changelog.md: Document v1.56.0

NC 32 and fixes

.dockerignore

@@ -0,0 +1,11 @@
+torrent/
+tmp/
+cache/
+output/
+raspbian_root/
+raspbian_boot/
+qemu-raspbian-network/
+armbian/
+*.img
+*.tar.bz2
+.git

.github/ISSUE_TEMPLATE/1_Bug_report.md

@@ -0,0 +1,31 @@
+---
+name: 🐛 Bug Report
+about: Report errors and problems
+
+---
+
+<!--
+Thanks for reporting issues back to NextcloudPi! 
+
+Here you can file bugs and feature requests. **Do NOT ask questions**, this is not a support forum.
+
+If there is an important security issue that has gone unnoticed, please send a private email to nacho _at_ ownyourbits.com
+
+### DO NOT ASK QUESTIONS, USE THE FORUMS
+
+NCP and its extras are explained in the wiki, also make sure to read the articles in ownyourbits explaining NextcloudPi extras before asking. https://ownyourbits.com/category/nextcloudpi/
+
+For asking questions, please use the forums. https://help.nextcloud.com/c/support/appliances-docker-snappy-vm
+
+### PROBLEMS
+
+Please, look at the FAQ before posting a new issue. Also, make sure it has not been asked before. https://github.com/nextcloud/nextcloudpi/wiki/FAQ
+
+Keep in mind that many problems come from faulty power sources and corrupted SD cards, so make sure this is not the case for you before reporting.
+
+If you are running into problems, make sure to include the output of `sudo ncp-report`
+-->
+
+**System information**
+
+<!-- Paste the output of `sudo ncp-report` -->

.github/ISSUE_TEMPLATE/2_Feature_request.md

@@ -0,0 +1,12 @@
+---
+name: 🚀 Feature Request
+about: RFC and ideas for new features and improvements
+
+---
+
+**Description**  
+<!-- A clear and concise description of the new feature. -->
+
+**Example**  
+<!-- A simple example of the new feature in action (include PHP code, YAML config, etc.)
+     If the new feature changes an existing feature, include a simple before/after comparison. -->

.github/ISSUE_TEMPLATE/3_Support_question.md

@@ -0,0 +1,26 @@
+---
+name: ⛔ Support Question
+about: Do NOT ask here - Use the forum
+
+---
+
+Thanks for reporting issues back to NextcloudPi! 
+
+Here you can file bugs and feature requests. **Do NOT ask questions**, this is not a support forum.
+
+---
+DO NOT ASK QUESTIONS, USE THE FORUMS
+---
+
+NCP and its extras are explained in the wiki, also make sure to read the articles in ownyourbits explaining NextcloudPi extras before asking. https://ownyourbits.com/category/nextcloudpi/
+
+We use GitHub issues only to discuss about NextcloudPi bugs and new features.
+
+NCP and its extras are explained in the [wiki](https://github.com/nextcloud/nextcloudpi/wiki), also make sure to read the [articles in ownyourbits](https://ownyourbits.com/category/nextcloudpi/) explaining NextcloudPi extras before asking.
+
+For any other question or comment, please use the [forums](https://help.nextcloud.com/c/support/appliances-docker-snappy-vm), and make sure to tag
+the thread as `ncp`.
+
+Note that quite probably your question has an answer in the [FAQ](https://github.com/nextcloud/nextcloudpi/wiki/FAQ).
+
+Thank you!

.github/ISSUE_TEMPLATE/4_Documentation_issue.md

@@ -0,0 +1,12 @@
+---
+name: ⛔ Documentation Issue
+about: See the NextcloudPi Wiki
+
+---
+
+The NextcloudPi wiki is open to anyone to edit. If you find something inaccurate,
+missing or that can be improved, please feel free to contribute to it.
+
+https://github.com/nextcloud/nextcloudpi/wiki
+
+Thank you!

.github/actions/create-test-instance-bullseye/action.yml

@@ -0,0 +1,35 @@
+name: Create Test VM
+description: Create NCP instance for testing in the Hetzner cloud
+inputs:
+  version:
+    description: version (git rev / tag / branch) to install
+    required: true
+  uid:
+    description: A unique ID for labeling/naming generated resources
+    required: true
+  hcloud_token:
+    description: A auth token for Hetzner cloud
+    required: true
+  server_type:
+    description: Server type to use for hetzner servers
+    required: true
+    default: "cx22"
+
+outputs:
+  server_address:
+    description: Adress of the test instance
+  snapshot_id:
+    description: ID of the generated postinstall snapshot
+  test_server_id:
+    description: ID of the created test server
+runs:
+  using: docker
+  image: docker://thecalcaholic/ncp-test-automation:bullseye
+
+  env:
+    HCLOUD_TOKEN: ${{ inputs.hcloud_token }}
+    UID: ${{ inputs.uid }}
+    SERVER_TYPE: ${{ inputs.server_type }}
+  args:
+    - /ncp-test-automation/bin/actions/create-test-instance.sh
+    - ${{ inputs.version }}

.github/actions/create-test-instance/action.yml

@@ -0,0 +1,35 @@
+name: Create Test VM
+description: Create NCP instance for testing in the Hetzner cloud
+inputs:
+  version:
+    description: version (git rev / tag / branch) to install
+    required: true
+  uid:
+    description: A unique ID for labeling/naming generated resources
+    required: true
+  hcloud_token:
+    description: A auth token for Hetzner cloud
+    required: true
+  server_type:
+    description: Server type to use for hetzner servers
+    required: true
+    default: "cx22"
+
+outputs:
+  server_address:
+    description: Adress of the test instance
+  snapshot_id:
+    description: ID of the generated postinstall snapshot
+  test_server_id:
+    description: ID of the created test server
+runs:
+  using: docker
+  image: docker://thecalcaholic/ncp-test-automation:latest
+
+  env:
+    HCLOUD_TOKEN: ${{ inputs.hcloud_token }}
+    UID: ${{ inputs.uid }}
+    SERVER_TYPE: ${{ inputs.server_type }}
+  args:
+    - /ncp-test-automation/bin/actions/create-test-instance.sh
+    - ${{ inputs.version }}

.github/workflows/build-docker.yml

@@ -0,0 +1,539 @@
+# https://www.docker.com/blog/docker-v2-github-action-is-now-ga/
+# https://www.docker.com/blog/multi-arch-build-and-images-the-simple-way/
+# https://docs.github.com/en/actions/guides/publishing-docker-images
+
+name: 'Docker Integration Tests and Release'
+
+on:
+  workflow_call:
+    inputs:
+      git_ref:
+        required: true
+        type: string
+      arch:
+        required: false
+        type: string
+        default: 'x86'
+  push:
+    branches:
+      - docker-stable
+      - docker-devel
+  pull_request:
+    branches:
+      - docker-stable
+      - docker-devel
+      - release/docker/*
+
+jobs:
+  build:
+    if: ${{ github.repository == 'nextcloud/nextcloudpi' }}
+    runs-on: ubuntu-latest
+    env:
+      VERSION: "${{ inputs.git_ref || github.ref }}"
+      ARCH: "${{ inputs.arch || 'x86' }}"
+      LOG_DCKR: "\\033[1;34mDCKR::\\033[0m"
+      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+    steps:
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+#      - name: Set up QEMU
+#        uses: docker/setup-qemu-action@v3
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+
+      - name: Login to docker
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD_INTERNAL }}" | docker login -u "${{ secrets.DOCKER_LOGIN_INTERNAL }}" --password-stdin
+
+      - name: Build images
+        id: build-container
+        run: |
+          ./build/build-docker.sh "${ARCH?}"
+          docker tag "ownyourbits/nextcloudpi-${ARCH?}:latest" "thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}"
+          testing_image="ownyourbits/nextcloudpi-${ARCH?}:latest"
+          [[ "${ARCH?}" == "x86" ]] || testing_image="ownyourbits/ncp-qemu-fix-${ARCH?}:latest"
+          docker tag "${testing_image}" "thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}-testing"
+          docker push "thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}"
+          docker push "thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}-testing"
+
+  update-test:
+    # TODO: Fix update-test for armhf
+    # The issues are originating in a seemingly bug in apache2 that only occurs in the GH action and only
+    # if a docker volume or directory is mounted to /data.
+    # In this configuration, apache will serve the default placeholder page instead of the sites configured in ncp.
+    if: ${{ inputs.arch != 'armhf' }}
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    env:
+      VERSION: "${{ inputs.git_ref || github.ref }}"
+      ARCH: "${{ inputs.arch || 'x86' }}"
+      LOG_DCKR: "\\033[1;34mDCKR::\\033[0m"
+      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+    steps:
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+          fetch-depth: 0
+      - name: Get previous release
+        id: get_previous_version
+        shell: bash
+        run: |
+          set -ex
+          if [[ "${{ env.VERSION }}" == "refs/heads/devel" ]]
+          then
+            version="latest"
+          else
+            ref="${{ github.base_ref }}"
+            [[ -n "$ref" ]] || ref="${{ github.ref }}"
+            git checkout "$ref"
+            if [[ "${{ github.ref_type }}" != "tag" ]] || ! git describe --tags > /dev/null
+            then
+              git fetch -fu --tags origin "${ref}:${ref}"
+            fi
+            version="$(git describe --tags || true)"
+            [[ "$version" =~ .*-.*-.* ]] || {
+              git checkout HEAD~1
+              version="$(git describe --tags || echo latest)"
+            }
+            version="${version%-*-*}"
+          fi
+          curl "https://hub.docker.com/v2/repositories/ownyourbits/nextcloudpi-${ARCH}/tags/${version}" | grep 'errinfo' > /dev/null && {
+            echo "Image ownyourbits/nextcloudpi-${ARCH}:${version} does not exist - falling back to :latest"
+            version="latest"
+          }
+          version="${version#docker-}"
+          echo "Previous version is '$version'"
+          echo "PREVIOUS_VERSION=$version" >> "$GITHUB_ENV"
+          echo "previous_version=${version}" >> $GITHUB_OUTPUT
+#      - name: Set up QEMU
+#        uses: docker/setup-qemu-action@v3
+
+      - name: Enable qemu SUID
+        run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes --credential yes
+
+      - name: Start ncp container
+        run: |
+          docker volume create ncdata
+          platform=linux/${ARCH?}
+          [[ "$ARCH" == 'x86' ]] && platform=linux/amd64
+          tmpdir=$(mktemp -d)
+          pushd "$tmpdir" 
+          cat <<EOF > ./Dockerfile
+          FROM --platform=$platform ownyourbits/nextcloudpi:${{ steps.get_previous_version.outputs.previous_version }}
+  
+          RUN echo 'Mutex posixsem' >> /etc/apache2/mods-available/ssl.conf
+          EOF
+          docker buildx build --platform "$platform" -t ncp-testing -f Dockerfile --load .
+          popd
+          rm -r "$tmpdir"
+          docker run --platform "$platform" -v ncdata:/data -d --rm -p 8443:443 -p 4443:4443 --name nextcloudpi ncp-testing localhost
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+
+      - name: Setup Firefox
+        uses: browser-actions/setup-firefox@latest
+      - name: Setup GeckoDriver
+        uses: ChlodAlejandro/setup-geckodriver@latest
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Selenium
+        run: pip install selenium
+
+      - name: Wait for container startup
+        run: |
+          set -e
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          
+          attempt=0
+          stage=0
+          success=false
+          for attempt in {1..30}
+          do
+            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/30)..."
+            redis_pw="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")"
+            redis_socket="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")"
+            if [[ "$stage" == "0" ]] && docker logs nextcloudpi 2> /dev/null | grep '^Init done'
+            then
+              stage=1
+            elif [[ "$(docker exec nextcloudpi ncc maintenance:mode)" =~ .*disabled.* ]] \
+              && docker exec nextcloudpi ncc status \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" get redisready \
+              && curl -k https://localhost:8443/activate/ > /dev/null
+            then
+              success=true
+              echo -e "${LOG_CICD} Startup successful"
+              break
+            fi
+
+            attempt=$((attempt + 1))
+            sleep 5
+          done
+          
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Timeout reached."
+            exit 1
+          }
+
+      - name: Activate container
+        working-directory: ./tests
+        run: |
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          docker exec nextcloudpi bash -c 'tail -f /var/log/ncp.log' |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+          cmd=(python activation_tests.py --no-gui localhost 8443 4443)
+          [[ "${ARCH?}" == "x86" ]] || { sleep 60; cmd+=(--timeout 300); }
+          
+          success=false
+          for attempt in {1..10}
+          do
+            echo -e "${LOG_CICD} == Activation Tests (attempt $attempt/10) =="
+            "${cmd[@]}"                                               |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              tail -n 20 geckodriver.log                              |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo -e "${LOG_CICD} Activation test (attempt $attempt/10) failed!"
+              docker exec nextcloudpi bash /usr/local/bin/ncp-diag    |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              cat /proc/sys/fs/binfmt_misc/qemu-aarch64               |& awk "{ print \"${LOG_DIAG} (qemu-aarch64) \" \$0 }" || true
+              cat /proc/sys/fs/binfmt_misc/qemu-arm                   |& awk "{ print \"${LOG_DIAG} (qemu-arm) \" \$0 }" || true
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Activation test failed in all attempts!"
+            echo "Creating error report..."
+            docker exec nextcloudpi bash /usr/local/bin/ncp-report > error-report.txt
+            echo "done."
+            exit 1
+          }
+          echo -e "${LOG_CICD} Activation test successful"
+      - name: Start new container
+        run: |
+          docker stop nextcloudpi
+          docker run -d -v ncdata:/data --rm -p 8443:443 -p 4443:4443 -e NOBACKUP=true --name nextcloudpi thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}-testing localhost
+      - name: Wait for container startup
+        run: |
+          set -e
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          
+          attempt=0
+          stage=0
+          for attempt in {1..200}
+          do
+            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/30)..."
+            redis_pw="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")"
+            redis_socket="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")"
+            if [[ "$stage" == "0" ]] && docker logs nextcloudpi 2> /dev/null | grep '^Init done' > /dev/null
+            then
+              stage=1
+            elif [[ "$(docker exec nextcloudpi ncc maintenance:mode)" =~ .*disabled.* ]] \
+              && docker exec nextcloudpi ncc status \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" get redisready \
+              && curl -k https://localhost:8443/activate/
+            then
+              echo -e "${LOG_CICD} Startup successful"
+              break
+            elif [[ "$attempt" -ge 30 ]]
+            then
+              echo -e "${LOG_CICD} Timeout reached."
+              exit 1
+            fi
+
+            attempt=$((attempt + 1))
+            sleep 5
+          done
+          
+          echo "Wait one more minute..."
+          sleep 60
+      - name: Update Nextcloud
+        run: |
+          set -e
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          
+          current_nc_version="$(docker exec nextcloudpi ncc status | grep "version:" | awk '{ print $3 }')"
+          latest_nc_version="$(docker exec nextcloudpi cat /usr/local/etc/ncp.cfg | jq -r '.nextcloud_version')"
+          
+          if [[ "$current_nc_version" == "$latest_nc_version".* ]]
+          then
+            echo -e "${LOG_CICD} Nextcloud is up to date - skipping NC update test."
+          else
+            docker exec nextcloudpi bash -c "DBG=x ncp-update-nc ${latest_nc_version?}" |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} Nextcloud Update failed"
+              echo -e "${LOG_CICD} Creating error report..."
+              docker exec nextcloudpi bash /usr/local/bin/ncp-report > error-report.txt
+              docker exec nextcloudpi bash /usr/local/bin/ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+              exit 1
+            }
+          fi
+      - name: Wait for update completion
+        run: |
+          set -e
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          
+          attempt=0
+          for attempt in {1..30}
+          do
+            echo -e "${LOG_CICD} Waiting for update completion (attempt $attempt/30)..."
+            redis_pw="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")"
+            redis_socket="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")"
+            if [[ "$(docker exec nextcloudpi ncc maintenance:mode)" =~ .*disabled.* ]] \
+              && docker exec nextcloudpi ncc status \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" get redisready
+            then
+              echo -e "${LOG_CICD} Startup successful"
+              break
+            elif [[ "$attempt" -ge 30 ]]
+            then
+              echo -e "${LOG_CICD} Timeout reached."
+              exit 1
+            fi
+
+            attempt=$((attempt + 1))
+            sleep 5
+          done
+
+      - name: Integration Tests
+        working-directory: ./tests
+        run: |
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          docker exec nextcloudpi bash -c 'tail -f /var/log/ncp.log' |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+          [[ "${ARCH?}" == "x86" ]] || sleep 240
+          
+          sleep 20
+                    
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+            python system_tests.py --no-ping --non-interactive |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} System test (attempt $attempt) failed!"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} System test failed in all attempts!"
+            echo -e "${LOG_CICD} Creating error report..."
+            docker exec nextcloudpi bash /usr/local/bin/ncp-report > error-report.txt
+            exit 1
+          }
+          echo -e "${LOG_CICD} System test successful"
+          
+          success=false
+          for attempt in {1..3}
+          do
+            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+            python nextcloud_tests.py --no-gui localhost 8443 4443   |& awk "{ print \"${LOG_TEST} \" \$0 }" 
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              tail -n 20 geckodriver.log                             |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo -e "${LOG_CICD} Nextcloud test (attempt $attempt/3) failed!"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+            echo -e "${LOG_CICD} Creating error report..."
+            docker exec nextcloudpi bash /usr/local/bin/ncp-report > error-report.txt
+            echo -e "${LOG_CICD} done."
+            exit 1
+          }
+          echo -e "${LOG_CICD} Nextcloud test successful"
+          
+          docker exec nextcloudpi bash /usr/local/bin/ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+      - name: "Upload error report"
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ github.run_id }}-docker-${{ env.ARCH }}-update-test-error-report
+          path: tests/error-report.txt
+
+  test:
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    env:
+      VERSION: "${{ inputs.git_ref || github.ref }}"
+      ARCH: "${{ inputs.arch || 'x86' }}"
+      LOG_DCKR: "\\033[1;34mDCKR::\\033[0m"
+      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+    steps:
+#      - name: Set up QEMU
+#        uses: docker/setup-qemu-action@v3
+
+      - name: Login to docker
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD_INTERNAL }}" | docker login -u "${{ secrets.DOCKER_LOGIN_INTERNAL }}" --password-stdin
+      - name: Start ncp container
+        run: |
+          docker run -d --rm -p 8443:443 -p 4443:4443 --name nextcloudpi thecalcaholic/ncp-internal-${ARCH?}:${{ github.run_id }}-testing localhost
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+
+      - name: Setup Firefox
+        uses: browser-actions/setup-firefox@latest
+      - name: Setup GeckoDriver
+        uses: ChlodAlejandro/setup-geckodriver@latest
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Selenium
+        run: pip install selenium
+      - name: Wait for container startup
+        run: |
+          set -e
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+
+          attempt=0
+          stage=0
+          for attempt in {1..200}
+          do
+            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/30)..."
+            redis_pw="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")"
+            redis_socket="$(docker exec nextcloudpi bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")"
+            if [[ "$stage" == "0" ]] && docker logs nextcloudpi 2> /dev/null | grep '^Init done' > /dev/null
+            then
+              stage=1
+            elif [[ "$(docker exec nextcloudpi ncc maintenance:mode)" =~ .*disabled.* ]] \
+              && docker exec nextcloudpi ncc status \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes \
+              && docker exec nextcloudpi redis-cli -s "$redis_socket" -a "$redis_pw" get redisready \
+              && curl -k https://localhost:8443/activate/
+            then
+              echo -e "${LOG_CICD} Startup successful"
+              break
+            elif [[ "$attempt" -ge 30 ]]
+            then
+              echo -e "${LOG_CICD} Timeout reached."
+              exit 1
+            fi
+
+            attempt=$((attempt + 1))
+            sleep 5
+          done
+      - name: Integration Tests
+        working-directory: ./tests
+        run: |
+          docker logs nextcloudpi                                    |& awk "{ print \"${LOG_DCKR} \" \$0 }"
+          echo -e "${LOG_DCKR} =========="
+          docker logs -f nextcloudpi                                 |& awk "{ print \"${LOG_DCKR} \" \$0 }" &
+          docker exec nextcloudpi bash -c 'tail -f /var/log/ncp.log' |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+          cmd=(python activation_tests.py --no-gui localhost 8443 4443)
+          [[ "${ARCH?}" == "x86" ]] || { sleep 60; cmd+=(--timeout 300); }
+          
+          success=false
+          for attempt in {1..10}
+          do
+            echo -e "${LOG_CICD} == Activation Tests (attempt $attempt/10) =="
+            "${cmd[@]}"                                              |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              tail -n 20 geckodriver.log >&2                         |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo -e "${LOG_CICD} Activation test (attempt $attempt/10) failed!"
+              docker exec nextcloudpi bash /usr/local/bin/ncp-diag   |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Activation test failed in all attempts!"
+            exit 1
+          }
+          echo -e "${LOG_CICD} Activation test successful"
+          
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+            python system_tests.py --no-ping --non-interactive       |& awk "{ print \"${LOG_TEST} \" \$0 }" 
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} System test (attempt $attempt) failed!"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} System test failed in all attempts!"
+            exit 1
+          }
+          echo -e "${LOG_CICD} System test successful"
+          
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+            python nextcloud_tests.py --no-gui localhost 8443 4443   |& awk "{ print \"${LOG_TEST} \" \$0 }" 
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              tail -n 20 geckodriver.log >&2                         |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo -e "${LOG_CICD} Nextcloud test (attempt $attempt/3) failed!"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+            echo -e "${LOG_CICD} Creating error report..."
+            docker exec nextcloudpi bash /usr/local/bin/ncp-report > error-report.txt
+            echo -e "${LOG_CICD} done."
+            exit 1
+          }
+          echo -e "${LOG_CICD} Nextcloud test successful"
+          
+          docker exec nextcloudpi bash /usr/local/bin/ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+
+      - name: "Upload error report"
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ github.run_id }}-docker-${{ env.ARCH }}-install-test-error-report
+          path: tests/error-report.txt

