← Back
Editing: config.sample.php
<?php /** * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors * SPDX-FileCopyrightText: 2016 ownCloud, Inc. * SPDX-License-Identifier: AGPL-3.0-only */ /** * This configuration file is only provided to document the different * configuration options and their usage. * * DO NOT COMPLETELY BASE YOUR CONFIGURATION FILE ON THIS SAMPLE. THIS MAY BREAK * YOUR INSTANCE. Instead, manually copy configuration switches that you * consider important for your instance to your working ``config.php``, and * apply configuration options that are pertinent for your instance. * * This file is used to generate the configuration documentation. * Please consider following requirements of the current parser: * * All comments need to start with `/**` and end with ` *\/` - each on their * own line * * Add a `@see CONFIG_INDEX` to copy a previously described config option * also to this line * * Everything between the ` *\/` and the next `/**` will be treated as the * config option * * Use RST syntax */ $CONFIG = [ /** * Default Parameters * * These parameters are configured by the Nextcloud installer, and are required * for your Nextcloud server to operate. */ /** * This is a unique identifier for your Nextcloud installation, created * automatically by the installer. This example is for documentation only, * and you should never use it because it will not work. A valid ``instanceid`` * is created when you install Nextcloud. */ 'instanceid' => '', /** * This is a unique identifier for your server. * It is useful when your Nextcloud instance is using different PHP servers. * Once it's set it shouldn't be changed. * * Value must be an integer, comprised between 0 and 1023. * * When config.php is shared between different servers, this value should be overriden with "NC_serverid=<int>" on each server. * Note that it must be overriden for CLI and for your webserver. * * Example for CLI: NC_serverid=42 occ config:list system */ 'serverid' => -1, /** * The salt used to hash all passwords, auto-generated by the Nextcloud * installer. (There are also per-user salts.) If you lose this salt, you lose * all your passwords. This example is for documentation only, and you should * never use it. * * @deprecated 9.0.0 This salt is deprecated and only used for legacy-compatibility, * developers should *NOT* use this value for anything nowadays. */ 'passwordsalt' => '', /** * Secret used by Nextcloud for various purposes, e.g., to encrypt data. If you * lose this string, there will be data corruption. */ 'secret' => '', /** * Your list of trusted domains that users can log into. Specifying trusted * domains prevents host header poisoning. Do not remove this, as it performs * necessary security checks. * * You can specify: * * - The exact hostname of your host or virtual host, e.g. ``demo.example.org``. * - The exact hostname with permitted port, e.g. ``demo.example.org:443``. This disallows all other ports on this host * - Use ``*`` as a wildcard, e.g., ``ubos-raspberry-pi*.local`` will allow ``ubos-raspberry-pi.local`` and ``ubos-raspberry-pi-2.local`` * - The IP address with or without permitted port, e.g. ``[2001:db8::1]:8080`` Using TLS certificates where ``commonName=<IP address>`` is deprecated */ 'trusted_domains' => [ 'demo.example.org', 'otherdomain.example.org', '10.111.112.113', '[2001:db8::1]' ], /** * The validity domain for cookies, for example ``''`` (cookies will be sent only * the domain that defined it, e.g. ``'demo.example.org'``), ``'demo.example.org'`` * (cookies will be valid for the domain and all subdomains), ... * * Defaults to ``''`` (safe option) */ 'cookie_domain' => '', /** * Where user files are stored. The SQLite database is also stored here, when * you use SQLite. * * Default to ``data/`` in the Nextcloud directory. */ 'datadirectory' => '/var/www/nextcloud/data', /** * The current version number of your Nextcloud installation. This is set up * during installation and update, so you shouldn't need to change it. */ 'version' => '', /** * Identifies the database used with this installation. See also config option * ``supportedDatabases`` * * Available: * - sqlite3 (SQLite3) * - mysql (MySQL/MariaDB) * - pgsql (PostgreSQL) * * Defaults to ``sqlite3`` */ 'dbtype' => 'sqlite3', /** * Your host server name, for example ``localhost``, ``hostname``, * ``hostname.example.com``, or the IP address. * To specify a port, use ``hostname:####``; for IPv6 addresses, use the URI notation ``[ip]:port``. * To specify a Unix socket, use ``localhost:/path/to/directory/containing/socket`` or * ``:/path/to/directory/containing/socket``, e.g., ``localhost:/run/postgresql/``. */ 'dbhost' => '', /** * The name of the Nextcloud database, which is set during installation. You * should not need to change this. */ 'dbname' => 'nextcloud', /** * The user that Nextcloud uses to write to the database. This must be unique * across Nextcloud instances using the same SQL database. This is set up during * installation, so you shouldn't need to change it. */ 'dbuser' => '', /** * The password for the database user. This is set up during installation, so * you shouldn't need to change it. */ 'dbpassword' => '', /** * Prefix for the Nextcloud tables in the database. * * Default to ``oc_`` */ 'dbtableprefix' => 'oc_', /** * Enable persistent connections to the database. * This setting uses the ``persistent`` option from Doctrine DBAL, which in turn * uses the PDO::ATTR_PERSISTENT option from the PDO driver. */ 'dbpersistent' => '', /** * Specify read-only replicas to be used by Nextcloud when querying the database */ 'dbreplica' => [ ['user' => 'nextcloud', 'password' => 'password1', 'host' => 'replica1', 'dbname' => ''], ['user' => 'nextcloud', 'password' => 'password2', 'host' => 'replica2', 'dbname' => ''], ], /** * Add request ID to the database query in a comment. * * This can be enabled to assist in mapping database logs to Nextcloud logs. */ 'db.log_request_id' => false, /** * Indicates whether the Nextcloud instance was installed successfully; ``true`` * indicates a successful installation, and ``false`` indicates an unsuccessful * installation. * * Defaults to ``false`` */ 'installed' => false, /** * User Experience * * These optional parameters control some aspects of the user interface. Default * values, where present, are shown. */ /** * This sets the default language on your Nextcloud server, using ISO_639-1 * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for * French. The default_language parameter is only used when the browser does * not send any language, and the user hasn’t configured their own language * preferences. * * Nextcloud has two distinguished language codes for German, ``de`` and ``de_DE``. * ``de`` is used for informal German and ``de_DE`` for formal German. By setting * this value to ``de_DE``, you can enforce the formal version of German unless * the user has chosen something different explicitly. * * Defaults to ``en`` */ 'default_language' => 'en', /** * With this setting, a language can be forced for all users. If a language is * forced, the users are also unable to change their language in the personal * settings. If users shall be unable to change their language, but users have * different languages, this value can be set to ``true`` instead of a language * code. * * Defaults to ``false`` */ 'force_language' => 'en', /** * This sets the default locale on your Nextcloud server, using ISO_639 * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for * French, and ISO-3166 country codes such as ``GB``, ``US``, ``CA``, as defined * in RFC 5646. It overrides automatic locale detection on public pages like * login or shared items. User's locale preferences configured under "personal * -> locale" override this setting after they have logged in. * * Defaults to ``en`` */ 'default_locale' => 'en_US', /** * With this setting, it is possible to reduce the languages available in the * language chooser. The languages have to be set as array values using ISO_639-1 * language codes such as ``en`` for English, ``de`` for German, etc. * * For example: Set to ``['de', 'fr']`` to only allow German and French languages. */ 'reduce_to_languages' => [], /** * This sets the default region for phone numbers on your Nextcloud server, * using ISO 3166-1 country codes such as ``DE`` for Germany, ``FR`` for France, … * It is required to allow inserting phone numbers in the user profiles starting * without the country code (e.g., +49 for Germany). * * No default value! */ 'default_phone_region' => 'GB', /** * With this setting, a locale can be forced for all users. If a locale is * forced, the users are also unable to change their locale in the personal * settings. If users shall be unable to change their locale, but users have * different languages, this value can be set to ``true`` instead of a locale * code. * * Defaults to ``false`` */ 'force_locale' => 'en_US', /** * This sets the default timezone on your Nextcloud server, using IANA * identifiers like ``Europe/Berlin`` or ``Pacific/Auckland``. The default * timezone parameter is only used when the timezone of the user cannot be * determined. * * Defaults to ``UTC`` */ 'default_timezone' => 'Europe/Berlin', /** * ``true`` enables the Help menu item in the user menu (top right of the * Nextcloud Web interface). * ``false`` removes the Help item. */ 'knowledgebaseenabled' => true, /** * ``true`` embeds the documentation in an iframe inside Nextcloud. * ``false`` only shows buttons to the online documentation. */ 'knowledgebase.embedded' => false, /** * ``true`` allows users to change their display names (on their Personal * pages), and ``false`` prevents them from changing their display names. */ 'allow_user_to_change_display_name' => true, /** * The directory where the skeleton files are located. These files will be * copied to the data directory of new users. Set empty string to not copy any * skeleton files. If unset and templatedirectory is an empty string, shipped * templates will be used to create a template directory for the user. * ``{lang}`` can be used as a placeholder for the language of the user. * If the directory does not exist, it falls back to non-dialect (from ``de_DE`` * to ``de``). If that does not exist either, it falls back to ``default`` * * Defaults to ``core/skeleton`` in the Nextcloud directory. */ 'skeletondirectory' => '/path/to/nextcloud/core/skeleton', /** * The directory where the template files are located. These files will be * copied to the template directory of new users. Set empty string to not copy any * template files. * ``{lang}`` can be used as a placeholder for the language of the user. * If the directory does not exist, it falls back to non-dialect (from ``de_DE`` * to ``de``). If that does not exist either, it falls back to ``default`` * * To disable creating a template directory, set both skeletondirectory and * templatedirectory to empty strings. */ 'templatedirectory' => '/path/to/nextcloud/templates', /** * User session */ /** * Lifetime of the remember login cookie. This should be larger than the * session_lifetime. If it is set to 0, remember me is disabled. * * Defaults to ``60*60*24*15`` seconds (15 days) */ 'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15, /** * The lifetime of a session after inactivity. * * The maximum possible time is limited by the ``session.gc_maxlifetime`` php.ini setting * which would overwrite this option if it is less than the value in the ``config.php`` * * Defaults to ``60*60*24`` seconds (24 hours) */ 'session_lifetime' => 60 * 60 * 24, /** * The timeout in seconds for requests to servers made by the DAV component (e.g., needed for federated shares). */ 'davstorage.request_timeout' => 30, /** * The timeout in seconds for synchronizing address books, e.g., federated system address books (as run by ``occ federation:sync-addressbooks``). * * Defaults to ``30`` seconds */ 'carddav_sync_request_timeout' => 30, /** * The limit applied to the synchronization report request, e.g. federated system address books (as run by ``occ federation:sync-addressbooks``). */ 'carddav_sync_request_truncation' => 2500, /** * ``true`` enables a relaxed session timeout, where the session timeout would no longer be * handled by Nextcloud but by either the PHP garbage collection or the expiration of * potential other session backends like Redis. * * This may lead to sessions being available for longer than what ``session_lifetime`` uses but * comes with performance benefits as sessions are no longer a locking operation for concurrent * requests. */ 'session_relaxed_expiry' => false, /** * Enable or disable session keep-alive when a user is logged in to the Web UI. * Enabling this sends a "heartbeat" to the server to keep it from timing out. * * Defaults to ``true`` */ 'session_keepalive' => true, /** * Enable or disable the automatic logout after session_lifetime, even if session * keepalive is enabled. This will make sure that an inactive browser will log itself out * even if requests to the server might extend the session lifetime. * * NOTE: The logout is handled on the client side. This is not a way to * limit the duration of potentially compromised sessions. * * Defaults to ``false`` */ 'auto_logout' => false, /** * Enforce token authentication for clients, which blocks requests using the user * password for enhanced security. Users need to generate tokens in personal settings * which can be used as passwords on their clients. * * Defaults to ``false`` */ 'token_auth_enforced' => false, /** * The interval at which token activity should be updated. * Increasing this value means that the last activity on the security page gets * more outdated. * * Tokens are still checked every 5 minutes for validity * max value: 300 * * Defaults to ``60`` */ 'token_auth_activity_update' => 60, /** * Whether the brute force protection shipped with Nextcloud should be enabled or not. * * WARNING: Disabling this is discouraged for security reasons. * * Defaults to ``true`` */ 'auth.bruteforce.protection.enabled' => true, /** * Whether the brute force protection should write into the database even when a memory cache is available * * Using the database is most likely worse for performance, but makes investigating * issues a lot easier as it's possible to look directly at the table to see all * logged remote addresses and actions. * * Defaults to ``false`` */ 'auth.bruteforce.protection.force.database' => false, /** * Whether the brute force protection shipped with Nextcloud should be set to testing mode. * * In testing mode, brute force attempts are still recorded, but the requests do * not sleep/wait for the specified time. They will still abort with * "429 Too Many Requests" when the maximum delay is reached. * Enabling this is discouraged for security reasons * and should only be done for debugging and on CI when running tests. * * Defaults to ``false`` */ 'auth.bruteforce.protection.testing' => false, /** * Brute force protection: maximum number of attempts before blocking * * When more than max-attempts login requests are sent to Nextcloud, requests * will abort with "429 Too Many Requests". * For security reasons, change it only if you know what you are doing. * * Defaults to ``10`` */ 'auth.bruteforce.max-attempts' => 10, /** * Whether the rate limit protection shipped with Nextcloud should be enabled or not. * * WARNING: Disabling this is discouraged for security reasons. * * Defaults to ``true`` */ 'ratelimit.protection.enabled' => true, /** * Overwrite the individual rate limit for a specific route * * From time to time it can be necessary to extend the rate limit of a specific route, * depending on your usage pattern or when you script some actions. * Instead of completely disabling the rate limit or excluding an IP address from the * rate limit, the following config allows to overwrite the rate limit duration and period. * * The first level key is the name of the route. You can find the route name from a URL * using the ``occ router:list`` command of your server. * * You can also specify different limits for logged-in users with the ``user`` key * and not-logged-in users with the ``anon`` key. However, if there is no specific ``user`` limit, * the ``anon`` limit is also applied for logged-in users. * * Defaults to empty array ``[]`` */ 'ratelimit_overwrite' => [ 'profile.profilepage.index' => [ 'user' => ['limit' => 300, 'period' => 3600], 'anon' => ['limit' => 1, 'period' => 300], ] ], /** * Size of subnet used to normalize IPv6 * * For Brute Force Protection and Rate Limiting, IPv6 addresses are truncated using subnet size. * It defaults to /56, but you can set it between /32 and /64 * * Defaults to ``56`` */ 'security.ipv6_normalized_subnet_size' => 56, /** * By default, WebAuthn is available, but it can be explicitly disabled by admins */ 'auth.webauthn.enabled' => true, /** * Whether encrypted passwords should be stored in the database * * The passwords are only decrypted using the login token stored uniquely in the * clients and allow connecting to external storages, autoconfiguring mail accounts in * the mail app, and periodically checking if the password is still valid. * * This might be desirable to disable this functionality when using one-time * passwords or when having a password policy enforcing long passwords (> 300 * characters). * * By default, the passwords are stored encrypted in the database. * * WARNING: If disabled, password changes on the user backend (e.g., on LDAP) no * longer log connected clients out automatically. Users can still disconnect * the clients by deleting the app token from the security settings. */ 'auth.storeCryptedPassword' => true, /** * By default, the login form is always available. There are cases (SSO) where an * admin wants to avoid users entering their credentials to the system if the SSO * app is unavailable. * * This will show an error. But the direct login still works with adding ``?direct=1`` */ 'hide_login_form' => false, /** * If your user backend does not allow password resets (e.g., when it's a * read-only user backend like LDAP), you can specify a custom link, where the * user is redirected to, when clicking the "Reset password" link after a failed * login attempt. * In case you do not want to provide any link, replace the URL with ``'disabled'`` */ 'lost_password_link' => 'https://example.org/link/to/password/reset', /** * URL to use as target for the logo link in the header (top-left logo) * * Defaults to the base URL of your Nextcloud instance */ 'logo_url' => 'https://example.org', /** * Mail Parameters * * These configure the email settings for Nextcloud notifications and password * resets. */ /** * The return address that you want to appear on emails sent by the Nextcloud * server, for example ``nc-admin@example.com``, substituting your own domain, * of course. */ 'mail_domain' => 'example.com', /** * FROM address that overrides the built-in ``sharing-noreply`` and * ``lostpassword-noreply`` FROM addresses. * * Defaults to different FROM addresses depending on the feature. */ 'mail_from_address' => 'nextcloud', /** * Enable SMTP class debugging. * NOTE: ``loglevel`` will likely need to be adjusted too. See docs: * https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html#enabling-debug-mode * * Defaults to ``false`` */ 'mail_smtpdebug' => false, /** * Which mode to use for sending mail: ``sendmail``, ``smtp``, ``qmail``, or ``null``. * * If you are using local or remote SMTP, set this to ``smtp``. * * For the ``sendmail`` option, you need an installed and working email system on * the server, with ``/usr/sbin/sendmail`` installed on your Unix system. * * For ``qmail``, the binary is /var/qmail/bin/sendmail, and it must be installed * on your Unix system. * * Use the string ``null`` to send no mails (disable mail delivery). This can be * useful if mails should be sent via APIs and rendering messages is not necessary. * * Defaults to ``smtp`` */ 'mail_smtpmode' => 'smtp', /** * This depends on ``mail_smtpmode``. Specify the IP address of your mail * server host. This may contain multiple hosts separated by a semicolon. If * you need to specify the port number, append it to the IP address separated by * a colon, like this: ``127.0.0.1:24``. * * Defaults to ``127.0.0.1`` */ 'mail_smtphost' => '127.0.0.1', /** * This depends on ``mail_smtpmode``. Specify the port for sending mail. * * Defaults to ``25`` */ 'mail_smtpport' => 25, /** * This depends on ``mail_smtpmode``. This sets the SMTP server timeout, in * seconds. You may need to increase this if you are running an anti-malware or * spam scanner. * * Defaults to ``10`` seconds */ 'mail_smtptimeout' => 10, /** * This depends on ``mail_smtpmode``. Specify ``ssl`` when you are using SSL/TLS. Any other value will be ignored. * * If the server advertises STARTTLS capabilities, they might be used, but they cannot be enforced by * this config option. * * Defaults to ``''`` (empty string) */ 'mail_smtpsecure' => '', /** * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail * server requires authentication. * * Defaults to ``false`` */ 'mail_smtpauth' => false, /** * This depends on ``mail_smtpauth``. Specify the username for authenticating to * the SMTP server. * * Defaults to ``''`` (empty string) */ 'mail_smtpname' => '', /** * This depends on ``mail_smtpauth``. Specify the password for authenticating to * the SMTP server. * * Default to ``''`` (empty string) */ 'mail_smtppassword' => '', /** * Replaces the default mail template layout. This can be utilized if the * options to modify the mail texts with the theming app are not enough. * The class must extend ``\OC\Mail\EMailTemplate`` */ 'mail_template_class' => '\OC\Mail\EMailTemplate', /** * Email will be sent by default with an HTML and a plain text body. This option * allows sending only plain text emails. */ 'mail_send_plaintext_only' => false, /** * This depends on ``mail_smtpmode``. Array of additional streams options that * will be passed to underlying Swift mailer implementation. * Defaults to an empty array. */ 'mail_smtpstreamoptions' => [], /** * Which mode is used for sendmail/qmail: ``smtp`` or ``pipe``. * * For ``smtp``, the sendmail binary is started with the parameter ``-bs``: * - Use the SMTP protocol on standard input and output. * * For ``pipe``, the binary is started with the parameters ``-t``: * - Read message from STDIN and extract recipients. * * Defaults to ``smtp`` */ 'mail_sendmailmode' => 'smtp', /** * Proxy Configurations */ /** * The automatic hostname detection of Nextcloud can fail in certain reverse * proxy and CLI/cron situations. This option allows you to manually override * the automatic detection; for example, ``www.example.com``, or specify the port * ``www.example.com:8080``. */ 'overwritehost' => '', /** * When generating URLs, Nextcloud attempts to detect whether the server is * accessed via ``https`` or ``http``. However, if Nextcloud is behind a proxy * and the proxy handles the ``https`` calls, Nextcloud would not know that * ``ssl`` is in use, which would result in incorrect URLs being generated. * Valid values are ``http`` and ``https``. */ 'overwriteprotocol' => '', /** * Nextcloud attempts to detect the webroot for generating URLs automatically. * For example, if ``www.example.com/nextcloud`` is the URL pointing to the * Nextcloud instance, the webroot is ``/nextcloud``. When proxies are in use, * it may be difficult for Nextcloud to detect this parameter, resulting in * invalid URLs. */ 'overwritewebroot' => '', /** * This option allows you to define a manual override condition as a regular * expression for the remote IP address. For example, defining a range of IP * addresses starting with ``10.0.0.