### Enable and Start Docker Service

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Commands to enable the Docker service to start on boot and then start the Docker service immediately. This ensures Docker is running and accessible.

```bash
systemctl enable docker && systemctl start docker  
```

--------------------------------

### Start OpenCloud with Updated Image (Docker)

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Command to start OpenCloud using the updated Docker image. It maps ports, volumes, and sets environment variables for a new instance. Assumes configuration is in `$HOME/opencloud/opencloud-config` and data in `$HOME/opencloud/opencloud-data`.

```bash
docker run \
--name opencloud \
--rm \
-it \
-p 9200:9200 \
-v $HOME/opencloud/opencloud-config:/etc/opencloud \
-v $HOME/opencloud/opencloud-data:/var/lib/opencloud \
-e OC_INSECURE=true \
-e PROXY_HTTP_ADDR=0.0.0.0:9200 \
-e OC_URL=https://localhost:9200 \
opencloudeu/opencloud:{tag}
```

--------------------------------

### Start OpenCloud with Updated Image (Docker Compose)

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Command to start OpenCloud using Docker Compose with an updated image. It utilizes environment variables to specify the image and tag for the upgrade process.

```bash
OC_DOCKER_IMAGE=opencloudeu/opencloud OC_DOCKER_TAG=tag docker compose up -d
```

--------------------------------

### Start OpenCloud Docker Container

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker

Starts the OpenCloud Docker container in detached mode. It maps ports, sets up bind mounts for configuration and data, and configures network settings and the OpenCloud URL. The container is named 'opencloud' and will be removed upon stopping.

```bash
docker run \
    --name opencloud \
    --rm \
    -d \
    -p 9200:9200 \
    -v $HOME/opencloud/opencloud-config:/etc/opencloud \
    -v $HOME/opencloud/opencloud-data:/var/lib/opencloud \
    -e OC_INSECURE=true \
    -e PROXY_HTTP_ADDR=0.0.0.0:9200 \
    -e OC_URL=https://localhost:9200 \
    opencloudeu/opencloud-rolling:latest  

```

--------------------------------

### Start OpenCloud Docker Compose Services

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Command to start all services defined in the Docker Compose configuration in detached mode. Ensures OpenCloud and its dependencies are running.

```bash
docker compose up -d  
```

--------------------------------

### Clone OpenCloud Compose and Set Environment

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Clones the OpenCloud Compose repository, navigates into the directory, copies the example environment file, and opens it for editing. Essential for OpenCloud setup.

```bash
git clone https://github.com/opencloud-eu/opencloud-compose.git  
cd opencloud-compose  
cp .env.example .env  
nano .env  
```

--------------------------------

### Verify Configuration Changes (Docker)

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Steps to enter an OpenCloud container and verify configuration changes using `opencloud init --diff`. This helps identify necessary updates to `opencloud.yaml` before proceeding with the upgrade.

```bash
docker run --rm -it --entrypoint /bin/sh -v $HOME/opencloud/opencloud-config:/etc/opencloud opencloudeu/opencloud:{tag}
```

```bash
opencloud init --diff
```

--------------------------------

### Stop OpenCloud Instance (Docker)

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Command to stop a running OpenCloud instance managed by Docker. This is the initial step before upgrading.

```bash
docker stop opencloud
```

--------------------------------

### Update and Upgrade System Packages

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Commands to update package lists and upgrade existing packages on a Debian-based system. Ensures the system has the latest software versions before installing new packages.

```bash
apt update && apt upgrade -y  
```

--------------------------------

### Create Directories for Docker Bind Mounts

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker

Creates the necessary directories in the user's home folder for OpenCloud configuration and data persistence using bind mounts in Docker. Ensures that data is not lost when containers are removed.

```shell
mkdir -p $HOME/opencloud/opencloud-config  
mkdir -p $HOME/opencloud/opencloud-data  

```

--------------------------------

### Initialize OpenCloud Docker Container

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker

Runs a Docker container to initialize OpenCloud for the first time. It sets up the configuration and data directories using bind mounts and configures the admin password via an environment variable. The container is removed after initialization.

```bash
docker run --rm -it \
    -v $HOME/opencloud/opencloud-config:/etc/opencloud \
    -v $HOME/opencloud/opencloud-data:/var/lib/opencloud \
    -e IDM_ADMIN_PASSWORD=admin \
    opencloudeu/opencloud-rolling:latest init  