.github/workflows/build-lxd.yml

@@ -0,0 +1,775 @@
+name: "Build and test LXD image"
+on:
+  workflow_call:
+    inputs:
+      git_ref:
+        required: true
+        type: string
+      arch:
+        required: false
+        type: string
+        default: 'x86'
+    outputs:
+      lxd_artifact_name:
+        value: "${{ jobs.build-current.outputs.artifact_name }}"
+      lxd_artifact_file:
+        value: "${{ jobs.build-current.outputs.artifact_file }}"
+      lxc_artifact_name:
+        value: "${{ jobs.convert-to-lxc-image.outputs.artifact_name }}"
+      lxc_artifact_file:
+        value: "${{ jobs.convert-to-lxc-image.outputs.artifact_file }}"
+  push:
+    branches:
+      - "**"
+  pull_request:
+    branches:
+      - master
+      - devel
+      - release/*
+
+jobs:
+  determine-runner:
+    env:
+      LXD_ARCH: "${{ inputs.arch || 'x86' }}"
+    runs-on: ubuntu-latest
+    outputs:
+      runner_label: ${{ steps.script.outputs.runner_label }}
+      lxc_cmd: ${{ steps.script.outputs.lxc_cmd }}
+      lxd_extra_profile: ${{ steps.script.outputs.lxd_extra_profile }}
+    steps:
+      - name: script
+        id: script
+        run: |
+          if [[ "${LXD_ARCH}" == "arm64" ]]
+          then
+            LXC_CMD="incus"
+            RUNNER_LABEL="ubuntu-20.04-arm64"
+            echo "lxd_extra_profile=network" | tee -a "$GITHUB_OUTPUT"
+          else
+            LXC_CMD="incus"
+            RUNNER_LABEL="ubuntu-latest"
+          fi
+
+          echo "runner_label=$RUNNER_LABEL" | tee -a $GITHUB_OUTPUT
+          echo "lxc_cmd=$LXC_CMD" | tee -a $GITHUB_OUTPUT
+  build-current:
+    needs:
+      - determine-runner
+    runs-on: ${{ needs.determine-runner.outputs.runner_label }}
+    outputs:
+      artifact_name: "${{ env.ARTIFACT_NAME }}"
+      artifact_file: "${{ steps.pack-lxd.outputs.artifact_file }}"
+    env:
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      ARTIFACT_NAME: "${{ github.run_id }}-lxd-${{ inputs.arch || 'x86' }}-image"
+      LXD_ARCH: "${{ inputs.arch || 'x86' }}"
+      LXC: "${{ needs.determine-runner.outputs.lxc_cmd }}"
+      LXD_EXTRA_PROFILE: "${{ needs.determine-runner.outputs.lxd_extra_profile }}"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: "${{ env.VERSION }}"
+      - name: Setup incus
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        run: |
+          sudo apt-get install -y incus qemu-system incus-tools
+          sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
+          sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+          sudo incus admin init --auto
+      - name: Build LXD image
+        env:
+          USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
+        run: |
+          export CI
+          LXD_EXTRA_PROFILE="$LXD_EXTRA_PROFILE" BRANCH="${VERSION##refs/heads/}" ./build/build-LXD.sh
+      - name: Pack LXD image
+        id: pack-lxd
+        run: |
+          . ./build/buildlib.sh
+          ARTIFACT_FILE="NextcloudPi_LXD_${LXD_ARCH:-x86}_${VERSION//\//_}"
+          sudo "$LXC" image export -q ncp/"${version}" "output/${ARTIFACT_FILE}"
+          echo "artifact_file=${ARTIFACT_FILE}.tar.gz" >> $GITHUB_OUTPUT
+      - name: upload LXD image to artifact store
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ env.ARTIFACT_NAME }}"
+          path: "output/${{ steps.pack-lxd.outputs.artifact_file }}"
+          if-no-files-found: error
+
+#  build-previous:
+#    needs:
+#      - determine-runner
+#    runs-on: [ ubuntu-20.04 ]
+#    if: ${{ inputs.arch == 'x86' || inputs.arch == '' }}
+#    outputs:
+#      artifact_name: "${{ env.ARTIFACT_NAME }}"
+#      artifact_file: "${{ steps.pack-lxd.outputs.artifact_file }}"
+#      previous_version: "${{ steps.checkout_previous_version.outputs.previous_version }}"
+#    env:
+#      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+#      ARTIFACT_NAME: "${{ github.run_id }}-lxd-${{ inputs.arch || 'x86' }}-image-previous"
+#      LXD_ARCH: "${{ inputs.arch || 'x86' }}"
+#      LXC: "${{ needs.determine-runner.outputs.lxc_cmd }}"
+#      LXD_EXTRA_PROFILE: "${{ needs.determine-runner.outputs.lxd_extra_profile }}"
+#    steps:
+#      - name: Checkout code
+#        uses: actions/checkout@v3
+#        with:
+#          ref: "${{ env.VERSION }}"
+#          fetch-depth: 0
+#      - name: Checkout previous release
+#        id: checkout_previous_version
+#        shell: bash
+#        run: |
+#          set -e
+#          if [[ -n "${{ github.base_ref }}" ]]
+#          then
+#            version="${{ github.base_ref }}"
+#          elif [[ "${{ env.VERSION }}" == "refs/heads/devel" ]]
+#          then
+#            version="master"
+#          else
+#            if [[ "${{ github.ref_type }}" != "tag" ]] || ! git describe --tags > /dev/null
+#            then
+#              git fetch -fu --tags origin ${{ env.VERSION }}:${{ env.VERSION }}
+#            fi
+#            version="$(git describe --tags)"
+#            [[ "$version" =~ .*-.*-.* ]] || {
+#              git checkout HEAD~1
+#              version="$(git describe --tags)"
+#            }
+#            version="${version%-*-*}"
+#          fi
+#          echo "Previous version is '$version'"
+#          git checkout "$version"
+#          echo "VERSION=$version" >> "$GITHUB_ENV"
+#          echo "previous_version=${version}" >> $GITHUB_OUTPUT
+#      - name: Setup incus
+#        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+#        run: |
+#          curl https://pkgs.zabbly.com/get/incus-stable | sudo sh -x
+#          sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
+#          sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+#          sudo incus admin init --auto
+#
+#      - name: Build LXD image
+#        env:
+#          USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
+#        run: |
+#          export CI
+#          LXD_EXTRA_PROFILE="$LXD_EXTRA_PROFILE" BRANCH="${VERSION##refs/heads/}" ./build/build-LXD.sh
+#      - name: Pack LXD image
+#        id: pack-lxd
+#        run: |
+#          . ./build/buildlib.sh
+#          ARTIFACT_FILE="NextcloudPi_LXD_${LXD_ARCH:-x86}_${VERSION//\//_}"
+#          sudo "${LXC}" image export -q ncp/"${version}" "output/${ARTIFACT_FILE}"
+#          echo "artifact_file=${ARTIFACT_FILE}.tar.gz" >> $GITHUB_OUTPUT
+#      - name: upload LXD image to artifact store
+#        uses: actions/upload-artifact@v3
+#        with:
+#          name: "${{ env.ARTIFACT_NAME }}"
+#          path: "output/${{ steps.pack-lxd.outputs.artifact_file }}"
+#          if-no-files-found: error
+#
+#  test-update:
+#    needs:
+#      - determine-runner
+#      - build-previous
+#    runs-on: ${{ needs.determine-runner.outputs.runner_label }}
+#    outputs:
+#      artifact_name: "${{ env.ARTIFACT_NAME }}"
+#      artifact_file: "${{ steps.pack-lxd.outputs.artifact_file }}"
+#    env:
+#      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+#      ARTIFACT_NAME: "${{ needs.build-previous.outputs.artifact_name }}"
+#      LXC: "${{ needs.determine-runner.outputs.lxc_cmd }}"
+#      USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
+#    steps:
+#      - name: Checkout code
+#        uses: actions/checkout@v3
+#        with:
+#          ref: "${{ env.VERSION }}"
+#      - name: Setup incus
+#        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+#        run: |
+#          curl https://pkgs.zabbly.com/get/incus-stable | sudo sh -x
+#          sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
+#          sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+#          sudo incus admin init --auto
+#      - name: Setup Firefox
+#        continue-on-error: true
+#        id: setup-firefox-browser-action
+#        uses: browser-actions/setup-firefox@latest
+#      - name: Setup Firefox from packages
+#        if: ${{ steps.setup-firefox-browser-action.outcome == 'failure' }}
+#        run: |
+#          sudo apt-get install -y --no-install-recommends firefox
+#      - name: Setup GeckoDriver
+#        env:
+#          GH_TOKEN: ${{ github.token }}
+#        run: |
+#          arch=linux64
+#          if [[ "$RUNNER_ARCH" == "ARM64" ]]
+#          then
+#            arch="linux-aarch64"
+#          fi
+#          gh release download -R mozilla/geckodriver -p 'geckodriver-*-'"$arch.tar.gz"
+#          tar xf "geckodriver-"*"-$arch.tar.gz"
+#          sudo mv geckodriver /usr/local/bin/
+#      - name: Setup Selenium
+#        run: pip install selenium
+#      - name: download LXD image from artifact store
+#        uses: actions/download-artifact@v3
+#        with:
+#          name: ${{ needs.build-previous.outputs.artifact_name }}
+#      - name: Remove old lxd images
+#        if: ${{ inputs.arch == 'arm64' }}
+#        run: |
+#          for img in $("$LXC" image list -c f -f csv)
+#          do
+#            sudo "$LXC" image delete "$img"
+#          done
+#      - name: Launch ncp container
+#        run: |
+#          set -x
+#          sudo "$LXC" delete -q -f ncp || true
+#          sudo "$LXC" image import -q "./${{ needs.build-previous.outputs.artifact_file }}" --alias "ncp/update"
+#          systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "ncp/test" ncp || \
+#          sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "ncp/test" ncp
+#          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+#          sudo "$LXC" exec ncp -- rm -f /opt/ncdata/data/nextcloud.log
+#          sleep 30
+#          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+#          ip="${ip/% *}"
+#          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+#          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+#      - name: Activate and Test LXD Image
+#        working-directory: ./tests
+#        run: |
+#          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+#          python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+#            echo "Activation test failed!"
+#            echo "Geckodriver logs:"
+#            tail -n 20 geckodriver.log >&2 || true
+#            echo "================"
+#            echo "ncp.log: "
+#            "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+#            exit 1
+#          }
+#          python nextcloud_tests.py --no-gui --skip-release-check "nextcloudpi.local" 443 4443 || {
+#            echo "Nextcloud test failed!"
+#            echo "Geckodriver logs:"
+#            tail -n 20 geckodriver.log >&2 || true
+#            echo "================"
+#            echo "ncp.log: "
+#            "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+#            echo "================"
+#            echo "nextcloud log: "
+#            datadir="$("$LXC" exec ncp -- ncc config:system:get datadirectory)"
+#            "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+#            exit 1
+#          }
+#          USE_INCUS="$USE_INCUS" python system_tests.py --non-interactive --skip-update-test || {
+#            echo "System test failed!"
+#            exit 1
+#          }
+#      - name: Update ncp
+#        env:
+#          HEAD_REF: "${{ github.head_ref }}"
+#        run: |
+#          set -ex
+#          BRANCH="${VERSION/refs\/heads\//}"
+#          BRANCH="${BRANCH/refs\/tags\//}"
+#          if [[ "$BRANCH" =~ "refs/pull/"* ]]
+#          then
+#            UPDATE_ARGS=("${HEAD_REF}" "$VERSION")
+#          else
+#            UPDATE_ARGS=("$BRANCH")
+#          fi
+#          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+#          echo "Running update ${{ needs.build-previous.outputs.previous_version }} -> ${VERSION}"
+#
+#          current_nc_version="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
+#          latest_nc_version="$(cat etc/ncp.cfg | jq -r '.nextcloud_version')"
+#
+#          sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
+#          sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
+#
+#          if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
+#          then
+#            echo "Nextcloud is up to date - skipping NC update test."
+#          else
+#            sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update-nc ${latest_nc_version?}"
+#          fi
+#
+#          sudo "$LXC" exec ncp -- rm -f /opt/ncdata/data/nextcloud.log
+#
+#          sudo "$LXC" stop ncp
+#      - name: Relaunch container
+#        run: |
+#          set -x
+#          systemd-run --user --scope -p "Delegate=yes" "$LXC" start -q ncp || \
+#          sudo systemd-run --scope -p "Delegate=yes" "$LXC" start -q ncp
+#          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+#          sleep 30
+#          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+#          ip="${ip/% *}"
+#          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+#          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+#      - name: Test LXD Image
+#        working-directory: ./tests
+#        run: |
+#          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+#          python nextcloud_tests.py --no-gui --skip-release-check "nextcloudpi.local" 443 4443 || {
+#            echo "Nextcloud test failed!"
+#            echo "Geckodriver logs:"
+#            tail -n 20 geckodriver.log >&2 || true
+#            echo "================"
+#            echo "ncp.log: "
+#            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+#            echo "================"
+#            echo "nextcloud log: "
+#            datadir="$("$LXC" exec ncp -- ncc config:system:get datadirectory)"
+#            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+#            exit 1
+#          }
+#          USE_INCUS="$USE_INCUS" python system_tests.py --non-interactive || {
+#            echo "System test failed!"
+#            exit 1
+#          }
+
+  test-dist-upgrade:
+    if: false
+    needs:
+      - determine-runner
+    runs-on: ${{ needs.determine-runner.outputs.runner_label }}
+    env:
+      VERSION: "${{ inputs.git_ref || github.ref }}"
+      LXC: "${{ needs.determine-runner.outputs.lxc_cmd }}"
+      LXD_EXTRA_PROFILE: "${{ needs.determine-runner.outputs.lxd_extra_profile }}"
+      PREVIOUS_IMAGE_URL_ARM64: "https://github.com/nextcloud/nextcloudpi/releases/download/v1.53.2/NextcloudPi_LXD_arm64_v1.53.2.tar.gz"
+      PREVIOUS_IMAGE_URL_AMD64: "https://github.com/nextcloud/nextcloudpi/releases/download/v1.53.2/NextCloudPi_LXD_x86_v1.53.2.tar.gz"
+      USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
+    steps:
+      - name: Setup incus
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        run: |
+          sudo apt-get install -y incus qemu-system incus-tools
+          sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
+          sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+          sudo incus admin init --auto
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "v1.54.3"
+      - name: Setup Firefox
+        if: ${{ runner.arch != 'ARM64' }}
+        continue-on-error: true
+        id: setup-firefox-browser-action
+        uses: browser-actions/setup-firefox@latest
+      - name: Setup Firefox from packages
+        if: ${{ runner.arch == 'ARM64' || steps.setup-firefox-browser-action.outcome == 'failure' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends firefox
+      - name: Setup GeckoDriver
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -x
+          arch=linux64
+          if [[ "${{ runner.arch }}" == "ARM64" ]]
+          then
+            arch="linux-aarch64"
+          fi
+          gh release download -R mozilla/geckodriver -p 'geckodriver-*-'"$arch.tar.gz"
+          tar xf "geckodriver-"*"-$arch.tar.gz"
+          sudo mv geckodriver /usr/local/bin/
+          sudo chmod +x /usr/local/bin/geckodriver
+          echo "GECKODRIVER_PATH=/usr/local/bin/geckodriver" >> "$GITHUB_ENV"
+          geckodriver -V
+      - name: Setup Selenium
+        run: |
+          sudo apt-get -y install python3-venv
+          python3 -m venv ./.venv
+          ./.venv/bin/pip install selenium
+      - name: download LXD image
+        run: |
+          image_url="${PREVIOUS_IMAGE_URL_AMD64?}"
+          if [[ "${{ runner.arch }}" == "ARM64" ]]
+          then
+            image_url="${PREVIOUS_IMAGE_URL_ARM64?}"
+          fi
+          wget -qO ./ncp.tar.gz "${image_url?}"
+      - name: Launch ncp container
+        run: |
+          set -x
+          sudo "$LXC" delete -q -f ncp || true
+          sudo "$LXC" image import -q "./ncp.tar.gz" --alias "ncp/update"
+          LXC_ARGS=(-p default)
+          [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
+          systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp || \
+          sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp
+          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+          sudo "$LXC" exec ncp -- rm -f /opt/ncdata/data/nextcloud.log
+          sleep 30
+          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+          ip="${ip/% *}"
+          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+      - name: Activate and Test LXD Image
+        working-directory: ./tests
+        run: |
+          set -x
+          export GECKODRIVER_PATH="$GECKODRIVER_PATH"
+          export FF_BINARY_PATH="$(which firefox)"
+          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+          ../.venv/bin/python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+            echo "Activation test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            exit 1
+          }
+          ../.venv/bin/python nextcloud_tests.py --skip-release-check --no-gui "nextcloudpi.local" 443 4443 || {
+            echo "Nextcloud test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+          USE_INCUS="$USE_INCUS"  ../.venv/bin/python system_tests.py --non-interactive --skip-update-test || {
+            echo "System test failed!"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+
+      - name: Update ncp
+        env:
+          HEAD_REF: "${{ github.head_ref }}"
+        run: |
+          set -ex
+          BRANCH="${VERSION/refs\/heads\//}"
+          BRANCH="${BRANCH/refs\/tags\//}"
+          if [[ "$BRANCH" =~ "refs/pull/"* ]]
+          then
+            UPDATE_ARGS=("${HEAD_REF}" "$VERSION") 
+          else
+            UPDATE_ARGS=("$BRANCH")
+          fi
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+          echo "Running update to ${VERSION}"
+          
+          current_nc_version="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
+          latest_nc_version="29.0.9"
+          
+          sudo "$LXC" exec ncp -- apt-get update ||:
+          sudo "$LXC" exec ncp -- apt-get install --no-install-recommends -y gnupg2
+          sudo "$LXC" exec ncp -- apt-key adv --fetch-keys https://packages.sury.org/php/apt.gpg
+          
+          sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
+          sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
+          
+          #if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
+          #then
+          #  echo "Nextcloud is up to date - skipping NC update test."
+          #else
+          #  sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update-nc ${latest_nc_version?}"
+          #  sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
+          #fi
+  
+          sudo "$LXC" exec ncp -- rm -f /opt/ncdata/data/nextcloud.log
+          
+          sudo "$LXC" stop ncp
+      - name: Relaunch container
+        run: |
+          set -x
+          LXC_ARGS=()
+          [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
+          systemd-run --user --scope -p "Delegate=yes" "$LXC" start ncp || \
+          sudo systemd-run --scope -p "Delegate=yes" "$LXC" start ncp
+          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+          sleep 30
+          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+          ip="${ip/% *}"
+          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+      - name: Test LXD Image
+        working-directory: ./tests
+        run: |
+          export GECKODRIVER_PATH="$GECKODRIVER_PATH"
+          export FF_BINARY_PATH="$(which firefox)"
+          ../.venv/bin/python nextcloud_tests.py --no-gui --skip-release-check "nextcloudpi.local" 443 4443 || {
+            echo "Nextcloud test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive --skip-update-test || {
+            echo "System test failed!"
+            exit 1
+          }
+      - name: Checkout current version
+        run: |
+          git fetch origin
+          git checkout "${{ env.VERSION }}"
+      - name: NCP distupgrade
+        id: distupgrade
+        run: |
+          set -x
+          sudo "$LXC" exec ncp -- cat /etc/os-release | grep 'VERSION_ID="11"' || {
+            echo "can't upgrade from Debian $(sudo "$LXC" exec ncp -- cat /etc/os-release | grep VERSION_ID=)"
+            exit 1
+          }
+          current_nc_version="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
+          latest_nc_version="$(cat etc/ncp.cfg | jq -r '.nextcloud_version')"
+          
+          sudo "$LXC" exec ncp -- bash -c "DEBIAN_FRONTEND=noninteractive ncp-dist-upgrade"
+          sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
+          
+          if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
+          then
+            echo "Nextcloud is up to date - skipping NC update test."
+          else
+            
+            for i in {1..10};
+            do
+              echo "running nc update ($i/10)..."
+              sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update-nc ${latest_nc_version?}"
+            
+              sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
+              current_nc_version_new="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
+              if [[ "$current_nc_version_new" =~ "$latest_nc_version".* ]]
+              then
+                break
+              fi
+              if [[ "$current_nc_version" == "$current_nc_version_new" ]]
+              then
+                echo "failed to update to $latest_nc_version"
+                exit 1
+              fi
+              current_nc_version="$current_nc_version_new"
+            done
+          fi
+          
+          sudo "$LXC" exec ncp -- rm -f /opt/ncdata/data/nextcloud.log
+          sudo "$LXC" stop ncp
+      - name: Relaunch container
+        run: |
+          set -x
+          LXC_ARGS=()
+          [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
+          systemd-run --user --scope -p "Delegate=yes" "$LXC" start ncp || \
+          sudo systemd-run --scope -p "Delegate=yes" "$LXC" start ncp
+          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+          sleep 30
+          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+          ip="${ip/% *}"
+          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+      - name: Test LXD Image
+        working-directory: ./tests
+        run: |
+          set -x
+          export GECKODRIVER_PATH="$GECKODRIVER_PATH"
+          export FF_BINARY_PATH="$(which firefox)"
+          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+            echo "Nextcloud test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive || {
+            echo "System test failed!"
+            exit 1
+          }
+          sudo "$LXC" stop ncp
+
+  test-fresh-install:
+    needs:
+      - determine-runner
+      - build-current
+    runs-on: ${{ needs.determine-runner.outputs.runner_label }}
+    env:
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      ARTIFACT_NAME: ${{ needs.build-current.outputs.artifact_name }}
+      ARTIFACT_FILE: ${{ needs.build-current.outputs.artifact_file }}
+      LXC: "${{ needs.determine-runner.outputs.lxc_cmd }}"
+      USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
+      LXD_EXTRA_PROFILE: "${{ needs.determine-runner.outputs.lxd_extra_profile }}"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+      - name: Setup incus
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        run: |
+          sudo apt-get install -y incus qemu-system incus-tools
+          sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
+          sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+          sudo incus admin init --auto
+      - name: Setup Firefox
+        if: ${{ runner.arch != 'ARM64' }}
+        continue-on-error: true
+        id: setup-firefox-browser-action
+        uses: browser-actions/setup-firefox@latest
+      - name: Setup Firefox from packages
+        if: ${{ runner.arch == 'ARM64' || steps.setup-firefox-browser-action.outcome == 'failure' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends firefox
+      - name: Setup GeckoDriver
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -x
+          arch=linux64
+          if [[ "${{ runner.arch }}" == "ARM64" ]]
+          then
+            arch="linux-aarch64"
+          fi
+          gh release download -R mozilla/geckodriver -p 'geckodriver-*-'"$arch.tar.gz"
+          tar xf "geckodriver-"*"-$arch.tar.gz"
+          sudo mv geckodriver /usr/local/bin/
+          sudo chmod +x /usr/local/bin/geckodriver
+          echo "GECKODRIVER_PATH=/usr/local/bin/geckodriver" >> "$GITHUB_ENV"
+          geckodriver -V
+      - name: Setup Selenium
+        run: |
+          sudo apt-get install -y python3-venv
+          python3 -m venv ./.venv
+          ./.venv/bin/pip install selenium
+      - name: download LXD image from artifact store
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ env.ARTIFACT_NAME }}
+      - name: Remove old lxd images
+        if: ${{ inputs.arch == 'arm64' }}
+        run: |
+          for img in $("$LXC" image list -c f -f csv)
+          do
+            sudo "$LXC" image delete "$img"
+          done
+      - name: Launch ncp container
+        run: |
+          set -x
+          . ./build/buildlib.sh
+          sudo "$LXC" delete -q -f ncp || true
+          sudo "$LXC" image import -q "./${ARTIFACT_FILE?}" --alias "ncp/test" || true
+          LXC_ARGS=(-p default)
+          [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
+          systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp || \
+          sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp
+          sudo "$LXC" exec ncp -- bash -c 'while [ "$(systemctl is-system-running 2>/dev/null)" != "running" ] && [ "$(systemctl is-system-running 2>/dev/null)" != "degraded" ]; do :; done'
+          sleep 30
+          ip="$(sudo "$LXC" list -c n4 -f csv | grep '^ncp' | cut -d ',' -f2)"
+          ip="${ip/% *}"
+          sudo sed -i 's/^.*nextcloudpi.local.*$//g' /etc/hosts
+          echo "${ip} nextcloudpi.local" | sudo tee -a /etc/hosts
+      - name: Test LXD Image
+        working-directory: ./tests
+        run: |
+          set -x
+          export GECKODRIVER_PATH="$GECKODRIVER_PATH"
+          export FF_BINARY_PATH="$(which firefox)"
+          sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
+          ../.venv/bin/python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+            echo "Activation test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$("$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+            echo "Nextcloud test failed!"
+            echo "Geckodriver logs:"
+            tail -n 20 geckodriver.log >&2 || true
+            echo "================"
+            echo "ncp.log: "
+            sudo "$LXC" exec ncp -- "tail -n20 /var/log/ncp.log" || true
+            echo "================"
+            echo "nextcloud log: "
+            datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
+            sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            exit 1
+          }
+          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive || {
+            echo "System test failed!"
+            exit 1
+          }
+          sudo "$LXC" stop ncp
+
+  convert-to-lxc-image:
+    needs:
+      - build-current
+    runs-on: ubuntu-latest
+    outputs:
+      artifact_name: "${{ steps.lxd-to-lxc.outputs.artifact_name }}"
+      artifact_file: "${{ steps.lxd-to-lxc.outputs.artifact_file }}"
+    env:
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      LXD_ARTIFACT_NAME: ${{ needs.build-current.outputs.artifact_name }}
+      LXD_ARTIFACT_FILE: ${{ needs.build-current.outputs.artifact_file }}
+    steps:
+      - name: download LXD image from artifact store
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ env.LXD_ARTIFACT_NAME }}
+      - name: convert to LXC image
+        id: lxd-to-lxc
+        run: |
+          mkdir repackage output;
+          cd repackage; 
+          sudo su - -c "cd '$(pwd)'; tar xpf '../${LXD_ARTIFACT_FILE?}';"
+          sudo rm -rf ./rootfs/dev;
+          LXC_ARTIFACT_FILE="${LXD_ARTIFACT_FILE//LXD/LXC}";
+          sudo tar cpzf "../output/${LXC_ARTIFACT_FILE?}" -C rootfs/ .;
+          cd ..;
+          sudo chown "$(id -un):" "./output/${LXC_ARTIFACT_FILE}";  
+          ls -l ./output
+          echo "artifact_file=${LXC_ARTIFACT_FILE?}" >> $GITHUB_OUTPUT;
+          echo "artifact_name=${LXD_ARTIFACT_NAME//lxd/lxc}" >> $GITHUB_OUTPUT;
+      - name: upload LXD image to artifact store
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ steps.lxd-to-lxc.outputs.artifact_name }}"
+          path: "output/${{ steps.lxd-to-lxc.outputs.artifact_file }}"
+          if-no-files-found: error