`` and ending with 1 to 3: * ``^10\.0\.0\.[1-3]$`` * * Defaults to ``''`` (empty string) */ 'overwritecondaddr' => '', /** * Use this configuration parameter to specify the base URL for any URLs which * are generated within Nextcloud using any kind of command line tools (cron or * occ). The value should contain the full base URL: * ``https://www.example.com/nextcloud`` * Please make sure to set the value to the URL that your users mainly use to access this Nextcloud. * Otherwise, there might be problems with the URL generation via cron. * * Defaults to ``''`` (empty string) */ 'overwrite.cli.url' => '', /** * To have clean URLs without ``/index.php``, this parameter needs to be configured. * * This parameter will be written as "RewriteBase" on update and installation of * Nextcloud to your ``.htaccess`` file. While this value is often simply the URL * path of the Nextcloud installation, it cannot be set automatically properly in * every scenario and needs thus some manual configuration. * * In a standard Apache setup, this usually equals the folder that Nextcloud is * accessible at. So if Nextcloud is accessible via ``https://mycloud.org/nextcloud``, * the correct value would most likely be ``/nextcloud``. If Nextcloud is running * under ``https://mycloud.org/``, then it would be ``/``. * * Note that the above rule is not valid in every case, as there are some rare setup * cases where this may not apply. However, to avoid any update problems, this * configuration value is explicitly opt-in. * * After setting this value, run ``occ maintenance:update:htaccess``. Now, when the * following conditions are met, Nextcloud URLs won't contain ``index.php``: * * - ``mod_rewrite`` is installed * - ``mod_env`` is installed * * Defaults to ``''`` (empty string) */ 'htaccess.RewriteBase' => '/', /** * For server setups that don't have ``mod_env`` enabled or restricted (e.g., suEXEC), * this parameter has to be set to true and will assume mod_rewrite. * * Please check if ``mod_rewrite`` is active and functional before setting this * parameter, and you updated your .htaccess with ``occ maintenance:update:htaccess``. * Otherwise, your Nextcloud installation might not be reachable any more. * For example, try accessing resources by leaving out ``index.php`` in the URL. */ 'htaccess.IgnoreFrontController' => false, /** * The URL of your proxy server, for example, ``proxy.example.com:8081``. * * NOTE: Guzzle (the HTTP library used by Nextcloud) reads the environment * variables ``HTTP_PROXY`` (only for CLI requests), ``HTTPS_PROXY``, and ``NO_PROXY`` by default. * * If you configure a proxy with Nextcloud, any default configuration by Guzzle * is overwritten. Make sure to set ``proxyexclude`` accordingly if necessary. * * Defaults to ``''`` (empty string) */ 'proxy' => '', /** * The optional authentication for the proxy to use to connect to the internet. * The format is: ``username:password``. * * Defaults to ``''`` (empty string) */ 'proxyuserpwd' => '', /** * List of hostnames that should not be proxied to. * For example: ``['.mit.edu', 'foo.com']``. * * Hint: Use something like ``explode(',', getenv('NO_PROXY'))`` to sync this * value with the global ``NO_PROXY`` option. * * Defaults to empty array. */ 'proxyexclude' => [], /** * Allow remote servers with local addresses, e.g., in federated shares, webcal services, and more * * Defaults to ``false`` */ 'allow_local_remote_servers' => true, /** * Deleted Items (trash bin) * * These parameters control the Deleted files app. */ /** * If the trash bin app is enabled (default), this setting defines the policy * for when files and folders in the trash bin will be permanently deleted. * * If the user quota limit is exceeded due to deleted files in the trash bin, * retention settings will be ignored and files will be cleaned up until * the quota requirements are met. * * The app allows for two settings, a minimum time for trash bin retention, * and a maximum time for trash bin retention. * * Minimum time is the number of days a file will be kept, after which it * *may be* deleted. A file may be deleted after the minimum number of days * has expired if space is needed. The file will not be deleted if space is * not needed. * * Whether "space is needed" depends on whether a user quota is defined or not: * * * If no user quota is defined, the available space on the Nextcloud data * partition sets the limit for the trashbin * (issues: see https://github.com/nextcloud/server/issues/28451). * * If a user quota is defined, 50% of the user's remaining quota space sets * the limit for the trashbin. * * Maximum time is the number of days at which it is *guaranteed * to be* deleted. There is no further dependency on the available space. * * Both minimum and maximum times can be set together to explicitly define * file and folder deletion. For migration purposes, this setting is installed * initially set to "auto", which is equivalent to the default setting in * Nextcloud. * * Available values (D1 and D2 are configurable numbers): * * * ``auto`` * | Default setting. Keeps files and folders in the trash bin for at least **30** days. * | Then, **if space is needed**, deletes trashed files anytime after that. * * ``D1, auto`` * | Keeps files and folders in the trash bin for at least **D1** days. * | Then, **if space is needed**, deletes trashed files anytime after that. * * ``auto, D2`` * | **If space is needed**, deletes trashed files anytime. * | After **D2** days, delete all trashed files automatically * * ``D1, D2`` * | Keeps files and folders in the trash bin for at least **D1** days. * | Then, after **D2** days, delete all trashed files automatically. * * ``disabled`` * | Trash bin auto clean is disabled, files and folders will be kept forever. * * Defaults to ``auto`` */ 'trashbin_retention_obligation' => 'auto', /** * File versions * * These parameters control the Versions app. */ /** * If the versions app is enabled (default), this setting defines the policy * for when versions will be permanently deleted. * The app allows for two settings, a minimum time for version retention, * and a maximum time for version retention. * Minimum time is the number of days a version will be kept, after which it * may be deleted. Maximum time is the number of days at which it is guaranteed * to be deleted. * Both minimum and maximum times can be set together to explicitly define * version deletion. For migration purposes, this setting is installed * initially set to "auto", which is equivalent to the default setting in * Nextcloud. * * Available values: * * * ``auto`` * default setting. Automatically expire versions according to expire * rules. Please refer to :doc:`../configuration_files/file_versioning` for * more information. * * ``D, auto`` * keep versions at least for D days, apply expiration rules to all versions * that are older than D days * * ``auto, D`` * delete all versions that are older than D days automatically, delete * other versions according to expire rules * * ``D1, D2`` * keep versions for at least D1 days and delete when exceeds D2 days * * ``disabled`` * versions auto clean disabled, versions will be kept forever * * Defaults to ``auto`` */ 'versions_retention_obligation' => 'auto', /** * Nextcloud Verifications * * Nextcloud performs several verification checks. There are two options, * ``true`` and ``false``. */ /** * Checks an app before install whether it uses private APIs instead of the * proper public APIs. If this is set to true, it will only allow installing or * enabling apps that pass this check. * * Defaults to ``false`` */ 'appcodechecker' => true, /** * Check if Nextcloud is up-to-date and shows a notification if a new version is * available. It sends current version, PHP version, installation and last update * time, and release channel to the updater server which responds with the latest * available version based on those metrics. * * Defaults to ``true`` */ 'updatechecker' => true, /** * URL that Nextcloud should use to look for updates * * Defaults to ``https://updates.nextcloud.com/updater_server/`` */ 'updater.server.url' => 'https://updates.nextcloud.com/updater_server/', /** * The channel that Nextcloud should use to look for updates * * Supported values: * * - ``daily`` * - ``beta`` * - ``stable`` */ 'updater.release.channel' => 'stable', /** * Is Nextcloud connected to the Internet or running in a closed network? * * Defaults to ``true`` */ 'has_internet_connection' => true, /** * Which domains to request to determine the availability of an Internet * connection. If none of these hosts are reachable, the administration panel * will show a warning. Set to an empty list to not do any such checks (warning * will still be shown). * If no protocol is provided, both http and https will be tested. * For example, ``http://www.nextcloud.com`` and ``https://www.nextcloud.com`` * will be tested for ``www.nextcloud.com`` * If a protocol is provided, only this one will be tested. * * Defaults to the following domains: * * - https://www.nextcloud.com * - https://www.startpage.com * - https://www.eff.org * - https://www.edri.org */ 'connectivity_check_domains' => [ 'https://www.nextcloud.com', 'https://www.startpage.com', 'https://www.eff.org', 'https://www.edri.org' ], /** * Allows Nextcloud to verify a working .well-known URL redirects. This is done * by attempting to make a request from JS to * ``https://example.tld/.well-known/caldav/`` * * Defaults to ``true`` */ 'check_for_working_wellknown_setup' => true, /** * This is a crucial security check on Apache servers that should always be set * to ``true``. This verifies that the ``.htaccess`` file is writable and works. * If it is not, then any options controlled by ``.htaccess``, such as large * file uploads, will not work. It also runs checks on the ``data/`` directory, * which