#!/usr/bin/env bash
#
# Nextcloud with Euro-Office on Proxmox: one VM, Docker Compose and a Cloudflare Tunnel
# https://www.zadran.net/guides/nextcloud-euro-office-proxmox-cloudflare-tunnel
# Generated from the guide, last updated 2026-10-18.
#
# NO WARRANTY. This script is provided as is. You are responsible for
# understanding what it does before running it, and for the consequences.
# Take a backup first. See https://www.zadran.net/disclaimer
#
# Destructive steps are left commented out on purpose -- uncomment them
# only once you have understood what they do.
#
# Where the guide writes a file with <<'EOF' and your values are in it,
# this script uses <<EOF so that they expand. Every other $, ` and \
# gets a backslash, so the rest comes out exactly as the guide shows it.
#
# These are the guide's bash commands. Its PowerShell commands are in
# https://www.zadran.net/guides/nextcloud-euro-office-proxmox-cloudflare-tunnel/script.ps1

set -euo pipefail

# ---- Set these for your environment ----
# A free ID on your Proxmox host
VMID='120'
# Where the VM disks go (thin storage recommended)
STORAGE='local-lvm'
# The bridge of your LAN
BRIDGE='vmbr0'
# Room for files and the database
DATA_DISK_GB='500'
# Created by cloud-init, used for SSH
VM_USER='admin1'
# A free fixed IP in your LAN
VM_IP='192.168.1.50'
# Usually your router
GATEWAY='192.168.1.1'
# Space-separated, your local DNS
DNS_SERVERS='192.168.1.2 192.168.1.3'
# Your local domain
SEARCH_DOMAIN='home.example.com'
# Where the Cloudflare connector runs
LAN_SUBNET='192.168.1.0/24'
# Public name for Nextcloud
NC_DOMAIN='cloud.example.com'
# Two-letter country code
PHONE_REGION='DE'

echo 'ssh-ed25519 AAAA...your-line...' > /root/${VM_USER}.pub

cd /root
wget https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.qcow2

VMID=${VMID}
qm create $VMID --name nextcloud --ostype l26 --machine q35 \
  --cpu host --cores 4 --memory 8192 --balloon 0 --agent 1 \
  --scsihw virtio-scsi-single --net0 virtio,bridge=${BRIDGE},firewall=1 \
  --serial0 socket --vga serial0 --onboot 1
qm set $VMID --scsi0 ${STORAGE}:0,import-from=/root/debian-13-genericcloud-amd64.qcow2,discard=on,iothread=1,ssd=1
qm resize $VMID scsi0 32G
qm set $VMID --scsi1 ${STORAGE}:${DATA_DISK_GB},discard=on,iothread=1,ssd=1
qm set $VMID --ide2 ${STORAGE}:cloudinit --boot order=scsi0
qm set $VMID --ciuser ${VM_USER} --ipconfig0 ip=${VM_IP}/24,gw=${GATEWAY} \
  --nameserver "${DNS_SERVERS}" --searchdomain ${SEARCH_DOMAIN}
qm set $VMID --sshkeys /root/${VM_USER}.pub
qm start $VMID

sudo apt update && sudo apt -y full-upgrade && sudo apt -y install qemu-guest-agent && sudo systemctl enable --now qemu-guest-agent

lsblk
sudo mkfs.ext4 -L ncdata /dev/sdb
sudo mkdir -p /srv/nextcloud
echo 'LABEL=ncdata /srv/nextcloud ext4 defaults,noatime,discard 0 2' | sudo tee -a /etc/fstab
sudo systemctl daemon-reload && sudo mount -a
df -h /srv/nextcloud

sudo apt -y install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update && sudo apt -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo usermod -aG docker ${VM_USER}
exit

docker run --rm hello-world | grep "Hello from Docker"
docker compose version

cd /srv/nextcloud
sudo chown ${VM_USER}:${VM_USER} /srv/nextcloud
mkdir -p db html data
sudo chown 33:33 data && sudo chmod 0770 data

cat > .env <<EOF
POSTGRES_PASSWORD=$(openssl rand -hex 24)
NC_ADMIN_PASSWORD=$(openssl rand -base64 18)
EO_JWT_SECRET=$(openssl rand -hex 32)
EOF
chmod 600 .env

echo 'Header always set Strict-Transport-Security "max-age=15552000"' > hsts.conf

cat > compose.yaml <<EOF
services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
    volumes:
      - ./db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nextcloud -d nextcloud"]
      interval: 10s
      retries: 10

  redis:
    image: redis:7-alpine
    restart: unless-stopped

  app:
    image: nextcloud:stable-apache
    restart: unless-stopped
    depends_on:
      db: {condition: service_healthy}
      redis: {condition: service_started}
    ports:
      - "8080:80"
    environment:
      POSTGRES_HOST: db
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
      REDIS_HOST: redis
      NEXTCLOUD_ADMIN_USER: admin
      NEXTCLOUD_ADMIN_PASSWORD: \${NC_ADMIN_PASSWORD}
      NEXTCLOUD_TRUSTED_DOMAINS: ${NC_DOMAIN} ${VM_IP}
      TRUSTED_PROXIES: ${LAN_SUBNET}
      OVERWRITECLIURL: https://${NC_DOMAIN}
      PHP_MEMORY_LIMIT: 1G
      PHP_UPLOAD_LIMIT: 10G
    volumes:
      - ./html:/var/www/html
      - ./data:/var/www/html/data
      - ./hsts.conf:/etc/apache2/conf-enabled/hsts.conf:ro

  cron:
    image: nextcloud:stable-apache
    restart: unless-stopped
    entrypoint: /cron.sh
    depends_on:
      - app
    volumes:
      - ./html:/var/www/html
      - ./data:/var/www/html/data
      - ./hsts.conf:/etc/apache2/conf-enabled/hsts.conf:ro

  eurooffice:
    image: ghcr.io/euro-office/documentserver:latest
    restart: unless-stopped
    ports:
      - "8890:80"
    environment:
      JWT_ENABLED: "true"
      JWT_SECRET: \${EO_JWT_SECRET}
      ALLOW_PRIVATE_IP_ADDRESS: "true"
    volumes:
      - eo_data:/var/lib/euro-office
      - eo_logs:/var/log/euro-office

volumes:
  eo_data:
  eo_logs:
EOF

docker compose config -q && echo "compose file OK"

docker compose pull
docker compose up -d
sleep 90
docker compose ps
curl -s http://localhost:8890/healthcheck; echo " <- Euro-Office (true = OK)"
curl -s -o /dev/null -w "Nextcloud: %{http_code}\n" http://localhost:8080/status.php

grep NC_ADMIN_PASSWORD /srv/nextcloud/.env

cd /srv/nextcloud
occ() { docker compose exec -u www-data app php occ "$@"; }
occ app:install eurooffice

occ config:system:get trusted_domains

occ config:system:set trusted_domains 3 --value=app
occ config:system:get trusted_domains

cd /srv/nextcloud
occ() { docker compose exec -u www-data app php occ "$@"; }
occ background:cron
occ config:system:set default_phone_region --value=${PHONE_REGION}
occ config:system:set maintenance_window_start --type=integer --value=1
occ config:system:set serverid --type=integer --value=1
occ db:add-missing-indices
occ maintenance:repair --include-expensive
occ app:disable app_api

occ app:install twofactor_totp

occ config:list system | grep -A3 twofactor

grep -B1 -A8 '^vzdump' /etc/pve/jobs.cfg

cd /srv/nextcloud
docker compose pull
docker compose up -d
docker compose ps