.github/workflows/build-sd-images.yml

@@ -0,0 +1,869 @@
+name: "Build Armbian Images"
+on:
+  workflow_call:
+    inputs:
+      git_ref:
+        required: true
+        type: string
+      board_id:
+        required: true
+        type: string
+      board_name:
+        required: true
+        type: string
+      require_test:
+        required: false
+        default: true
+        type: boolean
+      test_image_url:
+        required: false
+        type: string
+        default: ""
+    outputs:
+      artifact_name:
+        value: "${{ jobs.build.outputs.artifact_name }}"
+      artifact_file:
+        value: "${{ jobs.build.outputs.artifact_file }}"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      VERSION: "${{ inputs.git_ref }}"
+      LOG_GUEST: "\\033[1;34mGUEST::\\033[0m"
+      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+    defaults:
+      run:
+        shell: bash
+    outputs:
+      artifact_file: ${{ env.ARTIFACT_FILE }}
+      artifact_name: ${{ github.run_id }}-${{ inputs.board_id }}-image
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+#      - name: Set up QEMU
+#        run: |
+#          sudo apt-get update
+#          sudo apt-get install -y binfmt-support
+#          curl -L -o /tmp/qemu.sh 'https://raw.githubusercontent.com/qemu/qemu/master/scripts/qemu-binfmt-conf.sh'
+#          bash /tmp/qemu.sh --debian
+#          sudo systemctl disable apparmor
+#          docker run --rm --privileged tonistiigi/binfmt:latest --install all
+#          docker run --rm --privileged multiarch/qemu-user-static:register --reset --credential yes
+#          sudo mkdir -p /etc/binfmt
+#          for conf in qemu-{aarch64,arm}-static.conf
+#          do
+#            sed 's/:F$/:OC/' /usr/lib/binfmt.d/$conf | sudo tee /etc/binfmt/$conf
+#          done
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+#      - name: Debug
+#        run: |
+#          which qemu-aarch64-static
+#          update-binfmts --display qemu-aarch64
+#          update-binfmts --display qemu-arm
+      - name: "Skip build"
+        if: "${{ inputs.test_image_url != '' }}"
+        run: |
+          echo "artifact_file=NextcloudPi_TestImage_${VERSION//\//_}.img" >> $GITHUB_OUTPUT
+          echo "ARTIFACT_FILE=NextcloudPi_TestImage_${VERSION//\//_}.img" >> $GITHUB_ENV
+      - name: "Build Armbian"
+        if: "${{ inputs.test_image_url == '' }}"
+        id: build-armbian
+        continue-on-error: true
+        run: |
+          set -ex
+          export IMG="NextcloudPi_${{ inputs.board_name }}_${VERSION//\//_}.img"
+          [[ "${{ github.ref_protected }}" == true ]] || export DBG=x
+
+          ./build/build-SD-armbian.sh "${{ inputs.board_id }}" "${{ inputs.board_name }}"
+
+          artifacts=("armbian/output/images/Armbian"*.img)
+          mkdir -p output
+          mv "${artifacts[0]}" "output/$IMG"
+          echo "artifact_file=${IMG}" >> $GITHUB_OUTPUT
+          echo "ARTIFACT_FILE=${IMG}" >> $GITHUB_ENV
+      - name: "Build Armbian (2nd attempt)"
+        if: ${{ steps.build-armbian.outcome == 'failure' }}
+        id: build-armbian-2nd
+        run: |
+          set -ex
+          echo -e "${LOG_CICD} Cleanup armbian build leftovers..."
+          sudo rm -rf armbian/ tmp/ output/
+
+          export IMG="NextcloudPi_${{ inputs.board_name }}_${VERSION//\//_}.img"
+          [[ "${{ github.ref_protected }}" == true ]] || export DBG=x
+
+          ./build/build-SD-armbian.sh "${{ inputs.board_id }}" "${{ inputs.board_name }}"
+
+          artifacts=("armbian/output/images/Armbian"*.img)
+          mkdir -p output
+          mv "${artifacts[0]}" "output/$IMG"
+          echo "artifact_file=${IMG}" >> $GITHUB_OUTPUT
+          echo "ARTIFACT_FILE=${IMG}" >> $GITHUB_ENV
+      - name: "Upload Armbian logs"
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ github.run_id }}-${{ inputs.board_id }}-logs
+          path: armbian/output
+      - name: upload image to artifact store
+        if: "${{ inputs.test_image_url == '' }}"
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ github.run_id }}-${{ inputs.board_id }}-image
+          path: output/${{ env.ARTIFACT_FILE }}
+          if-no-files-found: error
+
+  test:
+    needs: build
+    runs-on: ubuntu-22.04
+    env:
+      VERSION: "${{ inputs.git_ref }}"
+      ARTIFACT_ID: ${{ needs.build.outputs.artifact_name }}
+      ARTIFACT_FILE: ${{ needs.build.outputs.artifact_file }}
+      LOG_GUEST: "\\033[1;34mGUEST::\\033[0m"
+      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Disable apparmor
+        run: |
+          sudo systemctl disable apparmor
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+      - uses: actions/download-artifact@v4
+        if: "${{ inputs.test_image_url == '' }}"
+        with:
+          name: ${{ env.ARTIFACT_ID }}
+          path: output
+      - name: Download Test Image
+        if: "${{ inputs.test_image_url != '' }}"
+        run: |
+          set -ex
+          mkdir -p output
+          sudo apt-get install -y pv
+          wget -nv "${{ inputs.test_image_url }}" -O - | pv -n --bytes --rate --timer -i 3 > "output/${ARTIFACT_FILE?}"
+      - name: Prepare test
+        run: |
+          set -x
+          mv "output/${ARTIFACT_FILE?}" ncp.img
+          sudo apt-get install -y systemd-container
+          python3 -m venv ./.venv
+          . ./.venv/bin/activate
+          ./.venv/bin/pip install selenium
+          sudo rm -rf raspbian_root
+          . ./build/buildlib.sh
+          mount_raspbian "ncp.img"
+          sudo cat raspbian_root/etc/machine-id
+          sudo systemd-id128 new | sudo tee ./raspbian_root/etc/machine-id
+          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-aarch64-static -O raspbian_root/usr/bin/qemu-aarch64-static
+          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-arm-static -O raspbian_root/usr/bin/qemu-arm-static
+          sudo chmod +x raspbian_root/usr/bin/qemu-{arm,aarch64}-static
+          echo 'Mutex posixsem' | sudo tee -a raspbian_root/etc/apache2/mods-available/ssl.conf
+          echo 'ignore-warnings ARM64-COW-BUG' | sudo tee -a raspbian_root/etc/redis/redis.conf
+          sudo mkdir -p raspbian_root/etc/systemd/system/redis-server.service.d
+          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/redis-server.service.d/ncp.conf
+          echo 'PrivateUsers=false' | sudo tee -a raspbian_root/etc/systemd/system/redis-server.service.d/ncp.conf
+          
+          sudo mkdir -p raspbian_root/etc/systemd/system/php8.3-fpm.service.d
+          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp.conf
+          echo 'ExecStartPre=mkdir -p /var/run/php' | sudo tee -a raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp.conf
+      - name: Test image
+        id: test
+        run: |
+          
+          log_err() {
+            rc="${1?}"
+            msg="${2?}"
+            echo -e "${LOG_DIAG} $msg" >&2
+            return $rc
+          }
+          
+          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
+          sleep 60
+          
+          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+          
+          success=false
+          for attempt in {1..30}
+          do
+            echo -e "${LOG_CICD} == Wait until container network is available (attempt $attempt/30) =="
+                ip="$("${CONTAINER_CMD[@]}" bash -c '. /usr/local/etc/library.sh > /dev/null; get_ip')"
+            [[ -n "$ip" ]] && curl -k "https://$ip/activate/" > /dev/null || { sleep 6; continue; }
+            success=true
+            break
+          done
+          sudo cat ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }"
+          sudo tail -n 0 -f ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+          
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Could not reach container. Aborting..."
+            exit 1
+          }
+
+          attempt=0
+          success=false
+          for attempt in {1..150}
+          do
+            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/150)..."
+            redis_pw="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")" \
+            && redis_socket="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")" \
+            || log_err $? "Error retrieving redis credentials" || true
+            if { "${CONTAINER_CMD[@]}" -q ncc status |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "ncc status check failed"; } \
+              && { [[ "$("${CONTAINER_CMD[@]}" ncc maintenance:mode)" =~ .*disabled.* ]] || log_err $? "Maintenance mode is enabled or could not be retrieved"; } \
+              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to set redis variable"; } \
+              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" get redisready |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to read redis variable"; }
+            then
+              echo -e "${LOG_CICD} Startup successful"
+              success=true
+              break
+            fi
+            attempt=$((attempt + 1))
+            sleep 5
+          done
+          
+          [[ "$success" == "true" ]] || {
+              echo -e "${LOG_CICD} ERR: Timeout reached."
+              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }" ||:
+              "${CONTAINER_CMD[@]}" -q systemctl status redis-server |& awk "{ print \"${LOG_DIAG} \" \$0 }" ||:
+              sudo journalctl --file ./raspbian_root/var/log/journal/"$(sudo cat ./raspbian_root/etc/machine-id)"/system.journal --no-pager -eu redis-server ||:
+              "${CONTAINER_CMD[@]}" -q journalctl --no-pager -eu redis-server
+              "${CONTAINER_CMD[@]}" -q systemctl status 'php*-fpm' |& awk "{ print \"${LOG_DIAG} \" \$0 }" ||:
+              "${CONTAINER_CMD[@]}" -q systemctl status apache2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" ||:
+              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }" ||:
+              exit 1
+          }
+          
+          set -x
+          set +e
+          
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == Activation Tests (attempt $attempt/5) =="
+            ./.venv/bin/python tests/activation_tests.py -t 300 --no-gui "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} Activation test failed!"
+              echo -e "${LOG_DIAG} Geckodriver logs:"
+              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo "================"
+              echo -e "${LOG_DIAG} mysql: "
+              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Activation test failed in all attempts!"
+            exit 1
+          }
+          
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+            USE_SUDO=yes ./.venv/bin/python tests/system_tests.py --non-interactive |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} System test failed!"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} System test failed in all attempts!"
+            exit 1
+          }
+          
+          success=false
+          for attempt in {1..5}
+          do
+            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+            ./.venv/bin/python tests/nextcloud_tests.py --no-gui "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+              echo -e "${LOG_CICD} Nextcloud test failed!"
+              echo -e "${LOG_DIAG} /etc/os-release:"
+              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'cat /etc/os-release'
+              echo -e "${LOG_DIAG} /usr/local/etc/ncp.cfg:"
+              "${CONTAINER_CMD[@]}" --pipe -q ncp /bin/bash -c 'cat /usr/local/etc/ncp.cfg'
+              cat ./raspbian_root/usr/local/etc/ncp.cfg
+              echo -e "${LOG_DIAG} /home/ncp-app-bridge config ncp"
+              sudo ls -l ./raspbian_root/home/www/ncp-app-bridge.sh
+              "${CONTAINER_CMD[@]}" --pipe --uid=33 ncp /bin/bash -c 'sudo /home/www/ncp-app-bridge.sh config ncp'
+              echo -e "{$LOG_DIAG} Geckodriver logs:"
+              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo -e "${LOG_CICD} ================"
+              echo -e "${LOG_DIAG} ncp.log: "
+              "${CONTAINER_CMD[@]}" --pipe ncp /bin/bash -c "tail -n20 /var/log/ncp.log" |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              echo "================"
+              echo "${LOG_DIAG} Nextcloud log: "
+              "${CONTAINER_CMD[@]}" --pipe -q ncp /bin/bash -c 'ls -l /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              "${CONTAINER_CMD[@]}" --pipe -q ncp /bin/bash -c 'cat /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+              sudo cat ./raspbian_root/opt/ncdata/data/nextcloud.log |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+              sleep 12
+              continue
+            }
+            success=true
+            break
+          done
+          
+          sudo machinectl terminate ncp
+          
+          [[ "$success" == "true" ]] || {
+            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+          
+            echo "Apache2 logs (error):"
+            sudo cat ./raspbian_root/var/log/apache2/error.log || true
+            echo "===================="
+            
+            echo "Apache2 logs (nc-error):"
+            sudo cat ./raspbian_root/var/log/apache2/nc-error.log || true
+            echo "===================="
+            
+            echo "PHP FPM logs:"
+            sudo cat ./raspbian_root/var/log/php*-fpm.log
+            echo "===================="
+            
+            echo "Nextcloud logs:"
+            sudo cat ./raspbian_root/opt/ncdata/data/nextcloud.log
+            echo "===================="
+            
+            echo "MySQL logs:"
+            sudo journalctl --file ./raspbian_root/var/log/journal/"$(sudo cat ./raspbian_root/etc/machine-id)"/system.journal --no-pager -eu mariadb || true
+            echo "===================="
+            
+            echo "Redis logs:"
+            sudo journalctl --file ./raspbian_root/var/log/journal/"$(sudo cat ./raspbian_root/etc/machine-id)"/system.journal --no-pager -eu redis-server || true
+            echo "===================="
+            exit 1
+          }
+
+#  test-distupgrade:
+#    runs-on: ubuntu-latest
+#    env:
+#      VERSION: "${{ inputs.git_ref || github.ref }}"
+#      LOG_GUEST: "\\033[1;34mGUEST::\\033[0m"
+#      LOG_NCP: "\\033[1;36m~NCP::\\033[0m"
+#      LOG_CICD: "\\033[1;35mCICD::\\033[0m"
+#      LOG_TEST: "\\033[1;33mTEST::\\033[0m"
+#      LOG_DIAG: "\\033[1;31mDIAG::\\033[0m"
+#      PREVIOUS_VERSION: "v1.53.2"
+#    defaults:
+#      run:
+#        shell: bash
+#    steps:
+#      - name: Set up QEMU
+#        uses: docker/setup-qemu-action@v3
+#      - name: Checkout code
+#        uses: actions/checkout@v3
+#        with:
+#          ref: "${{ env.VERSION }}"
+#      - name: Download previous image
+#        id: download-previous-image
+#        run: |
+#          set -x
+#          mkdir -p output
+#          cd output
+#          wgetrc=0
+#          wgeterr="$(wget -O ./ncp.zip "https://github.com/nextcloud/nextcloudpi/releases/download/${PREVIOUS_VERSION?}/NextcloudPi_${{ inputs.board_name }}_${PREVIOUS_VERSION}.zip" 2>&1)" || wgetrc=$?
+#          if [[ $wgetrc -ne 0 ]]
+#          then
+#            if echo "$wgeterr" | grep '404 Not Found'
+#            then
+#              echo "Board not found in previous release - skipping."
+#              echo "skipped=true" >> "$GITHUB_OUTPUT"
+#              exit 0
+#            else
+#              echo "$wgeterr"
+#              exit $wgetrc
+#            fi
+#          fi
+#          echo "skipped=false" >> "$GITHUB_OUTPUT"
+#          unzip ncp.zip
+#          rm ncp.zip
+#          mv NextcloudPi_${{ inputs.board_name }}_${PREVIOUS_VERSION}.img ./ncp.img
+#          echo "ARTIFACT_FILE=ncp.img" >> "$GITHUB_ENV"
+#      - name: Prepare test
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        run: |
+#          set -x
+#          mv output/${ARTIFACT_FILE?} ncp.img
+#          sudo apt-get install -y systemd-container
+#          sudo pip install selenium
+#          sudo rm -rf raspbian_root
+#          . ./build/buildlib.sh
+#          mount_raspbian "ncp.img"
+#          sudo cat raspbian_root/etc/machine-id
+#          sudo systemd-id128 new | sudo tee ./raspbian_root/etc/machine-id
+#          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-aarch64-static -O raspbian_root/usr/bin/qemu-aarch64-static
+#          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-arm-static -O raspbian_root/usr/bin/qemu-arm-static
+#          sudo chmod +x raspbian_root/usr/bin/qemu-{arm,aarch64}-static
+#          echo 'Mutex posixsem' | sudo tee -a raspbian_root/etc/apache2/mods-available/ssl.conf
+#          echo 'ignore-warnings ARM64-COW-BUG' | sudo tee -a raspbian_root/etc/redis/redis.conf
+#          sudo mkdir -p raspbian_root/etc/systemd/system/redis-server.service.d
+#          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/redis-server.service.d/ncp.conf
+#          echo 'PrivateUsers=false' | sudo tee -a raspbian_root/etc/systemd/system/redis-server.service.d/ncp.conf
+#      - name: Test and activate image
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        id: test
+#        run: |
+#
+#          log_err() {
+#            rc="${1?}"
+#            msg="${2?}"
+#            echo -e "${LOG_DIAG} $msg" >&2
+#            return $rc
+#          }
+#
+#          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
+#          sleep 60
+#
+#          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+#
+#          success=false
+#          for attempt in {1..30}
+#          do
+#            echo -e "${LOG_CICD} == Wait until container network is available (attempt $attempt/30) =="
+#            ip="$("${CONTAINER_CMD[@]}" bash -c '. /usr/local/etc/library.sh > /dev/null; get_ip')"
+#            [[ -n "$ip" ]] && curl -k "https://$ip/activate/" > /dev/null || { sleep 6; continue; }
+#            success=true
+#            break
+#          done
+#          sudo cat ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }"
+#          sudo tail -n 0 -f ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Could not reach container. Aborting..."
+#            exit 1
+#          }
+#
+#          attempt=0
+#          success=false
+#          for attempt in {1..150}
+#          do
+#            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/150)..."
+#            "${CONTAINER_CMD[@]}" journalctl -eu redis.service || true
+#            "${CONTAINER_CMD[@]}" systemctl status php8.1-fpm.service || true
+#            redis_pw="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")" \
+#            && redis_socket="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")" \
+#            || log_err $? "Error retrieving redis credentials" || true
+#            if { "${CONTAINER_CMD[@]}" -q ncc status |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "ncc status check failed"; } \
+#              && { [[ "$("${CONTAINER_CMD[@]}" ncc maintenance:mode)" =~ .*disabled.* ]] || log_err $? "Maintenance mode is enabled or could not be retrieved"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to set redis variable"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" get redisready |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to read redis variable"; }
+#            then
+#              echo -e "${LOG_CICD} Startup successful"
+#              success=true
+#              break
+#            fi
+#            attempt=$((attempt + 1))
+#            sleep 5
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#              echo -e "${LOG_CICD} Timeout reached."
+#              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status redis |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status 'php*-fpm' |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status apache2 |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              exit 1
+#          }
+#
+#          set -x
+#          set +e
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == Activation Tests (attempt $attempt/5) =="
+#            python tests/activation_tests.py -t 300 --no-gui "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} Activation test failed!"
+#              echo -e "${LOG_DIAG} Geckodriver logs:"
+#              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo "================"
+#              echo -e "${LOG_DIAG} mysql: "
+#              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Activation test failed in all attempts!"
+#            exit 1
+#          }
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+#            sudo python tests/system_tests.py --non-interactive --skip-update-test |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} System test failed!"
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} System test failed in all attempts!"
+#            exit 1
+#          }
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+#            python tests/nextcloud_tests.py --no-gui --skip-release-check "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} Nextcloud test failed!"
+#              echo -e "{$LOG_DIAG} Geckodriver logs:"
+#              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo -e "${LOG_CICD} ================"
+#              echo -e "${LOG_DIAG} ncp.log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c "tail -n20 /var/log/ncp.log" |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo "================"
+#              echo "${LOG_DIAG} Nextcloud log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'ls -l /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'cat /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+#            exit 1
+#          }
+#      - name: Update NCP
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        run: |
+#          set -ex
+#
+#          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+#
+#          BRANCH="${VERSION/refs\/heads\//}"
+#          BRANCH="${BRANCH/refs\/tags\//}"
+#          if [[ "$BRANCH" =~ "refs/pull/"* ]]
+#          then
+#            UPDATE_ARGS=("${{ github.head_ref }}" "$VERSION")
+#          else
+#            UPDATE_ARGS=("$BRANCH")
+#          fi
+#          current_nc_version="$("${CONTAINER_CMD[@]}" ncc status | grep "version:" | awk '{ print $3 }')"
+#          latest_nc_version="$(cat etc/ncp.cfg | jq -r '.nextcloud_version')"
+#
+#          echo "Updating from $PREVIOUS_VERSION to $VERSION"
+#
+#          "${CONTAINER_CMD[@]}" bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
+#          "${CONTAINER_CMD[@]}" /usr/local/bin/ncc status
+#          # "${CONTAINER_CMD[@]}" bash -c 'curl https://download.nextcloud.com/server/releases/nextcloud-28.0.4.tar.bz2 > /var/www/nextcloud-28.0.4.tar.bz2'
+#          k0nKat1Nation
+#
+#          # if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
+#          # then
+#          #   echo "Nextcloud is up to date - skipping NC update test."
+#          # else
+#          #   "${CONTAINER_CMD[@]}" bash -c "DBG=x ncp-update-nc ${latest_nc_version?}"
+#          # fi
+#
+#          sudo machinectl terminate ncp
+#          sudo rm -f ./raspbian_root/opt/ncdata/data/nextcloud.log
+#      - name: Test image after update
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        run: |
+#
+#          log_err() {
+#            rc="${1?}"
+#            msg="${2?}"
+#            echo -e "${LOG_DIAG} $msg" >&2
+#            return $rc
+#          }
+#
+#          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
+#          sleep 60
+#
+#          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+#
+#          success=false
+#          for attempt in {1..30}
+#          do
+#            echo -e "${LOG_CICD} == Wait until container network is available (attempt $attempt/30) =="
+#            ip="$("${CONTAINER_CMD[@]}" bash -c '. /usr/local/etc/library.sh > /dev/null; get_ip')"
+#            [[ -n "$ip" ]] && curl -k "https://$ip/activate/" > /dev/null || { sleep 6; continue; }
+#            success=true
+#            break
+#          done
+#          sudo cat ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }"
+#          sudo tail -n 0 -f ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Could not reach container. Aborting..."
+#            exit 1
+#          }
+#
+#          attempt=0
+#          success=false
+#          for attempt in {1..150}
+#          do
+#            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/150)..."
+#            "${CONTAINER_CMD[@]}" journalctl -eu redis.service || true
+#            "${CONTAINER_CMD[@]}" systemctl status php8.1-fpm.service || true
+#            redis_pw="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")" \
+#            && redis_socket="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")" \
+#            || log_err $? "Error retrieving redis credentials" || true
+#            if { "${CONTAINER_CMD[@]}" -q ncc status |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "ncc status check failed"; } \
+#              && { [[ "$("${CONTAINER_CMD[@]}" ncc maintenance:mode)" =~ .*disabled.* ]] || log_err $? "Maintenance mode is enabled or could not be retrieved"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to set redis variable"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" get redisready |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to read redis variable"; }
+#            then
+#              echo -e "${LOG_CICD} Startup successful"
+#              success=true
+#              break
+#            fi
+#            attempt=$((attempt + 1))
+#            sleep 5
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#              echo -e "${LOG_CICD} Timeout reached."
+#              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status redis |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status 'php*-fpm' |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status apache2 |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              exit 1
+#          }
+#
+#          set -x
+#          set +e
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+#            sudo python tests/system_tests.py --non-interactive --skip-update-test |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} System test failed!"
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} System test failed in all attempts!"
+#            exit 1
+#          }
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+#            python tests/nextcloud_tests.py --no-gui --skip-release-check "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} Nextcloud test failed!"
+#              echo -e "{$LOG_DIAG} Geckodriver logs:"
+#              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo -e "${LOG_CICD} ================"
+#              echo -e "${LOG_DIAG} ncp.log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c "tail -n20 /var/log/ncp.log" |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo "================"
+#              echo "${LOG_DIAG} Nextcloud log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'ls -l /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'cat /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+#            exit 1
+#          }
+#
+#      - name: Run dist-upgrade
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        run: |
+#          set -ex
+#
+#          source ./library.sh
+#
+#          echo "Updating from $PREVIOUS_VERSION to $VERSION
+#
+#          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+#
+#          sudo grep 'VERSION="11"' ./raspbian_root/etc/os-release || {
+#            echo "Can't dist-upgrade from debian version $(sudo grep 'Version=' ./raspbian_root/etc/os-release)"
+#            exit 1
+#          }
+#          "${CONTAINER_CMD[@]}" DBG=x ncp-dist-upgrade "$VERSION"
+#
+#          sudo machinectl terminate ncp
+#          sudo rm -f ./raspbian_root/opt/ncdata/data/nextcloud.log
+#
+#      - name: Test image after dist-upgrade
+#        if:  ${{ steps.download-previous-image.outputs.skipped == 'false' }}
+#        run: |
+#
+#          log_err() {
+#            rc="${1?}"
+#            msg="${2?}"
+#            echo -e "${LOG_DIAG} $msg" >&2
+#            return $rc
+#          }
+#
+#          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
+#          sleep 60
+#
+#          CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
+#
+#          success=false
+#          for attempt in {1..30}
+#          do
+#            echo -e "${LOG_CICD} == Wait until container network is available (attempt $attempt/30) =="
+#            ip="$("${CONTAINER_CMD[@]}" bash -c '. /usr/local/etc/library.sh > /dev/null; get_ip')"
+#            [[ -n "$ip" ]] && curl -k "https://$ip/activate/" > /dev/null || { sleep 6; continue; }
+#            success=true
+#            break
+#          done
+#          sudo cat ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }"
+#          sudo tail -n 0 -f ./raspbian_root/var/log/ncp.log |& awk "{ print \"${LOG_NCP} \" \$0 }" &
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Could not reach container. Aborting..."
+#            exit 1
+#          }
+#
+#          attempt=0
+#          success=false
+#          for attempt in {1..150}
+#          do
+#            echo -e "${LOG_CICD} Waiting for container startup (attempt $attempt/150)..."
+#            "${CONTAINER_CMD[@]}" journalctl -eu redis.service || true
+#            "${CONTAINER_CMD[@]}" systemctl status php8.1-fpm.service || true
+#            redis_pw="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"password'")" \
+#            && redis_socket="$("${CONTAINER_CMD[@]}" bash -c ". /usr/local/etc/library.sh; get_nc_config_value 'redis\"][\"host'")" \
+#            || log_err $? "Error retrieving redis credentials" || true
+#            if { "${CONTAINER_CMD[@]}" -q ncc status |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "ncc status check failed"; } \
+#              && { [[ "$("${CONTAINER_CMD[@]}" ncc maintenance:mode)" =~ .*disabled.* ]] || log_err $? "Maintenance mode is enabled or could not be retrieved"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" set redisready yes |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to set redis variable"; } \
+#              && { "${CONTAINER_CMD[@]}" redis-cli -s "$redis_socket" -a "$redis_pw" get redisready |& awk "{ print \"${LOG_DIAG} \" \$0 }" || log_err $? "Failed to read redis variable"; }
+#            then
+#              echo -e "${LOG_CICD} Startup successful"
+#              success=true
+#              break
+#            fi
+#            attempt=$((attempt + 1))
+#            sleep 5
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#              echo -e "${LOG_CICD} Timeout reached."
+#              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status redis |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status 'php*-fpm' |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q systemctl status apache2 |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }"
+#              exit 1
+#          }
+#
+#          set -x
+#          set +e
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == Activation Tests (attempt $attempt/5) =="
+#            python tests/activation_tests.py -t 300 --no-gui "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} Activation test failed!"
+#              echo -e "${LOG_DIAG} Geckodriver logs:"
+#              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo "================"
+#              echo -e "${LOG_DIAG} mysql: "
+#              "${CONTAINER_CMD[@]}" -q ncp-diag |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              "${CONTAINER_CMD[@]}" -q systemctl status mysql |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Activation test failed in all attempts!"
+#            exit 1
+#          }
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
+#            sudo python tests/system_tests.py --non-interactive |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} System test failed!"
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} System test failed in all attempts!"
+#            exit 1
+#          }
+#
+#          success=false
+#          for attempt in {1..5}
+#          do
+#            echo -e "${LOG_CICD} == Nextcloud Tests (attempt $attempt/5) =="
+#            python tests/nextcloud_tests.py --no-gui "$ip" 443 4443 |& awk "{ print \"${LOG_TEST} \" \$0 }"
+#            [[ ${PIPESTATUS[0]} -eq 0 ]] || {
+#              echo -e "${LOG_CICD} Nextcloud test failed!"
+#              echo -e "{$LOG_DIAG} Geckodriver logs:"
+#              tail -n 20 geckodriver.log >&2 |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo -e "${LOG_CICD} ================"
+#              echo -e "${LOG_DIAG} ncp.log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c "tail -n20 /var/log/ncp.log" |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              echo "================"
+#              echo "${LOG_DIAG} Nextcloud log: "
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'ls -l /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              "${CONTAINER_CMD[@]}" -q ncp /bin/bash -c 'cat /opt/ncdata/data/nextcloud.log' |& awk "{ print \"${LOG_DIAG} \" \$0 }" || true
+#              sleep 12
+#              continue
+#            }
+#            success=true
+#            break
+#          done
+#
+#          [[ "$success" == "true" ]] || {
+#            echo -e "${LOG_CICD} Nextcloud test failed in all attempts!"
+#            exit 1
+#          }

.github/workflows/lxd-trigger.yml

@@ -0,0 +1,17 @@
+name: LXD Tests
+
+on:
+  pull_request:
+    branches:
+      - master
+      - devel
+      - release/*
+  push:
+    branches:
+      - devel
+
+jobs:
+  lxd:
+    uses: ./.github/workflows/build-lxd.yml
+    with:
+      git_ref: "${{ github.head_ref || github.ref_name }}"

.github/workflows/organize_gh_project.yml

@@ -0,0 +1,142 @@
+name: "Organize Issues and PRs on GH project"
+
+on:
+  issues:
+    types:
+      - opened
+      - reopened
+      - closed
+      - assigned
+      - labeled
+      - unlabeled
+      - milestoned
+  issue_comment:
+    types:
+      - created
+
+permissions:
+  repository-projects: write
+  contents: write
+  issues: write
+
+jobs:
+
+  add_issue_to_project:
+    if: ${{ github.event_name == 'issues' && (github.event.action == 'opened' || github.event.action == 'reopened') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get project data
+        env:
+          GITHUB_TOKEN: ${{ secrets.NCP_PROJECT_PAT }}
+          ORGANIZATION: nextcloud
+          PROJECT_NUMBER: 67
+        run: |
+          gh api graphql -f query='
+            query($org: String!, $number: Int!) {
+              organization(login: $org){
+                projectV2(number: $number) {
+                  id
+                  fields(first:20) {
+                    nodes {
+                      ... on ProjectV2Field {
+                        id
+                        name
+                      }
+                      ... on ProjectV2SingleSelectField {
+                        id
+                        name
+                        options {
+                          id
+                          name
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }' -f org=$ORGANIZATION -F number=$PROJECT_NUMBER > project_data.json
+          
+          echo 'PROJECT_ID='$(jq '.data.organization.projectV2.id' project_data.json) >> $GITHUB_ENV
+          echo "BUGS_STATUS_FIELD_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name== "Status") | .id' project_data.json)" >> $GITHUB_ENV
+          echo "BUGS_STATUS_OPTION_NEW_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name== "Status") | .options[] | select(.name=="New") |.id' project_data.json)" >> $GITHUB_ENV
+          echo "BUGS_STATUS_OPTION_BUG_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name== "Status") | .options[] | select(.name=="Bugs") |.id' project_data.json)" >> $GITHUB_ENV
+          echo "DEVEL_STATUS_FIELD_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name== "Development Status") | .id' project_data.json)" >> $GITHUB_ENV
+          echo "DEVEL_STATUS_OPTION_BACKLOG_ID=$(jq '.data.organization.projectV2.fields.nodes[] | select(.name== "Development Status") | .options[] | select(.name=="Backlog") |.id' project_data.json)" >> $GITHUB_ENV
+
+      - name: Add Issue to project
+        env:
+          GH_TOKEN: ${{ secrets.NCP_PROJECT_PAT }}
+          ISSUE_ID: ${{ github.event.issue.node_id }}
+        run: |
+          item_id="$( gh api graphql -f query='
+            mutation($project:ID!, $issue:ID!) {
+              addProjectV2ItemById(input: {projectId: $project, contentId: $issue}) {
+                item {
+                  id
+                }
+              }
+            }' -f project=$PROJECT_ID -f issue=$ISSUE_ID --jq '.data.addProjectV2ItemById.item.id')"
+
+          echo 'ITEM_ID='$item_id >> $GITHUB_ENV
+#      - name: Set fields
+#        env:
+#          GH_TOKEN: ${{ secrets.NCP_PROJECT_PAT }}
+#          IS_ENHANCMENET: ${{ contains( github.event.issue.labels.*.name, 'enhancement') || contains( github.event.issue.labels.*.name, 'feature-request') || contains( github.event.issue.labels.*.name, 'roadmap') }}
+#          IS_BUG: ${{ contains( github.event.issue.labels.*.name, 'bug') }}
+#        run: |
+#
+#          if [[ "$IS_ENHANCEMENT" == true ]]
+#          then
+#            STATUS_FIELD_ID="$DEVEL_STATUS_FIELD_ID"
+#            STATUS_OPTION_ID="$DEVEL_STATUS_OPTION_BACKLOG_ID"
+#          elif [[ "$IS_BUG" == true ]]
+#          then
+#            STATUS_FIELD_ID="$BUGS_STATUS_FIELD_ID"
+#            STATUS_OPTION_ID="$BUGS_STATUS_OPTION_BUG_ID"
+#          else
+#            STATUS_FIELD_ID="$BUGS_STATUS_FIELD_ID"
+#            STATUS_OPTION_ID="$BUGS_STATUS_OPTION_NEW_ID"
+#          fi
+#
+#          echo "project=$PROJECT_ID
+#          item=$ITEM_ID
+#          status_field=$STATUS_FIELD_ID
+#          status_value=$STATUS_OPTION_ID"
+#
+#          gh api graphql -f query='
+#            mutation(
+#              $project: ID!
+#              $item: ID!
+#              $status_field: ID!
+#              $status_value: String!
+#            ) {
+#              set_status: updateProjectV2ItemFieldValue(input: {
+#                projectId: $project
+#                itemId: $item
+#                fieldId: $status_field
+#                value: {
+#                  singleSelectOptionId: $status_value
+#                }
+#              }) {
+#                projectV2Item {
+#                  id
+#                }
+#              }
+#            }' \
+#          -f project=$PROJECT_ID \
+#          -f "item=$ITEM_ID" \
+#          -f "status_field=$STATUS_FIELD_ID" \
+#          -f "status_value=$STATUS_OPTION_ID" \
+#          --silent
+
+  set_update_label:
+    if: ${{ github.event_name == 'issue_comment' && !github.event.issue.pull_request && !contains( github.event.issue.assignees.*.login, github.event.comment.user.login ) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add update label to issue
+        if: ${{ ! contains( github.event.issue.labels.*.name, 'update' ) }}
+        env:
+          ISSUE_ID: ${{ github.event.issue.number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh issue edit --repo "${{ github.repository }}" --add-label has-updates "$ISSUE_ID" 

.github/workflows/publish-image.yml

@@ -0,0 +1,100 @@
+name: "Publish Images"
+on:
+  workflow_call:
+    inputs:
+      git_ref:
+        required: true
+        type: string
+      artifact_id:
+        required: true
+        type: string
+      artifact_file:
+        required: true
+        type: string
+      dry_run:
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    env:
+      VERSION: "${{ inputs.git_ref }}"
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ env.VERSION }}"
+      - name: "Download artifact"
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.artifact_id }}
+          path: artifacts
+      - name: "Publish artifact"
+        env:
+          IMG: "${{ inputs.artifact_file }}"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -ex
+          mkdir -p publish
+          mv "artifacts/${{ inputs.artifact_file }}" publish/
+          cd publish
+          
+          asset="${IMG}"
+          [[ "$IMG" =~ .*".img" ]] && { 
+            zip "${IMG%.img}.zip" "${IMG?}"
+            asset="${IMG%.img}.zip"
+          }
+          
+          checksum="$(md5sum "$asset")"
+          echo "Artifact Checksum: 
+            $checksum"
+          
+          [[ "${{ inputs.dry_run }}" == "true" ]] && {
+            echo "Dry run only. Skipping release..."
+            exit 0
+          }
+          
+          success=false
+          for i in {1..5}
+          do
+            body="$(gh release view --json body "${VERSION}" | jq -r '.body')"
+            if ! [[ "$body" =~ .*'**Checksums:**'.* ]]
+            then
+            
+              body="${body}
+          
+          **Checksums:**
+          \`\`\`
+          \`\`\`"
+            fi
+            
+            body="${body%$'\n\`\`\`'*}
+          $checksum
+          \`\`\`"
+          
+            gh release edit "${VERSION?}" -n "$body"
+            if gh release view --json body "${VERSION}" | jq -r '.body' | grep "$checksum"
+            then
+              success=true
+              break
+            else
+              WAIT_TIME="$((1 + $RANDOM % 20))"
+              echo "Checksum missing from release description. Retrying in $WAIT_TIME seconds..."
+              sleep "$WAIT_TIME"
+            fi
+          done
+          
+          [[ "$success" == "true" ]] || {
+            echo "Updating release description failed."
+            exit 1
+          }
+          
+          gh release upload "${VERSION?}" "${asset}"
+          echo "Image published successfully."