```

--------------------------------

### Stop and Start OpenCloud Docker Container

Source: https://docs.opencloud.eu/docs/admin/resources/common-issues

Commands to stop and then start the OpenCloud Docker container using Docker Compose. This is part of the process for resetting the admin password.

```bash
docker compose stop opencloud
```

```bash
docker compose up -d
```

--------------------------------

### Create Certbot Webroot Directory

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Creates a directory for Certbot to use for HTTP challenges and sets the correct ownership to the Nginx web server user.

```bash
sudo mkdir -p /var/www/certbot  
sudo chown -R www-data:www-data /var/www/certbot  
```

--------------------------------

### Pull OpenCloud Docker Image

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker

Pulls the latest rolling release of the OpenCloud Docker image from Docker Hub. This command ensures you have the most up-to-date version of the OpenCloud application to run locally.

```bash
docker pull opencloudeu/opencloud-rolling:latest  

```

--------------------------------

### Stop OpenCloud Instance (Docker Compose)

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Command to stop a running OpenCloud instance managed by Docker Compose. This action is part of the upgrade preparation process.

```bash
docker compose stop
```

--------------------------------

### Pull New OpenCloud Docker Image

Source: https://docs.opencloud.eu/docs/admin/maintenance/upgrade

Command to pull the latest OpenCloud Docker image from the registry. Replace `{tag}` with the desired version tag. This is crucial for upgrading to a newer version.

```bash
docker pull opencloudeu/opencloud:{tag}
```

--------------------------------

### rclone Configuration for WebDAV Services

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Example rclone configuration file (rclone.conf) demonstrating how to set up connections to various WebDAV-compliant services including OpenCloud, oCIS, and Nextcloud. Each entry specifies the type, URL, vendor, user, and a (likely obscured) password.

```ini
[opencloud-admin]
type = webdav
url = https://opencloud_url/remote.php/webdav
vendor = opencloud
owncloud_exclude_shares = true
user = admin
pass = sQOM4mn2DdR9ihRGkyAMcd50W6mniaSqSfx2qVOdBJs
description = opencloud-admin

[opencloud-alan]
type = webdav
url = https://opencloud_url/remote.php/webdav
vendor = opencloud
owncloud_exclude_shares = true
user = alan
pass = sQOM4mn2DdR9ihRGkyAMcd50W6mniaSqSfx2qVOdBJs
description = opencloud-alan

[ocis-admin]
type = webdav
url = https://ocis_url/remote.php/webdav
vendor = ocis
owncloud_exclude_shares = true
user = admin
pass = Sav5354nRTgBHyItQeCZp9tCBidX2BxbuMx_dDLwxqs
description = ocis-admin

[ocis-einstein]
type = webdav
url = https://ocis_url/remote.php/webdav
vendor = ocis-einstein
owncloud_exclude_shares = true
user = einstein
pass = dcYsf3PNvBxaIi7MMq-bqg74KMWWWS8p3uFT-WD17SA
description = ocis-einstein

[nc-admin]
type = webdav
url = http://nc_url/remote.php/webdav
vendor = nc
owncloud_exclude_shares = true
user = admin
pass = IBSkhC1wCDdS2Gt9iBV-C9IqlGek
description = nc-admin

[nc-bob]
type = webdav
url = http://localhost:8080/remote.php/webdav
vendor = nc-bob
owncloud_exclude_shares = true
user = bob
pass = ufOK3zPDjR4meEwwy3cWUVA18Lf8TpubBRyPL5m9KC508PkMiEVAXTxg6olu
description = nc-bob
```

--------------------------------

### Configure OpenCloud: Enable auth-app Service

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Modify the .env file to start the auth-app service and enable proxy authentication for OpenCloud. This is a prerequisite for generating user tokens via API.

```bash
START_ADDITIONAL_SERVICES="auth-app"
PROXY_ENABLE_APP_AUTH="true"
```

