 404
104+
105+
@assets {
106+
path *.css *.js *.svg *.gif *.png *.jpg *.jpeg *.ico *.wasm *.tflite *.map *.wasm2
107+
file {path} # Only if requested file exists on disk, otherwise /index.php will take care of it
108+
}
109+
route @assets {
110+
header /* Cache-Control "max-age=15552000" # Cache-Control policy borrowed from `.htaccess`
111+
header /*.woff2 Cache-Control "max-age=604800" # Cache-Control policy borrowed from `.htaccess`
112+
skip_log # Optional: Don't log access to assets
113+
file_server {
114+
precompressed gzip
115+
}
116+
}
117+
118+
# Rule borrowed from `.htaccess`
119+
redir /remote/* /remote.php{path} permanent
120+
121+
# Serve found static files, continuing to the PHP default handler below if not found
122+
try_files {path} {path}/
123+
file_server {
124+
pass_thru
125+
}
126+
127+
# Required for legacy support
128+
#
129+
# Rewrites all requests containing the string “.php” to be prepended by
130+
# “/index.php” unless they match a known-valid PHP file path.
131+
@unknownphppath {
132+
path /*.php /*.php/*
133+
not path \
134+
/index.php /index.php/* \
135+
/remote.php /remote.php/* \
136+
/public.php /public.php/* \
137+
/corn.php /cron.php/* \
138+
/core/ajax/update.php /core/ajax/update.php/* \
139+
/status.php /status.php/* \
140+
/ocs/v1.php /ocs/v1.php/* \
141+
/ocs/v2.php /ocs/v2.php/* \
142+
/updater/*.php /updater/*.php/* \
143+
/ocm-provider/*.php /ocm-provider/*.php/* \
144+
/ocs-provider/*.php /ocs-provider/*.php/* \
145+
/*/richdocumentscode/proxy.php /*/richdocumentscode/proxy.php/*
146+
}
147+
rewrite @unknownphppath /index.php{path}
148+
149+
# Let everything else be handled by the PHP-FPM component
150+
php_fastcgi nextcloud:9000 {
151+
env modHeadersAvailable true # Avoid sending the security headers twice
152+
env front_controller_active true # Enable pretty urls
153+
}
154+
}

‎admin_manual/installation/caddy.rst‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
===================
2+
Caddy configuration
3+
===================
4+
5+
.. warning::
6+
Please note that webservers other than Apache 2.x are not officially supported.
7+
8+
.. note::
9+
This page covers example Caddy configuration to run a Nextcloud server.
10+
These configurations examples were originally provided by
11+
`@ntninja <https://ninetailed.ninja>`_ based on the :doc:`nginx` sample and
12+
are exclusively community-maintained. (Thank you contributors!)
13+
14+
- This guide assumes you are using Caddy 2.6 or later and the presented sample
15+
configuration will not work on older versions without modification.
16+
- Caddy takes care of TLS certificate configuration and HTTP-to-HTTPS redirects
17+
automatically, so that is not covered here.
18+
- The example configuration makes use of the `route <https://caddyserver.com/docs/caddyfile/directives/route>`_
19+
directive which disables all directive reordering usually done by Caddy. This
20+
means that anything within that block should be read strictly top-to-bottom
21+
unlike what you may be used from NGINX or regular (non-route) Caddy
22+
configurations.
23+
- Be careful about line breaks if you copy the examples, as long lines may be
24+
broken for page formatting.
25+
- Some environments might need a ``cgi.fix_pathinfo`` set to ``1`` in their
26+
``php.ini``.
27+
28+
Nextcloud in the webroot of Caddy
29+
---------------------------------
30+
31+
The following configuration should be used when Nextcloud is placed in the
32+
webroot of your nginx installation. In this example it is
33+
``/var/www/nextcloud`` and it is accessed via ``http(s)://cloud.example.com/``
34+
35+
.. literalinclude:: Caddyfile.sample
36+
:language: caddy
37+
38+
..
39+
Nextcloud in a subdir of the Caddy webroot
40+
------------------------------------------
41+
42+
This section remains to be written, but should be as simple as wrapping most
43+
of the configuration example from the last section, except for the
44+
/.well-known parts, in a `handle_path /nextcloud/* { … }` block.
45+
46+
Tips and tricks
47+
---------------
48+
49+
Suppressing log messages
50+
^^^^^^^^^^^^^^^^^^^^^^^^
51+
52+
If you're seeing meaningless messages in your logfile, for example ``client
53+
denied by server configuration: /var/www/data/htaccesstest.txt``, add this
54+
section to your Caddy configuration to suppress them:
55+
56+
.. code-block:: caddy
57+
58+
route {
59+
# …
60+
61+
route /data/htaccesstest.txt {
62+
skip_log # Silences logging for the matched path
63+
file_server
64+
}
65+
66+
# …
67+
}

‎admin_manual/installation/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ Installation and server configuration
1313
apps_supported
1414
selinux_configuration
1515
nginx
16+
caddy
1617
harden_server
1718
server_tuning
1819

0 commit comments

Comments
 (0)