diff options
Diffstat (limited to 'config/config.sample.php')
| -rw-r--r-- | config/config.sample.php | 1609 |
1 files changed, 1103 insertions, 506 deletions
diff --git a/config/config.sample.php b/config/config.sample.php index 54d3d46070a..d8780324cb0 100644 --- a/config/config.sample.php +++ b/config/config.sample.php @@ -1,6 +1,12 @@ <?php /** + * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors + * SPDX-FileCopyrightText: 2016 ownCloud, Inc. + * SPDX-License-Identifier: AGPL-3.0-only + */ + +/** * This configuration file is only provided to document the different * configuration options and their usage. * @@ -11,13 +17,13 @@ * * This file is used to generate the configuration documentation. * Please consider following requirements of the current parser: - * * all comments need to start with `/**` and end with ` *\/` - each on their + * * All comments need to start with `/**` and end with ` *\/` - each on their * own line - * * add a `@see CONFIG_INDEX` to copy a previously described config option + * * Add a `@see CONFIG_INDEX` to copy a previously described config option * also to this line - * * everything between the ` *\/` and the next `/**` will be treated as the + * * Everything between the ` *\/` and the next `/**` will be treated as the * config option - * * use RST syntax + * * Use RST syntax */ $CONFIG = [ @@ -41,41 +47,54 @@ $CONFIG = [ */ 'instanceid' => '', - /** - * The salt used to hash all passwords, auto-generated by the Nextcloud - * installer. (There are also per-user salts.) If you lose this salt you lose - * all your passwords. This example is for documentation only, and you should - * never use it. - * - * @deprecated This salt is deprecated and only used for legacy-compatibility, - * developers should *NOT* use this value for anything nowadays. - * - * 'passwordsalt' => 'd3c944a9af095aa08f', +/** + * The salt used to hash all passwords, auto-generated by the Nextcloud + * installer. (There are also per-user salts.) If you lose this salt, you lose + * all your passwords. This example is for documentation only, and you should + * never use it. + * + * @deprecated This salt is deprecated and only used for legacy-compatibility, + * developers should *NOT* use this value for anything nowadays. + * + * 'passwordsalt' => 'd3c944a9af095aa08f', */ 'passwordsalt' => '', /** + * Secret used by Nextcloud for various purposes, e.g., to encrypt data. If you + * lose this string, there will be data corruption. + */ +'secret' => '', + +/** * Your list of trusted domains that users can log into. Specifying trusted * domains prevents host header poisoning. Do not remove this, as it performs * necessary security checks. * You can specify: * - * - the exact hostname of your host or virtual host, e.g. demo.example.org. - * - the exact hostname with permitted port, e.g. demo.example.org:443. + * - The exact hostname of your host or virtual host, e.g., demo.example.org. + * - The exact hostname with permitted port, e.g., demo.example.org:443. * This disallows all other ports on this host - * - use * as a wildcard, e.g. ubos-raspberry-pi*.local will allow + * - Use * as a wildcard, e.g., ubos-raspberry-pi*.local will allow * ubos-raspberry-pi.local and ubos-raspberry-pi-2.local - * - the IP address with or without permitted port, e.g. [2001:db8::1]:8080 + * - The IP address with or without permitted port, e.g., [2001:db8::1]:8080 * Using TLS certificates where commonName=<IP address> is deprecated */ -'trusted_domains' => - [ - 'demo.example.org', - 'otherdomain.example.org', - '10.111.112.113', - '[2001:db8::1]' - ], +'trusted_domains' => [ + 'demo.example.org', + 'otherdomain.example.org', + '10.111.112.113', + '[2001:db8::1]' +], +/** + * The validity domain for cookies, for example '' (cookies will be sent only + * the domain that defined it, e.g. 'demo.example.org'), 'demo.example.org' + * (cookies will be valid for the domain and all subdomains), ... + * + * Defaults to '' (safe option) + */ +'cookie_domain' => '', /** * Where user files are stored. The SQLite database is also stored here, when @@ -96,9 +115,9 @@ $CONFIG = [ * ``supportedDatabases`` * * Available: - * - sqlite3 (SQLite3) - * - mysql (MySQL/MariaDB) - * - pgsql (PostgreSQL) + * - sqlite3 (SQLite3) + * - mysql (MySQL/MariaDB) + * - pgsql (PostgreSQL) * * Defaults to ``sqlite3`` */ @@ -106,9 +125,10 @@ $CONFIG = [ /** * Your host server name, for example ``localhost``, ``hostname``, - * ``hostname.example.com``, or the IP address. To specify a port use - * ``hostname:####``; to specify a Unix socket use - * ``/path/to/directory/containing/socket`` e.g. ``/run/postgresql/``. + * ``hostname.example.com``, or the IP address. + * To specify a port, use ``hostname:####``; for IPv6 addresses, use the URI notation ``[ip]:port``. + * To specify a Unix socket, use ``localhost:/path/to/directory/containing/socket`` or + * ``:/path/to/directory/containing/socket``, e.g., ``localhost:/run/postgresql/``. */ 'dbhost' => '', @@ -136,8 +156,29 @@ $CONFIG = [ * * Default to ``oc_`` */ -'dbtableprefix' => '', +'dbtableprefix' => 'oc_', +/** + * Enable persistent connections to the database. + * This setting uses the "persistent" option from Doctrine DBAL, which in turn + * uses the PDO::ATTR_PERSISTENT option from the PDO driver. + */ +'dbpersistent' => '', + +/** + * Specify read-only replicas to be used by Nextcloud when querying the database + */ +'dbreplica' => [ + ['user' => 'nextcloud', 'password' => 'password1', 'host' => 'replica1', 'dbname' => ''], + ['user' => 'nextcloud', 'password' => 'password2', 'host' => 'replica2', 'dbname' => ''], +], + +/** + * Add request ID to the database query in a comment. + * + * This can be enabled to assist in mapping database logs to Nextcloud logs. + */ +'db.log_request_id' => false, /** * Indicates whether the Nextcloud instance was installed successfully; ``true`` @@ -159,20 +200,21 @@ $CONFIG = [ /** * This sets the default language on your Nextcloud server, using ISO_639-1 * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for - * French. It overrides automatic language detection on public pages like login - * or shared items. User's language preferences configured under "personal -> - * language" override this setting after they have logged in. Nextcloud has two - * distinguished language codes for German, 'de' and 'de_DE'. 'de' is used for - * informal German and 'de_DE' for formal German. By setting this value to 'de_DE' - * you can enforce the formal version of German unless the user has chosen - * something different explicitly. + * French. The default_language parameter is only used when the browser does + * not send any language, and the user hasn’t configured their own language + * preferences. + * + * Nextcloud has two distinguished language codes for German, 'de' and 'de_DE'. + * 'de' is used for informal German and 'de_DE' for formal German. By setting + * this value to 'de_DE', you can enforce the formal version of German unless + * the user has chosen something different explicitly. * * Defaults to ``en`` */ 'default_language' => 'en', /** - * With this setting a language can be forced for all users. If a language is + * With this setting, a language can be forced for all users. If a language is * forced, the users are also unable to change their language in the personal * settings. If users shall be unable to change their language, but users have * different languages, this value can be set to ``true`` instead of a language @@ -195,17 +237,26 @@ $CONFIG = [ 'default_locale' => 'en_US', /** + * With this setting, it is possible to reduce the languages available in the + * language chooser. The languages have to be set as array values using ISO_639-1 + * language codes such as ``en`` for English, ``de`` for German, etc. + * + * For example: Set to ['de', 'fr'] to only allow German and French languages. + */ +'reduce_to_languages' => [], + +/** * This sets the default region for phone numbers on your Nextcloud server, * using ISO 3166-1 country codes such as ``DE`` for Germany, ``FR`` for France, … * It is required to allow inserting phone numbers in the user profiles starting - * without the country code (e.g. +49 for Germany). + * without the country code (e.g., +49 for Germany). * * No default value! */ 'default_phone_region' => 'GB', /** - * With this setting a locale can be forced for all users. If a locale is + * With this setting, a locale can be forced for all users. If a locale is * forced, the users are also unable to change their locale in the personal * settings. If users shall be unable to change their locale, but users have * different languages, this value can be set to ``true`` instead of a locale @@ -216,15 +267,14 @@ $CONFIG = [ 'force_locale' => 'en_US', /** - * Set the default app to open on login. Use the app names as they appear in the - * URL after clicking them in the Apps menu, such as documents, calendar, and - * gallery. You can use a comma-separated list of app names, so if the first - * app is not enabled for a user then Nextcloud will try the second one, and so - * on. If no enabled apps are found it defaults to the dashboard app. + * This sets the default timezone on your Nextcloud server, using IANA + * identifiers like ``Europe/Berlin`` or ``Pacific/Auckland``. The default + * timezone parameter is only used when the timezone of the user cannot be + * determined. * - * Defaults to ``dashboard,files`` + * Defaults to ``UTC`` */ -'defaultapp' => 'dashboard,files', +'default_timezone' => 'Europe/Berlin', /** * ``true`` enables the Help menu item in the user menu (top right of the @@ -233,14 +283,50 @@ $CONFIG = [ 'knowledgebaseenabled' => true, /** + * ``true`` embeds the documentation in an iframe inside Nextcloud. + * ``false`` only shows buttons to the online documentation. + */ +'knowledgebase.embedded' => false, + +/** * ``true`` allows users to change their display names (on their Personal * pages), and ``false`` prevents them from changing their display names. */ 'allow_user_to_change_display_name' => true, /** + * The directory where the skeleton files are located. These files will be + * copied to the data directory of new users. Set empty string to not copy any + * skeleton files. If unset and templatedirectory is an empty string, shipped + * templates will be used to create a template directory for the user. + * ``{lang}`` can be used as a placeholder for the language of the user. + * If the directory does not exist, it falls back to non-dialect (from ``de_DE`` + * to ``de``). If that does not exist either, it falls back to ``default`` + * + * Defaults to ``core/skeleton`` in the Nextcloud directory. + */ +'skeletondirectory' => '/path/to/nextcloud/core/skeleton', + +/** + * The directory where the template files are located. These files will be + * copied to the template directory of new users. Set empty string to not copy any + * template files. + * ``{lang}`` can be used as a placeholder for the language of the user. + * If the directory does not exist, it falls back to non-dialect (from ``de_DE`` + * to ``de``). If that does not exist either, it falls back to ``default`` + * + * To disable creating a template directory, set both skeletondirectory and + * templatedirectory to empty strings. + */ +'templatedirectory' => '/path/to/nextcloud/templates', + +/** + * User session + */ + +/** * Lifetime of the remember login cookie. This should be larger than the - * session_lifetime. If it is set to 0 remember me is disabled. + * session_lifetime. If it is set to 0, remember me is disabled. * * Defaults to ``60*60*24*15`` seconds (15 days) */ @@ -257,6 +343,34 @@ $CONFIG = [ 'session_lifetime' => 60 * 60 * 24, /** + * The timeout in seconds for requests to servers made by the DAV component (e.g., needed for federated shares). + */ +'davstorage.request_timeout' => 30, + +/** + * The timeout in seconds for synchronizing address books, e.g., federated system address books (as run by `occ federation:sync-addressbooks`). + * + * Defaults to ``30`` seconds + */ +'carddav_sync_request_timeout' => 30, + +/** + * The limit applied to the synchronization report request, e.g. federated system address books (as run by `occ federation:sync-addressbooks`). + */ +'carddav_sync_request_truncation' => 2500, + +/** + * `true` enables a relaxed session timeout, where the session timeout would no longer be + * handled by Nextcloud but by either the PHP garbage collection or the expiration of + * potential other session backends like Redis. + * + * This may lead to sessions being available for longer than what session_lifetime uses but + * comes with performance benefits as sessions are no longer a locking operation for concurrent + * requests. + */ +'session_relaxed_expiry' => false, + +/** * Enable or disable session keep-alive when a user is logged in to the Web UI. * Enabling this sends a "heartbeat" to the server to keep it from timing out. * @@ -266,8 +380,10 @@ $CONFIG = [ /** * Enable or disable the automatic logout after session_lifetime, even if session - * keepalive is enabled. This will make sure that an inactive browser will be logged out - * even if requests to the server might extend the session lifetime. + * keepalive is enabled. This will make sure that an inactive browser will log itself out + * even if requests to the server might extend the session lifetime. Note: the logout is + * handled on the client side. This is not a way to limit the duration of potentially + * compromised sessions. * * Defaults to ``false`` */ @@ -284,18 +400,18 @@ $CONFIG = [ /** * The interval at which token activity should be updated. - * Increasing this value means that the last activty on the security page gets + * Increasing this value means that the last activity on the security page gets * more outdated. * * Tokens are still checked every 5 minutes for validity * max value: 300 * - * Defaults to ``300`` + * Defaults to ``60`` */ 'token_auth_activity_update' => 60, /** - * Whether the bruteforce protection shipped with Nextcloud should be enabled or not. + * Whether the brute force protection shipped with Nextcloud should be enabled or not. * * Disabling this is discouraged for security reasons. * @@ -304,52 +420,98 @@ $CONFIG = [ 'auth.bruteforce.protection.enabled' => true, /** - * By default WebAuthn is available but it can be explicitly disabled by admins + * Whether the brute force protection should write into the database even when a memory cache is available + * + * Using the database is most likely worse for performance, but makes investigating + * issues a lot easier as it's possible to look directly at the table to see all + * logged remote addresses and actions. + * + * Defaults to ``false`` */ -'auth.webauthn.enabled' => true, +'auth.bruteforce.protection.force.database' => false, /** - * By default the login form is always available. There are cases (SSO) where an - * admin wants to avoid users entering their credentials to the system if the SSO - * app is unavailable. + * Whether the brute force protection shipped with Nextcloud should be set to testing mode. * - * This will show an error. But the the direct login still works with adding ?direct=1 + * In testing mode, brute force attempts are still recorded, but the requests do + * not sleep/wait for the specified time. They will still abort with + * "429 Too Many Requests" when the maximum delay is reached. + * Enabling this is discouraged for security reasons + * and should only be done for debugging and on CI when running tests. + * + * Defaults to ``false`` */ -'hide_login_form' => false, +'auth.bruteforce.protection.testing' => false, /** - * The directory where the skeleton files are located. These files will be - * copied to the data directory of new users. Leave empty to not copy any - * skeleton files. - * ``{lang}`` can be used as a placeholder for the language of the user. - * If the directory does not exist, it falls back to non dialect (from ``de_DE`` - * to ``de``). If that does not exist either, it falls back to ``default`` + * Brute force protection: maximum number of attempts before blocking * - * Defaults to ``core/skeleton`` in the Nextcloud directory. + * When more than max-attempts login requests are sent to Nextcloud, requests + * will abort with "429 Too Many Requests". + * For security reasons, change it only if you know what you are doing. + * + * Defaults to ``10`` */ -'skeletondirectory' => '/path/to/nextcloud/core/skeleton', +'auth.bruteforce.max-attempts' => 10, +/** + * Whether the rate limit protection shipped with Nextcloud should be enabled or not. + * + * Disabling this is discouraged for security reasons. + * + * Defaults to ``true`` + */ +'ratelimit.protection.enabled' => true, /** - * The directory where the template files are located. These files will be - * copied to the template directory of new users. Leave empty to not copy any - * template files. - * ``{lang}`` can be used as a placeholder for the language of the user. - * If the directory does not exist, it falls back to non dialect (from ``de_DE`` - * to ``de``). If that does not exist either, it falls back to ``default`` + * Size of subnet used to normalize IPv6 * - * If this is not set creating a template directory will only happen if no custom - * ``skeletondirectory`` is defined, otherwise the shipped templates will be used - * to create a template directory for the user. + * For Brute Force Protection and Rate Limiting, IPv6 addresses are truncated using subnet size. + * It defaults to /56, but you can set it between /32 and /64 + * + * Defaults to ``56`` */ -'templatedirectory' => '/path/to/nextcloud/templates', +'security.ipv6_normalized_subnet_size' => 56, + +/** + * By default, WebAuthn is available, but it can be explicitly disabled by admins + */ +'auth.webauthn.enabled' => true, + +/** + * Whether encrypted passwords should be stored in the database + * + * The passwords are only decrypted using the login token stored uniquely in the + * clients and allow connecting to external storages, autoconfiguring mail accounts in + * the mail app, and periodically checking if the password is still valid. + * + * This might be desirable to disable this functionality when using one-time + * passwords or when having a password policy enforcing long passwords (> 300 + * characters). + * + * By default, the passwords are stored encrypted in the database. + * + * WARNING: If disabled, password changes on the user backend (e.g., on LDAP) no + * longer log connected clients out automatically. Users can still disconnect + * the clients by deleting the app token from the security settings. + */ +'auth.storeCryptedPassword' => true, /** - * If your user backend does not allow password resets (e.g. when it's a + * By default, the login form is always available. There are cases (SSO) where an + * admin wants to avoid users entering their credentials to the system if the SSO + * app is unavailable. + * + * This will show an error. But the direct login still works with adding ?direct=1 + */ +'hide_login_form' => false, + +/** + * If your user backend does not allow password resets (e.g., when it's a * read-only user backend like LDAP), you can specify a custom link, where the * user is redirected to, when clicking the "reset password" link after a failed - * login-attempt. - * In case you do not want to provide any link, replace the url with 'disabled' + * login attempt. + * In case you do not want to provide any link, replace the URL with 'disabled' */ 'lost_password_link' => 'https://example.org/link/to/password/reset', @@ -378,36 +540,41 @@ $CONFIG = [ * FROM address that overrides the built-in ``sharing-noreply`` and * ``lostpassword-noreply`` FROM addresses. * - * Defaults to different from addresses depending on the feature. + * Defaults to different FROM addresses depending on the feature. */ 'mail_from_address' => 'nextcloud', /** * Enable SMTP class debugging. + * NOTE: ``loglevel`` will likely need to be adjusted too. See docs: + * https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html#enabling-debug-mode * * Defaults to ``false`` */ 'mail_smtpdebug' => false, /** - * Which mode to use for sending mail: ``sendmail``, ``smtp`` or ``qmail``. + * Which mode to use for sending mail: ``sendmail``, ``smtp``, ``qmail``, or ``null``. * * If you are using local or remote SMTP, set this to ``smtp``. * - * For the ``sendmail`` option you need an installed and working email system on + * For the ``sendmail`` option, you need an installed and working email system on * the server, with ``/usr/sbin/sendmail`` installed on your Unix system. * - * For ``qmail`` the binary is /var/qmail/bin/sendmail, and it must be installed + * For ``qmail``, the binary is /var/qmail/bin/sendmail, and it must be installed * on your Unix system. * + * Use the string ``null`` to send no mails (disable mail delivery). This can be + * useful if mails should be sent via APIs and rendering messages is not necessary. + * * Defaults to ``smtp`` */ 'mail_smtpmode' => 'smtp', /** * This depends on ``mail_smtpmode``. Specify the IP address of your mail - * server host. This may contain multiple hosts separated by a semi-colon. If - * you need to specify the port number append it to the IP address separated by + * server host. This may contain multiple hosts separated by a semicolon. If + * you need to specify the port number, append it to the IP address separated by * a colon, like this: ``127.0.0.1:24``. * * Defaults to ``127.0.0.1`` @@ -431,8 +598,10 @@ $CONFIG = [ 'mail_smtptimeout' => 10, /** - * This depends on ``mail_smtpmode``. Specify when you are using ``ssl`` for SSL/TLS or - * ``tls`` for STARTTLS, or leave empty for no encryption. + * This depends on ``mail_smtpmode``. Specify ``ssl`` when you are using SSL/TLS. Any other value will be ignored. + * + * If the server advertises STARTTLS capabilities, they might be used, but they cannot be enforced by + * this config option. * * Defaults to ``''`` (empty string) */ @@ -447,14 +616,6 @@ $CONFIG = [ 'mail_smtpauth' => false, /** - * This depends on ``mail_smtpmode``. If SMTP authentication is required, choose - * the authentication type as ``LOGIN`` or ``PLAIN``. - * - * Defaults to ``LOGIN`` - */ -'mail_smtpauthtype' => 'LOGIN', - -/** * This depends on ``mail_smtpauth``. Specify the username for authenticating to * the SMTP server. * @@ -472,14 +633,14 @@ $CONFIG = [ /** * Replaces the default mail template layout. This can be utilized if the - * options to modify the mail texts with the theming app is not enough. - * The class must extend ``\OC\Mail\EMailTemplate`` + * options to modify the mail texts with the theming app are not enough. + * The class must extend ``\OC\Mail\EMailTemplate`` */ 'mail_template_class' => '\OC\Mail\EMailTemplate', /** - * Email will be send by default with an HTML and a plain text body. This option - * allows to only send plain text emails. + * Email will be sent by default with an HTML and a plain text body. This option + * allows sending only plain text emails. */ 'mail_send_plaintext_only' => false, @@ -493,10 +654,10 @@ $CONFIG = [ /** * Which mode is used for sendmail/qmail: ``smtp`` or ``pipe``. * - * For ``smtp`` the sendmail binary is started with the parameter ``-bs``: + * For ``smtp``, the sendmail binary is started with the parameter ``-bs``: * - Use the SMTP protocol on standard input and output. * - * For ``pipe`` the binary is started with the parameters ``-t``: + * For ``pipe``, the binary is started with the parameters ``-t``: * - Read message from STDIN and extract recipients. * * Defaults to ``smtp`` @@ -510,7 +671,7 @@ $CONFIG = [ /** * The automatic hostname detection of Nextcloud can fail in certain reverse * proxy and CLI/cron situations. This option allows you to manually override - * the automatic detection; for example ``www.example.com``, or specify the port + * the automatic detection; for example, ``www.example.com``, or specify the port * ``www.example.com:8080``. */ 'overwritehost' => '', @@ -548,30 +709,32 @@ $CONFIG = [ * are generated within Nextcloud using any kind of command line tools (cron or * occ). The value should contain the full base URL: * ``https://www.example.com/nextcloud`` + * Please make sure to set the value to the URL that your users mainly use to access this Nextcloud. + * Otherwise, there might be problems with the URL generation via cron. * * Defaults to ``''`` (empty string) */ 'overwrite.cli.url' => '', /** - * To