--------------------------------

### Final Nginx Reverse Proxy Configuration for OpenCloud

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Nginx configuration file for OpenCloud. Includes HTTP to HTTPS redirection, SSL certificate setup, and reverse proxy settings for OpenCloud and Collabora services.

```nginx
# Redirect HTTP to HTTPS  
server {
    listen 80;
    server_name cloud.YOUR.DOMAIN collabora.YOUR.DOMAIN wopiserver.YOUR.DOMAIN;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# OpenCloud  
server {
    listen 443 ssl;
    server_name cloud.YOUR.DOMAIN;

    ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;
    # Increase max upload size (required for Tus — without this, uploads over 1 MB fail)
    client_max_body_size 10M;
    # Disable buffering - essential for SSE
    proxy_buffering off;
    proxy_request_buffering off;

    # Extend timeouts for long connections
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    keepalive_timeout 3600s;

    # Prevent nginx from trying other upstreams
    proxy_next_upstream off;

    location / {
        proxy_pass http://127.0.0.1:9200;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

```

--------------------------------

### Obtain SSL Certificates with Certbot

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Uses Certbot with the webroot authenticator to obtain SSL certificates for specified domains. Requires root privileges and the webroot directory to be set up.

```bash
sudo certbot certonly --webroot \ 
  -w /var/www/certbot \ 
  -d cloud.YOUR.DOMAIN \ 
  -d collabora.YOUR.DOMAIN \ 
  -d wopiserver.YOUR.DOMAIN \ 
  --email your@email.com \ 
  --agree-tos \ 
  --no-eff-email  
```

--------------------------------

### SSH Connection Command

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Command to connect to your server via SSH. Replace YOUR.SERVER.IP with your server's IP address.

```bash
ssh root@YOUR.SERVER.IP  
```

--------------------------------

### Enable and Reload Nginx Configuration

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Commands to enable the Nginx configuration file and then test its syntax before reloading the Nginx service to apply the changes. This ensures the reverse proxy is active and correctly configured.

```bash
sudo ln -s /etc/nginx/sites-available/opencloud /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
```

--------------------------------

### Enable Certbot Challenge Config and Reload Nginx

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Symlinks the temporary Certbot configuration file to the Nginx enabled sites directory and then tests the Nginx configuration before reloading the service.

```bash
sudo ln -s /etc/nginx/sites-available/certbot-challenge /etc/nginx/sites-enabled/  
sudo nginx -t && sudo systemctl reload nginx  
```

--------------------------------

### OpenCloud Docker Compose Environment Variables

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Key environment variables to configure for OpenCloud and Collabora Online deployment using Docker Compose. Includes domain settings, compose file definition, and admin password.

```bash
# INSECURE=true  
  
COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml  
  
OC_DOMAIN=cloud.YOUR.DOMAIN  
  
INITIAL_ADMIN_PASSWORD=YOUR.SECRET.PASSWORD  
  
COLLABORA_DOMAIN=collabora.YOUR.DOMAIN  
  
WOPISERVER_DOMAIN=wopiserver.YOUR.DOMAIN  
```

--------------------------------

### OpenCloud Server Configuration for Keycloak

Source: https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/keycloak

General server configuration settings for OpenCloud when using Keycloak as an identity provider. These variables control aspects like account provisioning, role assignment, OIDC issuer URL, and user claim mapping. Ensure these align with your Keycloak setup and desired OpenCloud behavior.

```shell
PROXY_AUTOPROVISION_ACCOUNTS=true|false
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
OC_OIDC_ISSUER=https://your-domain.example.com/realms/openCloud
WEB_OPTION_ACCOUNT_EDIT_LINK_HREF=https://your-domain.example.com/realms/openCloud/account
PROXY_OIDC_REWRITE_WELLKNOWN=true
PROXY_USER_OIDC_CLAIM=preferred_username|sub|uuid
OC_ADMIN_USER_ID: ""
SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
GRAPH_USERNAME_MATCH=none
OC_EXCLUDE_RUN_SERVICES=idp,idm
```