.github/workflows/release.yml

@@ -0,0 +1,387 @@
+name: 'Release'
+on:
+  workflow_dispatch:
+    inputs:
+      git_ref:
+        description: git ref, branch or tag to test against
+        required: false
+        type: string
+      sd-images:
+        type: boolean
+        description: 'Build/test SD images?'
+        required: false
+        default: true
+      lxd:
+        type: boolean
+        description: 'Build/test LXD image?'
+        required: false
+        default: true
+      installer:
+        type: boolean
+        description: 'Run curl-installer/upgrade tests?'
+        required: false
+        default: true
+      release:
+        type: boolean
+        description: 'Release images to GH'
+        required: false
+        default: false
+      test_image_url:
+        type: string
+        description: 'URL for test image to test instead of actual armbian builds'
+        required: false
+        default: ''
+  push:
+    tags:
+      - "v*"
+    branches:
+      - master
+
+permissions:
+  contents: write
+
+jobs:
+  lxd-x86:
+    if: ${{ inputs.lxd || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-lxd.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      arch: 'x86'
+    secrets: inherit
+  lxd-arm64:
+    if: ${{ inputs.lxd || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-lxd.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      arch: 'arm64'
+    secrets: inherit
+
+  test-curl-installer:
+    if: ${{ inputs.installer || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/vm-tests.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+    secrets: inherit
+
+  raspberrypi:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: rpi4b
+      board_name: RaspberryPi 4+
+    secrets: inherit
+
+  armbian-test-image:
+    if: ${{ inputs.test_image_url != '' }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: testimage
+      board_name: TestImage
+      test_image_url: "${{ inputs.test_image_url }}"
+    secrets: inherit
+
+  # TODO: Fix 32bit armbian images
+  odroidxu4:
+    # if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    if: ${{ false }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: odroidxu4
+      board_name: OdroidHC2
+    secrets: inherit
+  rockpro64:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: rockpro64
+      board_name: RockPro64
+    secrets: inherit
+  rock64:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: rock64
+      board_name: Rock64
+    secrets: inherit
+  # TODO: Fix 32bit armbian images
+  bananapi:
+    # if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    if: ${{ false }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: bananapi
+      board_name: BananaPi
+    secrets: inherit
+  odroidhc4:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: odroidhc4
+      board_name: OdroidHC4
+    secrets: inherit
+  odroidc4:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: odroidc4
+      board_name: OdroidC4
+    secrets: inherit
+  odroidc2:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: odroidc2
+      board_name: OdroidC2
+    secrets: inherit
+  orangepi5:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: orangepi5
+      board_name: OrangePi5
+    secrets: inherit
+  orangepi5plus:
+    if: ${{ inputs.sd-images || ( github.event_name != 'workflow_dispatch' && !startsWith(github.ref_name, 'docker-') ) }}
+    uses: ./.github/workflows/build-sd-images.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      board_id: orangepi5-plus
+      board_name: OrangePi5Plus
+    secrets: inherit
+
+  lxd-x86-release:
+    needs:
+      - github-release
+      - lxd-x86
+    if: ${{ inputs.lxd || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.lxd-x86.outputs.lxd_artifact_name }}"
+      artifact_file: "${{ needs.lxd-x86.outputs.lxd_artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+
+  lxd-arm64-release:
+    needs:
+      - github-release
+      - lxd-arm64
+    if: ${{ inputs.lxd || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.lxd-arm64.outputs.lxd_artifact_name }}"
+      artifact_file: "${{ needs.lxd-arm64.outputs.lxd_artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+
+  lxc-x86-release:
+    needs:
+      - github-release
+      - lxd-x86
+    if: ${{ inputs.lxd || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.lxd-x86.outputs.lxc_artifact_name }}"
+      artifact_file: "${{ needs.lxd-x86.outputs.lxc_artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+
+  lxc-arm64-release:
+    needs:
+      - github-release
+      - lxd-arm64
+    if: ${{ inputs.lxd || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.lxd-arm64.outputs.lxc_artifact_name }}"
+      artifact_file: "${{ needs.lxd-arm64.outputs.lxc_artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+
+  raspberrypi-release:
+    needs:
+      - raspberrypi
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.raspberrypi.outputs.artifact_name }}"
+      artifact_file: "${{ needs.raspberrypi.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+
+  odroidxu4-release:
+    needs:
+      - odroidxu4
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.odroidxu4.outputs.artifact_name }}"
+      artifact_file: "${{ needs.odroidxu4.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  rockpro64-release:
+    needs:
+      - rockpro64
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.rockpro64.outputs.artifact_name }}"
+      artifact_file: "${{ needs.rockpro64.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  rock64-release:
+    needs:
+      - rock64
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.rock64.outputs.artifact_name }}"
+      artifact_file: "${{ needs.rock64.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  bananapi-release:
+    needs:
+      - bananapi
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.bananapi.outputs.artifact_name }}"
+      artifact_file: "${{ needs.bananapi.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  odroidhc4-release:
+    needs:
+      - odroidhc4
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.odroidhc4.outputs.artifact_name }}"
+      artifact_file: "${{ needs.odroidhc4.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  odroidc4-release:
+    needs:
+      - odroidc4
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.odroidc4.outputs.artifact_name }}"
+      artifact_file: "${{ needs.odroidc4.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  odroidc2-release:
+    needs:
+      - odroidc2
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.odroidc2.outputs.artifact_name }}"
+      artifact_file: "${{ needs.odroidc2.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  orangepi5-release:
+    needs:
+      - orangepi5
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.orangepi5.outputs.artifact_name }}"
+      artifact_file: "${{ needs.orangepi5.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+  orangepi5plus-release:
+    needs:
+      - orangepi5plus
+      - github-release
+    if: ${{ inputs.sd-images || github.event_name != 'workflow_dispatch' }}
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      git_ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      artifact_id: "${{ needs.orangepi5plus.outputs.artifact_name }}"
+      artifact_file: "${{ needs.orangepi5plus.outputs.artifact_file }}"
+      dry_run: ${{ (!inputs.release && github.event_name == 'workflow_dispatch') || github.ref_type != 'tag' || !(github.ref_protected || startsWith(github.ref, 'refs/tags/v'))  }}
+    secrets: inherit
+
+  github-release:
+    if: ${{ github.event_name == 'workflow_dispatch' || !startsWith(github.ref_name, 'docker-') }}
+    needs:
+      - test-curl-installer
+    runs-on: ubuntu-latest
+    env:
+      UID: "${{ github.run_id }}-rpi"
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+    defaults:
+      run:
+        shell: bash
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          ref: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      - name: Debug output
+        run: |
+          echo "do release?: ${{ inputs.release }}"
+          echo "event name: ${{ github.event_name }}"
+          echo "ref type: ${{ github.ref_type }}"
+          echo "protected?: ${{ github.ref_protected }}"
+      - name: Create Draft
+        if: ${{ (inputs.release || github.event_name != 'workflow_dispatch') && github.ref_type == 'tag' && (github.ref_protected || startsWith(github.ref, 'refs/tags/v')) }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          
+          NC_VERSION="$(jq -r '.nextcloud_version' < etc/ncp.cfg)"
+          PHP_VERSION="$(jq -r '.php_version' < etc/ncp.cfg)"
+          DEBIAN_VERSION="$(jq -r '.release' < etc/ncp.cfg)"
+          ARMBIAN_VERSIOn="$(cat build/armbian/armbian_version)"
+          
+          subject="$(git tag -n10 --format="%(contents:subject)" "${{ env.VERSION }}")"
+          body="$(git tag -n30 --format="%(contents:body)" "${{ env.VERSION }}")"
+          separator="
+
+          ---
+          
+          "
+
+          gh release create --draft -F - "${{ env.VERSION }}" <<EOF
+          ${subject:-No message found}
+          
+          ### Included Software
+          Nextcloud ${NC_VERSION} (can be automatically updated to latest minor version) 
+          PHP ${PHP_VERSION}
+          Debian ${DEBIAN_VERSION}
+          Armbian ${ARMBIAN_VERSION}
+
+          ${body:+${body}${separator}}
+
+          [Changelog](https://github.com/nextcloud/nextcloudpi/blob/${{ env.VERSION }}/changelog.md)
+          EOF

.github/workflows/vm-tests.yml

@@ -0,0 +1,714 @@
+name: 'VM Integration Tests'
+
+on:
+  workflow_dispatch:
+    inputs:
+      git_ref:
+        description: git ref, branch or tag to test against
+        required: false
+        type: string
+  workflow_call:
+    inputs:
+      git_ref:
+        description: git ref, branch or tag to test against
+        required: false
+        type: string
+  push:
+    branches:
+      - master
+
+jobs:
+  installation-test:
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:bookworm
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+        UID: "${{ github.run_id }}-install"
+    outputs:
+      server_address: ${{ steps.create-test-instance.outputs.server_address }}
+      snapshot_id: ${{ steps.create-test-instance.outputs.snapshot_id }}
+      test_server_id: ${{ steps.create-test-instance.outputs.test_server_id }}
+      version: ${{ env.VERSION }}
+      test_result: ${{ steps.final_test.outputs.test_result }}
+      ssh_artifact_name: ${{ env.SSH_ARTIFACT_NAME }}
+    env:
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      HOME: /root
+      SSH_ARTIFACT_NAME: "${{ github.run_id }}-install-ssh"
+      UID: "${{ github.run_id }}-install"
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          path: /__w/nextcloudpi/nextcloudpi
+      - name: Generate ssh keypair
+        working-directory: /__w/nextcloudpi/nextcloudpi
+        run: |
+          set -e
+          mkdir -p .ssh
+          ssh-keygen -t ed25519 -f ".ssh/automation_ssh_key"
+          . /ncp-test-automation/bin/entrypoint.sh
+      - name: upload ssh private key to artifact store
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ env.SSH_ARTIFACT_NAME }}"
+          path: /__w/nextcloudpi/nextcloudpi/.ssh
+          if-no-files-found: error
+          include-hidden-files: true
+      - id: create-test-instance
+        uses: ./.github/actions/create-test-instance
+        with:
+          version: ${{ env.VERSION }}
+          uid: "${{ env.UID }}"
+          hcloud_token: ${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}
+          server_type: "cx22"
+      - name: set instance variables
+        run: |
+          echo "SERVER_ADDRESS=${{ steps.create-test-instance.outputs.server_address }}" >> "$GITHUB_ENV"
+          echo "SNAPSHOT_ID=${{ steps.create-test-instance.outputs.snapshot_id }}" >> "$GITHUB_ENV"
+      - name: Test postinstall VM
+        id: final_test
+        working-directory: /ncp-test-automation/bin
+        run: |
+          set -e
+          echo "Setup ssh"
+          chmod 0600 /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          trap '[ $? -eq 0 ] || echo "test_result=failure" >> "$GITHUB_OUTPUT"; terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+          
+          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+          
+          echo "Run integration tests"
+          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS}" cat /usr/local/etc/instance.cfg
+          set -x
+          test-ncp-instance -a -f "$SNAPSHOT_ID" -b "${VERSION}" --systemtest-args "--skip-update-test" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+          
+            echo "Integration tests failed"
+            echo "Here are the last lines of ncp-install.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+            echo "==========================================="
+            echo "and ncp.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+            echo "==========================================="
+            exit 1
+          }
+          echo "test_result=success" >> "$GITHUB_OUTPUT";
+
+#  update-test:
+#    runs-on: ubuntu-latest
+#    container:
+#      image: thecalcaholic/ncp-test-automation:bullseye
+#      env:
+#        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+#        UID: "${{ github.run_id }}-update"
+#    defaults:
+#      run:
+#        shell: bash
+#    outputs:
+#      server_address: ${{ steps.create-test-instance.outputs.server_address }}
+#      snapshot_id: ${{ steps.create-test-instance.outputs.snapshot_id }}
+#      test_server_id: ${{ steps.create-test-instance.outputs.test_server_id }}
+#      previous_version: ${{ steps.find-version.outputs.previous_version }}
+#      version: ${{ env.VERSION }}
+#      test_result: ${{ steps.final_test.outputs.test_result }}
+#      ssh_artifact_name: ${{ env.SSH_ARTIFACT_NAME }}
+#    env:
+#      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+#      HOME: /root
+#      SSH_ARTIFACT_NAME: "${{ github.run_id }}-update-ssh"
+#      UID: "${{ github.run_id }}-update"
+#    steps:
+#      - uses: actions/checkout@v3
+#        with:
+#          fetch-depth: 0
+#          path: /__w/nextcloudpi/nextcloudpi
+#      - name: find reference version
+#        working-directory: /__w/nextcloudpi/nextcloudpi
+#        shell: bash
+#        id: find-version
+#        run: |
+#          chown -R "$(id -u):$(id -g)" .
+#          set -e
+#          if [[ -n "${{ github.base_ref }}" ]]
+#          then
+#            version="${{ github.base_ref }}"
+#          elif [[ "${{ github.ref }}" == "refs/heads/devel" ]]
+#          then
+#            version="master"
+#          else
+#            git fetch -fu --tags origin ${{ github.ref }}:${{ github.ref }}
+#            version="$(git describe --tags)"
+#            [[ "$version" =~ .*-.*-.* ]] || {
+#              git checkout HEAD~1
+#              version="$(git describe --tags)"
+#            }
+#            version="${version%-*-*}"
+#          fi
+#          echo "Previous version is '$version'"
+#          #TODO: Revert to dynamically found version
+#          #echo "PREVIOUS_VERSION=${version}" >> "$GITHUB_ENV"
+#          echo "PREVIOUS_VERSION=v1.53.3" >> "$GITHUB_ENV"
+#      - name: Generate ssh key
+#        run: |
+#          set -x
+#          mkdir -p /__w/nextcloudpi/nextcloudpi/.ssh
+#          ssh-keygen -t ed25519 -f "/__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key"
+#          . /ncp-test-automation/bin/entrypoint.sh
+#      - name: upload ssh private key to artifact store
+#        uses: actions/upload-artifact@v3
+#        with:
+#          name: "${{ env.SSH_ARTIFACT_NAME }}"
+#          path: /__w/nextcloudpi/nextcloudpi/.ssh
+#          if-no-files-found: error
+#      - id: create-test-instance
+#        uses: ./.github/actions/create-test-instance-bullseye
+#        with:
+#          version: "${{ env.PREVIOUS_VERSION }}"
+#          uid: "${{ env.UID }}"
+#          hcloud_token: ${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}
+#          server_type: "cx11"
+#      - name: Set instance variables
+#        run: |
+#          echo "SERVER_ADDRESS=${{ steps.create-test-instance.outputs.server_address }}" >> "$GITHUB_ENV"
+#          echo "SNAPSHOT_ID=${{ steps.create-test-instance.outputs.snapshot_id }}" >> "$GITHUB_ENV"
+#      - uses: actions/checkout@v3
+#        with:
+#          repository: 'theCalcaholic/ncp-test-automation'
+#          ref: "bullseye"
+#          path: /__w/nextcloudpi/nextcloudpi/ncp-test-automation
+#      - name: Activate and Test postinstall VM
+#        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+#        run: |
+#          set -e
+#          echo "Setup ssh"
+#          chmod 0600 /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+#          eval "$(ssh-agent)"
+#          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+#
+#          source ./library.sh
+#
+#          trap 'terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+#
+#          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+#
+#          echo "Run integration tests"
+#          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS}" cat /usr/local/etc/instance.cfg
+#          test-ncp-instance -a -f "$SNAPSHOT_ID" -b "${VERSION}" --systemtest-args "--skip-update-test" --nc-test-args "--skip-release-check" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+#
+#            echo "Integration tests failed"
+#            echo "Here are the last lines of ncp-install.log:"
+#            echo "==========================================="
+#            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+#            echo "==========================================="
+#            echo "and ncp.log:"
+#            echo "==========================================="
+#            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+#            echo "==========================================="
+#            exit 1
+#          }
+#      - name: perform update
+#        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+#        run: |
+#          set -e
+#
+#          echo "Setup ssh"
+#          chmod 0600 /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+#          eval "$(ssh-agent)"
+#          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+#
+#          source ./library.sh
+#
+#          echo "Updating from $PREVIOUS_VERSION to $VERSION"
+#          ssh-keygen -f "$HOME/.ssh/known_hosts" -R "${SERVER_ADDRESS}" 2> /dev/null || true
+#          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" "ncp-update '$VERSION'"
+#      - name: Run integration tests after update
+#        id: final_test
+#        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+#        run: |
+#          set -e
+#
+#          echo "Setup ssh"
+#          eval "$(ssh-agent)"
+#          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+#
+#          source ./library.sh
+#
+#          trap '[ $? -eq 0 ] || echo "test_result=failure" >> "$GITHUB_OUTPUT"; terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+#
+#          echo "Run integration tests"
+#          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+#          NC_TEST_ARGS=()
+#          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" cat /etc/os-release | grep VERSION_ID=12 || NC_TEST_ARGS+=("--skip-release-check")
+#          set -x
+#          test-ncp-instance -f "$SNAPSHOT_ID" -b "${VERSION}" --nc-test-args "$NC_TEST_ARGS" --systemtest-args "--skip-update-test" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+#
+#            echo "Integration tests failed"
+#            echo "Here are the last lines of ncp-install.log:"
+#            echo "==========================================="
+#            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+#            echo "==========================================="
+#            echo "and ncp.log:"
+#            echo "==========================================="
+#            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+#            echo "==========================================="
+#            exit 1
+#          }
+#
+#          echo "test_result=success" >> "$GITHUB_OUTPUT";
+
+  dist-upgrade-test:
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:bullseye
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+        UID: "${{ github.run_id }}-distupgrade"
+    defaults:
+      run:
+        shell: bash
+    outputs:
+      test_result: ${{ steps.final_test.outputs.test_result }}
+      ssh_artifact_name: ${{ env.SSH_ARTIFACT_NAME }}
+      server_address: ${{ steps.create-test-instance.outputs.server_address }}
+      snapshot_id: ${{ steps.create-test-instance.outputs.snapshot_id }}
+      test_server_id: ${{ steps.create-test-instance.outputs.test_server_id }}
+      previous_version: ${{ env.PREVIOUS_VERSION }}
+      version: ${{ env.VERSION }}
+    env:
+      PREVIOUS_VERSION: "v1.53.3"
+      VERSION: "${{ inputs.git_ref || github.head_ref || github.ref_name }}"
+      HOME: /root
+      SSH_ARTIFACT_NAME: "${{ github.run_id }}-distupgrade-ssh"
+      UID: "${{ github.run_id }}-distupgrade"
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          path: /__w/nextcloudpi/nextcloudpi
+      - name: Generate ssh key
+        run: |
+          set -x
+          chown -R "$(id -u):$(id -g)" /__w/nextcloudpi/nextcloudpi
+          mkdir -p /__w/nextcloudpi/nextcloudpi/.ssh
+          ssh-keygen -t ed25519 -f "/__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key"
+          . /ncp-test-automation/bin/entrypoint.sh
+      - name: upload ssh private key to artifact store
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ env.SSH_ARTIFACT_NAME }}"
+          path: /__w/nextcloudpi/nextcloudpi/.ssh
+          if-no-files-found: error
+          include-hidden-files: true
+      - id: create-test-instance
+        uses: ./.github/actions/create-test-instance-bullseye
+        with:
+          version: "${{ env.PREVIOUS_VERSION }}"
+          uid: "${{ env.UID }}"
+          hcloud_token: ${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}
+          server_type: "cx22"
+      - name: Set instance variables
+        run: |
+          echo "SERVER_ADDRESS=${{ steps.create-test-instance.outputs.server_address }}" >> "$GITHUB_ENV"
+          echo "SNAPSHOT_ID=${{ steps.create-test-instance.outputs.snapshot_id }}" >> "$GITHUB_ENV"
+      - uses: actions/checkout@v3
+        with:
+          repository: 'theCalcaholic/ncp-test-automation'
+          ref: "bullseye"
+          path: /__w/nextcloudpi/nextcloudpi/ncp-test-automation
+      - name: Activate and Test postinstall VM
+        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+        run: |
+          set -e
+          echo "Setup ssh"
+          chmod 0600 /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          trap 'terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+          
+          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+          
+          echo "Run integration tests"
+          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS}" cat /usr/local/etc/instance.cfg
+          test-ncp-instance -a -f "$SNAPSHOT_ID" -b "v1.54.3" --systemtest-args "--skip-update-test" --nc-test-args "--skip-release-check" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+          
+            echo "Integration tests failed"
+            echo "Here are the last lines of ncp-install.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+            echo "==========================================="
+            echo "and ncp.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+            echo "==========================================="
+            exit 1
+          }
+      - name: perform update
+        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+        run: |
+          set -e
+          
+          echo "Setup ssh"
+          chmod 0600 /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+
+          echo "Updating from $PREVIOUS_VERSION to $VERSION"
+          ssh-keygen -f "$HOME/.ssh/known_hosts" -R "${SERVER_ADDRESS}" 2> /dev/null || true
+          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" "ncp-update '$VERSION'"
+      - name: Run integration tests after update
+        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+        run: |
+          set -e
+          
+          echo "Setup ssh"
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          trap 'terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+          
+          echo "Run integration tests"
+          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+          NC_TEST_ARGS=()
+          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" cat /etc/os-release | grep VERSION_ID=12 || NC_TEST_ARGS+=("--skip-release-check")
+          set -x
+          test-ncp-instance -f "$SNAPSHOT_ID" -b "v1.54.3" --nc-test-args "$NC_TEST_ARGS" --systemtest-args "--skip-update-test" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+          
+            echo "Integration tests failed"
+            echo "Here are the last lines of ncp-install.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+            echo "==========================================="
+            echo "and ncp.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+            echo "==========================================="
+            exit 1
+          }
+
+      - name: NCP distupgrade
+        id: distupgrade
+        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+        run: |
+          set -e
+          
+          echo "Setup ssh"
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" cat /etc/os-release | grep 'VERSION_ID="11"' || {
+            echo "Can't upgrade from Debian $(ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" grep 'VERSION_ID=' /etc/os-release)"
+            echo "skipped=yes" | tee -a $GITHUB_OUTPUT
+            exit 1
+          }
+          ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" DEBIAN_FRONTEND=noninteractive ncp-dist-upgrade
+          echo "skipped=no" | tee -a $GITHUB_OUTPUT
+      - name: Update Nextcloud
+        working-directory: /__w/nextcloudpi/nextcloudpi/ncp-test-automation/bin
+        run: |
+          set -ex
+          apk add jq
+          
+          echo "Setup ssh"
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          current_nc_version="$(ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" "ncc status" | grep "version:" | awk '{ print $3 }')"
+          latest_nc_version="$(cat ../../etc/ncp.cfg | jq -r '.nextcloud_version')"
+          
+          if [[ "$current_nc_version" =~ "$latest_nc_version".* ]]
+          then
+            echo "Nextcloud is up to date - skipping NC update test."
+          else
+            for i in {1..10};
+            do
+              echo "running nc update ($i/10)..."
+              ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" "bash -c 'DBG=x ncp-update-nc ${latest_nc_version?}'"
+          
+              ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" /usr/local/bin/ncc status
+          
+              current_nc_version_new="$(ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" "ncc status" | grep "version:" | awk '{ print $3 }')"
+              if [[ "$current_nc_version_new" =~ "$latest_nc_version".* ]]
+              then
+                break
+              fi
+              if [[ "$current_nc_version" == "$current_nc_version_new" ]]
+              then
+                echo "failed to update to $latest_nc_version"
+                exit 1
+              fi
+              current_nc_version="$current_nc_version_new"
+            done
+          fi
+
+      - name: Run integration tests after dist-upgrade
+        id: final_test
+        working-directory: /ncp-test-automation/bin
+        run: |
+          set -e
+          
+          echo "Setup ssh"
+          eval "$(ssh-agent)"
+          ssh-add /__w/nextcloudpi/nextcloudpi/.ssh/automation_ssh_key
+          
+          source ./library.sh
+          
+          trap '[ $? -eq 0 ] || echo "test_result=failure" >> "$GITHUB_OUTPUT"; terminate-ssh-port-forwarding "${SERVER_ADDRESS}"' EXIT 1 2
+          
+          echo "Run integration tests"
+          setup-ssh-port-forwarding "$SERVER_ADDRESS"
+          
+          test-ncp-instance -f "$SNAPSHOT_ID" -b "${VERSION}" --systemtest-args "--skip-update-test" "root@${SERVER_ADDRESS}" "localhost" "8443" "9443" || {
+          
+            echo "Integration tests failed"
+            echo "Here are the last lines of ncp-install.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp-install.log;
+            echo "==========================================="
+            echo "ncp.log:"
+            echo "==========================================="
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /var/log/ncp.log;
+            echo "==========================================="
+            echo "nextcloud.log:"
+            ssh "${SSH_OPTIONS[@]}" "root@${SERVER_ADDRESS}" tail /opt/ncdata/data/nextcloud.log;
+            exit 1
+          }
+          echo "test_result=success" >> "$GITHUB_OUTPUT"
+
+  install-postactivation-snapshot:
+    if: ${{ always() }}
+    needs:
+      - installation-test
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:latest
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+
+    env:
+      TEST_TYPE: install
+      SERVER_ADDRESS: ${{ needs.installation-test.outputs.server_address }}
+      TEST_RESULT: ${{ needs.installation-test.test_result }}
+      TEST_SERVER_ID: ${{ needs.installation-test.outputs.test_server_id }}
+      VERSION: ${{ needs.installation-test.outputs.version }}
+      SSH_ARTIFACT_NAME: "${{ needs.installation-test.outputs.ssh_artifact_name }}"
+      UID: ${{ github.run_id }}-install
+    steps:
+      - name: download ssh private key from artifact store
+        uses: actions/download-artifact@v4
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        with:
+          name: ${{ env.SSH_ARTIFACT_NAME }}
+          path: /github/workspace/.ssh
+      - name: Shutdown server
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        run: |
+          chmod 0600  /github/workspace/.ssh/automation_ssh_key
+          export SSH_PUBLIC_KEY="$(cat  /github/workspace/.ssh/automation_ssh_key.pub)"
+          bash /ncp-test-automation/bin/entrypoint.sh
+          eval "$(ssh-agent)"
+          ssh-add  /github/workspace/.ssh/automation_ssh_key
+          
+          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS?}" <<EOF
+          systemctl stop mariadb
+          systemctl poweroff
+          EOF
+      - name: Create Snapshot
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        shell: bash
+        working-directory: /ncp-test-automation/bin
+        run: |
+          set -x
+          echo "${TEST_SERVER_ID?}"
+          
+          . ./library.sh
+          
+          tf-init "$TF_SNAPSHOT"
+          tf-apply "$TF_SNAPSHOT" "$TF_VAR_FILE" -var="branch=${VERSION?}" -var="snapshot_provider_id=${TEST_SERVER_ID?}" -var="snapshot_type=ncp-postactivation" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate"
+          snapshot_id="$(tf-output "$TF_SNAPSHOT" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate" snapshot_id)"
+          hcloud image add-label -o "$snapshot_id" "test-result=${TEST_RESULT?}"
+
+#  update-postactivation-snapshot:
+#    if: ${{ always() }}
+#    needs:
+#      - update-test
+#    runs-on: ubuntu-latest
+#    container:
+#      image: thecalcaholic/ncp-test-automation:latest
+#      env:
+#        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+#
+#    env:
+#      TEST_TYPE: update
+#      SERVER_ADDRESS: ${{ needs.update-test.outputs.server_address }}
+#      TEST_RESULT: ${{ needs.update-test.test_result }}
+#      TEST_SERVER_ID: ${{ needs.update-test.outputs.test_server_id }}
+#      VERSION: ${{ needs.update-test.outputs.version }}
+#      UID: ${{ github.run_id }}-update
+#      SSH_ARTIFACT_NAME: "${{ needs.update-test.outputs.ssh_artifact_name }}"
+#    steps:
+#      - name: download ssh private key from artifact store
+#        uses: actions/download-artifact@v3
+#        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+#        with:
+#          name: ${{ env.SSH_ARTIFACT_NAME }}
+#          path: /github/workspace/.ssh
+#      - name: Shutdown server
+#        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+#        run: |
+#          chmod 0600  /github/workspace/.ssh/automation_ssh_key
+#          export SSH_PUBLIC_KEY="$(cat  /github/workspace/.ssh/automation_ssh_key.pub)"
+#          bash /ncp-test-automation/bin/entrypoint.sh
+#          eval "$(ssh-agent)"
+#          ssh-add  /github/workspace/.ssh/automation_ssh_key
+#
+#          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS?}" <<EOF
+#          systemctl stop mariadb
+#          systemctl poweroff
+#          EOF
+#      - name: Create Snapshot
+#        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+#        shell: bash
+#        working-directory: /ncp-test-automation/bin
+#        run: |
+#          set -x
+#          echo "${{ needs.update-test.outputs.test_server_id }}"
+#          echo "${TEST_SERVER_ID?}"
+#
+#          . ./library.sh
+#
+#          tf-init "$TF_SNAPSHOT"
+#          tf-apply "$TF_SNAPSHOT" "$TF_VAR_FILE" -var="branch=${VERSION?}" -var="snapshot_provider_id=${TEST_SERVER_ID?}" -var="snapshot_type=ncp-postactivation" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate"
+#          snapshot_id="$(tf-output "$TF_SNAPSHOT" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate" snapshot_id)"
+#          hcloud image add-label -o "$snapshot_id" "test-result=${TEST_RESULT?}"
+
+  dist-upgrade-postactivation-snapshot:
+    if: ${{ always() }}
+    needs:
+      - dist-upgrade-test
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:latest
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+
+    env:
+      TEST_TYPE: distupgrade
+      SERVER_ADDRESS: ${{ needs.dist-upgrade-test.outputs.server_address }}
+      TEST_RESULT: ${{ needs.dist-upgrade-test.outputs.test_result }}
+      TEST_SERVER_ID: ${{ needs.dist-upgrade-test.outputs.test_server_id }}
+      VERSION: ${{ needs.dist-upgrade-test.outputs.version }}
+      UID: ${{ github.run_id }}-distupgrade
+      SSH_ARTIFACT_NAME: "${{ needs.dist-upgrade-test.outputs.ssh_artifact_name }}"
+    steps:
+      - name: download ssh private key from artifact store
+        uses: actions/download-artifact@v4
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        with:
+          name: ${{ env.SSH_ARTIFACT_NAME }}
+          path: /github/workspace/.ssh
+      - name: Shutdown server
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        run: |
+          chmod 0600  /github/workspace/.ssh/automation_ssh_key
+          export SSH_PUBLIC_KEY="$(cat  /github/workspace/.ssh/automation_ssh_key.pub)"
+          bash /ncp-test-automation/bin/entrypoint.sh
+          eval "$(ssh-agent)"
+          ssh-add  /github/workspace/.ssh/automation_ssh_key
+          
+          ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" "root@${SERVER_ADDRESS?}" <<EOF
+          systemctl stop mariadb
+          systemctl poweroff
+          EOF
+      - name: Create Snapshot
+        if: ${{ contains('success|failure', env.TEST_RESULT) }}
+        shell: bash
+        working-directory: /ncp-test-automation/bin
+        run: |
+          set -x
+          echo "${{ needs.dist-upgrade-test.outputs.test_server_id }}"
+          echo "${TEST_SERVER_ID?}"
+          
+          . ./library.sh
+          
+          tf-init "$TF_SNAPSHOT"
+          tf-apply "$TF_SNAPSHOT" "$TF_VAR_FILE" -var="branch=${VERSION?}" -var="snapshot_provider_id=${TEST_SERVER_ID?}" -var="snapshot_type=ncp-postactivation" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate"
+          snapshot_id="$(tf-output "$TF_SNAPSHOT" -state="${TF_SNAPSHOT}/${VERSION//\//.}.postactivation.tfstate" snapshot_id)"
+          hcloud image add-label -o "$snapshot_id" "test-result=${TEST_RESULT?}"
+  
+  cleanup:
+    if: ${{ always() }}
+    needs:
+      - install-postactivation-snapshot
+      #- update-postactivation-snapshot
+      - dist-upgrade-postactivation-snapshot
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:latest
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+    strategy:
+      matrix:
+        uid: ["${{ github.run_id }}-install", "${{ github.run_id }}-update", "${{ github.run_id }}-distupgrade"]
+      fail-fast: false
+    env:
+      HOME: '/root'
+      UID: ${{ matrix.uid }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: /ncp-test-automation/bin
+    steps:
+      - name: Teardown VMs
+        run: |
+          for server in $(hcloud server list -o noheader -o columns=id -l "ci=${UID?}")
+          do
+            echo "Deleting server '$server'..."
+            hcloud server delete "$server"
+            echo "done."
+          done
+      - name: Delete ssh key
+        run: |
+          source ./library.sh
+          hcloud-clear-root-key
+  cleanup-snapshots:
+    if: ${{ always() }}
+    needs:
+      - install-postactivation-snapshot
+      #- update-postactivation-snapshot
+      - dist-upgrade-postactivation-snapshot
+    runs-on: ubuntu-latest
+    container:
+      image: thecalcaholic/ncp-test-automation:latest
+      env:
+        HCLOUD_TOKEN: "${{ secrets.TEST_AUTOMATION_HCLOUD_API_TOKEN }}"
+    env:
+      HOME: '/root'
+    steps:
+      - name: Delete old snapshots
+        run: |
+          for snapshot in $(hcloud image list -t snapshot -o noheader -o columns=id | head -n -12)
+          do
+            echo "Deleting snapshot '$snapshot'..."
+            hcloud image delete "$snapshot"
+            echo "done."
+          done