have clean URLs without `/index.php` this parameter needs to be configured. + * To have clean URLs without `/index.php`, this parameter needs to be configured. * * This parameter will be written as "RewriteBase" on update and installation of * Nextcloud to your `.htaccess` file. While this value is often simply the URL - * path of the Nextcloud installation it cannot be set automatically properly in + * path of the Nextcloud installation, it cannot be set automatically properly in * every scenario and needs thus some manual configuration. * - * In a standard Apache setup this usually equals the folder that Nextcloud is - * accessible at. So if Nextcloud is accessible via "https://mycloud.org/nextcloud" + * In a standard Apache setup, this usually equals the folder that Nextcloud is + * accessible at. So if Nextcloud is accessible via "https://mycloud.org/nextcloud", * the correct value would most likely be "/nextcloud". If Nextcloud is running - * under "https://mycloud.org/" then it would be "/". + * under "https://mycloud.org/", then it would be "/". * * Note that the above rule is not valid in every case, as there are some rare setup - * cases where this may not apply. However, to avoid any update problems this + * cases where this may not apply. However, to avoid any update problems, this * configuration value is explicitly opt-in. * - * After setting this value run `occ maintenance:update:htaccess`. Now, when the - * following conditions are met Nextcloud URLs won't contain `index.php`: + * After setting this value, run `occ maintenance:update:htaccess`. Now, when the + * following conditions are met, Nextcloud URLs won't contain `index.php`: * * - `mod_rewrite` is installed * - `mod_env` is installed @@ -581,23 +744,23 @@ $CONFIG = [ 'htaccess.RewriteBase' => '/', /** - * For server setups, that don't have `mod_env` enabled or restricted (e.g. suEXEC) + * For server setups that don't have `mod_env` enabled or restricted (e.g., suEXEC), * this parameter has to be set to true and will assume mod_rewrite. * - * Please check, if `mod_rewrite` is active and functional before setting this - * parameter and you updated your .htaccess with `occ maintenance:update:htaccess`. - * Otherwise your nextcloud installation might not be reachable anymore. + * Please check if `mod_rewrite` is active and functional before setting this + * parameter, and you updated your .htaccess with `occ maintenance:update:htaccess`. + * Otherwise, your Nextcloud installation might not be reachable anymore. * For example, try accessing resources by leaving out `index.php` in the URL. */ 'htaccess.IgnoreFrontController' => false, /** - * The URL of your proxy server, for example ``proxy.example.com:8081``. + * The URL of your proxy server, for example, ``proxy.example.com:8081``. * - * Note: Guzzle (the http library used by Nextcloud) is reading the environment - * variables HTTP_PROXY (only for cli request), HTTPS_PROXY, and NO_PROXY by default. + * Note: Guzzle (the HTTP library used by Nextcloud) reads the environment + * variables HTTP_PROXY (only for CLI requests), HTTPS_PROXY, and NO_PROXY by default. * - * If you configure proxy with Nextcloud any default configuration by Guzzle + * If you configure a proxy with Nextcloud, any default configuration by Guzzle * is overwritten. Make sure to set ``proxyexclude`` accordingly if necessary. * * Defaults to ``''`` (empty string) @@ -613,7 +776,7 @@ $CONFIG = [ 'proxyuserpwd' => '', /** - * List of host names that should not be proxied to. + * List of hostnames that should not be proxied to. * For example: ``['.mit.edu', 'foo.com']``. * * Hint: Use something like ``explode(',', getenv('NO_PROXY'))`` to sync this @@ -624,7 +787,7 @@ $CONFIG = [ 'proxyexclude' => [], /** - * Allow remote servers with local addresses e.g. in federated shares, webcal services and more + * Allow remote servers with local addresses, e.g., in federated shares, webcal services, and more * * Defaults to false */ @@ -639,27 +802,46 @@ $CONFIG = [ /** * If the trash bin app is enabled (default), this setting defines the policy * for when files and folders in the trash bin will be permanently deleted. + * + * If the user quota limit is exceeded due to deleted files in the trash bin, + * retention settings will be ignored and files will be cleaned up until + * the quota requirements are met. + * * The app allows for two settings, a minimum time for trash bin retention, * and a maximum time for trash bin retention. + * * Minimum time is the number of days a file will be kept, after which it - * may be deleted. Maximum time is the number of days at which it is guaranteed - * to be deleted. + * *may be* deleted. A file may be deleted after the minimum number of days + * has expired if space is needed. The file will not be deleted if space is + * not needed. + * + * Whether "space is needed" depends on whether a user quota is defined or not: + * + * * If no user quota is defined, the available space on the Nextcloud data + * partition sets the limit for the trashbin + * (issues: see https://github.com/nextcloud/server/issues/28451). + * * If a user quota is defined, 50% of the user's remaining quota space sets + * the limit for the trashbin. + * + * Maximum time is the number of days at which it is *guaranteed + * to be* deleted. There is no further dependency on the available space. + * * Both minimum and maximum times can be set together to explicitly define * file and folder deletion. For migration purposes, this setting is installed * initially set to "auto", which is equivalent to the default setting in * Nextcloud. * - * Available values: + * Available values (D1 and D2 are configurable numbers): * * * ``auto`` - * default setting. keeps files and folders in the trash bin for 30 days + * default setting. Keeps files and folders in the trash bin for 30 days * and automatically deletes anytime after that if space is needed (note: * files may not be deleted if space is not needed). - * * ``D, auto`` - * keeps files and folders in the trash bin for D+ days, delete anytime if + * * ``D1, auto`` + * keeps files and folders in the trash bin for D1+ days, delete anytime if * space needed (note: files may not be deleted if space is not needed) - * * ``auto, D`` - * delete all files in the trash bin that are older than D days + * * ``auto, D2`` + * delete all files in the trash bin that are older than D2 days * automatically, delete other files anytime if space needed * * ``D1, D2`` * keep files and folders in the trash bin for at least D1 days and @@ -698,7 +880,7 @@ $CONFIG = [ * rules. Please refer to :doc:`../configuration_files/file_versioning` for * more information. * * ``D, auto`` - * keep versions at least for D days, apply expire rules to all versions + * keep versions at least for D days, apply expiration rules to all versions * that are older than D days * * ``auto, D`` * delete all versions that are older than D days automatically, delete @@ -721,8 +903,8 @@ $CONFIG = [ /** * Checks an app before install whether it uses private APIs instead of the - * proper public APIs. If this is set to true it will only allow to install or - * enable apps that pass this check. + * proper public APIs. If this is set to true, it will only allow installing or + * enabling apps that pass this check. * * Defaults to ``false`` */ @@ -730,8 +912,8 @@ $CONFIG = [ /** * Check if Nextcloud is up-to-date and shows a notification if a new version is - * available. It sends current version, php version, installation and last update - * time and release channel to the updater server which responds with the latest + * available. It sends current version, PHP version, installation and last update + * time, and release channel to the updater server which responds with the latest * available version based on those metrics. * * Defaults to ``true`` @@ -749,9 +931,10 @@ $CONFIG = [ * The channel that Nextcloud should use to look for updates * * Supported values: - * - ``daily`` - * - ``beta`` - * - ``stable`` + * + * - ``daily`` + * - ``beta`` + * - ``stable`` */ 'updater.release.channel' => 'stable', @@ -774,16 +957,16 @@ $CONFIG = [ * * Defaults to the following domains: * - * - www.nextcloud.com - * - www.startpage.com - * - www.eff.org - * - www.edri.org + * - https://www.nextcloud.com + * - https://www.startpage.com + * - https://www.eff.org + * - https://www.edri.org */ 'connectivity_check_domains' => [ - 'www.nextcloud.com', - 'www.startpage.com', - 'www.eff.org', - 'www.edri.org' + 'https://www.nextcloud.com', + 'https://www.startpage.com', + 'https://www.eff.org', + 'https://www.edri.org' ], /** @@ -807,11 +990,11 @@ $CONFIG = [ 'check_for_working_htaccess' => true, /** - * In rare setups (e.g. on Openshift or docker on windows) the permissions check + * In rare setups (e.g., on OpenShift or Docker on Windows), the permissions check * might block the installation while the underlying system offers no means to * "correct" the permissions. In this case, set the value to false. * - * In regular cases, if issues with permissions are encountered they should be + * In regular cases, if issues with permissions are encountered, they should be * adjusted accordingly. Changing the flag is discouraged. * * Defaults to ``true`` @@ -819,10 +1002,10 @@ $CONFIG = [ 'check_data_directory_permissions' => true, /** - * In certain environments it is desired to have a read-only configuration file. + * In certain environments, it is desired to have a read-only configuration file. * When this switch is set to ``true``, writing to the config file will be * forbidden. Therefore, it will not be possible to configure all options via - * the Web interface. Furthermore, when updating Nextcloud it is required to + * the Web interface. Furthermore, when updating Nextcloud, it is required to * make the configuration file writable again and to set this switch to ``false`` * for the update process. * @@ -876,7 +1059,7 @@ $CONFIG = [ /** * Log file mode for the Nextcloud logging type in octal notation. * - * Defaults to 0640 (writeable by user, readable by group). + * Defaults to 0640 (writable by user, readable by group). */ 'logfilemode' => 0640, @@ -889,9 +1072,27 @@ $CONFIG = [ 'loglevel' => 2, /** + * Loglevel used by the frontend to start logging at. The same values as + * for ``loglevel`` can be used. If not set, it defaults to the value + * configured for ``loglevel`` or Warning if that is not set either. + * + * Defaults to ``2`` + */ +'loglevel_frontend' => 2, + +/** + * Loglevel used by the dirty database query detection. Useful to identify + * potential database bugs in production. Set this to loglevel or higher to + * see dirty queries in the logs. + * + * Defaults to ``0`` (debug) + */ +'loglevel_dirty_database_queries' => 0, + +/** * If you maintain different instances and aggregate the logs, you may want * to distinguish between them. ``syslog_tag`` can be set per instance - * with a unique id. Only available if ``log_type`` is set to ``syslog`` or + * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or * ``systemd``. * * The default value is ``Nextcloud``. @@ -901,7 +1102,7 @@ $CONFIG = [ /** * If you maintain different instances and aggregate the logs, you may want * to distinguish between them. ``syslog_tag_audit`` can be set per instance - * with a unique id. Only available if ``log_type`` is set to ``syslog`` or + * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or * ``systemd``. * * The default value is the value of ``syslog_tag``. @@ -910,16 +1111,19 @@ $CONFIG = [ /** * Log condition for log level increase based on conditions. Once one of these - * conditions is met, the required log level is set to debug. This allows to - * debug specific requests, users or apps + * conditions is met, the required log level is set to debug. This allows + * debugging specific requests, users, or apps * * Supported conditions: * - ``shared_secret``: if a request parameter with the name `log_secret` is set to - * this value the condition is met + * this value, the condition is met * - ``users``: if the current request is done by one of the specified users, * this condition is met * - ``apps``: if the log message is invoked by one of the