From 7bae05aaaa7d41d349cd9b542d14dd1c63b2079b Mon Sep 17 00:00:00 2001 From: Max Date: Sun, 23 Aug 2026 21:18:09 +0200 Subject: [PATCH 01/10] automatically build newer nextcloud versions when they have ripened half a year --- .forgejo/workflows/build_nextcloud.yml | 34 ++++++++++++++--- nextcloud/get_versions_to_be_built.py | 51 ++++++++++++++++++++++++++ 2 files changed, 80 insertions(+), 5 deletions(-) create mode 100644 nextcloud/get_versions_to_be_built.py diff --git a/.forgejo/workflows/build_nextcloud.yml b/.forgejo/workflows/build_nextcloud.yml index 4d2e866..cdf5a23 100644 --- a/.forgejo/workflows/build_nextcloud.yml +++ b/.forgejo/workflows/build_nextcloud.yml @@ -10,16 +10,40 @@ on: - cron: "@daily" jobs: - build-container: - name: Build Nextcloud ${{ matrix.nextcloud-version }} Image + get-versions: + name: Determine viable Nextcloud versions runs-on: docker + container: + image: docker.io/library/python:3.14-slim + + outputs: + versions: ${{ steps.matrix.outputs.versions }} + + steps: + - name: Install required system package + run: apt-get update; apt-get install -y --no-install-recommends --no-install-suggests nodejs + + - name: Install required pip package + run: pip install requests + + - name: Checkout source code + uses: actions/checkout@v7 + + - name: Generate Nextcloud version matrix + id: matrix + shell: sh + run: python3 ${{ forgejo.workspace }}/nextcloud/get_versions_to_be_built.py + + build-container: + name: Build Nextcloud Image + runs-on: docker + needs: get-versions container: image: ghcr.io/osscontainertools/kaniko:alpine strategy: matrix: - nextcloud-version: - # renovate: datasource=docker depName=docker.io/library/nextcloud - - 34 + nextcloud-version: ${{ fromJSON(needs.get-versions.outputs.versions) }} + steps: - name: Install required system packages run: apk add --no-cache nodejs git diff --git a/nextcloud/get_versions_to_be_built.py b/nextcloud/get_versions_to_be_built.py new file mode 100644 index 0000000..8ddc752 --- /dev/null +++ b/nextcloud/get_versions_to_be_built.py @@ -0,0 +1,51 @@ +import datetime +import json +import os +import re + +import requests + +endoflife_nextcloud_url = "https://endoflife.date/api/v1/products/nextcloud/" +ansible_nextcloud_vars_url = "https://git.hamburg.ccc.de/CCCHH/ansible-infra/raw/branch/main/inventories/chaosknoten/host_vars/cloud.yaml" +ansible_nextcloud_vars_regex = r"(?m)^\s*nextcloud__version:\s*(\d+)\s*$" + +releases_to_be_built = [] + + +# get the currently installed Nextcloud version +nc_vars = requests.get(ansible_nextcloud_vars_url).text +match = re.search(ansible_nextcloud_vars_regex, nc_vars) +if match: + current_version = int(match.group(1)) + releases_to_be_built.append(current_version) +else: + raise ValueError("nextcloud__version not found") + + +# determine the current Nextcloud versions +eol_data = requests.get(endoflife_nextcloud_url).text +eol_json = json.loads(eol_data) + +now = datetime.datetime.now() +format_string = '%Y-%m-%d' +viable_releases = [] + +for release in eol_json["result"]["releases"]: + # only check releases which are not EOL + if release['isEol'] is True: + continue + # parse release date + release_datetime = datetime.datetime.strptime(release['releaseDate'], format_string) + + # only consider releases older than half a year + if release_datetime < now - datetime.timedelta(days=180): + version = int(release['name']) + print(f"{version} released on {release['releaseDate']}") + if version > current_version: + releases_to_be_built.append(version) + +versions = [str(v) for v in releases_to_be_built] +print(versions) + +with open(os.environ["FORGEJO_OUTPUT"], "a") as output: + output.write(f"versions={json.dumps(versions)}\n") From f90c145538908a477f7cab1abc3ebab54818bd13 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 25 Aug 2026 18:41:11 +0200 Subject: [PATCH 02/10] Build minor version Until we figure out what the breaking changes in 26.7 might be --- .forgejo/workflows/build_keycloak.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index fc0f723..9c26874 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -20,6 +20,7 @@ jobs: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - 26.7.2 + - 26.6.4 # until we are sure we can go to 26.7 steps: - name: Install required system packages run: apk add --no-cache nodejs From 732c6db9bff3528b728c157d92ab8425710776ad Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 25 Aug 2026 18:57:34 +0200 Subject: [PATCH 03/10] Remove old version --- .forgejo/workflows/build_keycloak.