OpenCloud - Revision history

Krispyfi: /* Nginx */ Won't work without proxy_set_header

2026-04-16T14:15:10Z

Nginx: Won't work without proxy_set_header

← Older revision		Revision as of 14:15, 16 April 2026
Line 29:		Line 29:
	proxyPass = "http://127.0.0.1:9200";		proxyPass = "http://127.0.0.1:9200";
	proxyWebsockets = true;		proxyWebsockets = true;
			extraConfig = ''
			proxy_set_header Host $host;
			'';
	};		};
	};		};

Krispyfi: /* OpenCloud */ Inital password env variable is now "IDM_ADMIN_PASSWORD"

2026-04-16T14:13:52Z

OpenCloud: Inital password env variable is now "IDM_ADMIN_PASSWORD"

← Older revision		Revision as of 14:13, 16 April 2026
Line 3:		Line 3:
	==== OpenCloud ====		==== OpenCloud ====
	The snippet below enables the [https://github.com/opencloud-eu OpenCloud] service and disables TLS between the proxy and OpenCloud (only recommended when using together with a reverse proxy, see below)<syntaxhighlight lang="nix">		The snippet below enables the [https://github.com/opencloud-eu OpenCloud] service and disables TLS between the proxy and OpenCloud (only recommended when using together with a reverse proxy, see below)<syntaxhighlight lang="nix">
			environment.etc."opencloud-admin-pass".text = ''
			IDM_ADMIN_PASSWORD=secure-password
			'';
	services.opencloud = {		services.opencloud = {
	enable = true;		enable = true;
Line 10:		Line 13:
	environment = {		environment = {
	PROXY_TLS = "false"; # disable https when behind reverse-proxy		PROXY_TLS = "false"; # disable https when behind reverse-proxy
	~~INITIAL_ADMIN_PASSWORD = "secure-password";~~
	};		};
			environmentFile = "/etc/opencloud-admin-pass";
	};		};

Lhf: Forward radicale traffic through opencloud instead of nginx. The previous configuration allowed anyone to query the public endpoint and override the remote user header. This edit matches: https://github.com/opencloud-eu/opencloud-compose/blob/main/config/radicale/config https://github.com/opencloud-eu/opencloud-compose/blob/main/config/opencloud/proxy.yaml

2026-04-01T14:30:30Z

Forward radicale traffic through opencloud instead of nginx. The previous configuration allowed anyone to query the public endpoint and override the remote user header. This edit matches: https://github.com/opencloud-eu/opencloud-compose/blob/main/config/radicale/config https://github.com/opencloud-eu/opencloud-compose/blob/main/config/opencloud/proxy.yaml

@@ Line 17: / Line 17: @@
 ==== Nginx ====
-This snippet enables the Nginx endpoint for OpenCloud and a Radicale service.
+This snippet enables the Nginx endpoint for OpenCloud.
 <syntaxhighlight lang="nix">
    services.nginx.virtualHosts = {
      "cloud.your.domain" = {
        enableACME = true;
        forceSSL = true;
-       locations = {
+       locations."/" = {
-        # Endpoint for OpenCloud
+        proxyPass = "http://127.0.0.1:9200";
-        "/" = {
+        proxyWebsockets = true;
        };
      };
    };
 </syntaxhighlight>
 ==== Radicale ====
-To use OpenCloud with CalDAV we need to enable the [https://github.com/Kozea/Radicale Radicale] service.<syntaxhighlight lang="nix">
+OpenCloud doesn't natively support CalDAV and CardDAV but can serve as a proxy to a Radicale service.
    services.radicale = {
      enable = true;
@@ Line 75: / Line 79: @@
        };
        auth = {
-         type = "http_x_remote_user"; # disable authentication, and use the username that OpenCloud provides is
+         type = "http_x_remote_user"; # disable authentication, and use the username that OpenCloud provides
        };
        web = {
@@ Line 82: / Line 86: @@
        storage = {
          filesystem_folder = "/var/lib/radicale/collections";
        };
        logging = {

Vagahbond: I added a section for people wanting to install Collabora Online and extra fonts on OpenCloud, as it is tricky.

2026-03-26T20:17:41Z

I added a section for people wanting to install Collabora Online and extra fonts on OpenCloud, as it is tricky.