specified apps, * this condition is met + * - ``matches``: if all the conditions inside a group match, + * this condition is met. This allows logging only entries to an app + * by a few users. * * Defaults to an empty array. */ @@ -927,9 +1131,28 @@ $CONFIG = [ 'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9', 'users' => ['sample-user'], 'apps' => ['files'], + 'matches' => [ + [ + 'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9', + 'users' => ['sample-user'], + 'apps' => ['files'], + 'loglevel' => 1, + 'message' => 'contains substring' + ], + ], ], /** + * Enables logging a backtrace with each log line. Normally, only Exceptions + * carry backtrace information, which are logged automatically. This + * switch turns them on for any log message. Enabling this option will lead + * to increased log data size. + * + * Defaults to ``false``. + */ +'log.backtrace' => false, + +/** * This uses PHP.date formatting; see https://www.php.net/manual/en/function.date.php * * Defaults to ISO 8601 ``2005-08-15T15:52:01+00:00`` - see \DateTime::ATOM @@ -953,7 +1176,7 @@ $CONFIG = [ /** * Enables log rotation and limits the total size of logfiles. Set it to 0 for - * no rotation. Specify a size in bytes, for example 104857600 (100 megabytes + * no rotation. Specify a size in bytes, for example, 104857600 (100 megabytes * = 100 * 1024 * 1024 bytes). A new logfile is created with a new name when the * old logfile reaches your limit. If a rotated log file is already present, it * will be overwritten. @@ -972,9 +1195,68 @@ $CONFIG = [ 'profiler' => false, /** + * Enable profiling for individual requests if profiling single requests is enabled or the secret is passed. + * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data. + * + * The profile data will be stored as a JSON file in the profiling.path directory that can be analyzed with speedscope. + * + * Defaults to ``false`` + */ +'profiling.request' => false, + +/** + * The rate at which profiling data is collected for individual requests. + * A lower value means more data points but higher overhead. + * + * Defaults to ``0.001`` + */ +'profiling.request.rate' => 0.001, + +/** + * A secret token that can be passed via ?profile_secret=<secret> to enable profiling for a specific request. + * This allows profiling specific requests in production without enabling it globally. + * + * No default value. + */ +'profiling.secret' => '', + +/** + * Enable sampling-based profiling. This collects profiling data periodically rather than per-request. + * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data. + * + * The profile data will be stored as a plain text file in the profiling.path directory that can be analyzed with speedscope. + * + * Defaults to ``false`` + */ +'profiling.sample' => false, + +/** + * The rate at which sampling profiling data is collected in seconds. + * A lower value means more frequent samples but higher overhead. + * + * Defaults to ``1`` + */ +'profiling.sample.rate' => 1, + +/** + * How often (in minutes) the sample log files are rotated. + * + * Defaults to ``60`` + */ +'profiling.sample.rotation' => 60, + +/** + * The directory where profiling data is stored. + * + * Note that this directory must be writable by the web server user and will not be cleaned up automatically. + */ +'profiling.path' => '/tmp', + + +/** * Alternate Code Locations * - * Some of the Nextcloud code may be stored in alternate locations. + * Some Nextcloud code may be stored in alternate locations. */ /** @@ -982,19 +1264,24 @@ $CONFIG = [ * seen in the first-run wizard and on Personal pages. * * Defaults to: - * - Desktop client: ``https://nextcloud.com/install/#install-clients`` - * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client`` - * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8`` - * - iOS client app id: ``1125420102`` + * + * - Desktop client: ``https://nextcloud.com/install/#install-clients`` + * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client`` + * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8`` + * - iOS client app ID: ``1125420102`` + * - F-Droid client: ``https://f-droid.org/packages/com.nextcloud.client/`` */ 'customclient_desktop' => - 'https://nextcloud.com/install/#install-clients', + 'https://nextcloud.com/install/#install-clients', 'customclient_android' => - 'https://play.google.com/store/apps/details?id=com.nextcloud.client', + 'https://play.google.com/store/apps/details?id=com.nextcloud.client', 'customclient_ios' => - 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8', + 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8', 'customclient_ios_appid' => - '1125420102', + '1125420102', +'customclient_fdroid' => + 'https://f-droid.org/packages/com.nextcloud.client/', + /** * Apps * @@ -1002,6 +1289,17 @@ $CONFIG = [ */ /** + * Set the default app to open on login. The entry IDs can be retrieved from + * the Navigations OCS API endpoint: https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/core-navigation-get-apps-navigation. + * You can use a comma-separated list of app names, so if the first + * app is not enabled for a user, then Nextcloud will try the second one, and so + * on. If no enabled apps are found, it defaults to the dashboard app. + * + * Defaults to ``dashboard,files`` + */ +'defaultapp' => 'dashboard,files', + +/** * When enabled, admins may install apps from the Nextcloud app store. * * Defaults to ``true`` @@ -1009,8 +1307,8 @@ $CONFIG = [ 'appstoreenabled' => true, /** - * Enables the installation of apps from a self hosted apps store. - * Requires that at least one of the configured apps directories is writeable. + * Enables the installation of apps from a self-hosted apps store. + * Requires that at least one of the configured apps directories is writable. * * Defaults to ``https://apps.nextcloud.com/api/v1`` */ @@ -1063,6 +1361,28 @@ $CONFIG = [ * Defaults to ``true`` */ 'enable_previews' => true, + +/** + * Number of all preview requests being processed concurrently, + * including previews that need to be newly generated, and those that have + * been generated. + * + * This should be greater than 'preview_concurrency_new'. + * If unspecified, defaults to twice the value of 'preview_concurrency_new'. + */ +'preview_concurrency_all' => 8, + +/** + * Number of new previews that are being concurrently generated. + * + * Depending on the max preview size set by 'preview_max_x' and 'preview_max_y', + * the generation process can consume considerable CPU and memory resources. + * It's recommended to limit this to be no greater than the number of CPU cores. + * If unspecified, defaults to the number of CPU cores, or 4 if that cannot + * be determined. + */ +'preview_concurrency_new' => 4, + /** * The maximum width, in pixels, of a preview. A value of ``null`` means there * is no limit. @@ -1089,94 +1409,131 @@ $CONFIG = [ 'preview_max_filesize_image' => 50, /** - * max memory for generating image previews with imagegd (default behavior) + * Max memory for generating image previews with imagegd (default behavior) * Reads the image dimensions from the header and assumes 32 bits per pixel. * If creating the image would allocate more memory, preview generation will * be disabled and the default mimetype icon is shown. Set to -1 for no limit. * - * Defaults to ``128`` megabytes + * Defaults to ``256`` megabytes */ -'preview_max_memory' => 128, +'preview_max_memory' => 256, /** - * custom path for LibreOffice/OpenOffice binary + * Custom path for LibreOffice/OpenOffice binary * * * Defaults to ``''`` (empty string) */ 'preview_libreoffice_path' => '/usr/bin/libreoffice', + /** - * Use this if LibreOffice/OpenOffice requires additional arguments. + * Custom path for ffmpeg binary * - * Defaults to ``''`` (empty string) + * Defaults to ``null`` and falls back to searching ``avconv`` and ``ffmpeg`` + * in the configured ``PATH`` environment + */ +'preview_ffmpeg_path' => '/usr/bin/ffmpeg', + +/** + * Custom path for ffprobe binary + * + * Defaults to ``null`` and falls back to using the same path as ffmpeg. + * ffprobe is typically packaged with ffmpeg and is required for + * enhanced preview generation for HDR videos. */ -'preview_office_cl_parameters' => - ' --headless --nologo --nofirststartwizard --invisible --norestore '. - '--convert-to png --outdir ', +'preview_ffprobe_path' => '/usr/bin/ffprobe', /** * Set the URL of the Imaginary service to send image previews to. - * Also requires the OC\Preview\Imaginary provider to be enabled. + * Also requires the ``OC\Preview\Imaginary`` provider to be enabled in the + * ``enabledPreviewProviders`` array, to create previews for these mimetypes: bmp, + * x-bitmap, png, jpeg, gif, heic, heif, svg+xml, tiff, webp, and illustrator. + * + * If you want Imaginary to also create preview images from PDF documents, you + * have to add the ``OC\Preview\ImaginaryPDF`` provider as well. * * See https://github.com/h2non/imaginary */ 'preview_imaginary_url' => 'http://previews_hpb:8088/', /** + * If you want to set an API key for Imaginary. + */ +'preview_imaginary_key' => 'secret', + +/** * Only register providers that have been explicitly enabled * * The following providers are disabled by default due to performance or privacy * concerns: * - * - OC\Preview\Illustrator - * - OC\Preview\HEIC - * - OC\Preview\Movie - * - OC\Preview\MSOffice2003 - * - OC\Preview\MSOffice2007 - * - OC\Preview\MSOfficeDoc - * - OC\Preview\PDF - * - OC\Preview\Photoshop - * - OC\Preview\Postscript - * - OC\Preview\StarOffice - * - OC\Preview\SVG - * - OC\Preview\TIFF - * - OC\Preview\Font + * - ``OC\Preview\Font`` + * - ``OC\Preview\HEIC`` + * - ``OC\Preview\Illustrator`` + * - ``OC\Preview\Movie`` + * - ``OC\Preview\MSOffice2003`` + * - ``OC\Preview\MSOffice2007`` + * - ``OC\Preview\MSOfficeDoc`` + * - ``OC\Preview\PDF`` + * - ``OC\Preview\Photoshop`` + * - ``OC\Preview\Postscript`` + * - ``OC\Preview\StarOffice`` + * - ``OC\Preview\SVG`` + * - ``OC\Preview\TIFF`` + * - ``OC\Preview\EMF`` * * * Defaults to the following providers: * - * - OC\Preview\BMP - * - OC\Preview\GIF - * - OC\Preview\JPEG - * - OC\Preview\MarkDown - * - OC\Preview\MP3 - * - OC\Preview\PNG - * - OC\Preview\TXT - * - OC\Preview\XBitmap - * - OC\Preview\OpenDocument - * - OC\Preview\Krita + * - ``OC\Preview\BMP`` + * - ``OC\Preview\GIF`` + * - ``OC\Preview\JPEG`` + * - ``OC\Preview\Krita`` + * - ``OC\Preview\MarkDown`` + * - ``OC\Preview\MP3`` + * - ``OC\Preview\OpenDocument`` + * - ``OC\Preview\PNG`` + * - ``OC\Preview\TXT`` + * - ``OC\Preview\XBitmap`` */ 'enabledPreviewProviders' => [ - 'OC\Preview\PNG', - 'OC\Preview\JPEG', - 'OC\Preview\GIF', 'OC\Preview\BMP', - 'OC\Preview\XBitmap', - 'OC\Preview\MP3', - 'OC\Preview\TXT', + 'OC\Preview\GIF', + 'OC\Preview\JPEG', + 'OC\Preview\Krita', 'OC\Preview\MarkDown', + 'OC\Preview\MP3', 'OC\Preview\OpenDocument', - 'OC\Preview\Krita', + 'OC\Preview\PNG', + 'OC\Preview\TXT', + 'OC\Preview\XBitmap', ], /** + * Maximum file size for metadata generation. + * If a file exceeds this size, metadata generation will be skipped. + * Note: memory equivalent to this size will be used for metadata generation. + * + * Default: 256 megabytes. + */ +'metadata_max_filesize' => 256, + +/** + * Maximum file size for file conversion. + * If a file exceeds this size, the file will not be converted. + * + * Default: 100 MiB + */ +'max_file_conversion_filesize' => 100, + +/** * LDAP * * Global settings used by LDAP User and Group Backend */ /** - * defines the interval in minutes for the background job that checks user + * Defines the interval in minutes for the background job that checks user * existence and marks them as ready to be cleaned up. The number is always * minutes. Setting it to 0 disables the feature. * See command line (occ) methods ``ldap:show-remnants`` and ``user:delete`` @@ -1188,7 +1545,8 @@ $CONFIG = [ /** * Sort groups in the user settings by name instead of the user count * - * By enabling this the user count beside the group name is disabled as well. + * By enabling this, the user count beside the group name is disabled as well. + * @deprecated since Nextcloud 29 - Use the frontend instead or set the app config value `group.sortBy` for `core` to `2` */ 