media/nextcloud/.env.example

@@ -4,3 +4,6 @@ TZ=America/Chicago
 PORT=8443
 MYSQL_ROOT_PASSWORD=changeme
 DATABASE_PASSWORD=changeme
+NEXTCLOUD_DOMAIN=nextcloud.example.com
+COLLABORA_ADMIN_USER=admin
+COLLABORA_ADMIN_PASSWORD=changeme

media/nextcloud/docker-compose.yml

@@ -33,6 +33,20 @@ services:
             - ./db:/config
         restart: unless-stopped
 
+    collabora:
+        image: collabora/code
+        container_name: collabora
+        environment:
+            - domain=${NEXTCLOUD_DOMAIN}
+            - username=${COLLABORA_ADMIN_USER}
+            - password=${COLLABORA_ADMIN_PASSWORD}
+            - extra_params=--o:ssl.enable=false --o:ssl.termination=true
+        cap_add:
+            - MKNOD
+        restart: unless-stopped
+        networks:
+            - traefik_portal
+
 networks:
     traefik_portal:
         external: true

tools/wireguard/traefik/dynamic.yml

@@ -19,6 +19,13 @@ http:
                 customRequestHeaders:
                     X-Forwarded-Proto: "https"
 
+        # Nextcloud headers to prevent man in the middle attacks
+        hsts:
+            headers:
+                stsSeconds: 15552000
+                stsIncludeSubdomains: true
+                stsPreload: true
+
     serversTransports:
         # Use this for backend containers that use self-signed TLS certs
         # (e.g. Nextcloud). Reference it in a service with:
@@ -46,6 +53,7 @@ http:
             service: my-service-with-headers
             middlewares:
                 - https-headers
+                - hsts
             tls:
                 certResolver: letsencrypt
 
@@ -74,6 +82,7 @@ http:
                 servers:
                     - url: "https://container-name:PORT" # <-- change container name and port
                 serversTransport: insecure-transport
+
     # -------------------------------------------------------------------------
 
 # =============================================================================