verifies that it can't be accessed directly through the Web server. * * Defaults to ``true`` */ 'check_for_working_htaccess' => true, /** * In rare setups (e.g., on OpenShift or Docker on Windows), the permissions check * might block the installation while the underlying system offers no means to * "correct" the permissions. In this case, set the value to false. * * In regular cases, if issues with permissions are encountered, they should be * adjusted accordingly. Changing the flag is discouraged. * * Defaults to ``true`` */ 'check_data_directory_permissions' => true, /** * In certain environments, it is desired to have a read-only configuration file. * When this switch is set to ``true``, writing to the config file will be * forbidden. Therefore, it will not be possible to configure all options via * the Web interface. Furthermore, when updating Nextcloud, it is required to * make the configuration file writable again and to set this switch to ``false`` * for the update process. * * Defaults to ``false`` */ 'config_is_read_only' => false, /** * Logging */ /** * This parameter determines where the Nextcloud logs are sent. * * - ``file``: the logs are written to file ``nextcloud.log`` in the default Nextcloud data directory. The log file can be changed with parameter ``logfile``. * - ``syslog``: the logs are sent to the system log. This requires a syslog daemon to be active. * - ``errorlog``: the logs are sent to the PHP ``error_log`` function. * - ``systemd``: the logs are sent to the Systemd journal. This requires a system that runs Systemd and the Systemd journal. The PHP extension ``systemd`` must be installed and active. * * Defaults to ``file`` */ 'log_type' => 'file', /** * This parameter determines where the audit logs are sent. See ``log_type`` for more information. * * Defaults to ``file`` */ 'log_type_audit' => 'file', /** * Name of the file to which the Nextcloud logs are written if parameter * ``log_type`` is set to ``file``. * * Defaults to ``[datadirectory]/nextcloud.log`` */ 'logfile' => '/var/log/nextcloud.log', /** * Name of the file to which the audit logs are written if parameter * ``log_type`` is set to ``file``. * * Defaults to ``[datadirectory]/audit.log`` */ 'logfile_audit' => '/var/log/audit.log', /** * Log file mode for the Nextcloud logging type in octal notation. * * Defaults to ``0640`` (writable by user, readable by group). */ 'logfilemode' => 0640, /** * Loglevel to start logging at. Valid values are: * * - ``0`` = Debug * - ``1`` = Info * - ``2`` = Warning * - ``3`` = Error * - ``4`` = Fatal. * * * Defaults to ``2`` (Warning) */ 'loglevel' => 2, /** * Loglevel used by the frontend to start logging at. The same values as * for ``loglevel`` can be used. If not set, it defaults to the value * configured for ``loglevel`` or Warning if that is not set either. * * Defaults to ``2`` */ 'loglevel_frontend' => 2, /** * Loglevel used by the dirty database query detection. Useful to identify * potential database bugs in production. Set this to loglevel or higher to * see dirty queries in the logs. * * Defaults to ``0`` (debug) */ 'loglevel_dirty_database_queries' => 0, /** * If you maintain different instances and aggregate the logs, you may want * to distinguish between them. ``syslog_tag`` can be set per instance * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or * ``systemd``. * * The default value is ``Nextcloud``. */ 'syslog_tag' => 'Nextcloud', /** * If you maintain different instances and aggregate the logs, you may want * to distinguish between them. ``syslog_tag_audit`` can be set per instance * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or * ``systemd``. * * The default value is the value of ``syslog_tag``. */ 'syslog_tag_audit' => 'Nextcloud', /** * Log condition for log level increase based on conditions. Once one of these * conditions is met, the required log level is set to debug. This allows * debugging specific requests, users, or apps * * Supported conditions: * - ``shared_secret``: if a request parameter with the name `log_secret` is set to * this value, the condition is met * - ``users``: if the current request is done by one of the specified users, * this condition is met * - ``apps``: if the log message is invoked by one of the specified apps, * this condition is met * - ``matches``: if all the conditions inside a group match, * this condition is met. This allows logging only entries to an app * by a few users. * * Defaults to an empty array. */ 'log.condition' => [ 'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9', 'users' => ['sample-user'], 'apps' => ['files'], 'matches' => [ [ 'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9', 'users' => ['sample-user'], 'apps' => ['files'], 'loglevel' => 1, 'message' => 'contains substring' ], ], ], /** * Enables logging a backtrace with each log line. Normally, only Exceptions * carry backtrace information, which are logged automatically. This * switch turns them on for any log message. Enabling this option will lead * to increased log data size. * * Defaults to ``false``. */ 'log.backtrace' => false, /** * This uses PHP.date formatting; see https://www.php.net/manual/en/function.date.php * * Defaults to ISO 8601 ``2005-08-15T15:52:01+00:00``, see ``\DateTime::ATOM`` * https://www.php.net/manual/en/class.datetimeinterface.php#datetimeinterface.constants.atom */ 'logdateformat' => 'F d, Y H:i:s', /** * The timezone for logfiles. See https://www.php.net/manual/en/timezones.php * * Defaults to ``UTC`` */ 'logtimezone' => 'Europe/Berlin', /** * Append all database queries and parameters to the log file. Use this only for * debugging, as your logfile will become huge. */ 'log_query' => false, /** * Enables log rotation and limits the total size of logfiles. Set it to 0 for * no rotation. Specify a size in bytes, for example, 104857600 (100 megabytes * = 100 * 1024 * 1024 bytes). A new logfile is created with a new name when the * old logfile reaches your limit. If a rotated log file is already present, it * will be overwritten. * * Defaults to 100 MB */ 'log_rotate_size' => 100 * 1024 * 1024, /** * Enable built-in profiler. Helpful when trying to debug performance * issues. * * Note that this has a performance impact and shouldn't be enabled * on production. */ 'profiler' => false, /** * Enable profiling for individual requests if profiling single requests is enabled or the secret is passed. * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data. * * The profile data will be stored as a JSON file in the profiling.path directory that can be analyzed with speedscope. * * Defaults to ``false`` */ 'profiling.request' => false, /** * The rate at which profiling data is collected for individual requests. * A lower value means more data points but higher overhead. * * Defaults to ``0.001`` */ 'profiling.request.rate' => 0.001, /** * A secret token that can be passed via ?profile_secret=<secret> to enable profiling for a specific request. * This allows profiling specific requests in production without enabling it globally. * * No default value. */ 'profiling.secret' => '', /** * Enable sampling-based profiling. This collects profiling data periodically rather than per-request. * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data. * * The profile data will be stored as a plain text file in the profiling.path directory that can be analyzed with speedscope. * * Defaults to ``false`` */ 'profiling.sample' => false, /** * The rate at which sampling profiling data is collected in seconds. * A lower value means more frequent samples but higher overhead. * * Defaults to ``1`` */ 'profiling.sample.rate' => 1, /** * How often (in minutes) the sample log files are rotated. * * Defaults to ``60`` */ 'profiling.sample.rotation' => 60, /** * The directory where profiling data is stored. * * Note that this directory must be writable by the web server user and will not be cleaned up automatically. */ 'profiling.path' => '/tmp', /** * Alternate Code Locations * * Some Nextcloud code may be stored in alternate locations. */ /** * This section is for configuring the download links for Nextcloud clients, as * seen in the first-run wizard and on Personal pages. * * Defaults to: * * - Desktop client: ``https://nextcloud.com/install/#install-clients`` * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client`` * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8`` * - iOS client app ID: ``1125420102`` * - F-Droid client: ``https://f-droid.org/packages/com.nextcloud.client/`` */ 'customclient_desktop' => 'https://nextcloud.com/install/#install-clients', 'customclient_android' => 'https://play.google.com/store/apps/details?id=com.nextcloud.client', 'customclient_ios' => 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8', 'customclient_ios_appid' => '1125420102', 'customclient_fdroid' => 'https://f-droid.org/packages/com.nextcloud.client/', /** * Activity * * Options for the activity app. */ /** * Retention of activities. * * A daily cron job deletes all activities for all users which are older than * the number of days specified here. * * Defaults to ``365`` */ 'activity_expire_days' => 365, /** * Activities in Team Folders and External Storages. * * By default, activities in team folders or external storages are only generated * for the current user. This is due to a limitations in current implementations. * This config flag makes activities in group folders and external storages work * like in normal shares (when set to ``true``). * * WARNING: Enabling this comes with some CRITICAL trade-offs: * * - If team folder "Advanced Permissions" (ACLs) are used, activities do not * respect the permissions and therefore all users see all activities, even * for files and directories they do not have access to. * - Users who had access to a team folder, share, or external storage can see * activities in their stream and emails that happen after they are removed * until they log in again. * - Users who are newly added to a team folder, share, or external storage * cannot see activities in their stream or emails that happen after they * are added until they log in again. * * Defaults to ``false`` */ 'activity_use_cached_mountpoints' => false, /** * Apps * * Options for the Apps folder, Apps store, and App code checker. */ /** * Set the default app to open on login. The entry IDs can be retrieved from * the Navigations OCS API endpoint: https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/core-navigation-get-apps-navigation. * You can use a comma-separated list of app names, so if the first * app is not enabled for a user, then Nextcloud will try the second one, and so * on. If no enabled apps are found, it defaults to the dashboard app. * * Defaults to ``dashboard,files`` */ 'defaultapp' => 'dashboard,files', /** * When enabled, admins may install apps from the Nextcloud app store. * * Defaults to ``true`` */ 'appstoreenabled' => true, /** * Enables the installation of apps from a self-hosted apps store. * Requires that at least one of the configured apps directories is writable. * * Defaults to ``https://apps.nextcloud.com/api/v1`` */ 'appstoreurl' => 'https://apps.nextcloud.com/api/v1', /** * Filters