'sort_groups_by_name' => false, @@ -1200,7 +1558,7 @@ $CONFIG = [ /** * Replaces the default Comments Manager Factory. This can be utilized if an - * own or 3rdParty CommentsManager should be used that – for instance – uses the + * own or 3rd-party CommentsManager should be used that – for instance – uses the * filesystem instead of the database to keep the comments. * * Defaults to ``\OC\Comments\ManagerFactory`` @@ -1209,7 +1567,7 @@ $CONFIG = [ /** * Replaces the default System Tags Manager Factory. This can be utilized if an - * own or 3rdParty SystemTagsManager should be used that – for instance – uses the + * own or 3rd-party SystemTagsManager should be used that – for instance – uses the * filesystem instead of the database to keep the tags. * * Defaults to ``\OC\SystemTag\ManagerFactory`` @@ -1228,7 +1586,7 @@ $CONFIG = [ * * If you want to prevent users from logging in to Nextcloud before you start * doing some maintenance work, you need to set the value of the maintenance - * parameter to true. Please keep in mind that users who are already logged-in + * parameter to true. Please keep in mind that users who are already logged in * are kicked out of Nextcloud instantly. * * Defaults to ``false`` @@ -1241,14 +1599,22 @@ $CONFIG = [ * Some background jobs only run once a day. When an hour is defined for this config, * the background jobs which advertise themselves as not time sensitive will be * delayed during the "working" hours and only run in the 4 hours after the given time. - * This is e.g. used for activity expiration, suspicious login training and update checks. + * This is, e.g., used for activity expiration, suspicious login training, and update checks. * - * A value of 1 e.g. will only run these background jobs between 01:00am UTC and 05:00am UTC. + * A value of 1, e.g., will only run these background jobs between 01:00am UTC and 05:00am UTC. * * Defaults to ``100`` which disables the feature */ 'maintenance_window_start' => 1, +/** + * Log all LDAP requests into a file + * + * Warning: This heavily decreases the performance of the server and is only + * meant to debug/profile the LDAP interaction manually. + * Also, it might log sensitive data into a plain text file. + */ +'ldap_log_file' => '', /** * SSL @@ -1256,7 +1622,7 @@ $CONFIG = [ /** * Extra SSL options to be used for configuration. - * + * * Defaults to an empty array. */ 'openssl' => [ @@ -1284,7 +1650,7 @@ $CONFIG = [ /** * Memory caching backend for locally stored data * - * * Used for host-specific data, e.g. file paths + * * Used for host-specific data, e.g., file paths * * Defaults to ``none`` */ @@ -1293,7 +1659,7 @@ $CONFIG = [ /** * Memory caching backend for distributed data * - * * Used for installation-specific data, e.g. database caching + * * Used for installation-specific data, e.g., database caching * * If unset, defaults to the value of memcache.local * * Defaults to ``none`` @@ -1301,24 +1667,24 @@ $CONFIG = [ 'memcache.distributed' => '\OC\Memcache\Memcached', /** - * Connection details for redis to use for memory caching in a single server configuration. + * Connection details for Redis to use for memory caching in a single server configuration. * - * For enhanced security it is recommended to configure Redis + * For enhanced security, it is recommended to configure Redis * to require a password. See http://redis.io/topics/security * for more information. * - * We also support redis SSL/TLS encryption as of version 6. + * We also support Redis SSL/TLS encryption as of version 6. * See https://redis.io/topics/encryption for more information. */ 'redis' => [ - 'host' => 'localhost', // can also be a unix domain socket: '/tmp/redis.sock' + 'host' => 'localhost', // can also be a Unix domain socket: '/tmp/redis.sock' 'port' => 6379, 'timeout' => 0.0, 'read_timeout' => 0.0, - 'user' => '', // Optional, if not defined no password will be used. - 'password' => '', // Optional, if not defined no password will be used. - 'dbindex' => 0, // Optional, if undefined SELECT will not run and will use Redis Server's default DB Index. - // If redis in-transit encryption is enabled, provide certificates + 'user' => '', // Optional: if not defined, no password will be used. + 'password' => '', // Optional: if not defined, no password will be used. + 'dbindex' => 0, // Optional: if undefined, SELECT will not run and will use Redis Server's default DB Index. + // If Redis in-transit encryption is enabled, provide certificates // SSL context https://www.php.net/manual/en/context.ssl.php 'ssl_context' => [ 'local_cert' => '/certs/redis.crt', @@ -1328,12 +1694,9 @@ $CONFIG = [ ], /** - * Connection details for a Redis Cluster - * - * Only for use with Redis Clustering, for Sentinel-based setups use the single - * server configuration above, and perform HA on the hostname. + * Connection details for a Redis Cluster. * - * Redis Cluster support requires the php module phpredis in version 3.0.0 or + * Redis Cluster support requires the PHP module phpredis in version 3.0.0 or * higher. * * Available failover modes: @@ -1341,9 +1704,9 @@ $CONFIG = [ * - \RedisCluster::FAILOVER_ERROR - failover to slaves for read commands if master is unavailable (recommended) * - \RedisCluster::FAILOVER_DISTRIBUTE - randomly distribute read commands across master and slaves * - * WARNING: FAILOVER_DISTRIBUTE is a not recommended setting and we strongly + * WARNING: FAILOVER_DISTRIBUTE is a not recommended setting, and we strongly * suggest to not use it if you use Redis for file locking. Due to the way Redis - * is synchronized it could happen, that the read for an existing lock is + * is synchronized, it could happen that the read for an existing lock is * scheduled to a slave that is not fully synchronized with the connected master * which then causes a FileLocked exception. * @@ -1353,16 +1716,16 @@ $CONFIG = [ * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1 */ 'redis.cluster' => [ - 'seeds' => [ // provide some/all of the cluster servers to bootstrap discovery, port required + 'seeds' => [ // provide some or all of the cluster servers to bootstrap discovery, port required 'localhost:7000', 'localhost:7001', ], 'timeout' => 0.0, 'read_timeout' => 0.0, 'failover_mode' => \RedisCluster::FAILOVER_ERROR, - 'user' => '', // Optional, if not defined no password will be used. - 'password' => '', // Optional, if not defined no password will be used. - // If redis in-transit encryption is enabled, provide certificates + 'user' => '', // Optional: if not defined, no password will be used. + 'password' => '', // Optional: if not defined, no password will be used. + // If Redis in-transit encryption is enabled, provide certificates // SSL context https://www.php.net/manual/en/context.ssl.php 'ssl_context' => [ 'local_cert' => '/certs/redis.crt', @@ -1373,10 +1736,11 @@ $CONFIG = [ /** - * Server details for one or more memcached servers to use for memory caching. + * Server details for one or more Memcached servers to use for memory caching. */ 'memcached_servers' => [ - // hostname, port and optional weight. Also see: + // hostname, port and optional weight + // or path and port 0 for Unix socket. Also see: // https://www.php.net/manual/en/memcached.addservers.php // https://www.php.net/manual/en/memcached.addserver.php ['localhost', 11211], @@ -1384,7 +1748,7 @@ $CONFIG = [ ], /** - * Connection options for memcached + * Connection options for Memcached */ 'memcached_options' => [ // Set timeouts to 50ms @@ -1403,7 +1767,7 @@ $CONFIG = [ // Enable Binary Protocol \Memcached::OPT_BINARY_PROTOCOL => true, - // Binary serializer vill be enabled if the igbinary PECL module is available + // Binary serializer will be enabled if the igbinary PECL module is available //\Memcached::OPT_SERIALIZER => \Memcached::SERIALIZER_IGBINARY, ], @@ -1434,7 +1798,7 @@ $CONFIG = [ /** * This example shows how to configure Nextcloud to store all files in a - * swift object storage. + * Swift object storage. * * It is important to note that Nextcloud in object store mode will expect * exclusive access to the object store container because it only stores the @@ -1442,19 +1806,18 @@ $CONFIG = [ * database for performance reasons. * * WARNING: The current implementation is incompatible with any app that uses - * direct file IO and circumvents our virtual filesystem. That includes + * direct file I/O and circumvents our virtual filesystem. That includes * Encryption and Gallery. Gallery will store thumbnails directly in the - * filesystem and encryption will cause severe overhead because key files need + * filesystem, and encryption will cause severe overhead because key files need * to be fetched in addition to any requested file. * - * One way to test is applying for a trystack account at http://trystack.org/ */ 'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\Swift', 'arguments' => [ - // trystack will use your facebook id as the user name + // trystack will use your Facebook ID as the username 'username' => 'facebook100000123456789', - // in the trystack dashboard go to user -> settings -> API Password to + // in the trystack dashboard, go to user -> settings -> API Password to // generate a password 'password' => 'Secr3tPaSSWoRdt7', // must already exist in the objectstore, name can be different @@ -1467,18 +1830,20 @@ $CONFIG = [ 'region' => 'RegionOne', // The Identity / Keystone endpoint 'url' => 'http://8.21.28.222:5000/v2.0', + // uploadPartSize: size of the uploaded chunks, defaults to 524288000 + 'uploadPartSize' => 524288000, // required on dev-/trystack 'tenantName' => 'facebook100000123456789', // dev-/trystack uses swift by default, the lib defaults to 'cloudFiles' // if omitted 'serviceName' => 'swift', - // The Interface / url Type, optional + // The Interface / URL Type, optional 'urlType' => 'internal' ], ], /** - * To use swift V3 + * To use Swift V3 */ 'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\Swift', @@ -1508,17 +1873,17 @@ $CONFIG = [ ], /** - * If this is set to true and a multibucket object store is configured then + * If this is set to true and a multibucket object store is configured, then * newly created previews are put into 256 dedicated buckets. * - * Those buckets are named like the mulibucket version but with the postfix + * Those buckets are named like the multibucket version but with the postfix * ``-preview-NUMBER`` where NUMBER is between 0 and 255. * * Keep in mind that only previews of files are put in there that don't have - * some already. Otherwise the old bucket will be used. + * some already. Otherwise, the old bucket will be used. * - * To migrate existing previews to this new multibucket distribution of previews - * use the occ command ``preview:repair``. For now this will only migrate + * To migrate existing previews to this new multibucket distribution of previews, + * use the occ command ``preview:repair``. For now, this will only migrate * previews that were generated before Nextcloud 19 in the flat * ``appdata_INSTANCEID/previews/FILEID`` folder structure. */ @@ -1533,7 +1898,7 @@ $CONFIG = [ /** * Replaces the default Share Provider Factory. This can be utilized if - * own or 3rdParty Share Providers are used that – for instance – use the + * own or 3rd-party Share Providers are used that – for instance – use the * filesystem instead of the database to keep the share information. * * Defaults to ``\OC\Share20\ProviderFactory`` @@ -1542,8 +1907,8 @@ $CONFIG = [ /** * Enables expiration for link share passwords sent by email (sharebymail). - * The passwords will expire after the configured interval, the users can - * still request a new one in the public link page. + * The passwords will expire after the configured interval; the users can + * still request a new one on the public link page. */ 'sharing.enable_mail_link_password_expiration' => false, @@ -1556,9 +1921,9 @@ $CONFIG = [ * Define max number of results returned by the search for auto-completion of * users, groups, etc. The value must not be lower than 0 (for unlimited). * - * If more, different sources are requested (e.g. different user backends; or + * If more, different sources are requested (e.g., different user backends; or * both users and groups), the