@@ Line 92: / Line 92: @@
      };
    };
 </syntaxhighlight>

O5-J: Correct duplicates of 'CalDAV' when it should be 'CardDav'

2026-01-27T16:42:42Z

Correct duplicates of 'CalDAV' when it should be 'CardDav'

← Older revision		Revision as of 16:42, 27 January 2026
Line 48:		Line 48:
	proxyPass = "http://127.0.0.1:5232";		proxyPass = "http://127.0.0.1:5232";
	extraConfig = "		extraConfig = "
	proxy_set_header X-Remote-User $remote_user; # provide username to ~~CalDAV~~		proxy_set_header X-Remote-User $remote_user; # provide username to CardDAV
	proxy_set_header X-Script-Name /carddav;		proxy_set_header X-Script-Name /carddav;
	";		";
Line 55:		Line 55:
	proxyPass = "http://127.0.0.1:5232";		proxyPass = "http://127.0.0.1:5232";
	extraConfig = "		extraConfig = "
	proxy_set_header X-Remote-User $remote_user; # provide username to ~~CalDAV~~		proxy_set_header X-Remote-User $remote_user; # provide username to CardDAV
	proxy_set_header X-Script-Name /carddav;		proxy_set_header X-Script-Name /carddav;
	";		";

Jooooscha: Add links to OpenCloud and Radicale

2026-01-26T12:44:23Z

Add links to OpenCloud and Radicale

← Older revision		Revision as of 12:44, 26 January 2026
Line 2:		Line 2:

	==== OpenCloud ====		==== OpenCloud ====
	The snippet below enables the OpenCloud service and disables TLS between the proxy and OpenCloud (only recommended when using together with a reverse proxy, see below)<syntaxhighlight lang="nix">		The snippet below enables the [https://github.com/opencloud-eu OpenCloud] service and disables TLS between the proxy and OpenCloud (only recommended when using together with a reverse proxy, see below)<syntaxhighlight lang="nix">
	services.opencloud = {		services.opencloud = {
	enable = true;		enable = true;
Line 66:		Line 66:

	==== Radicale ====		==== Radicale ====
	To use OpenCloud with CalDAV we need to enable the Radicale service.<syntaxhighlight lang="nix">		To use OpenCloud with CalDAV we need to enable the [https://github.com/Kozea/Radicale Radicale] service.<syntaxhighlight lang="nix">
	services.radicale = {		services.radicale = {
	enable = true;		enable = true;

Jooooscha: Add example for setting up OpenCloud together with Radicale as CalDAV backend

2026-01-26T12:43:16Z

Add example for setting up OpenCloud together with Radicale as CalDAV backend

New page

=== Installation and Configuration ===

==== OpenCloud ====
The snippet below enables the OpenCloud service and disables TLS between the proxy and OpenCloud (only recommended when using together with a reverse proxy, see below)<syntaxhighlight lang="nix">
services.opencloud = {
enable = true;
url = "https://cloud.your.domain";
address = "127.0.0.1";
port = port;
environment = {
PROXY_TLS = "false"; # disable https when behind reverse-proxy
INITIAL_ADMIN_PASSWORD = "secure-password";
};
};

</syntaxhighlight>

==== Nginx ====
This snippet enables the Nginx endpoint for OpenCloud and a Radicale service.

OpenCloud itself does not have support for CalDAV/CardDAV but it integrates well with Radicale.<syntaxhighlight lang="nix">
services.nginx.virtualHosts = {
"cloud.your.domain" = {
enableACME = true;
forceSSL = true;
locations = {
# Endpoint for OpenCloud
"/" = {
proxyPass = "http://127.0.0.1:9200";
proxyWebsockets = true;
};
# Radicale endpoints for CalDAV and CardDAV
"/caldav/" = {
proxyPass = "http://127.0.0.1:5232";
extraConfig = "
proxy_set_header X-Remote-User $remote_user; # provide username to CalDAV
proxy_set_header X-Script-Name /caldav;
";
}
"/.well-known/caldav" = {
proxyPass = "http://127.0.0.1:5232";
extraConfig = "
proxy_set_header X-Remote-User $remote_user; # provide username to CalDAV
proxy_set_header X-Script-Name /caldav;
";
}
"/carddav/" = {
proxyPass = "http://127.0.0.1:5232";
extraConfig = "
proxy_set_header X-Remote-User $remote_user; # provide username to CalDAV
proxy_set_header X-Script-Name /carddav;
";
}
"/.well-known/carddav/" = {
proxyPass = "http://127.0.0.1:5232";
extraConfig = "
proxy_set_header X-Remote-User $remote_user; # provide username to CalDAV
proxy_set_header X-Script-Name /carddav;
";
}
};
};
};

</syntaxhighlight>

==== Radicale ====
To use OpenCloud with CalDAV we need to enable the Radicale service.<syntaxhighlight lang="nix">
services.radicale = {
enable = true;
settings = {
server = {
hosts = [ "127.0.0.1:5232" ];
ssl = false; # disable SSL, only use when behind reverse proxy
};
auth = {
type = "http_x_remote_user"; # disable authentication, and use the username that OpenCloud provides is
};
web = {
type = "none";
};
storage = {
filesystem_folder = "/var/lib/radicale/collections";
};
logging = {
level = "debug"; # optional, enable debug logging
bad_put_request_content = true; # only if level=debug
request_header_on_debug = true; # only if level=debug
request_content_on_debug = true; # only if level=debug
response_content_on_debug = true; # only if level=debug
};
};
};

</syntaxhighlight>