allowed installable apps from the appstore. * Empty array will prevent all apps from the store to be found. */ 'appsallowlist' => [], /** * Use the ``apps_paths`` parameter to set the location of the Apps directory, * which should be scanned for available apps, and where user-specific apps * should be installed from the Apps store. The ``path`` defines the absolute * file system path to the app folder. The key ``url`` defines the HTTP Web path * to that folder, starting from the Nextcloud webroot. The key ``writable`` * indicates if a Web server can write files to that folder. */ 'apps_paths' => [ [ 'path' => '/var/www/nextcloud/apps', 'url' => '/apps', 'writable' => true, ], ], /** * @see appcodechecker */ /** * Previews * * Nextcloud supports generating previews for various file types, such as images, audio files, and text files. * These options control enabling and disabling previews, and thumbnail size. */ /** * By default, Nextcloud can generate previews for the following filetypes: * * - Image files * - Text documents * * Valid values are ``true``, to enable previews, or * ``false``, to disable previews * * Defaults to ``true`` */ 'enable_previews' => true, /** * Number of all preview requests being processed concurrently, * including previews that need to be newly generated, and those that have * been generated. * * This should be greater than ``preview_concurrency_new``. * If unspecified, defaults to twice the value of ``preview_concurrency_new``. */ 'preview_concurrency_all' => 8, /** * Number of new previews that are being concurrently generated. * * Depending on the max preview size set by ``preview_max_x`` and ``preview_max_y``, * the generation process can consume considerable CPU and memory resources. * It's recommended to limit this to be no greater than the number of CPU cores. * If unspecified, defaults to the number of CPU cores, or 4 if that cannot * be determined. */ 'preview_concurrency_new' => 4, /** * The maximum width, in pixels, of a preview. A value of ``null`` means there * is no limit. * * Defaults to ``4096`` */ 'preview_max_x' => 4096, /** * The maximum height, in pixels, of a preview. A value of ``null`` means there * is no limit. * * Defaults to ``4096`` */ 'preview_max_y' => 4096, /** * Max file size for generating image previews with imagegd (default behavior). * If the image is bigger, it'll try other preview generators, but will most * likely either show the default mimetype icon or not display the image at all. * Set to ``-1`` for no limit and try to generate image previews on all file sizes. * * Defaults to ``50`` megabytes */ 'preview_max_filesize_image' => 50, /** * Max memory for generating image previews with imagegd (default behavior) * Reads the image dimensions from the header and assumes 32 bits per pixel. * If creating the image would allocate more memory, preview generation will * be disabled and the default mimetype icon is shown. Set to ``-1`` for no limit. * * Defaults to ``256`` megabytes */ 'preview_max_memory' => 256, /** * Custom path for LibreOffice/OpenOffice binary * * * Defaults to ``''`` (empty string) */ 'preview_libreoffice_path' => '/usr/bin/libreoffice', /** * Custom path for ffmpeg binary * * Defaults to ``null`` and falls back to searching ``ffmpeg`` * in the configured ``PATH`` environment */ 'preview_ffmpeg_path' => '/usr/bin/ffmpeg', /** * Custom path for ffprobe binary * * Defaults to ``null`` and falls back to using the same path as ffmpeg. * ffprobe is typically packaged with ffmpeg and is required for * enhanced preview generation for HDR videos. */ 'preview_ffprobe_path' => '/usr/bin/ffprobe', /** * Set the URL of the Imaginary service to send image previews to. * Also requires the ``OC\Preview\Imaginary`` provider to be enabled in the * ``enabledPreviewProviders`` array, to create previews for these mimetypes: bmp, * x-bitmap, png, jpeg, gif, heic, heif, svg+xml, tiff, webp, and illustrator. * * If you want Imaginary to also create preview images from PDF documents, you * have to add the ``OC\Preview\ImaginaryPDF`` provider as well. * * See https://github.com/h2non/imaginary */ 'preview_imaginary_url' => 'http://previews_hpb:8088/', /** * If you want to set an API key for Imaginary. */ 'preview_imaginary_key' => 'secret', /** * Only register providers that have been explicitly enabled * * The following providers are disabled by default due to performance or privacy * concerns: * * - ``OC\Preview\EMF`` * - ``OC\Preview\Font`` * - ``OC\Preview\HEIC`` * - ``OC\Preview\Illustrator`` * - ``OC\Preview\Movie`` * - ``OC\Preview\MP3`` * - ``OC\Preview\MSOffice2003`` * - ``OC\Preview\MSOffice2007`` * - ``OC\Preview\MSOfficeDoc`` * - ``OC\Preview\PDF`` * - ``OC\Preview\Photoshop`` * - ``OC\Preview\Postscript`` * - ``OC\Preview\SGI`` * - ``OC\Preview\StarOffice`` * - ``OC\Preview\SVG`` * - ``OC\Preview\TGA`` * - ``OC\Preview\TIFF`` * * The following providers are disabled by default, because they provide an alternative to the built-in providers: * - ``OC\Preview\Imaginary`` * - ``OC\Preview\ImaginaryPDF`` * * Defaults to the following providers: * * - ``OC\Preview\PNG`` * - ``OC\Preview\JPEG`` * - ``OC\Preview\GIF`` * - ``OC\Preview\BMP`` * - ``OC\Preview\XBitmap`` * - ``OC\Preview\Krita`` * - ``OC\Preview\WebP`` * - ``OC\Preview\MarkDown`` * - ``OC\Preview\TXT`` * - ``OC\Preview\OpenDocument`` * */ 'enabledPreviewProviders' => [ 'OC\Preview\PNG', 'OC\Preview\JPEG', 'OC\Preview\GIF', 'OC\Preview\BMP', 'OC\Preview\XBitmap', 'OC\Preview\Krita', 'OC\Preview\WebP', 'OC\Preview\MarkDown', 'OC\Preview\TXT', 'OC\Preview\OpenDocument', ], /** * Maximum file size for metadata generation. * If a file exceeds this size, metadata generation will be skipped. * * NOTE: memory equivalent to this size will be used for metadata generation. * * Default: 256 megabytes. */ 'metadata_max_filesize' => 256, /** * Maximum file size for file conversion. * If a file exceeds this size, the file will not be converted. * * Default: 100 MiB */ 'max_file_conversion_filesize' => 100, /** * LDAP * * Global settings used by LDAP User and Group Backend */ /** * Defines the interval in minutes for the background job that checks user * existence and marks them as ready to be cleaned up. The number is always * minutes. Setting it to 0 disables the feature. * See command line (occ) methods ``ldap:show-remnants`` and ``user:delete`` * * Defaults to ``51`` minutes */ 'ldapUserCleanupInterval' => 51, /** * Sort groups in the user settings by name instead of the user count * * By enabling this, the user count beside the group name is disabled as well. * * @deprecated 29.0.0 Use the frontend instead or set the app config value ``group.sortBy`` for ``core`` to ``2`` */ 'sort_groups_by_name' => false, /** * Comments * * Global settings for the Comments infrastructure */ /** * Replaces the default Comments Manager Factory. This can be utilized if an * own or 3rd-party CommentsManager should be used that – for instance – uses the * filesystem instead of the database to keep the comments. * * Defaults to ``\OC\Comments\ManagerFactory`` */ 'comments.managerFactory' => '\OC\Comments\ManagerFactory', /** * Replaces the default System Tags Manager Factory. This can be utilized if an * own or 3rd-party SystemTagsManager should be used that – for instance – uses the * filesystem instead of the database to keep the tags. * * Defaults to ``\OC\SystemTag\ManagerFactory`` */ 'systemtags.managerFactory' => '\OC\SystemTag\ManagerFactory', /** * Maintenance * * These options are for halting user activity when you are performing server * maintenance. */ /** * Enable maintenance mode to disable Nextcloud * * If you want to prevent users from logging in to Nextcloud before you start * doing some maintenance work, you need to set the value of the maintenance * parameter to true. Please keep in mind that users who are already logged in * are kicked out of Nextcloud instantly. * * Defaults to ``false`` */ 'maintenance' => false, /** * UTC Hour for maintenance windows * * Some background jobs only run once a day. When an hour is defined for this config, * the background jobs which advertise themselves as not time sensitive will be * delayed during the "working" hours and only run in the 4 hours after the given time. * This is, e.g., used for activity expiration, suspicious login training, and update checks. * * A value of 1, e.g., will only run these background jobs between 01:00am UTC and 05:00am UTC. * * Defaults to ``100`` which disables the feature */ 'maintenance_window_start' => 1, /** * Log all LDAP requests into a file * * Warning: This heavily decreases the performance of the server and is only * meant to debug/profile the LDAP interaction manually. * Also, it might log sensitive data into a plain text file. */ 'ldap_log_file' => '', /** * SSL */ /** * Extra SSL options to be used for configuration. * * Defaults to an empty array. */ 'openssl' => [ 'config' => '/absolute/location/of/openssl.cnf', ], /** * Memory caching backend configuration * * Available cache backends: * * * ``\OC\Memcache\APCu`` APC user backend * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended) * * ``\OC\Memcache\Memcached`` Memcached backend * * ``\OC\Memcache\Redis`` Redis backend * * Advice on choosing between the various backends: * * * APCu should be easiest to install. Almost all distributions have packages. * Use this for single user environment for all caches. * * Use Redis or Memcached for distributed environments. * For the local cache (you can configure two) take APCu. */ /** * Memory caching backend for locally stored data * * * Used for host-specific data, e.g., file paths * * Defaults to ``none`` */ 'memcache.local' => '\\OC\\Memcache\\APCu', /** * Memory caching backend for distributed data * * * Used for installation-specific data, e.g., database caching * * If unset, defaults to the value of memcache.local * * Defaults to ``none`` */ 'memcache.distributed' => '\\OC\\Memcache\\Memcached', /** * Connection details for Redis to use for memory caching in a single server configuration. * * For enhanced security, it is recommended to configure Redis * to require a password. See http://redis.io/topics/security * for more information. * * We also support Redis SSL/TLS encryption as of version 6. * See https://redis.io/topics/encryption for more information. */ 'redis' => [ 'host' => 'localhost', // can also be a Unix domain socket: '/tmp/redis.sock' 'port' => 6379, 'timeout' => 0.0, 'read_timeout' => 0.0, 'user' => '', // Optional: if not defined, no password will be used. 'password' => '', // Optional: if not defined, no password will be used. 