value is applied per source and might not be - * truncated after collecting the results. I.e. more results can appear than + * truncated after collecting the results. I.e., more results can appear than * configured here. * * Default is 25. @@ -1583,12 +1948,20 @@ $CONFIG = [ 'sharing.force_share_accept' => false, /** - * Set to false to prevent users from setting a custom share_folder + * Set to ``false`` to prevent users from setting a custom share_folder */ 'sharing.allow_custom_share_folder' => true, /** - * Set to false to stop sending a mail when users receive a share + * Define a default folder for shared files and folders other than root. + * Changes to this value will only have effect on new shares. + * + * Defaults to ``/`` + */ +'share_folder' => '/', + +/** + * Set to ``false`` to stop sending a mail when users receive a share */ 'sharing.enable_share_mail' => true, @@ -1606,17 +1979,69 @@ $CONFIG = [ 'transferIncomingShares' => false, /** + * Federated Cloud Sharing + */ + +/** + * Allow self-signed certificates for federated shares + */ +'sharing.federation.allowSelfSignedCertificates' => false, + +/** + * Hashing + */ + +/** + * By default, Nextcloud will use the Argon2 password hashing if available. + * However, if for whatever reason you want to stick with the PASSWORD_DEFAULT + * of your PHP version, then set the setting to true. + * + * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its + * own and exposes its configuration options as following. More information can + * be found at: https://www.php.net/manual/en/function.password-hash.php + */ +'hashing_default_password' => false, + +/** + * The number of CPU threads to be used by the algorithm for computing a hash. + * The value must be an integer, and the minimum value is 1. Rationally, it does + * not help to provide a number higher than the available threads on the machine. + * Values that undershoot the minimum will be ignored in favor of the minimum. + */ +'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS, + +/** + * The memory in KiB to be used by the algorithm for computing a hash. The value + * must be an integer, and the minimum value is 8 times the number of CPU threads. + * Values that undershoot the minimum will be ignored in favor of the minimum. + */ +'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, + +/** + * The number of iterations that are used by the algorithm for computing a hash. + * The value must be an integer, and the minimum value is 1. Values that + * undershoot the minimum will be ignored in favor of the minimum. + */ +'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, + +/** + * The hashing cost used by hashes generated by Nextcloud + * Using a higher value requires more time and CPU power to calculate the hashes + */ +'hashingCost' => 10, + +/** * All other configuration options */ /** - * Additional driver options for the database connection, eg. to enable SSL + * Additional driver options for the database connection, e.g., to enable SSL * encryption in MySQL or specify a custom wait timeout on a cheap hoster. * * When setting up TLS/SSL for encrypting the connections, you need to ensure that - * the passed keys and certificates are readable by the PHP process. In addition + * the passed keys and certificates are readable by the PHP process. In addition, * PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT might need to be set to false, if the - * database servers certificates CN does not match with the hostname used to connect. + * database server's certificate CN does not match with the hostname used to connect. * The standard behavior here is different from the MySQL/MariaDB CLI client, which * does not verify the server cert except --ssl-verify-server-cert is passed manually. */ @@ -1629,31 +2054,31 @@ $CONFIG = [ ], /** - * sqlite3 journal mode can be specified using this configuration parameter - - * can be 'WAL' or 'DELETE' see for more details https://www.sqlite.org/wal.html + * SQLite3 journal mode can be specified using this configuration parameter - + * can be 'WAL' or 'DELETE'. See https://www.sqlite.org/wal.html for more details. */ 'sqlite.journal_mode' => 'DELETE', /** * During setup, if requirements are met (see below), this setting is set to true - * and MySQL can handle 4 byte characters instead of 3 byte characters. + * to enable MySQL to handle 4-byte characters instead of 3-byte characters. * - * If you want to convert an existing 3-byte setup into a 4-byte setup please - * set the parameters in MySQL as mentioned below and run the migration command: + * To convert an existing 3-byte setup to a 4-byte setup, configure the MySQL + * parameters as described below and run the migration command: * ./occ db:convert-mysql-charset - * The config setting will be set automatically after a successful run. + * This config setting will be automatically updated after a successful migration. * - * Consult the documentation for more details. + * Refer to the documentation for more details. * - * MySQL requires a special setup for longer indexes (> 767 bytes) which are - * needed: + * MySQL requires specific settings for longer indexes (> 767 bytes), which are + * necessary for 4-byte character support: * * [mysqld] * innodb_large_prefix=ON * innodb_file_format=Barracuda * innodb_file_per_table=ON * - * Tables will be created with + * Tables will be created with: * * character set: utf8mb4 * * collation: utf8mb4_bin * * row_format: dynamic @@ -1668,33 +2093,32 @@ $CONFIG = [ 'mysql.utf8mb4' => false, /** - * For search queries in the database, a default collation – depending on the - * character set – is chosen. In some cases a different behaviour is desired, - * for instances when a accent sensitive search is desired. + * For search queries in the database, a default collation is chosen based on the + * character set. In some cases, a different collation is desired, such as for + * accent-sensitive searches. * - * MariaDB and MySQL have an overlap in available collations, but also - * incompatible ones, also depending on the version of the database server. + * MariaDB and MySQL share some collations, but also have incompatible ones, + * depending on the database server version. * - * This option allows to override the automatic choice. Example: + * This option allows overriding the automatic collation choice. Example: * * 'mysql.collation' => 'utf8mb4_0900_as_ci', * - * This setting has no effect on setup or creating tables. In those cases - * always utf8[mb4]_bin is being used. This setting is only taken into - * consideration in SQL queries that utilize LIKE comparison operators. + * This setting does not affect table creation or setup, where utf8[mb4]_bin is + * always used. It applies only to SQL queries using LIKE comparison operators. */ 'mysql.collation' => null, /** - * Database types that are supported for installation. + * Database types supported for installation. * * Available: - * - sqlite (SQLite3) - * - mysql (MySQL) - * - pgsql (PostgreSQL) - * - oci (Oracle) + * - sqlite (SQLite3) + * - mysql (MySQL) + * - pgsql (PostgreSQL) + * - oci (Oracle) * - * Defaults to the following databases: + * Defaults to: * - sqlite (SQLite3) * - mysql (MySQL) * - pgsql (PostgreSQL) @@ -1707,88 +2131,103 @@ $CONFIG = [ ], /** - * Override where Nextcloud stores temporary files. Useful in situations where - * the system temporary directory is on a limited space ramdisk or is otherwise - * restricted, or if external storage which do not support streaming are in - * use. + * Override the location where Nextcloud stores temporary files. Useful in setups + * where the system temporary directory is on a limited-space ramdisk, restricted, + * or when using external storage that does not support streaming. * - * The Web server user must have write access to this directory. + * The web server user/PHP must have write access to this directory. Ensure that + * PHP configuration recognizes this as a valid temporary directory by setting + * the TMP, TMPDIR, and TEMP environment variables accordingly. Additional + * permissions may be required for AppArmor or SELinux. */ 'tempdirectory' => '/tmp/nextcloudtemp', /** - * Hashing - */ - -/** - * By default Nextcloud will use the Argon2 password hashing if available. - * However if for whatever reason you want to stick with the PASSWORD_DEFAULT - * of your php version. Then set the setting to true. - */ -'hashing_default_password' => false, - -/** + * Override the location where Nextcloud stores update files during updates. + * Useful when the default `datadirectory` is on a network disk like NFS or is + * otherwise restricted. Defaults to the value of `datadirectory` if unset. * - * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its - * own and exposes its configuration options as following. More information can - * be found at: https://www.php.net/manual/en/function.password-hash.php + * If set, the directory must be located outside the Nextcloud installation + * directory and writable by the web server user. */ +'updatedirectory' => '', /** - * The number of CPU threads to be used by the algorithm for computing a hash. - * The value must be an integer, and the minimum value is 1. Rationally it does - * not help to provide a number higher than the available threads on the machine. - * Values that undershoot the minimum will be ignored in favor of the minimum. + * Block specific files or filenames, disallowing uploads or access (read and write). + * ``.htaccess`` is blocked by default. + * + * WARNING: Use this only if you understand the implications. + * + * Note: This list is case-insensitive. + * + * Defaults to ``['.htaccess']`` */ -'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS, +'forbidden_filenames' => ['.htaccess'], /** - * The memory in KiB to be used by the algorithm for computing a hash. The value - * must be an integer, and the minimum value is 8 times the number of CPU threads. - * Values that undershoot the minimum will be ignored in favor of the minimum. + * Disallow uploads of files with specific basenames. Matching existing files + * cannot be updated, and no new files can be created in matching folders. + * + * The basename is the filename without the extension, e.g., for "archive.tar.gz", + * the basename is "archive". + * + * Note: This list is case-insensitive. + * + * Defaults to ``[]`` (empty array) */ -'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, +'forbidden_filename_basenames' => [], /** - * The number of iterations that are used by the algorithm for computing a hash. - * The value must be an integer, and the minimum value is 1. Values that - * undershoot the minimum will be ignored in favor of the minimum. + * Block specific characters in filenames. Useful for filesystems or operating + * systems (e.g., Windows) that do not support certain characters. Matching + * existing files cannot be updated, and no new files can be created in matching + * folders. + * + * The '/' and '\' characters, as well as ASCII characters [0-31], are always + * forbidden. + * + * Example for Windows: ``['?', '<', '>', ':', '*', '|', '"']`` + * See: https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits + * + * Defaults to ``[]`` (empty array) */ -'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, +'forbidden_filename_characters' => [], /** - * The hashing cost used by hashes generated by Nextcloud - * Using a higher value requires more time and CPU power to calculate the hashes + * Deny specific file extensions. Matching existing files cannot be updated, and + * no new files can be created in matching folders. + * + * The '.part' extension is always forbidden, as it is used internally by Nextcloud. + * + * Defaults to ``['.filepart', '.part']`` */ -'hashingCost' => 10, +'forbidden_filename_extensions' => ['.part', '.filepart'], /** - * Blacklist a specific file or files and disallow the upload of files - * with this name. ``.htaccess`` is blocked by default. - * WARNING: USE THIS ONLY IF YOU KNOW WHAT YOU ARE DOING. + * Specify the name of a theme to apply to Nextcloud. Themes are located in + * ``nextcloud/themes/`` by default. * - * Defaults to ``array('.htaccess')`` + * Defaults to the theming