8 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	962bc359a7	nextcloud: repair only the module's own account, read its existence from the user list, no admin group (issue 1253, review 1) ... occ's user:info says 'user not found' on stdout with an empty stderr, so the error read as 'occ produced no output' and mesh-admin was never made on novox: occ now says stderr and stdout both, and existence is read from user:list. The repair could reset whatever account the user setting names, the operator's included, and the 'admin' fallback is a hand-made install's human administrator: only mesh-admin is repaired now, and it is the default. The shares poll needs no admin rights, so the account gets no group. After a repair the throttle of the caller's address is reset, and a failing repair reaches the back-off's one loud line with occ's message.	2026-10-25 16:54:51 +01:00
jschoubben	67b13c42d3	nextcloud: repair the account on a throttle too, since a throttle follows refusals (issue 1253) ... Right after the delivery the first answer may be Nextcloud's 429, not a 401; without a repair then the account would never be made and the back-off would wait out a throttle that cannot end.	2026-10-25 16:40:54 +01:00
jschoubben	4021724ca4	nextcloud: make the mesh's own account match its secret when Nextcloud refuses it, and back off a refusal that stays (issue 1253) ... The image creates NEXTCLOUD_ADMIN_USER only on a fresh install. novox's instance was installed before the mesh adopted it, so mesh-admin was never created there, and the shares poll asked Nextcloud every minute with a login that cannot pass: 401, then Nextcloud's brute-force throttle (429), which also held the backup before a delivery. On a refused login the client now adds the account through occ (admin group), or sets its password to the module's own secret, passing it by OC_PASS so it is on no argv, and asks once more. A refusal that stays is said once and the poll backs off from 5 minutes to an hour instead of nine lines of XML every minute. An empty setting no longer becomes an empty name.	2026-10-25 16:40:01 +01:00
jochen	edb6d3b7d3	nextcloud: keep checking onlyoffice's connection while the last check failed (issue 1832) ... applyOnlyOffice only ran the connection check when a setting changed, so once it failed while settings matched, nothing checked again and the failure was logged once and forgotten. The client now remembers whether the last check failed and re-runs it on every tick until it passes; index.ts logs every failing tick and one line when it recovers.	2026-10-22 16:28:35 +02:00
jochen	8928e6f972	nextcloud: keep onlyoffice's jwt_secret off every argv (issue 1831) ... occ's config:app:set put the secret on the docker exec command line, so it sat in the docker CLI's argv, the container's php argv and docker's exec record. Apply jwt_secret through config:import on occ's stdin instead; the other three onlyoffice keys still go through config:app:set.	2026-10-22 16:27:15 +02:00
jochen	2d2e831659	Apply only-office's bound address and secret to onlyoffice settings every tick (issue 1830)	2026-10-22 11:30:26 +02:00
jochen	d3ebaf72eb	Require only-office's document server and carry its address and secret into nextcloud's config (issue 1830)	2026-10-22 11:27:49 +02:00
jochen	fe2040c65e	Keep every password, token and API key the vault's, never a setting (hq issue 342) ... A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's password over the ${secret:...} in their runtime config, and the gitea, home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings file before the vault's file. A secret in a setting cannot be rotated and is read back by the settings verb. The four files now keep their password protected, so the controller refuses a setting of it. The six clients ignore a secret in the settings file and say so once, by key and never with the value; icecast reads its admin password from the vault's file. checks/secrets refuses a mergeable file whose secret a layer could replace; searxng's nested server.secret_key is listed as known until the controller protects a nested key.	2026-10-13 07:32:19 +02:00