.gitignore

@@ -1,3 +1,14 @@
 .*.swp
-*.img
-*.bz2
+/qemu-raspbian-network/
+/archive/
+/output/
+/cache/
+/torrent/
+/armbian/
+/raspbian_root
+/raspbian_boot
+/ncp-web/wizard.cfg
+/ncp-web/ncp-web.cfg
+/docker-armhf/qemu-arm-static
+.vagrant/
+/.idea/

CONTRIBUTING.md

@@ -0,0 +1,6 @@
+# Contributing
+
+Check this wiki article if you want to learn how you can help.
+
+[Ways to contribute](https://help.nextcloud.com/t/contribute-to-nextcloudpi/126384)
+

FUNDING.yml

@@ -0,0 +1,14 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: thecalcaholic
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

README.md

@@ -1,47 +1,325 @@
-# NextCloudPi generator
+English | [Traditional Chinese 繁體中文](i18n/README-zh_TW.md) | [Simplified Chinese 简体中文](i18n/README-zh_CN.md)
 
-![NC Logo](/resources/nextcloud-square-logo.png)
+_(The translated README pages are not updated at this time)_
 
-Use QEMU to automatically generate Raspbian Images with Nextcloud 
+# NextcloudPi
+
+[![Telegram icon][telegram-badge]][chat-telegram] [![Matrix icon][matrix-badge]][chat-matrix]  [![Nextcloud icon][nc-badge]][nc-github]
+
+[![Forum icon][forum-badge]][nc-forum-support]
+
+<p align="center">
+  <img src="https://github.com/nextcloud/nextcloudpi/blob/master/ncp-app/img/app.svg"
+       width="120"
+       height="85"
+       alt="NextcloudPi logo">
+</p>
+
+This is the build code for the [NextcloudPi][ncp-website] open-source community project.
+
+NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. ([⇒ Downloads][ncp-releases])
+
+This code also generates the NextcloudPi LXD and LXC containers and there is an install script for the latest supported Debian based system as well.
+
+Find the documentation at [docs.nextcloudpi.com][ncp-docs-website], the documentation is all written by volunteers.
+
+Please reach out in the [Matrix][chat-matrix-wiki] or [Telegram][chat-telegram-wiki] Wiki group chats if you want to help out to keep them up-to-date and we'll add you to the [Wiki Group][nc-forum-wiki-group] on the [forum][nc-forum].
+
+---
+
+### Test Status
+
+`master`
+
+[![Release](https://github.com/nextcloud/nextcloudpi/actions/workflows/release.yml/badge.svg)](https://github.com/nextcloud/nextcloudpi/actions/workflows/release.yml)
+
+`devel`
+
+[![Release](https://github.com/nextcloud/nextcloudpi/actions/workflows/release.yml/badge.svg?branch=devel)](https://github.com/nextcloud/nextcloudpi/actions/workflows/release.yml)
+
+---
 
 ## Features
 
-* Raspbian 8 Jessie
-* Nextcloud 11.0.2
-* Apache 2.4.25, with HTTP2 enabled
-* PHP 7.0 (double the speed of PHP5!)
-* MariaDB 10
-* 4.9.13 Linux Kernel ( NEW 03-13-2017 ) 
-* nextcloudpi-config for easy setup
-* Automatic redirection to HTTPS
-* ACPU PHP cache
-* PHP Zend OPcache enabled with file cache
-* HSTS
-* Cron jobs for Nextcloud
-* Sane configuration defaults
-* Let’s Ecrypt for trusted HTTPS certificates.(  NEW 03-16-2017 )
-* Fail2Ban protection against brute force attacks. ( NEW 02-24-2017 )
-* Dynamic DNS support for no-ip.org ( NEW 03-05-2017 )
-* dnsmasq DNS server with DNS cache ( NEW 03-09-2017 )
-* Automatic security updates, activated by default. ( NEW 03-21-2017 )
-* ModSecurity Web Application Firewall ( NEW 03-23-2017 )
+ * Raspberry Pi OS/Debian 12 _(Bookworm)_
+ * Nextcloud
+ * Apache, with HTTP2 enabled
+ * PHP 8.1
+ * MariaDB
+ * Redis memory cache
+ * ncp-config TUI for easy setup ( RAM logs, USB drive and more )
+ * Automatic redirection to HTTPS
+ * APCu PHP cache
+ * PHP Zend OPcache enabled with file cache
+ * HSTS
+ * Cron jobs for Nextcloud
+ * Sane configuration defaults
+ * Full emoji support
+ * Postfix email
+ * Secure
 
-## Usage
+## Extras
+
+ * Setup wizard
+ * NextcloudPi Web Panel
+ * Wi-Fi ready
+ * Ram logs
+ * Automatic security updates, activated by default.
+ * Let’s Encrypt for trusted HTTPS certificates.
+ * Fail2Ban protection against brute force attacks.
+ * UFW firewall
+ * Dynamic DNS support for no-ip.org
+ * Dynamic DNS support for freeDNS
+ * Dynamic DNS support for duckDNS
+ * Dynamic DNS support for spDYN
+ * Dynamic DNS support for Namecheap
+ * dnsmasq DNS server with DNS cache
+ * ModSecurity Web Application Firewall
+ * NFS ready to mount your files over LAN
+ * SAMBA ready to share your files with Windows/Mac/Linux
+ * USB automount
+ * Remote updates
+ * Automatic NCP updates
+ * Automatic Nextcloud updates
+ * Update notifications
+ * Nextcloud backup and restore
+ * Nextcloud online installation
+ * Format USB drive to BTRFS
+ * BTRFS snapshots
+ * Automatic BTRFS snapshots
+ * BTRFS snapshot auto sync
+ * scheduled rsync
+ * UPnP automatic port forwarding
+ * Security audits with Lynis and Debsecan
+ * ZRAM
+ * SMART hard drive health monitoring
+
+Extras can be activated and configured using the web interface at HTTPS port 4443
+
+![ncp-web][ncp-web-image]
+
+Or from the command line using
 
 ```
-git clone https://github.com/nachoparker/nextcloud-raspbian-generator.git
-cd nextcloud-raspbian-generator
-./batch.sh 192.168.0.145 # change to your QEMU raspbian IP
+sudo ncp-config
 ```
 
-Extras can be activated and configured using
+![NCP-config][ncp-config-image]
+
+## Docker has been discontinued
+
+Docker has been discontinued for the time being, please read the announcement here: https://help.nextcloud.com/t/nextcloudpi-planning-to-discontinue-its-docker-version-with-nc-25/158895
+
+## Run in LXD
 
 ```
-sudo nextcloudpi-config
+# Imports the LXC image, replace the X's with version number
+lxc image import "NextcloudPi_LXD_vX.XX.X.tar.gz" --alias "nextcloudpi"
+
+# Launches a container from the image
+lxc launch "nextcloudpi" ncp
+
+# Starts the container you've launched from the imported image
+lxc start ncp
 ```
 
-![NCP-config](/resources/ncp-config.jpg)
+## Run in Proxmox
 
-Get the image, find details and more instructions at
+There are two ways to run NCP on Proxmox:
 
-https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+### 1. Using the official release image
+
+In your Proxmox web interface, head to any storage pool that has CT Templates enabled, go to CT Templates, 
+click "Download from URL" and enter the link to the latest LXC image from the [Nextcloudpi releases page](https://github.com/nextcloud/nextcloudpi/releases)
+and press "Download".
+
+<img height="300" alt="Download from URL dialog" src="https://nextcloudpi.com/images/ncp-proxmox-download-screenshot.png">
+
+Optionally, you can copy the corresponding md5 sum from the releases page and paste it in the "Checksum" field to have
+Proxmox check that the downloaded image was not corrupted
+
+### 2. Installer by community-scripts (formerly tteck)
+
+Use the [install script][ncp-proxmox-install-script-v5] from [community-scripts][community-scripts-profile] to install the LXC container on your Proxmox instance
+
+[community-scripts][community-scripts-profile] has multiple helper scripts available for Proxmox on their [website][website-helper-scripts], go have a look if you're using Proxmox. :+1:
+
+
+Installation: `bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nextcloudpi.sh)"`
+
+Default Settings: `2GB RAM - 8GB Storage - 2vCPU`
+
+_(Check their [website][website-helper-scripts] if this has changed and we haven't had the time to update it here yet, it's located under: Operating-Systems > NextcloudPi LXC)_
+
+Thank you to the [community-scripts][community-scripts-profile] organisation :heart: for making the helper script & letting us use this for Proxmox installations :pray:
+
+You can find the GitHub repository with the helper scripts here: [here][gh-helper-scripts-repo].
+
+## How to build
+
+Packages
+
+- `apt-utils`
+- `apt-transport-https`
+- `build-essential`
+- `binfmt-support`
+- `binutils`
+- `bzip2`
+- `ca-certificates`
+- `chroot`
+- `cron`
+- `curl`
+- `dialog`
+- `lsb-release`
+- `jq`
+- `git`
+- `psmisc`
+- `procps`
+- `wget`
+- `whiptail`
+- `qemu`
+- `qemu-user-static`
+
+### Raspberry Pi IMG
+
+```
+git clone https://github.com/nextcloud/nextcloudpi.git
+cd nextcloudpi
+./build/build-SD-rpi.sh
+```
+
+### Armbian-based board
+
+```
+./build-SD-armbian.sh odroidxu4   # supported board code name
+```
+
+### LXD
+
+```
+./build/build-LXD.sh
+```
+
+NextcloudPi can be installed in any architecture running the latest Debian
+
+_Note: this assumes a clean Debian install, and there is no rollback method_
+
+### Curl install scripts
+
+This is executed as `root` as indicated by the `#`
+
+```
+# curl -sSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh | bash
+```
+
+If you're not `root` you can run it with `sudo` like so
+
+```
+curl -sSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh | sudo bash
+```
+
+## Links
+
+[Website][ncp-website]
+
+[Downloads][ncp-releases]
+
+<!-- [Docker Hub][ncp-docker-hub] -->
+
+[Nextcloud Forum][nc-forum]
+
+[Nextcloud Forum Support][nc-forum-support]
+
+_(Use the Forum for Support questions please, there's a NCP tag available, it will bridge your post to the Matrix and Telegram chats)_
+
+## Contact
+
+You can find us on the [Forum][nc-forum], [Telegram][chat-telegram] or [Matrix][chat-matrix]
+
+<!-- LINKS -->
+
+[ncp-website]: https://nextcloudpi.com
+
+[ncp-docs-website]: http://docs.nextcloudpi.com
+
+[ncp-docker-hub]: https://hub.docker.com/r/ownyourbits/nextcloudpi
+
+[ncp-releases]: https://github.com/nextcloud/nextcloudpi/releases
+
+[nc-github]: https://github.com/nextcloud
+
+<!-- FORUM -->
+
+[nc-forum]: https://help.nextcloud.com/
+
+[nc-forum-support]: https://help.nextcloud.com/c/support/appliances-docker-snappy-vm
+
+[nc-forum-wiki-group]: https://help.nextcloud.com/g/NCP_Wiki_Team/members
+
+<!-- CHAT -->
+
+[chat-matrix]: https://matrix.to/#/#nextcloudpi:matrix.org
+
+[chat-matrix-wiki]: https://matrix.to/#/#NCP_Wiki_Team:matrix.org
+
+[chat-telegram]: https://t.me/NextcloudPi
+
+[chat-telegram-wiki]: https://t.me/NCP_Wiki_Team
+
+<!-- TESTS -->
+
+[vm-tests]: https://github.com/nextcloud/nextcloudpi/actions/workflows/vm-tests.yml
+
+[docker-tests]: https://github.com/nextcloud/nextcloudpi/actions/workflows/build-docker.yml
+
+<!-- BADGES -->
+
+[gh-vm-tests-badge]: https://github.com/nextcloud/nextcloudpi/actions/workflows/vm-tests.yml/badge.svg
+
+[gh-docker-tests-badge]: https://github.com/nextcloud/nextcloudpi/actions/workflows/build-docker.yml/badge.svg
+
+[gh-vm-tests-badge-devel]: https://github.com/nextcloud/nextcloudpi/actions/workflows/vm-tests.yml/badge.svg?branch=devel
+
+[gh-docker-tests-badge-devel]: https://github.com/nextcloud/nextcloudpi/actions/workflows/build-docker.yml/badge.svg?branch=devel
+
+[vm-tests-badge]: https://github.com/nextcloud/nextcloudpi/workflows/VM%20Integration%20Tests/badge.svg
+
+[docker-tests-badge]: https://github.com/nextcloud/nextcloudpi/actions/workflows/build-docker.yml/badge.svg
+
+[telegram-badge]: https://img.shields.io/badge/Telegram-2CA5E0?style=for-the-badge&logo=telegram&logoColor=white
+
+[matrix-badge]: https://img.shields.io/badge/matrix-000000?style=for-the-badge&logo=Matrix&logoColor=white
+
+[forum-badge]: https://img.shields.io/badge/help-forums-blue.svg
+
+[nc-badge]: https://img.shields.io/badge/Nextcloud-0082C9?style=for-the-badge&logo=Nextcloud&logoColor=white
+
+<!-- COMMUNITY-SCRIPTS -->
+
+[community-scripts-profile]: https://github.com/community-scripts/
+
+[gh-helper-scripts-repo]: https://github.com/community-scripts/ProxmoxVE
+
+[website-helper-scripts]: https://community-scripts.github.io/ProxmoxVE/
+
+[ncp-proxmox-install-script-v5]: https://github.com/community-scripts/ProxmoxVE/blob/main/install/nextcloudpi-install.sh
+
+<!-- IMAGES -->
+
+[ncp-web-image]: https://user-images.githubusercontent.com/21343324/136853829-f4e99ec0-6307-431f-b4c7-21b2330cae7f.png
+
+[ncp-config-image]: https://help.nextcloud.com/uploads/default/original/3X/b/3/b3d157022a32296ab54428b14b5df02104a91f18.png
+
+<!-- EXTRAS & BACKUPS
+
+[telegram-badge]: https://patrolavia.github.io/telegram-badge/chat.png
+
+[rpi-badge]: https://img.shields.io/badge/Raspberry%20Pi-A22846?style=for-the-badge&logo=Raspberry%20Pi&logoColor=white
+
+[linux-badge]: https://img.shields.io/badge/Linux-FCC624?style=for-the-badge&logo=linux&logoColor=black
+
+[debian-badge]: https://img.shields.io/badge/Debian-A81D33?style=for-the-badge&logo=debian&logoColor=white
+
+[gh-badge]: https://img.shields.io/badge/GitHub-100000?style=for-the-badge&logo=github&logoColor=white
+
+-->

batch.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-
-# Batch creation of NextCloudPi image
-# Tested with 2017-03-02-raspbian-jessie-lite.img
-#
-# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
-# GPL licensed (see end of file) * Use at your own risk!
-#
-# Usage:
-#
-
-source etc/library.sh       # initializes $IMGNAME
-
-IP=$1                   # First argument is the QEMU Raspbian IP address
-
-IMGFILE="NextCloudPi_$( date  "+%m-%d-%y" ).img"
-
-NO_CONFIG=1 NO_HALT_STEP=1 ./install-nextcloud.sh                 $IP $IMGFILE
-NO_CONFIG=1 NO_CFG_STEP=1  ./installer.sh fail2ban.sh             $IP $( ls -1t *.img | head -1 )
-NO_CONFIG=1 NO_CFG_STEP=1  ./installer.sh no-ip.sh                $IP $( ls -1t *.img | head -1 )  
-NO_CONFIG=1 NO_CFG_STEP=1  ./installer.sh dnsmasq.sh              $IP $( ls -1t *.img | head -1 ) 
-NO_CONFIG=1 NO_CFG_STEP=1  ./installer.sh letsencrypt.sh          $IP $( ls -1t *.img | head -1 ) 
-NO_CONFIG=1                ./installer.sh unattended-upgrades.sh  $IP $( ls -1t *.img | head -1 ) 
-NO_CONFIG=1 NO_CFG_STEP=1  ./installer.sh modsecurity.sh          $IP $( ls -1t *.img | head -1 ) 
-
-IMGOUT=$( ls -1t *.img | head -1 )
-IMGFULL=$( basename "$IMGFILE" .img )_FULL.img
-
-pack_image "$IMGOUT" "$IMGFULL" 
-
-# License
-#
-# This script is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This script is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this script; if not, write to the
-# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
-# Boston, MA  02111-1307  USA

bin/nc-broadcast

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+if [[ ${EUID} -ne 0 ]]; then
+  printf "Must be run as root. Try 'sudo %s'\n" "$( basename "$0" )"
+  exit 1
+fi
+
+if [[ " $* " =~ " "(--help|-h)" " ]]
+then
+  echo 'Description:
+  Generate notifications for all Nextcloud users
+
+Usage:
+  nc-broadcast <short-message> [options]
+
+Arguments:
+  short-message                    Short message to be sent to the user (max. 255 characters)
+
+Options:
+  -l, --long-message=LONG-MESSAGE  Long message to be sent to the users (max. 4000 characters) [default: ""]
+  -h, --help                       Display this help message
+  -q, --quiet                      Do not output any message
+  -V, --version                    Display ncc/occ version
+      --ansi|--no-ansi             Force (or disable --no-ansi) ANSI output
+  -n, --no-interaction             Do not ask any interactive question
+      --no-warnings                Skip global warnings, show command output only
+  -v|vv|vvv, --verbose             Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug'
+  exit 0
+fi
+
+ncc user:list --output=json | jq -r 'keys[]' | while read -r user
+do
+  echo "Sending notification to $user"
+  ncc notification:generate "${@:2}" "$user" "$1"
+done
+echo "All users have been notified."

bin/ncp-backup

@@ -0,0 +1,106 @@
+#!/bin/bash
+set -eE
+source /usr/local/etc/library.sh
+
+if [ "$1" = "--help" ]; then
+ echo "$0 <destdir> <includedata> <compress> <backuplimit>"
+ echo " <includedata> and <compress> are 'yes' or 'no'"
+ echo " <backuplimit> integer >= 1 or 0 for no limit"
+ exit 0
+fi
+
+destdir="${1:-/media/USBdrive/ncp-backups}"
+includedata="${2:-no}"
+compress="${3:-no}"
+backuplimit="${4:-0}"
+
+destfile="$destdir"/nextcloud-bkp_$( date +"%Y%m%d_%s" ).tar
+dbbackup=nextcloud-sqlbkp_$( date +"%Y%m%d" ).bak
+[[ -f /.docker-image ]] && basedir=/data || basedir=/var/www
+
+[[ "$compress" == "yes" ]] && destfile="$destfile".gz
+
+datadir=$( get_nc_config_value datadirectory ) || {
+  echo "Error reading data directory. Is NextCloud running and configured?";
+  exit 1;
+}
+
+cleanup(){ local ret=$?;                    rm -f "${dbbackup}"              ; restore_maintenance_mode; exit $ret; }
+fail()   { local ret=$?; echo "Abort..."  ; rm -f "${dbbackup}" "${destfile}"; restore_maintenance_mode; exit $ret; }
+trap cleanup EXIT
+trap fail INT TERM HUP ERR
+
+echo "check free space..." # allow at least ~500 extra MiB
+mkdir -p "$destdir"
+nsize=$(du -sb "$basedir/nextcloud" | awk '{ print $1 }')
+[[ -d "$basedir/nextcloud"/data ]] && \
+  dsize=$(du -sb "$basedir/nextcloud"/data | awk '{ print $1 }')
+margin=$((500*1024*1024))                  # safety margin for database and some extra
+if [[ "$includedata" == "yes" ]]; then
+  datasize=$(du -sb "$datadir" | awk '{ print $1 }')
+  size=$((nsize - dsize + margin + datasize))
+else
+  size=$((nsize - dsize + margin))
+fi
+free=$( df -B1 "$destdir" | tail -1 | awk '{ print $4 }' )
+
+[ $size -ge $free ] && {
+  echo "free space check failed. Need $size Bytes";
+  exit 1;
+}
+
+# delete older backups
+[[ $backuplimit != 0 ]] && {
+  numbkps=$( ls "$destdir"/nextcloud-bkp_* 2>/dev/null | wc -l )
+  [[ $numbkps -ge $backuplimit ]] && \
+    ls -t $destdir/nextcloud-bkp_* | tail -$(( numbkps - backuplimit + 1 )) | while read -r f; do
+      echo "clean up old backup $f"
+      rm "$f"
+    done
+}
+
+# database
+save_maintenance_mode
+cd "$basedir" || exit 1
+echo "backup database..."
+mysqldump -u root --single-transaction nextcloud > "$dbbackup"
+
+# files
+echo "backup files..."
+[[ "$includedata" == "yes" ]] && data="$(basename "$datadir")"
+[[ "$compress"    == "yes" ]] && compress_arg="-I pigz"
+mkdir -p "$destdir"
+tar $compress_arg -cf "$destfile" \
+\
+    "$dbbackup" \
+\
+    --exclude "$data/.opcache" \
+    --exclude "nextcloud/data/access.log" \
+    --exclude "nextcloud/data/error.log" \
+    --exclude "nextcloud/data/nextcloud.log" \
+    --exclude "$data/ncp-update-backups" \
+    -C "$(dirname "$datadir"/)" $data \
+\
+    --exclude "nextcloud/data/*/files/*" \
+    --exclude "nextcloud/data/.opcache" \
+    --exclude "nextcloud/data/access.log" \
+    --exclude "nextcloud/data/error.log" \
+    --exclude "nextcloud/data/nextcloud.log" \
+    --exclude "nextcloud/data/appdata_*/preview/*" \
+    --exclude "nextcloud/data/*/uploads/*" \
+    --exclude "nextcloud/data/*/cache/*" \
+    --exclude "nextcloud/data/*/files_trashbin/*" \
+    --exclude "nextcloud/data/*/files_versions/*" \
+    --exclude "nextcloud/data/ncp-update-backups" \
+    --exclude "nextcloud/data/__groupfolders" \
+    --exclude "nextcloud/.data_*" \
+    -C $basedir nextcloud/ \
+  || {
+        echo "error generating backup"
+        exit 1
+      }
+rm "$dbbackup"
+chmod 640 "$destfile"
+chown :www-data "$destfile"
+
+echo "backup $destfile generated"

bin/ncp-check-nc-version

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# notify latest available NC version
+
+set -e
+
+source /usr/local/etc/library.sh # sets NCLATESTVER
+
+CURRENT="$(nc_version)"
+NEXT_VERSION="$(determine_nc_update_version "${CURRENT}" "${NCLATESTVER?}")"
+if [[ -z "$NEXT_VERSION" ]] || [[ "$NEXT_VERSION" == "${CURRENT}" ]]
+then
+  exit 0
+fi
+
+NOTIFIED=/var/run/.nc-version-notified
+
+test -e "${NOTIFIED}" && [[ "${NEXT_VERSION}" == "$( cat "${NOTIFIED}" )" ]] && {
+  echo "Found update from ${CURRENT} to ${NEXT_VERSION}. Already notified"
+  exit 0
+}
+
+if is_more_recent_than "${NEXT_VERSION}" "${CURRENT}"; then
+  notify_admin \
+    "Nextcloud update" \
+    "Update from ${CURRENT} to ${NEXT_VERSION} is available. Update from https://$(get_ip):4443"
+  echo "${NEXT_VERSION}" > "${NOTIFIED}"
+fi

bin/ncp-check-updates

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# print message if an update is available
+
+VERFILE=/usr/local/etc/ncp-version 
+LATEST=/var/run/.ncp-latest-version
+
+if ncp-test-updates; then
+  echo -e "\nNextcloudPi \e[1m$( cat $VERFILE)\e[0m is outdated"
+  echo -e "update to \e[1m$( cat $LATEST )\e[0m through 'ncp-config' or type 'sudo ncp-update'" 
+else
+  echo -e "\nNextcloudPi \e[1m$( cat $VERFILE)\e[0m is up to date"
+fi

bin/ncp-check-version

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# update latest available version in /var/run/.ncp-latest-version
+
+TEMPDIR="$( mktemp -d /tmp/ncp-check.XXXXXX || ( echo "Failed to create temp dir. Exiting" >&2; exit 1 ) )"
+trap "rm -rf \"${TEMPDIR}\"; exit 0" 0 1 2 3 15
+
+BRANCH="master"
+{ [[ -f /.dockerenv ]] || [[ -f /.docker-image ]] || [[ "$DOCKERBUILD" == 1 ]]; } && BRANCH="docker-stable"
+
+git clone -b "$BRANCH" --depth 20 -q --bare https://github.com/nextcloud/nextcloudpi.git "$TEMPDIR" || {
+  echo "The git clone command failed: No connectivity to https://github.com ?" >&2
+  exit 1
+}
+
+cd "$TEMPDIR" || exit 1
+VER=$( git describe --always --tags | grep -oP "v\d+\.\d+\.\d+" )
+
+canary="$(. /usr/local/etc/library.sh; find_app_param ncp-community.sh CANARY)"
+
+[[ "$canary" != "yes" ]] && [[ -f "/usr/local/etc/instance.cfg" ]] && {
+  cohorte_id="$(jq .cohorteId /usr/local/etc/instance.cfg)"
+  [[ -f "./staged_rollouts/${VER}.txt" ]] && {
+    grep "^${cohorte_id}$" "./staged_rollouts/${VER}.txt" || {
+      echo "Skipping version $VER - cohorte ${cohorte_id} not yet active"
+      cd / || exit 1
+      exit 0
+    }
+  }
+}
+
+grep -qP "v\d+\.\d+\.\d+" <<< "$VER" && {       # check format
+  echo "$VER" > /var/run/.ncp-latest-version
+
+  # write changelog
+  git log --graph --oneline --decorate \
+    --pretty=format:"[%D] %s" --date=short | \
+    grep 'tag: v' | \
+    sed '/HEAD ->\|origin/s|\[.*\(tag: v[0-9]\+\.[0-9]\+\.[0-9]\+\).*\]|[\1]|' | \
+    sed 's|* \[tag: |[|' > /usr/local/etc/ncp-changelog
+}
+cd / || exit 1

bin/ncp-config

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# NextcloudPi software configuration
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Usage:
+#   sudo ncp-config
+#
+# More at https://ownyourbits.com/2017/03/13/nextcloudpi-gets-nextcloudpi-config/
+#
+
+BINDIR=/usr/local/bin/ncp
+
+source /usr/local/etc/library.sh
+{
+  ncpversion="$(cat /usr/local/etc/ncp-version)"
+  chlogfile=/usr/local/etc/ncp-changelog
+  # ask for update if outdated
+  ncp-test-updates 2>/dev/null && {
+    [[ -f "$chlogfile" ]] && changelog=$( head -4 "$chlogfile" )
+
+    latest_ver="$(cat /var/run/.ncp-latest-version 2>/dev/null)"
+    whiptail --backtitle "$backtitle $ncpversion" \
+             --title "NextcloudPi update available" \
+             --clear --yesno "Update to $latest_ver?\n\n$changelog" \
+             15 70
+
+    [[ $? -eq $dialog_ok ]] && ncp-update
+  }
+
+function generate_list()
+{
+  local dir="$1"
+  unset list
+  for item in "$dir"/*; do
+
+    # directories
+    [[ -d "$item" ]] && {
+      local dir="$( basename "$item" )"
+      list+=("  $dir" "")
+      continue
+    }
+
+    [[ "$item" =~ ".sh" ]] || continue
+
+    # regular ncp_apps
+    local app="$( basename "$item" .sh )"
+    local cfg="$cfgdir/$app".cfg
+
+    [[ -f "$cfg" ]] && local desc=$( jq -r .description "$cfg" ) || local desc="No description."
+    is_active_app "$app" "$dir" && local on="*" || local on=" "
+
+    list+=( "$on $app" "$desc" )
+  done
+}
+
+function config_menu()
+{
+  local dir="$1"
+  local backtitle="NextcloudPi configuration ver. "
+  local ncpversion="$(cat /usr/local/etc/ncp-version  )"
+  local cfgdir=/usr/local/etc/ncp-config.d
+  local dialog_ok=0
+  local desc cfg ncp_app
+
+  while true; do
+
+    # menu items
+    generate_list "$dir"
+
+    # launch the selection menu
+    [[ "$dir" == "$BINDIR" ]] && local cancel_btn="Finish" || local cancel_btn="Back"
+    ncp_app=$( whiptail --backtitle "$backtitle $ncpversion" \
+                       --title "NextcloudPi Configuration Tool (ncp-config)" \
+                       --cancel-button $cancel_btn --ok-button Select \
+                       --menu "Select ncp-app to configure or activate:" 20 105 10 \
+                       "${list[@]}" \
+              3>&1 1>&2 2>&3 )
+
+    [[ $? -ne $dialog_ok ]] || [[ "$ncp_app" == "" ]] && {
+      [[ "$dir" == "$BINDIR" ]] && return 0
+      dir="$(dirname "$dir")"
+      continue
+    }
+
+    # remove * and spaces
+    ncp_app=$( sed  's=*\| ==g' <<< "$ncp_app" )
+
+    # directory selection
+    [[ -d "$dir/$ncp_app" ]] && {
+      dir="$dir/$ncp_app"
+      config_menu "$dir"
+      return
+    }
+
+    # launch selected ncp_app
+    info_app      "$ncp_app" || continue
+    configure_app "$ncp_app" && \
+    run_app       "$ncp_app"
+    echo "Done. Press any key..."
+    read -r
+  done
+}
+
+if [[ ${EUID} -ne 0 ]]; then
+  printf "Must be run as root. Try 'sudo $( basename "$0" )'\n"
+  exit 1
+fi
+
+config_menu "$BINDIR"
+
+exit $?
+} # force to read the whole thing into memory, as its contents might change in update.sh
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp-diag