--------------------------------

### Temporary Nginx Config for Certbot HTTP Challenge

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Nginx server block configuration to listen on port 80 and serve files from the Certbot webroot directory for domain validation. Adjust server_name to your domain.

```nginx
server {
    listen 80;
    server_name cloud.YOUR.DOMAIN collabora.YOUR.DOMAIN wopiserver.YOUR.DOMAIN;

    root /var/www/certbot;

    location /.well-known/acme-challenge/ {
        allow all;
        try_files $uri =404;
    }
}

```

--------------------------------

### Nginx Server Block for WOPI Server

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Sets up Nginx as a reverse proxy for the WOPI server. It includes SSL configuration and forwards various headers like X-Real-IP and X-Forwarded-For to the backend WOPI server for proper request handling.

```nginx
server {
    listen 443 ssl;
    server_name wopiserver.YOUR.DOMAIN;

    ssl_certificate /etc/letsencrypt/live/cloud.YOUR.DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.YOUR.DOMAIN/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:9300;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

--------------------------------

### List Docker Volumes

Source: https://docs.opencloud.eu/docs/admin/resources/common-issues

Lists all available Docker volumes on the system. This command helps in identifying the correct volume names for data and configuration needed for password resets.

```bash
docker volume ls
```

--------------------------------

### Check Running Docker Containers

Source: https://docs.opencloud.eu/docs/admin/resources/common-issues

Lists all currently running Docker containers. This command is essential for verifying if services like opencloud and traefik are active.

```bash
docker ps
```

--------------------------------

### Remove Temporary Certbot Nginx Configuration

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Deletes the symbolic link for the temporary Certbot Nginx configuration file from the Nginx sites-enabled directory. This is done after setting up the permanent proxy configuration.

```bash
sudo rm /etc/nginx/sites-enabled/certbot-challenge  
```

--------------------------------

### Test Certificate Renewal with Certbot

Source: https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/external-proxy

Command to perform a dry run of the certificate renewal process using Certbot. This helps verify that SSL certificates can be renewed successfully without actually changing them.

```bash
sudo certbot renew --dry-run
```

--------------------------------

### Generate oCIS User Token via CLI

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Connect to the oCIS Docker container and execute the 'ocis auth-app create' command to generate an authentication token for a user, specifying the username and expiration duration. This token facilitates authentication.

```bash
docker exec -it ocis_full-ocis-1 sh
ocis auth-app create --user-name=einstein --expiration=72h
```

--------------------------------

### Resolve Docker Permission Denied Errors

Source: https://docs.opencloud.eu/docs/admin/resources/common-issues

Demonstrates how to fix 'permission denied' errors in Docker Compose logs by adjusting directory ownership. It shows incorrect and correct ownership formats and the command to change it.

```bash
chown -R 1000:1000 opencloud-data
```

--------------------------------

### Copy Data Between Cloud Services using rclone

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Utilize the 'rclone copy' command to transfer personal space data from oCIS and Nextcloud to OpenCloud. The command specifies the source and destination remote configurations and includes flags for ignoring certificate checks and showing progress.

```bash
rclone copy ocis-admin:/ opencloud-admin:/ --no-check-certificate -P  # Copy oCIS admin personal space to OpenCloud admin space
rclone copy ocis-einstein:/ opencloud-alan:/ --no-check-certificate -P  # Copy oCIS bob's personal space to OpenCloud admin space
rclone copy nc-bob:/ opencloud-alan:/ --no-check-certificate -P  # Copy Nextcloud admin personal space to OpenCloud admin space
```

--------------------------------

### Generate OpenCloud User Token via CLI

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Access the OpenCloud Docker container and use the 'opencloud auth-app create' command to generate an authentication token for a specific user with a defined expiration time. This token is used for authentication purposes.

```bash
docker exec -it opencloud-compose-opencloud-1 sh
opencloud auth-app create --user-name=alan --expiration=72h
```

--------------------------------

### Generate oCIS User Token via API

Source: https://docs.opencloud.eu/docs/admin/maintenance/migrate

Set the AUTH_APP_ENABLE_IMPERSONATION environment variable and then use curl to make a POST request to the oCIS API for token generation. This requires admin credentials and defines the target user and token expiry.

```bash
AUTH_APP_ENABLE_IMPERSONATION=true
curl -vk -XPOST 'https://ocis_url/auth-app/tokens?expiry=72h&userName=einstein' -uadmin:admin
```