feat: add file_lock and notify_push configuration to nextcloud role

Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>

roles/nextcloud/defaults/main.yml

@@ -53,6 +53,12 @@ nextcloud_upload_limit_mb: 2048
 
 nextcloud_scale_factor: 2
 
+# Trusted proxies (Docker internal networks)
+nextcloud_trusted_proxies: "172.16.0.0/12"
+
+# File locking and real-time push notifications
+nextcloud_enable_notify_push: false
+
 # Non-default apps to install and enable
 nextcloud_apps_to_install:
   - groupfolders
@@ -61,6 +67,8 @@ nextcloud_apps_to_install:
   - user_ldap
   - user_oidc
   - whiteboard
+  - files_lock
+  - notify_push
 
 # OIDC provider configuration
 nextcloud_oidc_allow_selfsigned: false  # Set to true to disable SSL verification for OIDC providers (dev only)

roles/nextcloud/tasks/main.yml

@@ -74,6 +74,10 @@
   ansible.builtin.include_tasks: drawio.yml
   when: nextcloud_enable_drawio
 
+- name: Configure notify_push
+  ansible.builtin.include_tasks: notify_push.yml
+  when: nextcloud_enable_notify_push
+
 - name: Configure LDAP backend
   ansible.builtin.include_tasks: ldap.yml
   when: nextcloud_ldap_enabled

roles/nextcloud/tasks/notify_push.yml

@@ -0,0 +1,8 @@
+#SPDX-License-Identifier: MIT-0
+---
+# tasks file for configuring notify_push in Nextcloud
+
+- name: Configure notify_push base endpoint
+  community.docker.docker_container_exec:
+    container: "{{ nextcloud_docker_compose_dir | basename }}-nextcloud-1"
+    command: php /var/www/html/occ notify_push:setup https://{{ nextcloud_domain }}/push

roles/nextcloud/templates/docker-compose.yml.j2

@@ -61,7 +61,7 @@ services:
       PHP_UPLOAD_LIMIT: {{  nextcloud_upload_limit_mb }}M
       OVERWRITEPROTOCOL: https
       OVERWRITEHOST: {{ nextcloud_domain }}
-      TRUSTED_PROXIES: "172.18.0.0/16 172.16.9.88/16 172.16.17.0/24 172.16.9.88"
+      TRUSTED_PROXIES: "{{ nextcloud_trusted_proxies }}"
     volumes:
       - {{ nextcloud_docker_volume_dir }}/nextcloud/:/var/www/html
     networks:
@@ -86,7 +86,7 @@ services:
       PHP_UPLOAD_LIMIT: {{  nextcloud_upload_limit_mb }}M
       OVERWRITEPROTOCOL: https
       OVERWRITEHOST: {{ nextcloud_domain }}
-      TRUSTED_PROXIES: "172.18.0.0/16 172.16.9.88/16 172.16.17.0/24 172.16.9.88"
+      TRUSTED_PROXIES: "{{ nextcloud_trusted_proxies }}"
 {% if nextcloud_use_s3_storage %}
       OBJECTSTORE_S3_KEY: {{ nextcloud_s3_key }}
       OBJECTSTORE_S3_SECRET: {{ nextcloud_s3_secret }}
@@ -109,6 +109,39 @@ services:
 {% endfor %}
 {% endif %}
 
+{% if nextcloud_enable_notify_push %}
+  notify-push:
+    image: icewind1991/notify_push
+    restart: always
+    depends_on:
+      - redis
+      - db
+    volumes:
+      - {{ nextcloud_docker_volume_dir }}/nextcloud/:/var/www/html
+    environment:
+      PORT: "7867"
+      REDIS_URL: "redis://redis:6379"
+      DATABASE_URL: "postgres://{{ nextcloud_postgres_user }}:{{ nextcloud_postgres_password }}@db:5432/{{ nextcloud_postgres_db }}"
+      DATABASE_PREFIX: "oc_"
+      NEXTCLOUD_URL: "http://nginx"
+    networks:
+      - {{ nextcloud_backend_network }}
+      - {{ nextcloud_traefik_network }}
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network={{ nextcloud_traefik_network }}
+      - traefik.http.routers.{{ nextcloud_service_name }}-push.rule=Host(`{{ nextcloud_domain }}`) && PathPrefix(`/push`)
+      - traefik.http.services.{{ nextcloud_service_name }}-push.loadbalancer.server.port=7867
+{% if nextcloud_use_ssl %}
+      - traefik.http.routers.{{ nextcloud_service_name }}-push.entrypoints=websecure
+      - traefik.http.routers.{{ nextcloud_service_name }}-push.tls=true
+{% else %}
+      - traefik.http.routers.{{ nextcloud_service_name }}-push.entrypoints=web
+{% endif %}
+      - traefik.http.middlewares.{{ nextcloud_service_name }}-push-https.headers.customrequestheaders.X-Forwarded-Proto=https
+      - traefik.http.routers.{{ nextcloud_service_name }}-push.middlewares={{ nextcloud_service_name }}-push-https
+{% endif %}
+
 networks:
   {{ nextcloud_backend_network }}:
   {{ nextcloud_traefik_network }}: