NEXTCLOUD_ADMIN_* environment variables not working with podman secrets

ℹ️ Support 📦 Appliances (Docker, Snappy, VM, NCP, AIO)
, , ,
1

Hi everyone,

I am trying to set up Nextcloud using a YAML file. Nearly everything works, but there’s one thing bugging me hard: It seems that the ENV Variables for NEXTCLOUD_ADMIN_USER and NEXTCLOUD_ADMIN_PW do not work with podman/docker secrets.

When I handover username and password inside of the YAML, everything works as expected. But if I try to use podman secrets, I will get the normal init wizard for Nextcloud to create an admin account. All other secrets are loading correctly and work (e.g. redis, mariadb etc.).

Any ideas? Please find below an excerpt for of my YAML file.

Thanks in advance.
dapari

nextcloud:
    image: nextcloud
    restart: always
    depends_on:
      - mariadb
      - redis
      - collabora
      - traefik
    environment:
      - SERVER_NAME=xxxxxx
      - MYSQL_PASSWORD=/run/secrets/nextcloud_db
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=/run/secrets/nextcloud_mariadb_usr
      - MYSQL_HOST=mariadb
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=/run/secrets/redis_root
      - NEXTCLOUD_ADMIN_USER=/run/secrets/nextcloudadmin
      - NEXTCLOUD_ADMIN_PASSWORD=/run/secrets/nextcloud_admin_pw
      - TRUSTED_PROXIES=xxxxx
      - NEXTCLOUD_TRUSTED_DOMAINS= xxxxx
      - APACHE_DISABLE_REWRITE_IP=1
      - NEXTCLOUD_COLLABORA_URL=xxxxx

[...]

secrets:
  nextcloud_mariadb_usr:
    external: true
  nextcloud_db:
    external: true
  mariadb_root:
    external: true
  redis_root:
    external: true
  nextcloudadmin:
    external: true
  nextcloud_admin_pw:
    external: true
2

I note two things:

  1. To use secrets with that image append _FILE to the variable (see Nextcloud - Docker Secrets).

  2. Permissions are often a factor. When exposing a secret, container environments them into /run/secrets/*. This is often owned and restricted to 0:0 by default. However, the container doesn’t run the Nextcloud installer as root. It runs as either the default USER specified in the image or the USER override specified at runtime. Generally www-data / 33.

Additional relevant references:

1 Like
3

This topic was automatically closed after 90 days. New replies are no longer allowed.