@@ -0,0 +1,181 @@
+#!/bin/bash
+# NextcloudPi diagnostics report
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Usage:
+#   sudo ncp-diag
+#
+# More at https://ownyourbits.com
+#
+# shellcheck disable=SC1091
+source /usr/local/etc/library.sh
+
+# Distro, NCP version and tag
+echo "NextcloudPi version|$( cat /usr/local/etc/ncp-version )"
+[[ -f /usr/local/etc/ncp-baseimage ]] && echo "NextcloudPi image|$( cat /usr/local/etc/ncp-baseimage )"
+echo "OS|$(sed 's| \\n \\l||' /etc/issue). $(uname -r) ($(uname -m))"
+
+# Data
+DATADIR="$( grep datadirectory /var/www/nextcloud/config/config.php |
+              awk '{ print $3 }' | grep -oP "[^']*[^']" | head -1 )"
+test -d "$DATADIR" || DIRINFO=" (doesn't exist)"
+USBDEVS="$( lsblk -S -o  NAME,TRAN | awk '{ if ( $2 == "usb" ) print $1; }' | tr '\n' ' ' )"
+[[ "$USBDEVS" == "" ]] && USBDEVS="none"
+
+am_cfg="/usr/local/etc/ncp-config.d/nc-automount.cfg"
+[[ -f "$am_cfg" ]] && [[ "$(jq -r ".params[0].value" "$am_cfg")" == "yes" ]] && echo "automount|yes" || echo "automount|no"
+echo "USB devices|$USBDEVS"
+echo "datadir|$DATADIR$DIRINFO"
+[[ "$DIRINFO" == "" ]] && {
+  echo "data in SD|$( [[ $( stat -fc%d / ) == $( stat -fc%d "$DATADIR" ) ]] && echo yes || echo no )"
+  echo "data filesystem|$( stat -fc%T "$DATADIR" )"
+  echo "data disk usage|$( df -h "$DATADIR" | tail -1 | awk '{ print $3"/"$2 }')"
+}
+echo "rootfs usage|$( df -h / | tail -1 | awk '{ print $3"/"$2 }')"
+SWP="$( swapon | tail -1 | awk '{ print $1 }' )"
+[[ "$SWP" == "" ]] && SWP="none"
+echo "swapfile|$SWP"
+
+# Database
+DBDIR=$( grep datadir /etc/mysql/mariadb.conf.d/90-ncp.cnf | awk -F "= " '{ print $2 }' )
+test -d "$DBDIR" || DBDIRINFO=" (doesn't exist)"
+echo "dbdir|$DBDIR$DBDIRINFO"
+
+# Nextcloud
+VERSION="$( ncc status | grep "version:" | awk '{ print $3 }' )"
+if [[ "$VERSION" != "" ]]; then
+  echo "Nextcloud check|ok"
+  echo "Nextcloud version|$VERSION"
+  else
+  echo "Nextcloud check|error"
+fi
+
+# Services
+echo "HTTPD service|$( pgrep -c apache2 &>/dev/null && echo up || echo down )"
+echo "PHP service|$( pgrep -c php-fpm &>/dev/null && echo up || echo down )"
+echo "MariaDB service|$( (pgrep -c mysqld || pgrep -c mariadb) &>/dev/null && echo up || echo down )"
+echo "Redis service|$( pgrep -c redis-server &>/dev/null && echo up || echo down )"
+echo "HPB service|$( ncc notify_push:self-test &>/dev/null && echo up || echo down )"
+echo "Postfix service|$( pgrep -fc postfix &>/dev/null && echo up || echo down )"
+
+# WAN
+echo "Internet check|$( ping -W 2 -w 1 -q github.com &>/dev/null && echo ok || echo no )"
+
+function is_port_open()
+{
+  # The URL leads to an application I've deployed for NCP on https://fly.io using a Docker container I made.
+  # The image for the container is available on Docker Hub (zendai/checkport:sanic) if you wish to deploy one yourself.
+  # The code for the Sanic server and Docker image is available at: https://github.com/ZendaiOwl/Build/tree/master/Docker/Python/Sanic/checkport
+  # I only have a free tier with limited outbound data per month, 100GB p/month.
+  # If we go over 100GB outbound data in a month, I will start being charged for the data going over that limit.
+  # I used a low level Python socket library & fortunately each request only consumes aprox. ~ 60-74 bytes p/second.
+  # Meaning 100GB should be plenty, it should be enough to handle a little less
+  # than 450 request p/second a month, unless my calculations are wrong.
+  # Thank you :pray: from Victor-ray, S. https://github.com/ZendaiOwl
+  local -r PORTURL="https://checkport.zendai.net.eu.org/check"
+  local TYPE="${1?}" IPType
+  # Checks both port 80 & 443 for IPv4/IPv6 and returns the result or [N/A] [N/A]
+  if ! [[ "$TYPE" =~ ^(0|4|6)$ ]]
+  then
+    # As this echo is redirected to STDERR it will not be
+    # asssigned in the arrays of the if-statement below this function
+    echo "Invalid type: $TYPE" 1>&2
+    return 1
+  elif [[ "$TYPE" == 0 ]]
+  then
+    # Public IPv4/6 is not available
+    echo -e "[N/A]\n[N/A]"
+  else
+    IPType="--ipv6"
+    [[ "$TYPE" -eq 6 ]] || IPType="--ipv4"
+    curl --silent --max-time 4 "$IPType" "$PORTURL" | jq -r '."80",."443"'
+  fi
+}
+publicIPv4=$(curl --silent --max-time 4 --ipv4 "https://ipv4.icanhazip.com" 2>/dev/null) || unset publicIPv4
+echo "Public IPv4|${publicIPv4:-"not found"}"
+publicIPv6=$(curl --silent --max-time 4 --ipv6 "https://ipv6.icanhazip.com" 2>/dev/null) || unset publicIPv6
+echo "Public IPv6|${publicIPv6:-"not found"}"
+
+# Declares the array variables for mapfile to work
+declare -a IPv4PORTS
+declare -a IPv6PORTS
+
+# Mapfile reads lines from standard input into an indexed array variable
+if [[ -n "$publicIPv4" ]]
+then
+  mapfile -t IPv4PORTS < <(is_port_open 4)
+else
+  mapfile -t IPv4PORTS < <(is_port_open 0)
+fi
+
+if [[ -n "$publicIPv6" ]]
+then
+  mapfile -t IPv6PORTS < <(is_port_open 6)
+else
+  mapfile -t IPv6PORTS < <(is_port_open 0)
+fi
+
+# Checks if Port 80 is open on IPv4 or IPv6
+if [[ "${IPv4PORTS[0]}" == "open" ]] || [[ "${IPv6PORTS[0]}" == "open" ]]
+then
+  PORT80="open"
+elif [[ "${IPv4PORTS[0]}" == "[N/A]" ]] && [[ "${IPv6PORTS[0]}" == "[N/A]" ]]
+then
+  PORT80="[N/A]"
+else
+  PORT80="closed"
+fi
+# Checks if Port 443 is open on IPv4 or IPv6
+if [[ "${IPv4PORTS[1]}" == "open" ]] || [[ "${IPv6PORTS[1]}" == "open" ]]
+then
+  PORT443="open"
+elif [[ "${IPv4PORTS[1]}" == "[N/A]" ]] && [[ "${IPv6PORTS[1]}" == "[N/A]" ]]
+then
+  PORT443="[N/A]"
+else
+  PORT443="closed"
+fi
+
+echo "Port 80|$PORT80"
+echo "Port 443|$PORT443"
+
+# LAN
+IFACE=$( ip r | grep "default via" | awk '{ print $5 }' | head -1 )
+GW=$(    ip r | grep "default via" | awk '{ print $3 }' | head -1 )
+IP="$(get_ip)"
+
+echo "IP|$IP"
+echo "Gateway|$GW"
+echo "Interface|$IFACE"
+
+# Certificates
+CERTS="$( grep "SSLCertificateFile */etc/letsencrypt/live/" /etc/apache2/sites-available/001-nextcloud.conf \
+        | sed 's|.*SSLCertificateFile */etc/letsencrypt/live/||;s|/fullchain.pem||' )"
+[[ "$CERTS" == "" ]] && CERTS=none
+echo "Certificates|$CERTS"
+
+RESOLV="$( ping -c1 -w1 "$CERTS" 2>/dev/null | head -1 | grep -oP '\d{1,3}(.\d{1,3}){3}' )"
+echo "NAT loopback|$( [[ "$RESOLV" == "$IP" ]] && echo yes || echo no )"
+
+# Other
+echo "Uptime|$( uptime | cut -f1 -d',' | awk '{ $1=""; $2=""; print }' | tr -d "  " )"
+# Get kernel version
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp-dist-upgrade

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -e
+
+[[ "${EUID}" -eq 0 ]] || {
+  echo "ERROR: Must be run as root (try sudo ncp-dist-upgrade)"
+  exit 1
+}
+
+. /etc/os-release
+
+if [[ "$VERSION_ID" -eq 10 ]]
+then
+  UPGRADE_CMD=(bash /usr/local/bin/ncp-dist-upgrade.d/debian-10.sh)
+elif [[ "$VERSION_ID" -eq 11 ]]
+then
+  UPGRADE_CMD=(bash /usr/local/bin/ncp-dist-upgrade.d/debian-11.sh)
+else
+  echo "No dist-upgrade available for OS version: Debian ${VERSION}."
+  exit 0
+fi
+
+if { [ "$TERM" = "screen" ] && [ -n "$TMUX" ]; } || [[ "${DEBIAN_FRONTEND:-}" == "noninteractive" ]] || ! [[ -t 0 ]]
+then
+  "${UPGRADE_CMD[@]}" |& tee /var/log/ncp-dist-upgrade.log
+else
+  tmux list-sessions | grep ncp-distupgrade && {
+    echo "Existing distupgrade process detected. Connecting..."
+    sleep 5
+    tmux attach -t ncp-distupgrade
+    exit 0
+  }
+  tmux new-session -s ncp-distupgrade bash -c "${UPGRADE_CMD[*]} |& tee /var/log/ncp-dist-upgrade.log; bash"
+fi
+

bin/ncp-dist-upgrade.d/debian-10.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+[[ -f /.dockerenv ]] && { echo "Not supported in Docker. Upgrade the container instead"; exit 0; }
+
+new_cfg=/usr/local/etc/ncp-recommended.cfg
+[[ -f "${new_cfg}" ]] || { echo "Already on the lastest recommended distribution. Abort." >&2; exit 1; }
+
+APTINSTALL="apt-get install -y --no-install-recommends"
+export DEBIAN_FRONTEND=noninteractive
+
+echo "
+>>> ATTENTION <<<
+This is a dangerous process that is only guaranteed to work properly if you
+have not made manual changes in the system. Backup the SD card first and
+proceed at your own risk.
+
+Note that this is not a requirement for NCP to continue working properly.
+The current distribution will keep receiving updates for some time.
+
+Do you want to continue? [y/N]"
+
+read key
+[[ "$key" == y ]] || exit 0
+
+source /usr/local/etc/library.sh # sets NCPCFG RELEASE PHPVER
+old_cfg="${NCPCFG}"
+
+trap "echo 'Something went wrong. Fix it and try again'" EXIT
+
+save_maintenance_mode
+
+# Fix grub-pc issue in VM
+if apt show grub-pc-bin &>/dev/null; then
+  $APTINSTALL grub
+fi
+
+apt-get update
+apt-get upgrade -y
+
+# remove old PHP version
+set +e
+apt-get purge -y php${PHPVER} php${PHPVER}-curl php${PHPVER}-gd php${PHPVER}-fpm php${PHPVER}-cli php${PHPVER}-opcache \
+	php${PHPVER}-mbstring php${PHPVER}-xml php${PHPVER}-zip php${PHPVER}-fileinfo php${PHPVER}-ldap \
+	php${PHPVER}-intl php${PHPVER}-bz2 php${PHPVER}-json
+apt-get purge -y php${PHPVER}-mysql
+apt-get purge -y php${PHPVER}-redis
+apt-get purge -y php${PHPVER}-exif
+apt-get purge -y php${PHPVER}-bcmath
+apt-get purge -y php${PHPVER}-gmp
+apt-get purge -y php${PHPVER}-imagick
+set -e
+
+# update sources
+sed -i 's/buster/bullseye/g' /etc/apt/sources.list
+sed -i 's/buster/bullseye/g' /etc/apt/sources.list.d/* || true
+sed -i 's/bullseye\/updates/bullseye-security/g' /etc/apt/sources.list
+rm -f /etc/apt/sources.list.d/php.list
+
+# fix DHCP systemd service command https://forums.raspberrypi.com/viewtopic.php?t=320383 in raspbian
+if [[ -f /usr/bin/raspi-config ]]; then
+  sed -i 's|ExecStart=/usr/lib/dhcpcd5/dhcpcd -q -w|ExecStart=/usr/sbin/dhcpcd -q -w|g' /etc/systemd/system/dhcpcd.service.d/wait.conf
+fi
+
+# install latest distro
+apt-get update
+apt-get dist-upgrade -y
+
+# install latest PHP version
+release_new=$(jq -r '.release'     < "${new_cfg}")
+# the default repo in bullseye is bullseye-security - use bullseye if it is not available
+grep -Eh '^deb ' /etc/apt/sources.list | grep 'bullseye-security' > /dev/null && release_new="${release_new}-security"
+php_ver_new=$(jq -r '.php_version' < "${new_cfg}")
+# PHP 8.1 is only supported via the
+[[ "$php_ver_new" != 8.1 ]] || php_ver_new=7.4
+
+$APTINSTALL -t ${release_new} php${php_ver_new} php${php_ver_new}-curl php${php_ver_new}-gd php${php_ver_new}-fpm php${php_ver_new}-cli php${php_ver_new}-opcache \
+	php${php_ver_new}-mbstring php${php_ver_new}-xml php${php_ver_new}-zip php${php_ver_new}-fileinfo php${php_ver_new}-ldap \
+	php${php_ver_new}-intl php${php_ver_new}-bz2 php${php_ver_new}-json
+
+$APTINSTALL php${php_ver_new}-mysql
+$APTINSTALL -t ${release_new} php${php_ver_new}-redis
+
+$APTINSTALL -t ${release_new} smbclient exfat-fuse exfat-utils
+sleep 2 # avoid systemd thinking that PHP is in a crash/restart loop
+$APTINSTALL -t ${release_new} php${php_ver_new}-exif
+sleep 2 # avoid systemd thinking that PHP is in a crash/restart loop
+$APTINSTALL -t ${release_new} php${php_ver_new}-bcmath
+sleep 2 # avoid systemd thinking that PHP is in a crash/restart loop
+$APTINSTALL -t ${release_new} php${php_ver_new}-gmp
+#$APTINSTALL -t ${release_new} imagemagick php${php_ver_new}-imagick ghostscript
+
+# Reinstall prometheus-node-exporter, specifically WITH install-recommends to include collectors on bullseye and later
+{ dpkg -l | grep '^ii.*prometheus-node-exporter' >/dev/null && apt-get install -y prometheus-node-exporter-collectors; } || true
+
+apt-get autoremove -y
+apt-get clean
+
+cat > /etc/php/${php_ver_new}/fpm/conf.d/90-ncp.ini <<EOF
+; disable .user.ini files for performance and workaround NC update bugs
+user_ini.filename =
+
+; from Nextcloud .user.ini
+upload_max_filesize=10G
+post_max_size=10G
+memory_limit=768M
+mbstring.func_overload=0
+always_populate_raw_post_data=-1
+default_charset='UTF-8'
+output_buffering=0
+
+; slow transfers will be killed after this time
+max_execution_time=3600
+max_input_time=3600
+EOF
+
+# restart services
+service php${php_ver_new}-fpm restart
+a2enconf php${php_ver_new}-fpm
+service apache2 restart
+
+is_active_app unattended-upgrades && run_app unattended-upgrades || true
+
+# mark as successful
+mv "${new_cfg}" "${old_cfg}"
+install_template "php/opcache.ini.sh" "/etc/php/${php_ver_new}/mods-available/opcache.ini" --defaults
+clear_opcache
+
+source /usr/local/etc/library.sh # refresh NCPCFG RELEASE PHPVER
+run_app nc-limits
+restore_maintenance_mode
+
+rm -f /etc/update-motd.d/30ncp-dist-upgrade
+
+echo "Upgrade to ${release_new} successful"
+trap '' EXIT

bin/ncp-dist-upgrade.d/debian-11.sh

@@ -0,0 +1,86 @@
+    #!/bin/bash
+
+set -eu -o pipefail
+
+new_cfg=/usr/local/etc/ncp-recommended.cfg
+[[ -f "${new_cfg}" ]] || { echo "Already on the lastest recommended distribution. Abort." >&2; exit 1; }
+
+echo "
+>>> ATTENTION <<<
+This is a dangerous process that is only guaranteed to work properly if you
+have not made manual changes in the system. Backup the SD card first and
+proceed at your own risk.
+
+Note that this is not a requirement for NCP to continue working properly.
+The current distribution will keep receiving updates for some time.
+
+Do you want to continue? [y/N]"
+
+if [[ "${DEBIAN_FRONTEND:-}" == "noninteractive" ]] || ! [[ -t 0 ]]
+then
+  echo "Noninteractive environment detected. Automatically proceeding in 30 seconds..."
+  sleep 30
+else
+  read -n1 -r key
+  [[ "${key,,}" == y ]] || exit 0
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+
+source /usr/local/etc/library.sh
+is_more_recent_than "${PHPVER}.0" "8.0.0" || {
+  echo "You still have PHP version ${PHPVER} installed. Please update to the latest supported version of nextcloud (which will also update your PHP version) before proceeding with the distribution upgrade."
+  echo "Exiting."
+  exit 1
+}
+save_maintenance_mode
+
+# Perform dist-upgrade
+
+apt-get update
+apt-get remove -y libc-dev-bin || true
+apt-get upgrade -y
+for aptlist in /etc/apt/sources.list /etc/apt/sources.list.d/{php.list,armbian.list,raspi.list}
+do
+  [ -f "$aptlist" ] && sed -i -e "s/bullseye/bookworm/g" "$aptlist"
+done
+for aptlist in /etc/apt/sources.list.d/*.list
+do
+	[[ "$aptlist" =~ "/etc/apt/sources.list.d/"(php|armbian|raspi)".list" ]] || {
+    echo "Disabling repositories from \"$aptlist\""
+    sed -i -e "s/deb/#deb/g" "$aptlist"
+  }
+done
+apt-get update
+apt-get upgrade -y dpkg
+apt-get upgrade -y --without-new-pkgs
+if is_lxc
+then
+  # Required to avoid breakage of /etc/resolv.conf
+  apt-get install -y --no-install-recommends systemd-resolved && systemctl enable --now systemd-resolved
+fi
+apt-get full-upgrade -y
+sudo apt-get install -y --no-install-recommends libc-dev-bin || true
+sudo apt-get --purge  autoremove -y
+
+apt-get install -y --no-install-recommends exfatprogs
+
+#mkdir -p /etc/systemd/system/php8.1-fpm.service.d
+#echo '[Service]' > /etc/systemd/system/php8.1-fpm.service.d/ncp.conf
+#echo 'ExecStartPre=mkdir -p /var/run/php' >> /etc/systemd/system/php8.1-fpm.service.d/ncp.conf
+#[[ "$INIT_SYSTEM" != "systemd" ]] || { systemctl daemon-reload && systemctl restart php8.1-fpm; }
+
+restore_maintenance_mode
+cfg="$(jq "." "$NCPCFG")"
+cfg="$(jq ".release = \"bookworm\"" <<<"$cfg")"
+echo "$cfg" > "$NCPCFG"
+rm -f /etc/update-motd.d/30ncp-dist-upgrade
+rm -f /usr/local/etc/ncp-recommended.cfg
+
+echo "Update to Debian 12 (bookworm) successful."
+
+is_active_app unattended-upgrades && {
+  echo "Setting up unattended upgrades..."
+  run_app unattended-upgrades || true
+  echo "done."
+}

bin/ncp-docker-hook

@@ -0,0 +1,11 @@
+# Here we have the opportunity to make changes in the persistent volume configuration before
+# anything is started, after pulling a new image
+
+# adjust PHP version (in case of php upgrade)
+if php --version | grep -q v7.4 && [[ -f /data/etc/apache2/conf-available/php7.3-fpm.conf ]]; then
+  a2disconf php7.3-fpm
+  mv /data/etc/apache2/conf-available/php7.{3,4}-fpm.conf
+  sed -i 's|php7.3|php7.4|g' /data/etc/apache2/conf-available/php7.4-fpm.conf
+  a2enconf php7.4-fpm
+fi
+

bin/ncp-provisioning.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+
+# this script runs at startup to provide an unique random passwords for each instance
+
+source /usr/local/etc/library.sh
+set -x
+## redis provisioning
+
+CFG=/var/www/nextcloud/config/config.php
+REDISPASS="$( grep "^requirepass" /etc/redis/redis.conf | cut -f2 -d' ' )"
+
+### IF redis password is the default one, generate a new one
+
+[[ "$REDISPASS" == "default" ]] && {
+  REDISPASS="$( openssl rand -base64 32 )"
+  echo Provisioning Redis password
+  sed -i -E "s|^requirepass .*|requirepass $REDISPASS|" /etc/redis/redis.conf
+  chown redis:redis /etc/redis/redis.conf
+  is_docker || systemctl restart redis
+}
+
+### If there exists already a configuration adjust the password
+[[ -f "$CFG" ]] && {
+  echo "Updating NextCloud config with Redis password"
+  sed -i "s|'password'.*|'password' => '$REDISPASS',|" "$CFG"
+}
+
+## mariaDB provisioning
+
+DBADMIN=ncadmin
+DBPASSWD=$( grep password /root/.my.cnf | sed 's|password=||' )
+
+[[ "$DBPASSWD" == "default" ]] && {
+  DBPASSWD=$( openssl rand -base64 32 )
+  echo Provisioning MariaDB password
+  echo -e "[client]\npassword=$DBPASSWD" > /root/.my.cnf
+  chmod 600 /root/.my.cnf
+  mysql <<EOF
+GRANT USAGE ON *.* TO '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+DROP USER '$DBADMIN'@'localhost';
+CREATE USER '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+GRANT ALL PRIVILEGES ON nextcloud.* TO $DBADMIN@localhost;
+FLUSH PRIVILEGES;
+EXIT
+EOF
+}
+
+[[ -f "$CFG" ]] && {
+  echo "Updating NextCloud config with MariaDB password"
+  sed -i "s|'dbpassword' =>.*|'dbpassword' => '$DBPASSWD',|" "$CFG"
+}
+
+## nc.limits.sh (auto)adjustments: number of threads, memory limits...
+
+source /usr/local/etc/library.sh
+run_app nc-limits
+
+## Check for interrupted upgrades and rollback
+BKP="$( ls -1t /var/www/nextcloud-bkp_*.tar.gz 2>/dev/null | head -1 )"
+[[ -f "$BKP" ]] && [[ "$( stat -c %U "$BKP" )" == "root" ]] && [[ "$( stat -c %a "$BKP" )" == 600 ]] && {
+  echo "Detected interrupted upgrade. Restoring..."
+  BKP_NEW="failed_$BKP"
+  mv "$BKP" "$BKP_NEW"
+  ncp-restore "$BKP_NEW" && rm "$BKP_NEW"
+}
+
+## Check for encrypted data and ask for password
+if needs_decrypt; then
+  echo "Detected encrypted instance"
+  a2dissite ncp 001-nextcloud
+  a2ensite ncp-activation
+  apache2ctl -k graceful
+fi
+
+[[ -f /usr/local/etc/instance.cfg ]] || {
+  cohorte_id=$((RANDOM % 100))
+  cat > /usr/local/etc/instance.cfg <<EOF
+{
+  "cohorteId": ${cohorte_id}
+}
+EOF
+  cat /usr/local/etc/instance.cfg
+}
+
+systemctl is-enabled -q nextcloud-ai-worker@1.service || {
+  max="$(nproc || echo '2')"
+  max="$((max-1))"
+  for i in $(seq 1 "$max")
+  do
+    systemctl enable --now "nextcloud-ai-worker@${i}.service"
+  done
+}
+
+exit 0

bin/ncp-report

@@ -0,0 +1,87 @@
+#!/bin/bash
+
+# NextcloudPi diagnostics report
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Usage:
+#   sudo ncp-report
+#
+# More at https://ownyourbits.com
+#
+
+function open_summary()
+{
+  echo "
+<details>
+<summary>$*</summary>
+
+\`\`\`
+"
+}
+
+function close_summary()
+{
+  echo "
+\`\`\`
+</details>
+"
+}
+
+[[ ${EUID} -ne 0 ]] && {
+  printf "Must be run as root. Try 'sudo $0'\n"
+  exit 1
+}
+
+echo "<--! Paste this in GitHub report -->"
+
+##
+
+open_summary "NextcloudPi diagnostics"
+bash /usr/local/bin/ncp-diag | sed -r 's=(IP|Certificates|Gateway|Public IPv4|Public IPv6).*=\1|***REMOVED SENSITIVE VALUE***=g' | column  -t -s'|'
+close_summary
+
+##
+
+open_summary "Nextcloud configuration"
+sudo -u www-data php /var/www/nextcloud/occ config:list system 2>&1 || true
+close_summary
+
+##
+
+open_summary "HTTPd logs"
+tail -20 /var/log/apache2/error.log 2>&1 || true
+close_summary
+
+##
+
+open_summary "Database logs"
+tail -20 /var/log/mysql/*.log 2>&1 || true
+close_summary
+
+##
+
+DATADIR="$( grep datadirectory /var/www/nextcloud/config/config.php |
+              awk '{ print $3 }' | grep -oP "[^']*[^']" | head -1 )"
+
+open_summary "Nextcloud logs"
+tail -20 "$DATADIR"/nextcloud.log 2>&1 || true
+close_summary
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp-restore