'dbindex' => 0, // Optional: if undefined, SELECT will not run and will use Redis Server's default DB Index. // If Redis in-transit encryption is enabled, provide certificates // SSL context https://www.php.net/manual/en/context.ssl.php 'ssl_context' => [ 'local_cert' => '/certs/redis.crt', 'local_pk' => '/certs/redis.key', 'cafile' => '/certs/ca.crt' ] ], /** * Connection details for a Redis Cluster. * * Redis Cluster support requires the PHP module phpredis in version 3.0.0 or * higher. * * Available failover modes: * - ``\RedisCluster::FAILOVER_NONE`` - only send commands to master nodes (default) * - ``\RedisCluster::FAILOVER_ERROR`` - failover to slaves for read commands if master is unavailable (recommended) * - ``\RedisCluster::FAILOVER_DISTRIBUTE`` - randomly distribute read commands across master and slaves * * WARNING: ``\RedisCluster::FAILOVER_DISTRIBUTE`` is a not recommended setting, and we strongly * suggest to not use it if you use Redis for file locking. Due to the way Redis * is synchronized, it could happen that the read for an existing lock is * scheduled to a slave that is not fully synchronized with the connected master * which then causes a FileLocked exception. * * See https://redis.io/topics/cluster-spec for details about the Redis cluster * * Authentication works with phpredis version 4.2.1+. See * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1 */ 'redis.cluster' => [ 'seeds' => [ // provide some or all of the cluster servers to bootstrap discovery, port required 'localhost:7000', 'localhost:7001', ], 'timeout' => 0.0, 'read_timeout' => 0.0, 'failover_mode' => \RedisCluster::FAILOVER_ERROR, 'user' => '', // Optional: if not defined, no password will be used. 'password' => '', // Optional: if not defined, no password will be used. // If Redis in-transit encryption is enabled, provide certificates // SSL context https://www.php.net/manual/en/context.ssl.php 'ssl_context' => [ 'local_cert' => '/certs/redis.crt', 'local_pk' => '/certs/redis.key', 'cafile' => '/certs/ca.crt' ] ], /** * Server details for one or more Memcached servers to use for memory caching. */ 'memcached_servers' => [ // hostname, port and optional weight // or path and port 0 for Unix socket. Also see: // https://www.php.net/manual/en/memcached.addservers.php // https://www.php.net/manual/en/memcached.addserver.php ['localhost', 11211], //array('other.host.local', 11211), ], /** * Connection options for Memcached */ 'memcached_options' => [ // Set timeouts to 50ms \Memcached::OPT_CONNECT_TIMEOUT => 50, \Memcached::OPT_RETRY_TIMEOUT => 50, \Memcached::OPT_SEND_TIMEOUT => 50, \Memcached::OPT_RECV_TIMEOUT => 50, \Memcached::OPT_POLL_TIMEOUT => 50, // Enable compression \Memcached::OPT_COMPRESSION => true, // Turn on consistent hashing \Memcached::OPT_LIBKETAMA_COMPATIBLE => true, // Enable Binary Protocol \Memcached::OPT_BINARY_PROTOCOL => true, // Binary serializer will be enabled if the igbinary PECL module is available //\Memcached::OPT_SERIALIZER => \Memcached::SERIALIZER_IGBINARY, ], /** * Location of the cache folder, defaults to ``data/$user/cache`` where * ``$user`` is the current user. When specified, the format will change to * ``$cache_path/$user`` where ``$cache_path`` is the configured cache directory * and ``$user`` is the user. * * Defaults to ``''`` (empty string) */ 'cache_path' => '', /** * TTL of chunks located in the cache folder before they're removed by * garbage collection (in seconds). Increase this value if users have * issues uploading very large files via the Nextcloud Client as upload isn't * completed within one day. * * Defaults to ``60*60*24`` (1 day) */ 'cache_chunk_gc_ttl' => 60 * 60 * 24, /** * Enable caching of the app config values. * If enabled the app config will be cached locally for a short TTL, * reducing database load significantly on larger setups. * * Defaults to ``true`` */ 'cache_app_config' => true, /** * Using Object Store with Nextcloud */ /** * This example shows how to configure Nextcloud to store all files in a * Swift object storage. * * It is important to note that Nextcloud in object store mode will expect * exclusive access to the object store container because it only stores the * binary data for each file. The metadata is currently kept in the local * database for performance reasons. * * WARNING: The current implementation is incompatible with any app that uses * direct file I/O and circumvents our virtual filesystem. That includes * Encryption and Gallery. Gallery will store thumbnails directly in the * filesystem, and encryption will cause severe overhead because key files need * to be fetched in addition to any requested file. * */ 'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\Swift', 'arguments' => [ // trystack will use your Facebook ID as the username 'username' => 'facebook100000123456789', // in the trystack dashboard, go to user -> settings -> API Password to // generate a password 'password' => 'Secr3tPaSSWoRdt7', // must already exist in the objectstore, name can be different 'container' => 'nextcloud', // prefix to prepend to the fileid, default is 'oid:urn:' 'objectPrefix' => 'oid:urn:', // create the container if it does not exist. default is false 'autocreate' => true, // required, dev-/trystack defaults to 'RegionOne' 'region' => 'RegionOne', // The Identity / Keystone endpoint 'url' => 'http://8.21.28.222:5000/v2.0', // uploadPartSize: size of the uploaded chunks, defaults to 524288000 'uploadPartSize' => 524288000, // required on dev-/trystack 'tenantName' => 'facebook100000123456789', // dev-/trystack uses swift by default, the lib defaults to 'cloudFiles' // if omitted 'serviceName' => 'swift', // The Interface / URL Type, optional 'urlType' => 'internal', // Maximum amount of data that can be uploaded 'totalSizeLimit' => 1024 * 1024 * 1024, ], ], /** * To use Swift V3 */ 'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\Swift', 'arguments' => [ 'autocreate' => true, 'user' => [ 'name' => 'swift', 'password' => 'swift', 'domain' => [ 'name' => 'default', ], ], 'scope' => [ 'project' => [ 'name' => 'service', 'domain' => [ 'name' => 'default', ], ], ], 'tenantName' => 'service', 'serviceName' => 'swift', 'region' => 'regionOne', 'url' => 'http://yourswifthost:5000/v3', 'bucket' => 'nextcloud', ], ], /** * To use S3 object storage */ 'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\S3', 'arguments' => [ 'bucket' => 'nextcloud', 'key' => 'your-access-key', 'secret' => 'your-secret-key', 'hostname' => 's3.example.com', 'port' => 443, 'use_ssl' => true, 'region' => 'us-east-1', // optional: Maximum number of retry attempts for failed S3 requests // Default: 5 'retriesMaxAttempts' => 5, // Data Integrity Protections for Amazon S3 (https://docs.aws.amazon.com/sdkref/latest/guide/feature-dataintegrity.html) // Valid values are "when_required" (default) and "when_supported". // To ensure compatibility with 3rd party S3 implementations, Nextcloud disables it by default. However, if you are // using Amazon S3 (or any other implementation that supports it) we recommend enabling it by using "when_supported". 'request_checksum_calculation' => 'when_required', 'response_checksum_validation' => 'when_required', ], ], /** * If this is set to true and a multibucket object store is configured, then * newly created previews are put into 256 dedicated buckets. * * Those buckets are named like the multibucket version but with the postfix * ``-preview-NUMBER`` where NUMBER is between 0 and 255. * * Keep in mind that only previews of files are put in there that don't have * some already. Otherwise, the old bucket will be used. * * To migrate existing previews to this new multibucket distribution of previews, * use the occ command ``preview:repair``. For now, this will only migrate * previews that were generated before Nextcloud 19 in the flat * ``appdata_INSTANCEID/previews/FILEID`` folder structure. */ 'objectstore.multibucket.preview-distribution' => false, /** * Sharing * * Global settings for Sharing */ /** * Replaces the default Share Provider Factory. This can be utilized if * own or 3rd-party Share Providers are used that – for instance – use the * filesystem instead of the database to keep the share information. * * Defaults to ``\OC\Share20\ProviderFactory`` */ 'sharing.managerFactory' => '\OC\Share20\ProviderFactory', /** * Enables expiration for link share passwords sent by email (sharebymail). * The passwords will expire after the configured interval; the users can * still request a new one on the public link page. */ 'sharing.enable_mail_link_password_expiration' => false, /** * Expiration interval for passwords, in seconds. */ 'sharing.mail_link_password_expiration_interval' => 3600, /** * Define max number of results returned by the search for auto-completion of * users, groups, etc. The value must not be lower than 0 (for unlimited). * * If more, different sources are requested (e.g., different user backends; or * both users and groups), the value is applied per source and might not be * truncated after collecting the results. I.e., more results can appear than * configured here. * * Default is 25. */ 'sharing.maxAutocompleteResults' => 25, /** * Define the minimum length of the search string before we start auto-completion * Default is no limit (value set to 0) */ 'sharing.minSearchStringLength' => 0, /** * Set to true to enable that internal shares need to be accepted by the users by default. * Users can change this for their account in their personal sharing settings */ 'sharing.enable_share_accept' => false, /** * Set to ``true`` to enforce that internal shares need to be accepted */ 'sharing.force_share_accept' => false, /** * Set to ``false`` to prevent users from setting a custom share_folder */ 'sharing.allow_custom_share_folder' => true, /** * Define a default folder for shared files and folders other than root. * Changes to this value will only have effect on new shares. * * Defaults to ``/`` */ 'share_folder' => '/', /** * Set to ``false`` to stop sending a mail when users receive a share */ 'sharing.enable_share_mail' => true, /** * Set to true to enable the feature to add exceptions for share password enforcement */ 'sharing.allow_disabled_password_enforcement_groups' => false, /** * Set to true to always transfer incoming shares by default * when running ``occ files:transfer-ownership``. * Defaults to ``false``, so incoming shares are not transferred if not specifically requested * by a command line argument. */ 'transferIncomingShares' => false, /** * Federated Cloud Sharing */ /** * Allow self-signed certificates for federated shares */ 'sharing.federation.allowSelfSignedCertificates' => false, /** * Hashing */ /** * By default, Nextcloud will use the Argon2 password hashing if available. * However, if for whatever reason you want to stick with the PASSWORD_DEFAULT * of your PHP version, then set the setting to true. * * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its * own and exposes its configuration options as following. More information can * be found at: https://www.php.net/manual/en/function.password-hash.php */ 'hashing_default_password' => false, /** * The number of CPU threads to be used by the algorithm for computing a hash. * The value must be an integer, and the minimum value is ``1``. Rationally, it does * not help to provide a number higher than the available threads on the machine. * Values that undershoot the minimum will be ignored in favor of the minimum. */ 'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS, /** * The memory in KiB to be used by the algorithm for computing a hash. The value * must be an integer, and the minimum value is 8 times the number of CPU threads. * Values that undershoot the minimum will