app, included since Nextcloud 9. */ -'blacklisted_files' => ['.htaccess'], +'theme' => '', /** - * Define a default folder for shared files and folders other than root. - * Changes to this value will only have effect on new shares. - * - * Defaults to ``/`` + * Enforce a specific user theme, disabling user theming settings. Must be a + * valid ITheme ID, e.g., dark, dark-highcontrast, default, light, + * light-highcontrast, opendyslexic. */ -'share_folder' => '/', +'enforce_theme' => '', /** - * If you are applying a theme to Nextcloud, enter the name of the theme here. - * The default location for themes is ``nextcloud/themes/``. + * Enable or disable Progressive Web App (PWA) functionality, which allows + * browsers to open web applications in dedicated windows. * - * Defaults to the theming app which is shipped since Nextcloud 9 + * Defaults to ``true`` */ -'theme' => '', +'theming.standalone_window.enabled' => true, /** - * The default cipher for encrypting files. Currently supported are: + * Specify the default cipher for encrypting files. Supported ciphers: * - AES-256-CTR * - AES-128-CTR * - AES-256-CFB @@ -1799,353 +2238,511 @@ $CONFIG = [ 'cipher' => 'AES-256-CTR', /** - * The minimum Nextcloud desktop client version that will be allowed to sync with - * this server instance. All connections made from earlier clients will be denied - * by the server. Defaults to the minimum officially supported Nextcloud desktop - * clientversion at the time of release of this server version. + * Use the legacy base64 format for encrypted files instead of the more + * space-efficient binary format. This affects only newly written files; existing + * encrypted files remain readable regardless of the format. + * + * Defaults to ``false`` + */ +'encryption.use_legacy_base64_encoding' => false, + +/** + * Specify the minimum Nextcloud desktop client version allowed to sync with this + * server. Connections from earlier clients will be denied. Defaults to the + * minimum officially supported version at the time of this server release. + * + * Changing this may cause older, unsupported clients to malfunction, potentially + * leading to data loss or unexpected behavior. * - * When changing this, note that older unsupported versions of the Nextcloud desktop - * client may not function as expected, and could lead to permanent data loss for - * clients or other unexpected results. + * Defaults to ``3.1.0`` + */ +'minimum.supported.desktop.version' => '3.1.0', + +/** + * Specify the maximum Nextcloud desktop client version allowed to sync with this + * server. Connections from later clients will be denied. * - * Defaults to ``2.0.0`` + * Defaults to ``99.99.99`` */ -'minimum.supported.desktop.version' => '2.0.0', +'maximum.supported.desktop.version' => '99.99.99', /** - * Option to allow local storage to contain symlinks. - * WARNING: Not recommended. This would make it possible for Nextcloud to access - * files outside the data directory and could be considered a security risk. + * Allow local storage to contain symlinks. + * WARNING: Not recommended, as this allows Nextcloud to access files outside the + * data directory, posing a potential security risk. * * Defaults to ``false`` */ 'localstorage.allowsymlinks' => false, /** - * EXPERIMENTAL: option whether to include external storage in quota - * calculation, defaults to false. + * Nextcloud overrides umask to ensure suitable access permissions regardless of + * web server or PHP-FPM configuration. Modifying this value has security + * implications and may cause issues with the installation. + * + * Most installations should not modify this value. + * + * Defaults to ``0022`` + */ +'localstorage.umask' => 0022, + +/** + * Allow storage systems that do not support modifying existing files to overcome + * this limitation by removing files before overwriting. + * + * Defaults to ``false`` + */ +'localstorage.unlink_on_truncate' => false, + +/** + * EXPERIMENTAL: Include external storage in quota calculations. * * Defaults to ``false`` */ 'quota_include_external_storage' => false, /** - * When an external storage is unavailable for some reasons, it will be flagged - * as such for 10 minutes. When the trigger is a failed authentication attempt - * the delay is higher and can be controlled with this option. The motivation - * is to make account lock outs at Active Directories (and compatible) more - * unlikely. + * When an external storage is unavailable (e.g., due to failed authentication), + * it is flagged as such for a specified duration. For authentication failures, + * this delay can be customized to reduce the likelihood of account lockouts in + * systems like Active Directory. * - * Defaults to ``1800`` (seconds) + * Defaults to ``1800`` seconds (30 minutes) */ 'external_storage.auth_availability_delay' => 1800, /** - * Allows to create external storages of type "Local" in the web interface and APIs. - * - * When disable, it is still possible to create local storages with occ using - * the following command: + * Allow creation of external storages of type "Local" via the web interface and + * APIs. When disabled, local storages can still be created using the occ command: * - * % php occ files_external:create /mountpoint local null::null -c datadir=/path/to/data + * occ files_external:create /mountpoint local null::null -c datadir=/path/to/data * * Defaults to ``true`` - * */ 'files_external_allow_create_new_local' => true, /** - * Specifies how often the local filesystem (the Nextcloud data/ directory, and - * NFS mounts in data/) is checked for changes made outside Nextcloud. This - * does not apply to external storage. - * - * 0 -> Never check the filesystem for outside changes, provides a performance - * increase when it's certain that no changes are made directly to the - * filesystem + * Specify how often the local filesystem (Nextcloud data/ directory and NFS + * mounts in data/) is checked for changes made outside Nextcloud. This does not + * apply to external storage. * + * 0 -> Never check the filesystem for outside changes, improving performance + * when no external changes are expected. * 1 -> Check each file or folder at most once per request, recommended for - * general use if outside changes might happen. + * general use if outside changes are possible. * * Defaults to ``0`` */ 'filesystem_check_changes' => 0, /** - * By default Nextcloud will store the part files created during upload in the - * same storage as the upload target. Setting this to false will store the part - * files in the root of the users folder which might be required to work with certain - * external storage setups that have limited rename capabilities. + * Store part files created during upload in the same storage as the upload + * target. Setting this to false stores part files in the root of the user's + * folder, which may be necessary for external storage with limited rename + * capabilities. * * Defaults to ``true`` */ 'part_file_in_storage' => true, /** - * Where ``mount.json`` file should be stored, defaults to ``data/mount.json`` - * in the Nextcloud directory. + * Specify the location of the ``mount.json`` file. * * Defaults to ``data/mount.json`` in the Nextcloud directory. */ 'mount_file' => '/var/www/nextcloud/data/mount.json', /** - * When ``true``, prevent Nextcloud from changing the cache due to changes in - * the filesystem for all storage. + * Prevent Nextcloud from updating the cache due to filesystem changes for all + * storage. * * Defaults to ``false`` */ 'filesystem_cache_readonly' => false, /** - * Secret used by Nextcloud for various purposes, e.g. to encrypt data. If you - * lose this string there will be data corruption. - */ -'secret' => '', - -/** - * List of trusted proxy servers - * - * You may set this to an array containing a combination of - * - IPv4 addresses, e.g. `192.168.2.123` - * - IPv4 ranges in CIDR notation, e.g. `192.168.2.0/24` - * - IPv6 addresses, e.g. `fd9e:21a7:a92c:2323::1` + * List of trusted proxy servers. Supported formats: + * - IPv4 addresses, e.g., `192.168.2.123` + * - IPv4 ranges in CIDR notation, e.g., `192.168.2.0/24` + * - IPv6 addresses, e.g., `fd9e:21a7:a92c:2323::1` + * - IPv6 ranges in CIDR notation, e.g., `2001:db8:85a3:8d3:1319:8a20::/95` * - * _(CIDR notation for IPv6 is currently work in progress and thus not - * available as of yet)_ + * If a request's `REMOTE_ADDR` matches an address here, it is treated as a proxy, + * and the client IP is read from the HTTP header specified in + * `forwarded_for_headers` instead of `REMOTE_ADDR`. * - * When an incoming request's `REMOTE_ADDR` matches any of the IP addresses - * specified here, it is assumed to be a proxy instead of a client. Thus, the - * client IP will be read from the HTTP header specified in - * `forwarded_for_headers` instead of from `REMOTE_ADDR`. + * Ensure `forwarded_for_headers` is configured if `trusted_proxies` is set. * - * So if you configure `trusted_proxies`, also consider setting - * `forwarded_for_headers` which otherwise defaults to `HTTP_X_FORWARDED_FOR` - * (the `X-Forwarded-For` header). - * - * Defaults to an empty array. + * Defaults to ``[]`` (empty array) */ 'trusted_proxies' => ['203.0.113.45', '198.51.100.128', '192.168.2.0/24'], /** - * Headers that should be trusted as client IP address in combination with - * `trusted_proxies`. If the HTTP header looks like 'X-Forwarded-For', then use - * 'HTTP_X_FORWARDED_FOR' here. + * Headers trusted as containing the client IP address when used with + * `trusted_proxies`. For example, use `HTTP_X_FORWARDED_FOR` for the + * `X-Forwarded-For` header. * - * If set incorrectly, a client can spoof their IP address as visible to - * Nextcloud, bypassing access controls and making logs useless! + * Incorrect configuration allows clients to spoof their IP address, bypassing + * access controls and rendering logs unreliable. * - * Defaults to ``'HTTP_X_FORWARDED_FOR'`` + * Defaults to ``['HTTP_X_FORWARDED_FOR']`` */ 'forwarded_for_headers' => ['HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'], /** - * max file size for animating gifs on public-sharing-site. - * If the gif is bigger, it'll show a static preview + * List of trusted IP ranges for admin actions. If non-empty, all admin actions + * must originate from IPs within these ranges. * - * Value represents the maximum filesize in megabytes. Set to ``-1`` for - * no limit. + * Supported formats: + * - IPv4 addresses or ranges, e.g., `192.0.2.42/32`, `233.252.0.0/24` + * - IPv6 addresses or ranges, e.g., `2001:db8::13:37/64` * - * Defaults to ``10`` megabytes + * Defaults to ``[]`` (empty array) */ -'max_filesize_animated_gifs_public_sharing' => 10, - +'allowed_admin_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'], /** - * Enables transactional file locking. - * This is enabled by default. + * Maximum file size (in megabytes) for animating GIFs on public sharing pages. + * If a GIF exceeds this size, a static preview is shown. * - * Prevents concurrent processes from accessing the same files - * at the same time. Can help prevent side effects that would - * be caused by concurrent operations. Mainly relevant for - * very large installations with many users working with - * shared files. + * Set to ``-1`` for no limit. * - * Defaults to ``true`` + * Defaults to ``10`` megabytes */ -'filelocking.enabled' => true, +'max_filesize_animated_gifs_public_sharing' => 10, /** - * Set the lock's time-to-live in seconds. + * Set the lock's time-to-live (TTL) in seconds. Locks older than this are + * automatically cleaned up. * - * Any lock older than this will be automatically cleaned up. - * - * Defaults to ``60*60`` seconds (1 hour) or the php - * max_execution_time, whichever is higher. + * Defaults to ``3600`` seconds (1 hour) or the PHP `max_execution_time`, + * whichever is higher. */ 'filelocking.ttl' => 60*60, /** - * Memory caching backend for file locking - * - * Because most memcache backends can clean values without warning using redis - * is highly recommended to *avoid data loss*. + * Memory caching backend for file locking. Redis is highly recommended to avoid + * data loss, as many memcache backends may evict values unexpectedly. * * Defaults