@@ -0,0 +1,186 @@
+#!/bin/bash
+set -eE
+
+BACKUPFILE="$1"
+
+DBADMIN=ncadmin
+DBPASSWD="$( grep password /root/.my.cnf | sed 's|password=||' )"
+
+source /usr/local/etc/library.sh # sets PHPVER
+
+DIR="$( cd "$( dirname "$BACKUPFILE" )" &>/dev/null && pwd )" #abspath
+
+[[ -f /.docker-image ]] && NCDIR=/data/nextcloud || NCDIR=/var/www/nextcloud
+
+[[ $# -eq 0           ]] && { echo "missing first argument"         ; exit 1; }
+[[ -f "$BACKUPFILE"   ]] || { echo "$BACKUPFILE not found"          ; exit 1; }
+[[ "$DIR" =~ "$NCDIR".* ]] && { echo "Refusing to restore from $NCDIR"; exit 1; }
+
+TEMPDIR="$( mktemp -d "$( dirname "$BACKUPFILE" )"/ncp-restore.XXXXXX )" || { echo "Failed to create temp dir" >&2; exit 1; }
+[[ "$(stat -fc%T "${TEMPDIR}")" =~ ext|btrfs|zfs ]] || { echo "Can only restore from ext/btrfs/zfs filesystems (found '$(stat -fc%T "${TEMPDIR}")"     >&2; exit 1; }
+
+TEMPDIR="$( cd "$TEMPDIR" &>/dev/null && pwd )" || { echo "$TEMPDIR not found"; exit 1; } #abspath
+cleanup(){  local RET=$?; echo "Cleanup..."; rm -rf "${TEMPDIR}"; trap "" EXIT; exit $RET; }
+trap cleanup INT TERM HUP ERR EXIT
+rm -rf "$TEMPDIR" && mkdir -p "$TEMPDIR"
+
+[[ "$BACKUPFILE" =~ .*".tar.gz" ]] && compress_arg="-I pigz"
+
+# CHECK FREE SPACE IN $TEMPDIR
+echo "check free space..." # allow at least ~100 extra MiB
+extractedsize=$(tar $compress_arg -tvf "$BACKUPFILE" | awk '{s+=$3} END{printf "%.0f", (s/1024)}') # Size of extracted files in "KB"
+size=$(($extractedsize + 100*1024))
+free=$( df "$TEMPDIR" | tail -1 | awk '{ print $4 }' )
+[ $size -ge $free ] && {
+  echo "free space check failed. Need $size KB in $TEMPDIR";
+  exit 1;
+}
+
+# EXTRACT FILES
+echo "extracting backup file $BACKUPFILE..."
+tar $compress_arg -xf "$BACKUPFILE" -C "$TEMPDIR" || exit 1
+
+## SANITY CHECKS
+[[ -d "$TEMPDIR"/nextcloud ]] && [[ -f "$( ls "$TEMPDIR"/nextcloud-sqlbkp_*.bak 2>/dev/null )" ]] || {
+  echo "invalid backup file. Abort"
+  exit 1
+}
+
+## RESTORE FILES
+
+echo "restore files..."
+[[ -d "$NCDIR/data" ]] && {
+  DATA_BKP_DIR="$(mktemp -d -p "$NCDIR/.." nc-data-XXXXXX)"
+  mv -T "$NCDIR/data" "$DATA_BKP_DIR/"
+}
+rm -rf "$NCDIR"
+mv -T "$TEMPDIR"/nextcloud "$NCDIR" || { echo "Error restoring base files"; exit 1; }
+
+if [[ -n "$DATA_BKP_DIR" ]]
+then
+  target="$NCDIR/data"
+  [[ -d "$target" ]] && {
+    target="$NCDIR/.data_$(date '+%FT%s')"
+    echo "DATA CONFLICT! Your old '$NCDIR/data' directory can be found in '$target' after the restore script is done. The new '$NCDIR/data' directory will be restored from the backup. You can manually merge these directories with this command (run nc-fix-permissions and nc-scan afterwards): cp -rn '$target/'* '$target/'.[!.]* '$NCDIR/data/'"
+  }
+  echo "Restoring old '$NCDIR/data' to '$target'..."
+  mv -T "$DATA_BKP_DIR" "$target"
+fi
+
+# update NC database password to this instance
+sed -i "s|'dbpassword' =>.*|'dbpassword' => '$DBPASSWD',|" /var/www/nextcloud/config/config.php
+
+# update redis credentials
+REDISPASS="$( grep "^requirepass" /etc/redis/redis.conf | cut -f2 -d' ' )"
+[[ "$REDISPASS" != "" ]] && \
+  sed -i "s|'password'.*|'password' => '$REDISPASS',|" /var/www/nextcloud/config/config.php
+service redis-server restart
+
+## RE-CREATE DATABASE TABLE
+
+echo "restore database..."
+mysql -u root <<EOFMYSQL
+DROP DATABASE IF EXISTS nextcloud;
+CREATE DATABASE nextcloud;
+GRANT USAGE ON *.* TO '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+DROP USER '$DBADMIN'@'localhost';
+CREATE USER '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+GRANT ALL PRIVILEGES ON nextcloud.* TO $DBADMIN@localhost;
+EXIT
+EOFMYSQL
+# shellcheck disable=SC2181
+[ $? -ne 0 ] && { echo "Error configuring nextcloud database"; exit 1; }
+
+mysql -u root nextcloud <  "$TEMPDIR"/nextcloud-sqlbkp_*.bak || { echo "Error restoring nextcloud database"; exit 1; }
+
+## RESTORE DATADIR
+
+DATADIR="$(get_nc_config_value datadirectory)"
+if is_docker && [[ "$DATADIR" == "/var/www/nextcloud/data" ]]; then
+  DATADIR=/data/nextcloud/data
+fi
+[[ "$DATADIR" == "" ]] && { echo "Error reading data directory"; exit 1; }
+
+cd "$NCDIR"
+
+### INCLUDEDATA=yes situation
+NUMFILES=2
+if [[ $( ls "$TEMPDIR" | wc -l ) -eq $NUMFILES ]]; then
+
+  [[ -e "$DATADIR" ]] && {
+    bk_target="$DATADIR-$( date '+%FT%s' )"
+    echo "backing up existing $DATADIR to ${bk_target}..."
+    mv "$DATADIR" "${bk_target}" || exit 1
+  }
+
+  echo "restore datadir to $DATADIR..."
+
+  mkdir -p "$DATADIR"
+  grep -q "btrfs" <(stat -fc%T "$DATADIR") && which btrfs &>/dev/null && {
+    rmdir "$DATADIR"                  || exit 1
+    btrfs subvolume create "$DATADIR" || exit 1
+  }
+  chown www-data: "$DATADIR"
+  TMPDATA="$TEMPDIR/$( basename "$DATADIR" )"
+  mv "$TMPDATA"/* "$TMPDATA"/.[!.]* "$DATADIR" || exit 1
+  rmdir "$TMPDATA"                             || exit 1
+
+  ncc maintenance:mode --off
+
+### INCLUDEDATA=no situation
+
+else
+  echo "No datadir found in backup"
+
+  [[ -e "$DATADIR" ]] || {
+    echo -n "${DATADIR} not found."
+    DATADIR="/data/ncdata/data"
+    is_docker || DATADIR="/opt/data"
+    echo "Resetting to ${DATADIR}"
+    mkdir -p "${DATADIR}"
+    touch "${DATADIR}"/.ocdata
+    chown -R www-data: "${DATADIR}"
+  }
+
+  ncc maintenance:mode --off
+  ncc files:scan --all
+
+  # cache needs to be cleaned as of NC 12
+  NEED_RESTART=1
+fi
+
+sed -i "s|'datadirectory' =>.*|'datadirectory' => '${DATADIR}',|" "${NCDIR}"/config/config.php
+
+# Just in case we moved the opcache dir
+install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+
+# tmp upload dir
+mkdir -p "$DATADIR/tmp"
+chown www-data: "$DATADIR/tmp"
+ncc config:system:set tempdirectory --value "$DATADIR/tmp"
+sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = $DATADIR/tmp|" "/etc/php/${PHPVER}/cli/php.ini"
+sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = $DATADIR/tmp|" "/etc/php/${PHPVER}/fpm/php.ini"
+sed -i "s|^;\?sys_temp_dir =.*$|sys_temp_dir = $DATADIR/tmp|"     "/etc/php/${PHPVER}/fpm/php.ini"
+
+# logs
+ncc config:system:set logfile --value="$DATADIR/nextcloud.log"
+
+# update fail2ban logpath
+[[ -f /etc/fail2ban/jail.conf ]] && {
+  sed -i "s|logpath  =.*|logpath  = $DATADIR/nextcloud.log|" /etc/fail2ban/jail.conf
+  pgrep fail2ban &>/dev/null && service fail2ban restart
+}
+
+# refresh nextcloud trusted domains
+bash /usr/local/bin/nextcloud-domain.sh
+
+# update the systems data-fingerprint
+ncc maintenance:data-fingerprint
+
+# refresh thumbnails
+ncc files:scan-app-data
+
+# restart PHP if needed
+[[ "$NEED_RESTART" == "1" ]] && {
+  bash -c "sleep 5; source /usr/local/etc/library.sh; clear_opcache; service php${PHPVER}-fpm restart" &>/dev/null &
+}

bin/ncp-suggestions

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+#
+# NextcloudPi configuration suggestions
+#
+# Copyleft 2018 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Usage:
+#   sudo ncp-suggestions "$( ncp-diag )"
+#
+# More at https://ownyourbits.com
+#
+
+OUT="$@"
+
+source /usr/local/etc/library.sh
+  
+check_distro || \
+  echo -e "You are using an outdated distro release. You should upgrade to latest Debian/Raspbian"
+
+is_active_app dnsmasq && \
+  grep -q "NAT loopback|no" <<<"$OUT" && \
+    echo -e "\nYou should enable dnsmasq to use your domain inside home"
+
+grep -q "Certificates|none" <<<"$OUT" && \
+  echo -e "\nYou should run Lets Encrypt for trusted encrypted access"
+
+grep -q "Port .*|closed" <<<"$OUT" && \
+    echo -e "\nYou should open your ports for Lets Encrypt and external access"
+
+grep -q "USB devices|none" <<<"$OUT" || {
+  grep -q "data in SD|yes" <<<"$OUT" && \
+    echo -e "\nYou should use nc-datadir to move your files to your plugged in USB drive"
+
+  grep -q "automount|no" <<<"$OUT" && \
+    echo -e "\nYou should enable automount to use your plugged in USB drive"
+}

bin/ncp-test-updates

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# given in disk version information, return 0 if an update is available
+
+NEED_UPDATE=false
+VERFILE=/var/run/.ncp-latest-version
+
+[[ $( cat $VERFILE 2>/dev/null | wc -c ) -eq 0 ]] && ncp-check-version
+
+if grep -qP "v\d+\.\d+\.\d+" $VERFILE; then
+
+  MAJOR=$( grep -oP "\d+\.\d+\.\d+" $VERFILE | cut -d. -f1 )
+  MINOR=$( grep -oP "\d+\.\d+\.\d+" $VERFILE | cut -d. -f2 )
+  PATCH=$( grep -oP "\d+\.\d+\.\d+" $VERFILE | cut -d. -f3 )
+
+  MAJ=$( grep -oP "\d+\.\d+\.\d+" /usr/local/etc/ncp-version | cut -d. -f1 )
+  MIN=$( grep -oP "\d+\.\d+\.\d+" /usr/local/etc/ncp-version | cut -d. -f2 )
+  PAT=$( grep -oP "\d+\.\d+\.\d+" /usr/local/etc/ncp-version | cut -d. -f3 )
+
+  if [ "$MAJOR" -gt "$MAJ" ]; then
+    NEED_UPDATE=true
+  elif [ "$MAJOR" -eq "$MAJ" ] && [ "$MINOR" -gt "$MIN" ]; then
+    NEED_UPDATE=true
+  elif [ "$MAJOR" -eq "$MAJ" ] && [ "$MINOR" -eq "$MIN" ] && [ "$PATCH" -gt "$PAT" ]; then
+    NEED_UPDATE=true
+  fi
+fi
+[[ "$NEED_UPDATE" == "true" ]] && exit 0

bin/ncp-update

@@ -0,0 +1,67 @@
+#!/bin/bash
+
+# update latest NextcloudPi code from github
+
+[[ -z "$DBG" ]] || set -$DBG
+
+if [[ -f /.dockerenv ]] || [[ -f /.docker-image ]] || [[ "$DOCKERBUILD" == 1 ]]
+then
+  echo "WARNING: Docker images should be updated by replacing the container from the latest docker image" \
+    "(refer to the documentation for instructions: https://docs.nextcloudpi.com)." \
+    "If you are sure that you know what you are doing, you can still execute the update script by running it like this:"
+  echo "> ALLOW_UPDATE_SCRIPT=1 ncp-update"
+  [[ "$ALLOW_UPDATE_SCRIPT" == "1" ]] || exit 1
+fi
+
+{
+  [ "$(id -u)" -ne 0 ] && { printf "Must be run as root. Try 'sudo $0'\n"; exit 1; }
+
+  BRANCH="${1:-master}"
+  [[ "$BRANCH" != "master" ]] && echo "INFO: updating to development branch '$BRANCH'"
+
+  TEMPDIR="$( mktemp -d /tmp/ncp-update.XXXXXX || ( echo "Failed to create temp dir. Exiting" >&2; exit 1 ) )"
+  trap 'cd /; rm -rf "${TEMPDIR}"' EXIT
+
+  echo -e "Downloading updates"
+  git clone --depth 20 -b "$BRANCH" -q https://github.com/nextcloud/nextcloudpi.git "$TEMPDIR" || {
+    echo "No internet connectivity"
+    exit 1
+  }
+
+  # shellcheck disable=SC2164
+  [[ -f /.ncp-image ]] || {
+    cd "$TEMPDIR"         # update locally during build
+
+    [[ -z "$2" ]] || {
+      git fetch origin "$2" || {
+        echo "Error: Could not fetch $2"
+        exit 1
+      }
+      git checkout FETCH_HEAD
+    }
+  }
+
+  echo -e "Performing updates"
+  ./update.sh || exit $?
+
+  cd "$TEMPDIR" || exit 1
+  git describe --always --tags --abbrev=0 2>/dev/null | grep -qoP "v\d+\.\d+\.\d+" || git fetch --unshallow --tags -q
+  VER=$( git describe --always --tags --abbrev=0 | grep -oP "v\d+\.\d+\.\d+" )
+
+  # check format
+  grep -qP "v\d+\.\d+\.\d+" <<< "$VER" || { echo "Error: missing version"; exit 1; }
+
+  echo "$VER" > /usr/local/etc/ncp-version
+  echo "$VER" > /var/run/.ncp-latest-version
+
+  # write changelog
+  git log --graph --oneline --decorate \
+    --pretty=format:"[%D] %s" --date=short | \
+    grep 'tag: v' | \
+    sed '/HEAD ->\|origin/s|\[.*\(tag: v[0-9]\+\.[0-9]\+\.[0-9]\+\).*\]|[\1]|' | \
+    sed 's|* \[tag: |[|' > /usr/local/etc/ncp-changelog
+
+  echo -e "NextcloudPi updated to version $VER"
+  exit 0
+
+} # force to read the whole thing into memory, as its contents might change in update.sh

bin/ncp-update-nc

@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# Upgrade to a different Nextcloud version
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Usage:
+#       ncp-update-nc <version>
+#
+# More at https://ownyourbits.com
+#
+
+# test cases
+####################
+# - with and without moving datadir
+# - failure at each test point
+# -> must pass basic NC in tests.py ( meaning it's not in a broken state )
+
+set -eE${DBG}
+
+BIN="${0##*/}"
+VER="$1"
+[[ "$VER" == "" ]] && { echo "Usage ${BIN} <version>"; exit 1; }
+
+connect_to_nc_update() {
+  tail -n 100 -f "/var/log/ncp-update-nc.log" &
+  tail_pid=$!
+  trap "kill '$tail_pid'" EXIT
+  while [[ "$(systemctl is-active ncp-update-nc ||:)" =~ ^(active|activating|deactivating)$ ]]
+  do
+    sleep 3
+  done
+
+  if [[ "$(systemctl is-active ncp-update-nc ||:)" == "inactive" ]]
+  then
+    echo "Nextcloud update finished successfully."
+    return 0
+  elif [[ "$(systemctl is-active ncp-update-nc ||:)" == "failed" ]]
+  then
+    echo "Nextcloud update failed (or was installed already)."
+    return 1
+  else
+    echo "Nextcloud update was not found or failed (unexpected status: '$(systemctl is-active ncp-update-nc ||:)')"
+  fi
+}
+
+if [[ "$(systemctl is-active ncp-update-nc ||:)" =~ ^(active|activating|deactivating)$ ]]
+then
+  echo "Existing ncp-update-nc process detected. Connecting..."
+  connect_to_nc_update
+  exit $?
+fi
+
+systemctl reset-failed ncp-update-nc 2>/dev/null ||:
+systemd-run -u 'ncp-update-nc' --service-type=oneshot --no-block -p TimeoutStartSec="24h" -p TimeoutStopSec="1h" \
+  bash -c "set -o pipefail; DBG='${DBG:-}' /usr/local/bin/ncp-update-nc.d/update-nc.sh '${VER}' |& tee /var/log/ncp-update-nc.log"
+sleep 1
+
+if ! [[ "$(systemctl is-active ncp-update-nc ||:)" =~ ^(active|inactive|activating|deactivating)$ ]]
+then
+  echo "Failed to start ncp-update-nc"
+  [[ -f /var/log/ncp-update-nc.log ]] && cat /var/log/ncp-update-nc.log
+  systemctl status --no-pager ncp-update-nc ||:
+  exit 1
+fi
+
+connect_to_nc_update

bin/ncp-update-nc.d/update-nc.sh

@@ -0,0 +1,261 @@
+#!/bin/bash
+
+set -eE${DBG}
+
+VER="$1"
+source /usr/local/etc/library.sh
+export RELEASE
+export PHPVER
+
+# pre-checks
+####################
+BASEDIR=/var/www
+cd "$BASEDIR"
+DATADIR="$( get_nc_config_value datadirectory )"
+ncc status &>/dev/null          || { [[ "$DBG" == x ]] && ncc status; echo "Nextcloud is currently down"; exit 1; }
+[[ -d "${BASEDIR}/nextcloud-old" ]] && { echo "Nextcloud backup directory found. Interrupted or already running installation?"; exit 1; }
+[[ -d "${BASEDIR}/nextcloud"     ]] || { echo "Nextcloud directory not found"      ; exit 1; }
+[[ -d "$DATADIR"             ]] || { echo "Nextcloud data directory not found" ; exit 1; }
+
+# check version
+####################
+
+[[ ${EUID} -eq 0 ]] && SUDO="sudo -u www-data"
+CURRENT="$(nc_version)"
+if [[ "$VER" == "0" ]] || [[ "$VER" == "" ]]
+then
+  REQUESTED_VERSION="latest"
+else
+  REQUESTED_VERSION="$VER"
+fi
+TARGET_VERSION="$(determine_nc_update_version "${CURRENT?}" "${NCLATESTVER}" "${REQUESTED_VERSION}")"
+[[ "$TARGET_VERSION" == "$CURRENT" ]] && {
+  echo "Nextcloud version ${CURRENT} is already installed. Nothing to do."
+  exit 1
+}
+[[ -n "$TARGET_VERSION" ]] || {
+  echo "Could not find a valid upgrade path from '${CURRENT}' to '${TARGET_VERSION}'. Nothing to update."
+  exit 1
+}
+
+MAJOR_NEW="${TARGET_VERSION%%.*}"
+DEBIAN_VERSION="$(. /etc/os-release; echo "$VERSION_ID")"
+
+if [[ "$MAJOR_NEW" -ge 24 ]] && [[ $DEBIAN_VERSION -le 10 ]]
+then
+  echo -e "NCP doesn't support Nextcloud versions greater than 23 with Debian 10 (Buster). Please run ncp-dist-upgrade."
+  exit 1
+fi
+
+if [[ "$MAJOR_NEW" -ge 29 ]] && [[ $DEBIAN_VERSION -le 11 ]]
+then
+  echo -e "NCP doesn't support Nextcloud versions greater than 28 with Debian 11 (Bullseye). Please run ncp-dist-upgrade."
+  exit 1
+fi
+
+grep -qP "\d+\.\d+\.\d+" <<<"$CURRENT" || { echo "Malformed version $CURRENT"; exit 1; }
+grep -qP "\d+\.\d+\.\d+" <<<"$TARGET_VERSION"   || { echo "Malformed version $TARGET_VERSION"    ; exit 1; }
+
+echo "Current   Nextcloud version $CURRENT"
+echo "Requested Nextcloud version $REQUESTED_VERSION"
+echo "Selected  Nextcloud version $TARGET_VERSION"
+
+if [[ "$REQUESTED_VERSION" == "latest" ]]
+then
+  echo "INFO: You have requested an update to the latest available version that can be performed directly, which is '${TARGET_VERSION}'. Updates can only performed to the next major version (or the latest minor version of the current major version). If you run ncp-update-nc again after this update completes, a new version might be available."
+  sleep 3
+elif [[ "$TARGET_VERSION" != "$REQUESTED_VERSION" ]]
+then
+  echo "INFO: You have requested an update to '${REQUESTED_VERSION}', but a direct update to '${REQUESTED_VERSION}' cannot be performed, so the latest available version that can be updated to (${TARGET_VERSION}) has been selected automatically."
+  sleep 3
+fi
+
+# make sure that cron.php is not running and there are no pending jobs
+# https://github.com/nextcloud/server/issues/10949
+pgrep -cf cron.php &>/dev/null && { pkill -f cron.php; sleep 3; }
+pgrep -cf cron.php &>/dev/null && { echo "cron.php running. Abort"; exit 1; }
+mysql nextcloud <<<"UPDATE ${DB_PREFIX}jobs SET reserved_at=0;"
+
+# cleanup
+####################
+cleanup() {
+  local RET=$?
+  set +eE
+  echo "Clean up..."
+  rm -rf "$BASEDIR"/nextcloud.tar.bz2 "$BASEDIR"/nextcloud-old
+  trap "" EXIT
+  exit $RET
+}
+trap cleanup EXIT
+
+# get new code
+####################
+URL="https://download.nextcloud.com/server/releases/nextcloud-$TARGET_VERSION.tar.bz2"
+echo "Download Nextcloud $TARGET_VERSION..."
+wget -q "$URL" -O nextcloud.tar.bz2 || { echo "Error downloading"; exit 1; }
+
+# backup
+####################
+BKPDIR="$BASEDIR"
+WITH_DATA=no
+COMPRESSED=yes
+LIMIT=0
+
+echo "Back up current instance..."
+set +eE
+ncp-backup "$BKPDIR" "$WITH_DATA" "$COMPRESSED" "$LIMIT" # && false # test point
+RET=$?
+sync
+set -eE
+
+BKP_="$( ls -1t "$BKPDIR"/nextcloud-bkp_*.tar.gz 2>/dev/null | head -1 )"
+[[ -f "$BKP_"  ]] || {                set +eE; echo "Error backing up"; false || cleanup; }
+[[ $RET -ne 0  ]] && { rm -f "$BKP_"; set +eE; echo "Error backing up"; false || cleanup; }
+BKP="$( dirname "$BKP_" )/$( basename "$BKP_" .tar.gz )-${CURRENT}.tar.gz"
+echo "Storing backup at '$BKP'..."
+mv "$BKP_" "$BKP"
+
+# simple restore if anything fails from here
+####################
+rollback_simple() {
+  set +eE
+  trap "" INT TERM HUP ERR
+  echo -e "Abort\nSimple roll back..."
+  rm -rf "$BASEDIR"/nextcloud
+  mv "$BASEDIR"/nextcloud-old "$BASEDIR"/nextcloud
+  false || cleanup                 # so cleanup exits with 1
+}
+trap rollback_simple INT TERM HUP ERR
+
+# replace code
+####################
+echo "Install Nextcloud $TARGET_VERSION..."
+mv -T nextcloud nextcloud-old
+tar -xf nextcloud.tar.bz2             # && false # test point
+rm -rf /var/www/nextcloud.tar.bz2
+
+# copy old config
+####################
+cp nextcloud-old/config/config.php nextcloud/config/
+
+# copy old themes
+####################
+cp -raT nextcloud-old/themes/ nextcloud/themes/
+
+# copy old NC apps
+####################
+for app in nextcloud-old/apps/*; do
+  if ! [[ -d /var/www/nextcloud/apps/"$(basename "$app")" ]]
+  then
+    cp -r -L "${app}" /var/www/nextcloud/apps/
+  fi
+done
+
+#false # test point
+
+# copy data if it was at the default location
+####################
+if [[ "$DATADIR" == "/var/www/nextcloud/data" ]] || [[ "$DATADIR" == "/data/nextcloud/data" ]]; then
+  echo "Restore data..."
+  mv -T nextcloud-old/data nextcloud/data
+fi
+
+# nc-restore if anything fails from here
+####################
+rollback() {
+  set +eE
+  trap "" INT TERM HUP ERR EXIT
+  echo -e "Abort\nClean up..."
+  rm -rf /var/www/nextcloud.tar.bz2 "$BASEDIR"/nextcloud-old
+  echo "Rolling back to backup $BKP..."
+  local TMPDATA
+  mkdir -p "$BASEDIR/recovery/"
+  TMPDATA="$( mktemp -d "$BASEDIR/recovery/ncp-data.XXXXXX" )" || { echo "Failed to create temp dir" >&2; exit 1; }
+  [[ "$DATADIR" == "$BASEDIR/nextcloud/data" ]] && mv -T "$DATADIR" "$TMPDATA"
+  ncp-restore "$BKP" || { echo "Rollback failed! Data left at $TMPDATA"; exit 1; }
+  [[ "$DATADIR" == "$BASEDIR/nextcloud/data" ]] && { rm -rf "$DATADIR"; mv -T "$TMPDATA" "$DATADIR"; }
+  rm "$BKP"
+  echo "Rollback successful. Nothing was updated"
+  exit 1
+}
+trap rollback INT TERM HUP ERR
+
+# fix permissions
+####################
+echo "Fix permissions..."
+chown -R www-data:www-data nextcloud
+find nextcloud/ -type d -exec chmod 750 {} \;
+find nextcloud/ -type f -exec chmod 640 {} \;
+
+# upgrade
+####################
+echo "Upgrade..."
+ncc='sudo -u www-data php nextcloud/occ'
+$ncc upgrade      # && false # test point
+$ncc | grep -q db:add-missing-indices && $ncc db:add-missing-indices -n
+$ncc | grep -q db:add-missing-columns && $ncc db:add-missing-columns -n
+$ncc | grep -q db:add-missing-primary-keys && $ncc db:add-missing-primary-keys -n
+$ncc | grep -q db:convert-filecache-bigint && $ncc db:convert-filecache-bigint -n
+$ncc | grep -q db:convert-mysql-charset && $ncc db:convert-mysql-charset -n
+$ncc maintenance:repair --help | grep -q -e '--include-expensive' && $ncc maintenance:repair --include-expensive
+if $ncc app_api:daemon:list | grep 'No registered daemon configs.' > /dev/null 2>&1
+then
+  $ncc app:disable app_api
+fi
+
+# use the correct version for custom apps
+NCVER="$(nc_version)"
+if is_more_recent_than "21.0.0" "${NCVER}"; then
+  NCPREV=/var/www/ncp-previewgenerator/ncp-previewgenerator-nc20
+else
+  # Install notify_push if not installed
+  if ! is_app_enabled notify_push; then
+    ncc app:install notify_push
+    ncc app:enable  notify_push
+    install_template nextcloud.conf.sh /etc/apache2/sites-available/nextcloud.conf
+    a2enmod proxy proxy_http proxy_wstunnel
+    apachectl -k graceful
+    ## make sure the notify_push daemon is runnnig
+
+    install_template systemd/notify_push.service.sh /etc/systemd/system/notify_push.service
+    start_notify_push
+    nc_domain="$(ncc config:system:get overwrite.cli.url)"
+    set-nc-domain "${nc_domain}" || {
+      echo "notify_push setup failed. You are probably behind a proxy"
+      echo "Run 'ncc config:system:set trusted_proxies 15 --value=<proxy_IP>' and then 'ncc notify_push:setup https://<domain>/push to enable"
+      echo "Check https://help.nextcloud.com/tags/ncp for support"
+    }
+
+  fi
+  NCPREV=/var/www/ncp-previewgenerator/ncp-previewgenerator-nc21
+fi
+rm -rf /var/www/nextcloud/apps/previewgenerator
+ln -snf "${NCPREV}" /var/www/nextcloud/apps/previewgenerator
+
+if ! is_more_recent_than "24.0.0" "${NCVER}" && is_more_recent_than "8.1.0" "${PHPVER}.0"
+then
+  /usr/local/bin/ncp-update-nc.d/upgrade-php-bullseye-8.1.sh
+
+  # Reload library.sh to reset PHPVER
+  source /usr/local/etc/library.sh
+elif ! is_more_recent_than "29.0.0" "${NCVER}" && is_more_recent_than "8.3.0" "${PHPVER}.0" && [[ "$DEBIAN_VERSION" -ge 12 ]]
+then
+  /usr/local/bin/ncp-update-nc.d/upgrade-php-bookworm-8.3.sh
+
+  # Reload library.sh to reset PHPVER
+  source /usr/local/etc/library.sh
+fi
+
+# refresh completions
+ncc _completion -g --shell-type bash -p ncc | sed 's|/var/www/nextcloud/occ|ncc|g' > /usr/share/bash-completion/completions/ncp
+
+echo "Update completed successfully."
+# done
+####################
+mkdir -p  "$DATADIR"/ncp-update-backups
+mv "$BKP" "$DATADIR"/ncp-update-backups
+chown -R www-data:www-data "$DATADIR"/ncp-update-backups
+BKP="$DATADIR"/ncp-update-backups/"$( basename "$BKP" )"
+echo "Backup stored at $BKP"
+
+bash -c "sleep 5; source /usr/local/etc/library.sh; clear_opcache;" &>/dev/null &