be ignored in favor of the minimum. */ 'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, /** * The number of iterations that are used by the algorithm for computing a hash. * The value must be an integer, and the minimum value is ``1``. Values that * undershoot the minimum will be ignored in favor of the minimum. */ 'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, /** * The hashing cost used by hashes generated by Nextcloud * Using a higher value requires more time and CPU power to calculate the hashes */ 'hashingCost' => 10, /** * All other configuration options */ /** * Additional driver options for the database connection, e.g., to enable SSL * encryption in MySQL or specify a custom wait timeout on a cheap hoster. * * When setting up TLS/SSL for encrypting the connections, you need to ensure that * the passed keys and certificates are readable by the PHP process. In addition, * ``PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT`` might need to be set to false, if the * database server's certificate CN does not match with the hostname used to connect. * The standard behavior here is different from the MySQL/MariaDB CLI client, which * does not verify the server cert except ``--ssl-verify-server-cert`` is passed manually. */ 'dbdriveroptions' => [ PDO::MYSQL_ATTR_SSL_CA => '/file/path/to/ca_cert.pem', PDO::MYSQL_ATTR_SSL_KEY => '/file/path/to/mysql-client-key.pem', PDO::MYSQL_ATTR_SSL_CERT => '/file/path/to/mysql-client-cert.pem', PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false, PDO::MYSQL_ATTR_INIT_COMMAND => 'SET wait_timeout = 28800' ], /** * SQLite3 journal mode can be specified using this configuration parameter - * can be ``'WAL'`` or ``'DELETE'``. See https://www.sqlite.org/wal.html for more details. */ 'sqlite.journal_mode' => 'DELETE', /** * During setup, if requirements are met (see below), this setting is set to true * to enable MySQL to handle 4-byte characters instead of 3-byte characters. * * To convert an existing 3-byte setup to a 4-byte setup, configure the MySQL * parameters as described below and run the migration command: * ``./occ db:convert-mysql-charset`` * This config setting will be automatically updated after a successful migration. * * Refer to the documentation for more details. * * MySQL requires specific settings for longer indexes (> 767 bytes), which are * necessary for 4-byte character support:: * * [mysqld] * innodb_large_prefix=ON * innodb_file_format=Barracuda * innodb_file_per_table=ON * * Tables will be created with: * * character set: ``utf8mb4`` * * collation: ``utf8mb4_bin`` * * row_format: ``dynamic`` * * See: * * https://dev.mysql.com/doc/refman/5.7/en/charset-unicode-utf8mb4.html * * https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_large_prefix * * https://mariadb.com/kb/en/mariadb/xtradbinnodb-server-system-variables/#innodb_large_prefix * * http://www.tocker.ca/2013/10/31/benchmarking-innodb-page-compression-performance.html * * http://mechanics.flite.com/blog/2014/07/29/using-innodb-large-prefix-to-avoid-error-1071/ */ 'mysql.utf8mb4' => false, /** * For search queries in the database, a default collation is chosen based on the * character set. In some cases, a different collation is desired, such as for * accent-sensitive searches. * * MariaDB and MySQL share some collations, but also have incompatible ones, * depending on the database server version. * * This option allows overriding the automatic collation choice. Example:: * * 'mysql.collation' => 'utf8mb4_0900_as_ci', * * This setting does not affect table creation or setup, where utf8[mb4]_bin is * always used. It applies only to SQL queries using LIKE comparison operators. */ 'mysql.collation' => null, /** * PostgreSQL SSL connection */ 'pgsql_ssl' => [ 'mode' => '', 'cert' => '', 'rootcert' => '', 'key' => '', 'crl' => '', ], /** * Database types supported for installation. * * Available: * - sqlite (SQLite3) * - mysql (MySQL) * - pgsql (PostgreSQL) * - oci (Oracle) * * Defaults to: * - sqlite (SQLite3) * - mysql (MySQL) * - pgsql (PostgreSQL) */ 'supportedDatabases' => [ 'sqlite', 'mysql', 'pgsql', 'oci', ], /** * Override the location where Nextcloud stores temporary files. Useful in setups * where the system temporary directory is on a limited-space ramdisk, restricted, * or when using external storage that does not support streaming. * * The web server user/PHP must have write access to this directory. Ensure that * PHP configuration recognizes this as a valid temporary directory by setting * the TMP, TMPDIR, and TEMP environment variables accordingly. Additional * permissions may be required for AppArmor or SELinux. */ 'tempdirectory' => '/tmp/nextcloudtemp', /** * Override the location where Nextcloud stores update files during updates. * Useful when the default ``datadirectory`` is on a network disk like NFS or is * otherwise restricted. Defaults to the value of ``datadirectory`` if unset. * * If set, the directory must be located outside the Nextcloud installation * directory and writable by the web server user. */ 'updatedirectory' => '', /** * Block specific files or filenames, disallowing uploads or access (read and write). * ``.htaccess`` is blocked by default. * * WARNING: Use this only if you understand the implications. * * NOTE: This list is case-insensitive. * * Defaults to ``['.htaccess']`` */ 'forbidden_filenames' => ['.htaccess'], /** * Disallow uploads of files with specific basenames. Matching existing files * cannot be updated, and no new files can be created in matching folders. * * The basename is the filename without the extension, e.g., for "archive.tar.gz", * the basename is "archive". * * NOTE: This list is case-insensitive. * * Defaults to ``[]`` (empty array) */ 'forbidden_filename_basenames' => [], /** * Block specific characters in filenames. Useful for filesystems or operating * systems (e.g., Windows) that do not support certain characters. Matching * existing files cannot be updated, and no new files can be created in matching * folders. * * The ``/`` and ``\`` characters, as well as ASCII characters [0-31], are always * forbidden. * * Example for Windows: ``['?', '<', '>', ':', '*', '|', '"']`` * See: https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits * * Defaults to ``[]`` (empty array) */ 'forbidden_filename_characters' => [], /** * Deny specific file extensions. Matching existing files cannot be updated, and * no new files can be created in matching folders. * * The ``'.part'`` extension is always forbidden, as it is used internally by Nextcloud. * * Defaults to ``['.filepart', '.part']`` */ 'forbidden_filename_extensions' => ['.part', '.filepart'], /** * Specify the name of a theme to apply to Nextcloud. Themes are located in * ``nextcloud/themes/`` by default. * * Defaults to the theming app, included since Nextcloud 9. */ 'theme' => '', /** * Enforce a specific user theme, disabling user theming settings. Must be a * valid ITheme ID, e.g., ``dark``, ``dark-highcontrast``, ``default``, ``light``, * ``light-highcontrast``, ``opendyslexic``. */ 'enforce_theme' => '', /** * Enable or disable Progressive Web App (PWA) functionality, which allows * browsers to open web applications in dedicated windows. * * Defaults to ``true`` */ 'theming.standalone_window.enabled' => true, /** * Specify the default cipher for encrypting files. Supported ciphers: * - AES-256-CTR * - AES-128-CTR * - AES-256-CFB * - AES-128-CFB * * Defaults to ``AES-256-CTR`` */ 'cipher' => 'AES-256-CTR', /** * Use the legacy base64 format for encrypted files instead of the more * space-efficient binary format. This affects only newly written files; existing * encrypted files remain readable regardless of the format. * * Defaults to ``false`` */ 'encryption.use_legacy_base64_encoding' => false, /** * Specify the minimum Nextcloud desktop client version allowed to sync with this * server. Connections from earlier clients will be denied. Defaults to the * minimum officially supported version at the time of this server release. * * Changing this may cause older, unsupported clients to malfunction, potentially * leading to data loss or unexpected behavior. * * Defaults to ``3.1.50`` */ 'minimum.supported.desktop.version' => '3.1.50', /** * Specify the maximum Nextcloud desktop client version allowed to sync with this * server. Connections from later clients will be denied. * * Defaults to ``99.99.99`` */ 'maximum.supported.desktop.version' => '99.99.99', /** * Allow local storage to contain symlinks. * WARNING: Not recommended, as this allows Nextcloud to access files outside the * data directory, posing a potential security risk. * * Defaults to ``false`` */ 'localstorage.allowsymlinks' => false, /** * Nextcloud overrides umask to ensure suitable access permissions regardless of * web server or PHP-FPM configuration. Modifying this value has security * implications and may cause issues with the installation. * * Most installations should not modify this value. * * Defaults to ``0022`` */ 'localstorage.umask' => 0022, /** * Allow storage systems that do not support modifying existing files to overcome * this limitation by removing files before overwriting. * * Defaults to ``false`` */ 'localstorage.unlink_on_truncate' => false, /** * EXPERIMENTAL: Include external storage in quota calculations. * * Defaults to ``false`` */ 'quota_include_external_storage' => false, /** * When an external storage is unavailable (e.g., due to failed authentication), * it is flagged as such for a specified duration. For authentication failures, * this delay can be customized to reduce the likelihood of account lockouts in * systems like Active Directory. * * Defaults to ``1800`` seconds (30 minutes) */ 'external_storage.auth_availability_delay' => 1800, /** * Allow creation of external storages of type "Local" via the web interface and * APIs. When disabled, local storages can still be created using the occ command:: * * occ files_external:create /mountpoint local null::null -c datadir=/path/to/data * * Defaults to ``true`` */ 'files_external_allow_create_new_local' => true, /** * Specify how often the local filesystem (Nextcloud data/ directory and NFS * mounts in data/) is checked for changes made outside Nextcloud. This does not * apply to external storage. * * - ``0`` -> Never check the filesystem for outside changes, improving performance when no external changes are expected. * - ``1`` -> Check each file or folder at most once per request, recommended for general use if outside changes are possible. * * Defaults to ``0`` */ 'filesystem_check_changes' => 0, /** * Store part files created during upload in the same storage as the upload * target. Setting this to false stores part files in the root of the user's * folder, which may be necessary for external storage with limited rename * capabilities. * * Defaults to ``true`` */ 'part_file_in_storage' => true, /** * Specify the location of the ``mount.json`` file. * * Defaults to ``data/mount.json`` in the Nextcloud directory. */ 'mount_file' => '/var/www/nextcloud/data/mount.json', /** * Prevent Nextcloud from updating the cache due to filesystem changes for all * storage. * * Defaults to ``false`` */ 'filesystem_cache_readonly' => false, /** * List of trusted proxy servers. Supported formats: * * - IPv4 addresses, e.g., ``192.168.2.123`` * - IPv4 ranges in CIDR notation, e.g., ``192.168.2.0/24`` * - IPv6 addresses, e.g., ``fd9e:21a7:a92c:2323::1`` * - IPv6 ranges in CIDR notation, e.g., ``2001:db8:85a3:8d3:1319:8a20::/95`` * * If a request's ``REMOTE_ADDR`` matches an address here, it is treated as a proxy, * and the client IP is read from the HTTP header specified in * ``forwarded_for_headers`` instead of ``REMOTE_ADDR``. * * Ensure ``forwarded_for_headers`` is configured if ``trusted_proxies`` is set. * * Defaults to ``[]`` (empty array) */ 'trusted_proxies' => ['203.0.113.45', '198.51.100.128', '192.168.2.0/24'], /** * Headers trusted as containing the client IP address when used with * ``trusted_proxies``. For example, use ``HTTP_X_FORWARDED_FOR`` for the * ``X-Forwarded-For`` header. * * Incorrect configuration allows clients to spoof their IP address, bypassing * access controls and rendering logs unreliable. * * Defaults to ``['HTTP_X_FORWARDED_FOR']`` */ 'forwarded_for_headers' => ['HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'], /** * List of trusted IP ranges for admin actions. If non-empty, all admin actions * must originate from IPs within these ranges. * * Supported formats: * - IPv4 addresses or ranges, e.g., ``192.0.2.42/32``, ``233.252.0.0/24`` * - IPv6 addresses or ranges, e.g., ``2001:db8::13:37/64`` * * Defaults to ``[]`` (empty array) */ 'allowed_admin_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'], /** * Maximum file size (in megabytes) for animating GIFs on public sharing pages. * If a GIF exceeds this size, a static preview is shown. * * Set to ``-1`` for no limit. * * Defaults to ``10`` megabytes */ 'max_filesize_animated_gifs_public_sharing' => 10, /** * Set the lock's time-to-live (TTL) in seconds. Locks older than this are * automatically cleaned up. * * Defaults to ``3600`` seconds (1 hour) or the PHP ``max_execution_time``, * whichever is higher. */ 'filelocking.ttl' => 60 * 60, /** * Memory caching backend for file locking. Redis is highly recommended to avoid * data loss, as many memcache backends may evict values unexpectedly. * * Defaults to ``none`` */ 'memcache.locking' => '\\OC\\Memcache\\Redis', /** * Enable debug logging for file locking. This can generate a large volume of log * entries, potentially causing performance degradation and large log files on * busy instances. * * Use with ``log.condition`` to limit logging in production environments. * * Defaults to ``false`` */ 'filelocking.debug' => false, /** * Disable the web-based updater. * * Defaults to ``false`` */ 'upgrade.disable-web' => false, /** * Customize the CLI upgrade documentation link. */ 'upgrade.cli-upgrade-link' => '', /** * Additional line(s) (string or array of strings) * that will be added to .user.ini on each update by the updater. * * Defaults to ``''`` (empty string) */ 'user_ini_additional_lines' => '', /** * Customize the server logs documentation link for exception handling. */ 'documentation_url.server_logs' => '', /** * Enable debugging mode for Nextcloud. Only use for local development, not in * production, as it disables minification and outputs additional debug * information. * * Defaults to ``false`` */ 'debug' => false, /** * Set the data fingerprint for the current data served. Used by clients to * detect if a backup has been restored. Update this by running:: * * occ maintenance:data-fingerprint * * Changing or deleting this value may cause connected clients to stall until * conflicts are resolved. * * Defaults to ``''`` (empty string) */ 'data-fingerprint' => '', /** * This entry serves as a warning if the sample configuration was copied. * DO NOT ADD THIS TO YOUR CONFIGURATION! * * Ensure all settings are modified only after consulting the documentation. */ 'copied_sample_config' => true, /** * Use a custom lookup server to publish user data. * * Defaults to ``https://lookup.nextcloud.com`` */ 'lookup_server' => 'https://lookup.nextcloud.com', /** * Enable Nextcloud's Global Scale architecture. * * Defaults to ``false`` */ 'gs.enabled' => false, /** * Configure federation for Global Scale setups. Set to ``global`` to allow * federation outside the environment. * * Defaults to ``internal`` */ 'gs.federation' => 'internal', /** * List of user agents exempt from SameSite cookie protection due to non-standard * HTTP behavior. * * WARNING: Use only if you understand the implications. * * Defaults to: * * - ``/^WebDAVFS/`` (OS X Finder) * - ``/^Microsoft-WebDAV-MiniRedir/`` (Windows WebDAV drive) */ 'csrf.optout' => [ '/^WebDAVFS/', // OS X Finder '/^Microsoft-WebDAV-MiniRedir/', // Windows WebDAV drive ], /** * Specify allowed user agents for Login Flow V2 using regular expressions. * User agents not matching this list are denied access to Login Flow V2. * * WARNING: Use only if you understand the implications. * * Example: Allow only the Nextcloud Android app:: * * 'core.login_flow_v2.allowed_user_agents' => ['/Nextcloud-android/i'], * * Defaults to ``[]`` (empty array) */ 'core.login_flow_v2.allowed_user_agents' => [], /** * Show or hide the "simple sign up" link on public pages. * See: https://nextcloud.com/signup/ * * Defaults to ``true`` */ 'simpleSignUpLink.shown' => true, /** * Enable or disable autocompletion for the login form. Disabling this prevents * browsers from remembering login credentials, which may be required for * compliance with certain security policies. * * Defaults to ``true`` */ 'login_form_autocomplete' => true, /** * Set a timeout (in seconds) for the login form. After this period, the form is * reset to prevent password leaks on public devices if the user forgets to clear * it. * * A value of 0 disables the timeout. * * Defaults to ``300`` seconds (5 minutes) */ 'login_form_timeout' => 300, /** * Suppress warnings for outdated or unsupported browsers. When enabled, users * can bypass the warning after reading it. * * Set to ``true`` to disable the warning. * * Defaults to ``false`` */ 'no_unsupported_browser_warning' => false, /** * Disable background scanning of files. When enabled, a background job runs * every 10 minutes to sync the filesystem and database for up to 500 users with * unscanned files (size < 0 in filecache). * * Defaults to ``false`` */ 'files_no_background_scan' => false, /** * Log all database queries to a file. * * WARNING: This significantly reduces server performance and is intended only * for debugging or profiling query interactions. Sensitive data may be logged in * plain text. */ 'query_log_file' => '', /** * Prefix all queries with the request ID when set to `yes`. * * Requires ``query_log_file`` to be set. */ 'query_log_file_requestid' => '', /** * Include all query parameters in the query log when set to `yes`. * * Requires ``query_log_file`` to be set. * WARNING: This may log sensitive data in plain text. */ 'query_log_file_parameters' => '', /** * Include a backtrace in the query log when set to `yes`. * * Requires ``query_log_file`` to be set. */ 'query_log_file_backtrace' => '', /** * Log all Redis requests to a file. * * WARNING: This significantly reduces server performance and is intended only * for debugging or profiling Redis interactions. Sensitive data may be logged in * plain text. */ 'redis_log_file' => '', /** * Enable diagnostics event logging. Logs timings of common execution steps at * debug level. Use with ``log.condition`` to enable conditionally in production. * * Defaults to ``true`` */ 'diagnostics.logging' => true, /** * Limit diagnostics event logging to events longer than the specified threshold * (in milliseconds). A value of 0 disables diagnostics event logging. */ 'diagnostics.logging.threshold' => 0, /** * Enable profiling globally. * * Defaults to ``true`` */ 'profile.enabled' => true, /** * Override default scopes for account data. Valid properties and scopes are * defined in ``OCP\Accounts\IAccountManager``. Values are merged with defaults * from ``OC\Accounts\AccountManager``. * * Example: Set phone property to private scope: * ``[\OCP\Accounts\IAccountManager::PROPERTY_PHONE => \OCP\Accounts\IAccountManager::SCOPE_PRIVATE]`` */ 'account_manager.default_property_scope' => [], /** * Enable the deprecated Projects feature, superseded by Related Resources since * Nextcloud 25. * * Defaults to ``false`` */ 'projects.enabled' => false, /** * Enable the bulk upload feature. * * Defaults to ``true`` */ 'bulkupload.enabled' => true, /** * Enable fetching Open Graph metadata from remote URLs. * * Defaults to ``true`` */ 'reference_opengraph' => true, /** * Enable the legacy unified search. * * Defaults to ``false`` */ 'unified_search.enabled' => false, /** * Enable features that do not yet comply with accessibility standards. * * Defaults to ``true`` */ 'enable_non-accessible_features' => true, /** * Directories where Nextcloud searches for external binaries (e.g., LibreOffice, * sendmail, ffmpeg). * * Defaults to: * - /usr/local/sbin * - /usr/local/bin * - /usr/sbin * - /usr/bin * - /sbin * - /bin * - /opt/bin */ 'binary_search_paths' => [ '/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin', '/opt/bin', ], /** * Maximum chunk size for chunked uploads (in bytes). Larger chunks increase * throughput but yield diminishing returns above 100 MiB. Services like * Cloudflare may limit to 100 MiB. * * Defaults to ``100 * 1024 * 1024`` (100 MiB) */ 'files.chunked_upload.max_size' => 100 * 1024 * 1024, /** * Maximum number of chunks uploaded in parallel during chunked uploads. Higher * counts increase throughput but consume more server resources, with diminishing * returns. * * Defaults to ``5`` */ 'files.chunked_upload.max_parallel_count' => 5, /** * Allow users to manually delete files from their trashbin. Automated deletions * (e.g., due to low quota) are unaffected. * * Defaults to ``true`` */ 'files.trash.delete' => true, /** * Enable PHP 8.4 lazy objects for Dependency Injection to improve performance by * avoiding instantiation of unused objects. * * Defaults to ``true`` */ 'enable_lazy_objects' => true, /** * Change the default certificates bundle used for trusting certificates. * * Nextcloud ships its own up-to-date certificates bundle, but in certain cases admins may wish to specify a different bundle, for example the one shipped by their distro. * * Defaults to `\OC::$SERVERROOT . '/resources/config/ca-bundle.crt'`. */ 'default_certificates_bundle_path' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt', /** * OpenMetrics skipped exporters * Allows to skip some exporters in the OpenMetrics endpoint ``/metrics``. * * Default to ``[]`` (empty array) */ 'openmetrics_skipped_classes' => [ 'OC\OpenMetrics\Exporters\FilesByType', 'OCA\Files_Sharing\OpenMetrics\SharesCount', ], /** * OpenMetrics allowed client IP addresses * Restricts the IP addresses able to make requests on the ``/metrics`` endpoint. * * Keep this list as restrictive as possible as metrics can consume a lot of resources. * * Default to ``[127.0.0.0/16', '::1/128]`` (allow loopback interface only) */ 'openmetrics_allowed_clients' => [ '192.168.0.0/16', 'fe80::/10', '10.0.0.1', ], ];
Save File
Cancel