Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

replace apache with a second caddy #7006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Zoey2936 wants to merge 4 commits into main
base: main
Choose a base branch
Loading
from replace-apache-with-caddy
Open

Conversation

@Zoey2936
Copy link
Collaborator

@Zoey2936 Zoey2936 commented Oct 17, 2025

Signed-off-by: Zoey zoey@z0ey.de

see #6998

Copy link
Collaborator

@szaimen szaimen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, thanks for working on this! I have an initial comment below. Will look more into detail into this next week.

@Zoey2936 Zoey2936 force-pushed the replace-apache-with-caddy branch 2 times, most recently from 59e4a6c to 0664ec8 Compare October 17, 2025 19:30
Comment on lines -334 to -346
# Don't allow access to the AIO interface from the Nextcloud container
# Probably more cosmetic than anything but at least an attempt
if ! grep -q '# nextcloud-aio-block' /etc/apache2/httpd.conf; then
cat << APACHE_CONF >> /etc/apache2/httpd.conf
# nextcloud-aio-block-start
<Location />
order allow,deny
deny from nextcloud-aio-nextcloud.nextcloud-aio
allow from all
</Location>
# nextcloud-aio-block-end
APACHE_CONF
fi
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do something comparable with caddy?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could resolve the ip for example with dig and block the ip(s) we get

Copy link
Collaborator

@szaimen szaimen Oct 23, 2025
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could resolve the ip for example with dig and block the ip(s) we get

I fear this is not going to work as the ip-addresses of the nextcloud-aio-nextcloud container might change or might not exist when the mastercontainer starts. Is there any other way to do this?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think not

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like there is a caddy plugin that could do this: https://github.com/muety/caddy-remote-host

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth recompiling caddy for this? also the last commit is 4 years ago, so is it still compatible with latest caddy?

sed -i 's|;listen.allowed_clients.*|listen.allowed_clients = 127.0.0.1,::1|' /usr/local/etc/php-fpm.d/www.conf; \
grep -q 'listen =' /usr/local/etc/php-fpm.d/www.conf; \
sed -i 's|listen =.*|;listen = /run/php.sock # handled in zz-docker.conf|' /usr/local/etc/php-fpm.d/www.conf; \
grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
grep -q 'listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \
grep -q '^listen =' /usr/local/etc/php-fpm.d/zz-docker.conf; \

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only for the zz-docker.conf?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd say so, yes. Or we comment listen in zz-docker and add listen to the www-conf which might be better

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

currently it is set twice:

/var/www/html # grep -r /usr/local/etc/ -e "listen\s="
/usr/local/etc/php-fpm.d/www.conf.default:listen = 127.0.0.1:9000
/usr/local/etc/php-fpm.d/www.conf.default:;pm.status_listen = 127.0.0.1:9001
/usr/local/etc/php-fpm.d/www.conf:listen = 127.0.0.1:9000
/usr/local/etc/php-fpm.d/www.conf:;pm.status_listen = 127.0.0.1:9001
/usr/local/etc/php-fpm.d/zz-docker.conf:listen = 9000

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in zz-docker.conf and www.conf, files ending with .default are ignored by fpm

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hm... lets maybe only set it in www.conf and comment it in zz-docker.conf

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you adjust this please/create a suggestion?

@szaimen szaimen added 2. developing Work in progress enhancement New feature or request labels Oct 20, 2025
@szaimen szaimen modified the milestone: next Oct 20, 2025
@szaimen szaimen force-pushed the replace-apache-with-caddy branch from 0664ec8 to bf02678 Compare October 20, 2025 13:00
Copy link
Collaborator

szaimen commented Oct 20, 2025
edited
Loading

@Zoey2936 please also update

- An Apache service for accessing the AIO interface via a self-signed HTTPS VirtualHost on 8080/tcp
Thanks in advance! :)

Signed-off-by: Zoey <zoey@z0ey.de>
Copy link
Collaborator Author

@Zoey2936 please also update

- An Apache service for accessing the AIO interface via a self-signed HTTPS VirtualHost on 8080/tcp

Thanks in advance! :)

should be done

szaimen reacted with heart emoji

Signed-off-by: Zoey <zoey@z0ey.de>
Signed-off-by: Zoey <zoey@z0ey.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@szaimen szaimen szaimen left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

2. developing Work in progress enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

AltStyle によって変換されたページ (->オリジナル) /