to ``none`` */ 'memcache.locking' => '\\OC\\Memcache\\Redis', /** - * Enable locking debug logging + * Enable debug logging for file locking. This can generate a large volume of log + * entries, potentially causing performance degradation and large log files on + * busy instances. * - * Note that this can lead to a very large volume of log items being written which can lead - * to performance degradation and large log files on busy instance. + * Use with `log.condition` to limit logging in production environments. * - * Thus enabling this in production for longer periods of time is not recommended - * or should be used together with the ``log.condition`` setting. + * Defaults to ``false`` */ 'filelocking.debug' => false, /** - * Disable the web based updater + * Disable the web-based updater. + * + * Defaults to ``false`` */ 'upgrade.disable-web' => false, /** - * Set this Nextcloud instance to debugging mode - * - * Only enable this for local development and not in production environments - * This will disable the minifier and outputs some additional debug information + * Customize the CLI upgrade documentation link. + */ +'upgrade.cli-upgrade-link' => '', + +/** + * Customize the server logs documentation link for exception handling. + */ +'documentation_url.server_logs' => '', + +/** + * Enable debugging mode for Nextcloud. Only use for local development, not in + * production, as it disables minification and outputs additional debug + * information. * * Defaults to ``false`` */ 'debug' => false, /** - * Sets the data-fingerprint of the current data served - * - * This is a property used by the clients to find out if a backup has been - * restored on the server. Once a backup is restored run + * Set the data fingerprint for the current data served. Used by clients to + * detect if a backup has been restored. Update this by running: * ./occ maintenance:data-fingerprint - * To set this to a new value. * - * Updating/Deleting this value can make connected clients stall until - * the user has resolved conflicts. + * Changing or deleting this value may cause connected clients to stall until + * conflicts are resolved. * * Defaults to ``''`` (empty string) */ 'data-fingerprint' => '', /** - * This entry is just here to show a warning in case somebody copied the sample - * configuration. DO NOT ADD THIS SWITCH TO YOUR CONFIGURATION! + * This entry serves as a warning if the sample configuration was copied. + * DO NOT ADD THIS TO YOUR CONFIGURATION! * - * If you, brave person, have read until here be aware that you should not - * modify *ANY* settings in this file without reading the documentation. + * Ensure all settings are modified only after consulting the documentation. */ 'copied_sample_config' => true, /** - * use a custom lookup server to publish user data + * Use a custom lookup server to publish user data. + * + * Defaults to ``https://lookup.nextcloud.com`` */ 'lookup_server' => 'https://lookup.nextcloud.com', /** - * set to true if the server is used in a setup based on Nextcloud's Global Scale architecture + * Enable Nextcloud's Global Scale architecture. + * + * Defaults to ``false`` */ 'gs.enabled' => false, /** - * by default federation is only used internally in a Global Scale setup - * If you want to allow federation outside of your environment set it to 'global' + * Configure federation for Global Scale setups. Set to 'global' to allow + * federation outside the environment. + * + * Defaults to ``internal`` */ 'gs.federation' => 'internal', /** - * List of incompatible user agents opted out from Same Site Cookie Protection. - * Some user agents are notorious and don't really properly follow HTTP - * specifications. For those, have an opt-out. + * List of user agents exempt from SameSite cookie protection due to non-standard + * HTTP behavior. * - * WARNING: only use this if you know what you are doing + * WARNING: Use only if you understand the implications. + * + * Defaults to: + * - /^WebDAVFS/ (OS X Finder) + * - /^Microsoft-WebDAV-MiniRedir/ (Windows WebDAV drive) */ 'csrf.optout' => [ '/^WebDAVFS/', // OS X Finder - '/^Microsoft-WebDAV-MiniRedir/', // Windows webdav drive + '/^Microsoft-WebDAV-MiniRedir/', // Windows WebDAV drive ], /** - * By default there is on public pages a link shown that allows users to - * learn about the "simple sign up" - see https://nextcloud.com/signup/ + * Specify allowed user agents for Login Flow V2 using regular expressions. + * User agents not matching this list are denied access to Login Flow V2. + * + * WARNING: Use only if you understand the implications. + * + * Example: Allow only the Nextcloud Android app: + * 'core.login_flow_v2.allowed_user_agents' => ['/Nextcloud-android/i'], * - * If this is set to "false" it will not show the link. + * Defaults to ``[]`` (empty array) */ -'simpleSignUpLink.shown' => true, +'core.login_flow_v2.allowed_user_agents' => [], /** - * By default autocompletion is enabled for the login form on Nextcloud's login page. - * While this is enabled, browsers are allowed to "remember" login names and such. - * Some companies require it to be disabled to comply with their security policy. + * Show or hide the "simple sign up" link on public pages. + * See: https://nextcloud.com/signup/ * - * Simply set this property to "false", if you want to turn this feature off. + * Defaults to ``true`` */ +'simpleSignUpLink.shown' => true, +/** + * Enable or disable autocompletion for the login form. Disabling this prevents + * browsers from remembering login credentials, which may be required for + * compliance with certain security policies. + * + * Defaults to ``true`` + */ 'login_form_autocomplete' => true, /** - * Disable background scanning of files + * Set a timeout (in seconds) for the login form. After this period, the form is + * reset to prevent password leaks on public devices if the user forgets to clear + * it. * - * By default, a background job runs every 10 minutes and execute a background - * scan to sync filesystem and database. Only users with unscanned files - * (size < 0 in filecache) are included. Maximum 500 users per job. + * A value of 0 disables the timeout. * - * Defaults to ``true`` + * Defaults to ``300`` seconds (5 minutes) + */ +'login_form_timeout' => 300, + +/** + * Suppress warnings for outdated or unsupported browsers. When enabled, users + * can bypass the warning after reading it. + * + * Set to ``true`` to disable the warning. + * + * Defaults to ``false`` + */ +'no_unsupported_browser_warning' => false, + +/** + * Disable background scanning of files. When enabled, a background job runs + * every 10 minutes to sync the filesystem and database for up to 500 users with + * unscanned files (size < 0 in filecache). + * + * Defaults to ``false`` */ 'files_no_background_scan' => false, /** - * Log all queries into a file + * Log all database queries to a file. * - * Warning: This heavily decreases the performance of the server and is only - * meant to debug/profile the query interaction manually. - * Also, it might log sensitive data into a plain text file. + * WARNING: This significantly reduces server performance and is intended only + * for debugging or profiling query interactions. Sensitive data may be logged in + * plain text. */ 'query_log_file' => '', /** - * Log all redis requests into a file + * Prefix all queries with the request ID when set to `yes`. * - * Warning: This heavily decreases the performance of the server and is only - * meant to debug/profile the redis interaction manually. - * Also, it might log sensitive data into a plain text file. + * Requires `query_log_file` to be set. */ -'redis_log_file' => '', +'query_log_file_requestid' => '', /** - * Log all LDAP requests into a file + * Include all query parameters in the query log when set to `yes`. * - * Warning: This heavily decreases the performance of the server and is only - * meant to debug/profile the LDAP interaction manually. - * Also, it might log sensitive data into a plain text file. + * Requires `query_log_file` to be set. + * WARNING: This may log sensitive data in plain text. */ -'ldap_log_file' => '', +'query_log_file_parameters' => '', + +/** + * Include a backtrace in the query log when set to `yes`. + * + * Requires `query_log_file` to be set. + */ +'query_log_file_backtrace' => '', /** - * Enable diagnostics event logging + * Log all Redis requests to a file. * - * If enabled the timings of common execution steps will be logged to the - * Nextcloud log at debug level. log.condition is useful to enable this on - * production systems to only log under some conditions + * WARNING: This significantly reduces server performance and is intended only + * for debugging or profiling Redis interactions. Sensitive data may be logged in + * plain text. + */ +'redis_log_file' => '', + +/** + * Enable diagnostics event logging. Logs timings of common execution steps at + * debug level. Use with `log.condition` to enable conditionally in production. + * + * Defaults to ``true`` */ 'diagnostics.logging' => true, /** - * Limit diagnostics event logging to events longer than the configured threshold in ms + * Limit diagnostics event logging to events longer than the specified threshold + * (in milliseconds). A value of 0 disables diagnostics event logging. */ 'diagnostics.logging.threshold' => 0, /** - * Enable profile globally + * Enable profiling globally. * * Defaults to ``true`` */ 'profile.enabled' => true, /** - * Enable file metadata collection + * Override default scopes for account data. Valid properties and scopes are + * defined in ``OCP\Accounts\IAccountManager``. Values are merged with defaults + * from ``OC\Accounts\AccountManager``. + * + * Example: Set phone property to private scope: + * ``[\OCP\Accounts\IAccountManager::PROPERTY_PHONE => \OCP\Accounts\IAccountManager::SCOPE_PRIVATE]`` + */ +'account_manager.default_property_scope' => [], + +/** + * Enable the deprecated Projects feature, superseded by Related Resources since + * Nextcloud 25. + * + * Defaults to ``false`` + */ +'projects.enabled' => false, + +/** + * Enable the bulk upload feature. + * + * Defaults to ``true`` + */ +'bulkupload.enabled' => true, + +/** + * Enable fetching Open Graph metadata from remote URLs. + * + * Defaults to ``true`` + */ +'reference_opengraph' => true, + +/** + * Enable the legacy unified search. + * + * Defaults to ``false`` + */ +'unified_search.enabled' => false, + +/** + * Enable features that do not yet comply with accessibility standards. + * + * Defaults to ``true`` + */ +'enable_non-accessible_features' => true, + +/** + * Directories where Nextcloud searches for external binaries (e.g., LibreOffice, + * sendmail, ffmpeg). + * + * Defaults to: + * - /usr/local/sbin + * - /usr/local/bin + * - /usr/sbin + * - /usr/bin + * - /sbin + * - /bin + * - /opt/bin + */ +'binary_search_paths' => [ + '/usr/local/sbin', + '/usr/local/bin', + '/usr/sbin', + '/usr/bin', + '/sbin', + '/bin', + '/opt/bin', +], + +/** + * Maximum chunk size for chunked uploads (in bytes). Larger chunks increase + * throughput but yield diminishing returns above 100 MiB. Services like + * Cloudflare may limit to 100 MiB. * - * This is helpful for the mobile clients and will enable a few optimization in - * the future for the preview generation. + * Defaults to ``100 * 1024 * 1024`` (100 MiB) + */ +'files.chunked_upload.max_size' => 100 * 1024 * 1024, + +/** + * Maximum number of chunks uploaded in parallel during chunked uploads. Higher + * counts increase throughput but consume more server resources, with diminishing + * returns. * - * Note that when enabled, this data will be stored in the database and might increase - * the database storage. + * Defaults to ``5`` + */ +'files.chunked_upload.max_parallel_count' => 5, + +/** + * Allow users to manually delete files from their trashbin. Automated deletions + * (e.g., due to low quota) are unaffected. + * + * Defaults to ``true`` + */ +'files.trash.delete' => true, + +/** + * Enable PHP 8.4 lazy objects for Dependency Injection to improve performance by + * avoiding instantiation of unused objects. + * + * Defaults to ``true`` */ -'enable_file_metadata' => true, +'enable_lazy_objects' => true, ]; |