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index 9c26874..fc0f723 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -20,7 +20,6 @@ jobs: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - 26.7.2 - - 26.6.4 # until we are sure we can go to 26.7 steps: - name: Install required system packages run: apk add --no-cache nodejs From 70e628607364846cbb1c1b74e3b55445175d20a1 Mon Sep 17 00:00:00 2001 From: Renovate Date: Mon, 31 Aug 2026 09:46:26 +0000 Subject: [PATCH 04/10] Update quay.io/keycloak/keycloak Docker tag to v26.7.3 --- .forgejo/workflows/build_keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index fc0f723..285a084 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -19,7 +19,7 @@ jobs: matrix: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - - 26.7.2 + - 26.7.3 steps: - name: Install required system packages run: apk add --no-cache nodejs From 76fb84be3620d3ce9cde6f2fd2dc6e7319923b7f Mon Sep 17 00:00:00 2001 From: Renovate Date: Wed, 16 Sep 2026 15:01:50 +0000 Subject: [PATCH 05/10] Update quay.io/keycloak/keycloak Docker tag to v26.7.4 --- .forgejo/workflows/build_keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index 285a084..a2c2d2f 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -19,7 +19,7 @@ jobs: matrix: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - - 26.7.3 + - 26.7.4 steps: - name: Install required system packages run: apk add --no-cache nodejs From a3fb62f221ec0043faf70c3c25de64f24b6f770f Mon Sep 17 00:00:00 2001 From: Renovate Date: Thu, 1 Oct 2026 02:18:27 +0000 Subject: [PATCH 06/10] Update quay.io/keycloak/keycloak Docker tag to v26.7.5 --- .forgejo/workflows/build_keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index a2c2d2f..74f418c 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -19,7 +19,7 @@ jobs: matrix: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - - 26.7.4 + - 26.7.5 steps: - name: Install required system packages run: apk add --no-cache nodejs From 18e8e44f0c4ff4300a50da51f32a44c3c25549f6 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 13 Oct 2026 14:17:37 +0000 Subject: [PATCH 07/10] Update quay.io/keycloak/keycloak Docker tag to v26.8.1 --- .forgejo/workflows/build_keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index 74f418c..74cc8b2 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -19,7 +19,7 @@ jobs: matrix: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - - 26.7.5 + - 26.8.1 steps: - name: Install required system packages run: apk add --no-cache nodejs From 146ca74b84c376a8bcc28f70489ee2e3e4e7d40f Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 21 Oct 2026 20:31:49 +0200 Subject: [PATCH 08/10] nextcloud: build oci-images with php strict_mode enabled --- nextcloud/99-security-hardening.ini | 9 +++++++++ nextcloud/Containerfile | 2 ++ 2 files changed, 11 insertions(+) create mode 100644 nextcloud/99-security-hardening.ini diff --git a/nextcloud/99-security-hardening.ini b/nextcloud/99-security-hardening.ini new file mode 100644 index 0000000..90a4b57 --- /dev/null +++ b/nextcloud/99-security-hardening.ini @@ -0,0 +1,9 @@ +; Whether to use strict session mode. +; Strict session mode does not accept an uninitialized session ID, and +; regenerates the session ID if the browser sends an uninitialized session ID. +; Strict mode protects applications from session fixation via a session adoption +; vulnerability. It is disabled by default for maximum compatibility, but +; enabling it is encouraged. +; https://wiki.php.net/rfc/strict_sessions +session.use_strict_mode = 1 + diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile index d76a998..a1fa572 100644 --- a/nextcloud/Containerfile +++ b/nextcloud/Containerfile @@ -1,6 +1,8 @@ ARG TAG FROM git.hamburg.ccc.de/ccchh/oci-images/nextcloud-base:${TAG} +COPY 99-security-hardening.ini /usr/local/etc/php/conf.d/99-security-hardening.ini + RUN apt-get update \ && apt-get install -y supervisor \ && rm -rf /var/lib/apt/lists/* \ From 9b3a19d2a826a286fb80ebe42aba4e2f5ccb2858 Mon Sep 17 00:00:00 2001 From: chris Date: Fri, 23 Oct 2026 13:38:01 +0200 Subject: [PATCH 09/10] php suggest to protect against unlikely RCE --- nextcloud/99-security-hardening.ini | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/nextcloud/99-security-hardening.ini b/nextcloud/99-security-hardening.ini index 90a4b57..80c7593 100644 --- a/nextcloud/99-security-hardening.ini +++ b/nextcloud/99-security-hardening.ini @@ -5,5 +5,12 @@ ; vulnerability. It is disabled by default for maximum compatibility, but ; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions -session.use_strict_mode = 1 +session.use_strict_mode = 1\ +; Enable upload progress tracking in $_SESSION +; Default Value: On +; Development Value: On +; Production Value: On +; https://php.net/session.upload-progress.enabled +; Warum, siehe hier: https://www.php.net/archive/2026.php#2026-10-23-1 +session.upload_progress.enabled = Off From c13790491a7de1cc219d0db10f06230314417a2d Mon Sep 17 00:00:00 2001 From: Renovate Date: Thu, 5 Nov 2026 20:18:13 +0000 Subject: [PATCH 10/10] Update quay.io/keycloak/keycloak Docker tag to v26.8.2 --- .forgejo/workflows/build_keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build_keycloak.yml b/.forgejo/workflows/build_keycloak.yml index 74cc8b2..3b870ba 100644 --- a/.forgejo/workflows/build_keycloak.yml +++ b/.forgejo/workflows/build_keycloak.yml @@ -19,7 +19,7 @@ jobs: matrix: keycloak-version: # renovate: datasource=docker depName=quay.io/keycloak/keycloak - - 26.8.1 + - 26.8.2 steps: - name: Install required system packages run: apk add --no-cache nodejs