bin/ncp-update-nc.d/upgrade-php-bookworm-8.3.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+source /usr/local/etc/library.sh
+
+echo "Upgrading PHP..."
+export DEBIAN_FRONTEND=noninteractive
+PHPVER_OLD="$PHPVER"
+PHPVER_NEW="8.3"
+PHP_PACKAGES_OLD=("php${PHPVER_OLD}" \
+  "php${PHPVER_OLD}"-{curl,gd,fpm,cli,opcache,mbstring,xml,zip,fileinfo,ldap,intl,bz2,mysql,bcmath,gmp,redis,common})
+PHP_PACKAGES_NEW=("php${PHPVER_NEW}" \
+  "php${PHPVER_NEW}"-{curl,gd,fpm,cli,opcache,mbstring,xml,zip,fileinfo,ldap,intl,bz2,mysql,bcmath,gmp,redis,common})
+
+php_restore() {
+  trap "" INT TERM HUP ERR
+  echo "Something went wrong while upgrading PHP. Rolling back to version ${PHPVER_OLD}..."
+  set +e
+  service "php${PHPVER_NEW}-fpm" stop
+  a2disconf php${PHPVER_NEW}-fpm
+  wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
+  echo "deb https://packages.sury.org/php/ ${RELEASE%-security} main" > /etc/apt/sources.list.d/php.list
+  apt-get update
+  apt-get remove --purge -y "${PHP_PACKAGES_NEW[@]}"
+  apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_OLD[@]}"
+  set_ncpcfg "php_version" "${PHPVER_OLD}"
+  install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_NEW}/mods-available/opcache.ini"
+  run_app nc-limits
+  a2enconf "php${PHPVER_OLD}-fpm"
+  service "php${PHPVER_OLD}-fpm" start
+  service apache2 restart
+  echo "PHP upgrade has been successfully reverted"
+  set -e
+}
+
+trap php_restore INT TERM HUP ERR
+
+apt-get update
+
+clear_opcache
+
+echo "Stopping apache and  php-fpm..."
+service "php${PHPVER_OLD}-fpm" stop
+service apache2 stop
+
+echo "Remove old PHP (${PHPVER_OLD})..."
+a2disconf "php${PHPVER_OLD}-fpm"
+
+apt-get remove --purge -y "${PHP_PACKAGES_OLD[@]}"
+
+echo "Install PHP ${PHPVER_NEW}..."
+install_with_shadow_workaround --no-install-recommends systemd
+apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_NEW[@]}"
+
+set_ncpcfg "php_version" "${PHPVER_NEW}"
+install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_NEW}/mods-available/opcache.ini"
+( set -e; export PHPVER="${PHPVER_NEW}"; run_app nc-limits )
+
+a2enconf "php${PHPVER_NEW}-fpm"
+
+[[ -f "/etc/systemd/system/php${PHPVER_OLD}-fpm.service.d/ncp.conf" ]] && {
+  mkdir -p "/etc/systemd/system/php${PHPVER_NEW}-fpm.service.d"
+  cp "/etc/systemd/system/php${PHPVER_OLD}-fpm.service.d/ncp.conf" "/etc/systemd/system/php${PHPVER_NEW}-fpm.service.d/ncp.conf"
+}
+
+echo "Starting apache and php-fpm..."
+service "php${PHPVER_NEW}-fpm" start
+service apache2 start
+ncc status

bin/ncp-update-nc.d/upgrade-php-bullseye-8.1.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+source /usr/local/etc/library.sh
+
+echo "Upgrading PHP..."
+export DEBIAN_FRONTEND=noninteractive
+PHPVER_OLD="$PHPVER"
+PHPVER_NEW="8.1"
+PHP_PACKAGES_OLD=(php-{common,igbinary,redis,json} "php${PHPVER_OLD}" \
+  "php${PHPVER_OLD}"-{curl,gd,fpm,cli,opcache,mbstring,xml,zip,fileinfo,ldap,intl,bz2,json,common,readline,mysql,bcmath,gmp})
+PHP_PACKAGES_NEW=("php${PHPVER_NEW}" \
+  "php${PHPVER_NEW}"-{curl,gd,fpm,cli,opcache,mbstring,xml,zip,fileinfo,ldap,intl,bz2,mysql,bcmath,gmp,redis,common})
+
+php_restore() {
+  trap "" INT TERM HUP ERR
+  echo "Something went wrong while upgrading PHP. Rolling back to version ${PHPVER_OLD}..."
+  set +e
+  service "php${PHPVER_NEW}-fpm" stop
+  a2disconf php${PHPVER_NEW}-fpm
+  rm /etc/apt/sources.list.d/php.list
+  apt-get update
+  apt-get remove --purge -y "${PHP_PACKAGES_NEW[@]}"
+  apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_OLD[@]}"
+  set_ncpcfg "php_version" "${PHPVER_OLD}"
+  install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_NEW}/mods-available/opcache.ini"
+  run_app nc-limits
+  a2enconf "php${PHPVER_OLD}-fpm"
+  service "php${PHPVER_OLD}-fpm" start
+  service apache2 restart
+  echo "PHP upgrade has been successfully reverted"
+  set -e
+}
+
+trap php_restore INT TERM HUP ERR
+
+# Setup apt repository for php 8
+wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
+echo "deb https://packages.sury.org/php/ ${RELEASE%-security} main" > /etc/apt/sources.list.d/php.list
+apt-get update
+
+clear_opcache
+
+echo "Stopping apache and  php-fpm..."
+service "php${PHPVER_OLD}-fpm" stop
+service apache2 stop
+
+echo "Remove old PHP (${PHPVER_OLD})..."
+a2disconf "php${PHPVER_OLD}-fpm"
+
+apt-get remove --purge -y "${PHP_PACKAGES_OLD[@]}"
+
+echo "Install PHP ${PHPVER_NEW}..."
+install_with_shadow_workaround --no-install-recommends systemd
+apt-get install -y --no-install-recommends -t "$RELEASE" "${PHP_PACKAGES_NEW[@]}"
+
+set_ncpcfg "php_version" "${PHPVER_NEW}"
+install_template "php/opcache.ini.sh" "/etc/php/${PHPVER_NEW}/mods-available/opcache.ini"
+( set -e; export PHPVER="${PHPVER_NEW}"; run_app nc-limits )
+
+a2enconf "php${PHPVER_NEW}-fpm"
+
+echo "Starting apache and php-fpm..."
+service "php${PHPVER_NEW}-fpm" start
+service apache2 start
+ncc status

bin/ncp/BACKUPS/nc-backup-auto.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# Nextcloud backups
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+tmpl_get_destination() {
+  (
+  . /usr/local/etc/library.sh
+  find_app_param nc-backup-auto DESTDIR
+  )
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    rm -f /etc/cron.d/ncp-backup-auto
+    service cron restart
+    echo "automatic backups disabled"
+    return 0
+  }
+
+  cat > /usr/local/bin/ncp-backup-auto <<EOF
+#!/bin/bash
+source /usr/local/etc/library.sh
+failed=
+run_script()
+{
+        if [ -x /usr/local/bin/ncp-backup-auto-\$1 ]
+        then
+                /usr/local/bin/ncp-backup-auto-\$1 || failed="\$failed\${failed:+, } \$1"
+        fi
+}
+
+run_script before
+save_maintenance_mode
+/usr/local/bin/ncp-backup "$DESTDIR" "$INCLUDEDATA" "$COMPRESS" "$BACKUPLIMIT" || failed="\$failed\${failed:+, } main"
+restore_maintenance_mode
+run_script after
+if [[ -n "\$failed" ]]
+then
+  notify_admin "Auto-backup failed" "The \$failed backup script(s) failed"
+fi
+EOF
+  chmod +x /usr/local/bin/ncp-backup-auto
+
+  [[ "$BACKUPHOUR" =~ ^([0-1]?[0-9]|2[0-4])$ ]] || {
+    echo "ERROR: 'BACKUPHOUR' must be a number between 0 and 24, was: '$BACKUPHOUR'"
+    return 1
+  }
+
+  [[ "$BACKUPDAYS" =~ ^[0-9]+$ ]] || {
+    echo "ERROR: 'BACKUPDAYS' must be a number, was: '$BACKUPDAYS'"
+    return 1
+  }
+
+  echo "0  ${BACKUPHOUR}  */${BACKUPDAYS}  *  *  root  /usr/local/bin/ncp-backup-auto >> /var/log/ncp.log 2>&1" > /etc/cron.d/ncp-backup-auto
+  chmod 644 /etc/cron.d/ncp-backup-auto
+  service cron restart
+
+  (
+    . "${BINDIR}/SYSTEM/metrics.sh"
+    reload_metrics_config
+  )
+
+  echo "automatic backups enabled"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/BACKUPS/nc-backup.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Nextcloud backups
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+tmpl_get_destination() {
+  (
+  . /usr/local/etc/library.sh
+  find_app_param nc-backup DESTDIR
+  )
+}
+
+install()
+{
+  apt-get update
+  apt-get install -y --no-install-recommends pigz
+}
+
+configure()
+{
+  (
+    . "${BINDIR}/SYSTEM/metrics.sh"
+    reload_metrics_config
+  )
+  ncp-backup "$DESTDIR" "$INCLUDEDATA" "$COMPRESS" "$BACKUPLIMIT"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-export-ncp.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Export NextcloudPi configuration
+#
+#
+# Copyleft 2017 by Courtney Hicks
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+
+configure() 
+{
+  [[ -d "$DIR" ]] || { echo "directory $DIR does not exist"; return 1; }
+
+  local destfile
+  destfile="$DIR"/ncp-config_$(date +"%Y%m%d").tar
+
+  tar -cf "$destfile" -C /usr/local/etc/ncp-config.d .
+  chmod 600 "$destfile"
+
+  echo -e "configuration exported to $destfile"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/BACKUPS/nc-import-ncp.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Import NextcloudPi configuration
+#
+#
+# Copyleft 2017 by Courtney Hicks
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+
+
+configure()
+{
+  [[ -f "$FILE" ]] || { echo "export file $FILE does not exist"; return 1; }
+
+  cd "$CFGDIR"   || return 1
+
+  # extract export
+  tar -xf "$FILE" -C "$CFGDIR"
+
+  # activate ncp-apps
+  find "${CFGDIR}/" -name '*.cfg' | while read -r cfg; do
+    app="$(basename "${cfg}" .cfg)"
+    if [[ "${app}" == "letsencrypt" ]] || [[ "${app}" == "dnsmasq" ]]; then
+      continue
+    fi
+    is_active_app "${app}" && run_app "${app}"
+  done
+
+  # order is important for these
+  is_active_app "dnsmasq"     && run_app "dnsmasq"
+  is_active_app "letsencrypt" && run_app "letsencrypt"
+
+  echo -e "\nconfiguration restored"
+
+  # delayed in bg so it does not kill the connection, and we get AJAX response
+  apachectl -k graceful
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/BACKUPS/nc-restore-snapshot.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+
+#!/bin/bash
+# Nextcloud restore backup
+#
+# Copyleft 2019 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at nextcloudpi.com
+#
+
+install() { :; }
+
+configure()
+{
+  [[ -d "$SNAPSHOT" ]] || { echo "$SNAPSHOT doesn't exist"; return 1; }
+
+  local datadir mountpoint
+  datadir=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running?";
+    return 1;
+  }
+
+  # file system check
+  mountpoint="$( stat -c "%m" "$datadir" )" || return 1
+  [[ "$( stat -fc%T "$mountpoint" )" != "btrfs" ]] && {
+    echo "$datadir is not in a BTRFS filesystem"
+    return 1
+  }
+
+  # file system check
+  btrfs subvolume show "$SNAPSHOT" &>/dev/null || {
+    echo "$SNAPSHOT is not a BTRFS snapshot"
+    return 1
+  }
+
+  btrfs-snp $mountpoint autobackup 0 0 ../ncp-snapshots || return 1
+
+  save_maintenance_mode
+  btrfs subvolume delete   "$datadir" || return 1
+  btrfs subvolume snapshot "$SNAPSHOT" "$datadir"
+  restore_maintenance_mode
+  ncp-scan
+
+  echo "snapshot $SNAPSHOT restored"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-restore.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+#!/bin/bash
+# Nextcloud restore backup
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+install() { :; }
+
+configure()
+{
+  ncp-restore "$BACKUPFILE"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-rsync-auto.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+
+# Periodically sync Nextcloud datafolder through rsync
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y rsync
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    rm -f /etc/cron.d/ncp-rsync-auto
+    echo "automatic rsync disabled"
+    return 0
+  }
+
+  [[ "$SYNCHOUR" =~ ^([0-1]?[0-9]|2[0-4])$ ]] || {
+    echo "ERROR: 'BACKUPHOUR' must be a number between 0 and 24, was: '$SYNCHOUR'"
+    return 1
+  }
+
+  [[ "$SYNCDAYS" =~ ^[0-9]+$ ]] || {
+    echo "ERROR: 'BACKUPDAYS' must be a number, was: '$SYNCDAYS'"
+    return 1
+  }
+
+  local DATADIR
+  DATADIR=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running and configured?";
+    return 1;
+  }
+
+  # Check if the ssh access is properly configured. For this purpose the command : or echo is called remotely.
+  # If one of the commands works, the test is successful.
+  [[ "$DESTINATION" =~ : ]] && {
+    local NET="$( sed 's|:.*||' <<<"$DESTINATION" )"
+    local SSH=( ssh -o "BatchMode=yes" -p "$PORTNUMBER" "$NET" )
+    ${SSH[@]} echo || { echo "SSH non-interactive not properly configured"; return 1; }
+  }
+
+  echo "0  ${SYNCHOUR}  */${SYNCDAYS}  *  *  root  /usr/bin/rsync -ax -e \"ssh -p $PORTNUMBER\" --delete \"$DATADIR\" \"$DESTINATION\"" > /etc/cron.d/ncp-rsync-auto
+  chmod 644 /etc/cron.d/ncp-rsync-auto
+  service cron restart
+
+  echo "automatic rsync enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-rsync.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Sync Nextcloud datafolder through rsync
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y rsync openssh-client
+}
+
+configure()
+{
+  save_maintenance_mode
+
+  local DATADIR
+  DATADIR=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running and configured?";
+    return 1;
+  }
+
+  rsync -ax -e "ssh -p $PORTNUMBER" --delete "$DATADIR" "$DESTINATION"
+
+  restore_maintenance_mode
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-snapshot-auto.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+
+#
+# NextcloudPi scheduled datadir BTRFS snapshots
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+install()
+{
+  wget https://raw.githubusercontent.com/nachoparker/btrfs-snp/master/btrfs-snp -O /usr/local/bin/btrfs-snp
+  chmod +x /usr/local/bin/btrfs-snp
+}
+
+configure()
+{
+  [[ "$ACTIVE" != "yes" ]] && {
+    rm -f /etc/cron.hourly/btrfs-snp
+    echo "automatic snapshots disabled"
+    return 0
+  }
+
+  cat > /etc/cron.hourly/btrfs-snp <<EOF
+#!/bin/bash
+
+source /usr/local/etc/library.sh
+
+DATADIR="\$(get_nc_config_value datadirectory)" || {
+  echo -e "Error reading data directory. Is NextCloud running and configured?";
+  exit 1;
+}
+
+# file system check
+MOUNTPOINT="\$(stat -c "%m" "\$DATADIR")" || return 1
+[[ "\$( stat -fc%T "\$MOUNTPOINT" )" != "btrfs" ]] && {
+  echo "\$MOUNTPOINT is not in a BTRFS filesystem"
+  exit 1
+}
+
+/usr/local/bin/btrfs-snp \$MOUNTPOINT hourly  24 3600    ../ncp-snapshots
+/usr/local/bin/btrfs-snp \$MOUNTPOINT daily    7 86400   ../ncp-snapshots
+/usr/local/bin/btrfs-snp \$MOUNTPOINT weekly   4 604800  ../ncp-snapshots
+/usr/local/bin/btrfs-snp \$MOUNTPOINT monthly 12 2592000 ../ncp-snapshots
+EOF
+  chmod 755 /etc/cron.hourly/btrfs-snp
+  echo "automatic snapshots enabled"
+}
+
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-snapshot-sync.sh

@@ -0,0 +1,104 @@
+#!/bin/bash
+
+# Sync Nextcloud BTRFS snapshots
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+tmpl_get_destination() {
+  (
+  . /usr/local/etc/library.sh
+  find_app_param nc-snapshot-sync DESTINATION
+  )
+}
+
+tmpl_is_destination_local() {
+  (
+  . /usr/local/etc/library.sh
+  is_active_app nc-snapshot-sync || exit 1
+  ! [[ "$(find_app_param nc-snapshot-sync DESTINATION)" =~ .*"@".*":".* ]]
+  )
+}
+
+is_active() {
+  [[ $ACTIVE == "yes" ]]
+}
+
+install()
+{
+  apt-get update
+  apt-get install -y --no-install-recommends pv openssh-client
+  wget https://raw.githubusercontent.com/nachoparker/btrfs-sync/master/btrfs-sync -O /usr/local/bin/btrfs-sync
+  chmod +x /usr/local/bin/btrfs-sync
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    rm -f /etc/cron.d/ncp-snapsync-auto
+    service cron restart
+    echo "snapshot sync disabled"
+    return 0
+  }
+
+  # checks
+
+  [[ "$SYNCHOUR" =~ ^([0-1]?[0-9]|2[0-4])$ ]] || {
+    echo "ERROR: 'BACKUPHOUR' must be a number between 0 and 24, was: '$SYNCHOUR'"
+    return 1
+  }
+
+  [[ "$SYNCDAYS" =~ ^[0-9]+$ ]] || {
+    echo "ERROR: 'BACKUPDAYS' must be a number, was: '$SYNCDAYS'"
+    return 1
+  }
+
+  [[ -d "$SNAPDIR" ]] || { echo "$SNAPDIR does not exist"; return 1; }
+  if ! [[ -f /root/.ssh/id_rsa ]]; then ssh-keygen -N "" -f /root/.ssh/id_rsa; fi
+
+  [[ "$DESTINATION" =~ : ]] && {
+    local NET="$( sed 's|:.*||' <<<"$DESTINATION" )"
+    local DST="$( sed 's|.*:||' <<<"$DESTINATION" )"
+    local SSH=( ssh -o "BatchMode=yes" "$NET" )
+    ${SSH[@]} : || { echo "SSH non-interactive not properly configured"; return 1; }
+  } || DST="$DESTINATION"
+  [[ "$( ${SSH[@]} stat -fc%T "$DST" )" != "btrfs" ]] && {
+    echo "$DESTINATION is not in a BTRFS filesystem"
+    return 1
+  }
+
+  [[ "$COMPRESSION" == "yes" ]] && ZIP="-z"
+
+  echo "30  ${SYNCHOUR}  */${SYNCDAYS}  *  *  root  /usr/local/bin/btrfs-sync -qd $ZIP \"$SNAPDIR\" \"$DESTINATION\"" > /etc/cron.d/ncp-snapsync-auto
+  chmod 644 /etc/cron.d/ncp-snapsync-auto
+  service cron restart
+
+  (
+    . "${BINDIR}/SYSTEM/metrics.sh"
+    reload_metrics_config
+  )
+
+  echo "snapshot sync enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/BACKUPS/nc-snapshot.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Nextcloud BTRFS snapshots
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+install()
+{
+  wget https://raw.githubusercontent.com/nachoparker/btrfs-snp/master/btrfs-snp -O /usr/local/bin/btrfs-snp
+  chmod +x /usr/local/bin/btrfs-snp
+}
+
+configure()
+{
+  save_maintenance_mode
+
+  local DATADIR MOUNTPOINT
+  DATADIR=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running?";
+    return 1;
+  }
+
+  # file system check
+  MOUNTPOINT="$( stat -c "%m" "$DATADIR" )" || return 1
+  [[ "$( stat -fc%T "$MOUNTPOINT" )" != "btrfs" ]] && {
+    echo "$MOUNTPOINT is not in a BTRFS filesystem"
+    return 1
+  }
+
+  btrfs-snp "${MOUNTPOINT}" manual "${LIMIT}" 0 ../ncp-snapshots
+
+  restore_maintenance_mode
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-admin.sh

@@ -1,32 +1,27 @@
 #!/bin/bash
 
-# System limit configurator for NextCloudPi
-# Tested with 2017-03-02-raspbian-jessie-lite.img
+# Change password for the Nextcloud admin user
 #
 # Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
 # GPL licensed (see end of file) * Use at your own risk!
 #
-# Usage:
-# 
-#   ./installer.sh nc-limits.sh <IP> (<img>)
-#
-# See installer.sh instructions for details
-#
-# More at https://ownyourbits.com/2017/03/13/nextcloudpi-gets-nextcloudpi-config/
+# More at: https://ownyourbits.com
 #
 
-DESCRIPTION="Configure system limits for NextCloudPi"
-MAXFILESIZE_=768M
+
 
 configure()
 {
-  sed -i "s/post_max_size=.*/post_max_size=$MAXFILESIZE_/"             /var/www/nextcloud/.user.ini
-  sed -i "s/upload_max_filesize=.*/upload_max_filesize=$MAXFILESIZE_/" /var/www/nextcloud/.user.ini
-  sed -i "s/memory_limit=.*/memory_limit=$MAXFILESIZE_/"               /var/www/nextcloud/.user.ini
+  [[ "$PASSWORD" == "" ]] && { echo "empty password"; return 1; }
+  [[ "$USER"     == "" ]] && { echo "empty user"    ; return 1; }
+  [[ "$PASSWORD" == "$CONFIRM" ]] || { echo "passwords do not match"; return 1; }
+
+  OC_PASS="$PASSWORD" \
+    sudo -E -u www-data php /var/www/nextcloud/occ \
+    user:resetpassword --password-from-env "$USER"
 }
 
 install() { :; }
-cleanup() { :; }
 
 # License
 #
@@ -44,4 +39,3 @@ cleanup() { :; }
 # along with this script; if not, write to the
 # Free Software Foundation, Inc., 59 Temple Place, Suite 330,
 # Boston, MA  02111-1307  USA
-

bin/ncp/CONFIG/nc-database.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+
+# Data dir configuration script for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/
+#
+
+
+is_active()
+{
+  local SRCDIR=$( grep datadir /etc/mysql/mariadb.conf.d/90-ncp.cnf | awk -F "= " '{ print $2 }' )
+  [[ "$SRCDIR" != "/var/lib/mysql" ]]
+}
+
+tmpl_db_dir() {
+  if is_active_app nc-database; then
+    find_app_param nc-database DBDIR
+  fi
+}
+
+configure()
+{
+  local SRCDIR=$( grep datadir /etc/mysql/mariadb.conf.d/90-ncp.cnf | awk -F "= " '{ print $2 }' )
+  [ -d "$SRCDIR" ] || { echo -e "database directory $SRCDIR not found"; return 1; }
+
+  [ -d "$DBDIR" ] && {
+    [[ $( find "$DBDIR" -maxdepth 0 -empty | wc -l ) == 0 ]] && {
+      echo "$DBDIR is not empty"
+      return 1
+    }
+    rmdir "$DBDIR"
+  }
+
+  local BASEDIR=$( dirname "$DBDIR" )
+  mkdir -p "$BASEDIR"
+
+  [[ "$(stat -fc%T "${BASEDIR}")" =~ ext|btrfs|zfs ]] || { echo -e "Only ext/btrfs/zfs filesystems can hold the data directory (found '$(stat -fc%T "${BASEDIR}")"; return 1; }
+
+  sudo -u mysql test -x "$BASEDIR" || { echo -e "ERROR: the user mysql does not have access permissions over $BASEDIR"; return 1; }
+
+  [[ $( stat -fc%d / ) == $( stat -fc%d "$BASEDIR" ) ]] && \
+    echo -e "INFO: moving database to the SD card\nIf you want to use an external mount, make sure it is properly set up"
+
+  save_maintenance_mode
+
+  echo "moving database to $DBDIR..."
+  service mysql stop
+  mv "$SRCDIR" "$DBDIR"
+  install_template "mysql/90-ncp.cnf.sh" "/etc/mysql/mariadb.conf.d/90-ncp.cnf"
+  service mysql start
+
+  restore_maintenance_mode
+}
+
+install(){ :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-datadir.sh

@@ -0,0 +1,180 @@
+#!/bin/bash
+
+# Data dir configuration script for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/03/13/nextcloudpi-gets-nextcloudpi-config/
+#
+
+is_active()
+{
+  local SRCDIR
+  SRCDIR="$( grep datadirectory /var/www/nextcloud/config/config.php | awk '{ print $3 }' | grep -oP "[^']*[^']" | head -1 )" || return 1
+  [[ "$SRCDIR" != "/var/www/nextcloud/data" ]]
+}
+
+install()
+{
+  apt_install btrfs-progs
+}
+
+tmpl_opcache_dir() {
+  DATADIR="$(get_nc_config_value datadirectory || find_app_param nc-datadir DATADIR)"
+  echo -n "${DATADIR}/.opcache"
+  #[[ $( stat -fc%d / ) == $( stat -fc%d "$DATADIR" ) ]] && echo "/tmp" || echo "${DATADIR}/.opcache"
+}
+
+tmpl_tmp_upload_dir() {
+  DATADIR="$(get_nc_config_value datadirectory || find_app_param nc-datadir DATADIR)"
+  echo -n "${DATADIR}/tmp"
+}
+
+create_opcache_dir() {
+  OPCACHE_DIR="$(tmpl_opcache_dir)"
+  mkdir -p "$OPCACHE_DIR"
+  chown -R www-data:www-data "$OPCACHE_DIR"
+  if [[ "$(stat -fc%T "${BASEDIR}")" == "btrfs" ]]
+  then
+    chattr -R +C "$OPCACHE_DIR"
+  fi
+}
+
+create_tmp_upload_dir() {
+  UPLOAD_DIR="$(tmpl_tmp_upload_dir)"
+  mkdir -p "${UPLOAD_DIR}"
+  chown www-data:www-data "${UPLOAD_DIR}"
+  if [[ "$(stat -fc%T "${BASEDIR}")" == "btrfs" ]]
+  then
+    chattr +C "${UPLOAD_DIR}"
+  fi
+}
+
+configure()
+{
+  set -e -o pipefail
+  shopt -s dotglob # includes dot files
+
+  ## CHECKS
+  local SRCDIR BASEDIR ENCDIR
+  SRCDIR=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running and configured?";
+    return 1;
+  }
+  [ -d "${SRCDIR?}" ] || { echo -e "data directory $SRCDIR not found"; return 1; }
+
+  [[ "$SRCDIR" == "${DATADIR?}"      ]] && { echo -e "INFO: data already there"; return 0; }
+  [[ "$SRCDIR" == "${DATADIR}"/data ]] && { echo -e "INFO: data already there"; return 0; }
+
+  BASEDIR="${DATADIR}"
+  # If the user chooses the root of the mountpoint, force a folder
+  mountpoint -q "${BASEDIR?}" && {
+    BASEDIR="${BASEDIR}"/ncdata
+  }
+
+  mkdir -p "${BASEDIR}"
+  BASEDIR="$(cd "${BASEDIR}" && pwd -P)" # resolve symlinks and use the real path
+  DATADIR="${BASEDIR}"/data
+  ENCDIR="${BASEDIR}"/ncdata_enc
+
+  # checks
+  [[ "$DISABLE_FS_CHECK" == 1 ]] || [[ "$(stat -fc%T "${BASEDIR}")" =~ ext|btrfs|zfs ]] || {
+    echo -e "Only ext/btrfs/zfs filesystems can hold the data directory (found '$(stat -fc%T "${BASEDIR}")')"
+    return 1
+  }
+
+  sudo -u www-data test -x "${BASEDIR}" || {
+    echo -e "ERROR: the user www-data does not have access permissions over ${BASEDIR}"
+    return 1
+  }
+
+  # backup possibly existing datadir
+  [ -d "${BASEDIR}" ] && {
+    rmdir "${BASEDIR}" &>/dev/null || {
+      local BKP="${BASEDIR}-$(date "+%m-%d-%y.%s")"
+      echo "INFO: ${BASEDIR} is not empty. Creating backup ${BKP?}"
+      mv "${BASEDIR}" "${BKP}"
+    }
+    mkdir -p "${BASEDIR}"
+  }
+
+  ## COPY
+  cd /var/www/nextcloud
+  [[ "$BUILD_MODE" == 1 ]] || save_maintenance_mode
+
+  echo "moving data directory from ${SRCDIR} to ${DATADIR}..."
+
+  # use subvolumes, if BTRFS
+  [[ "$(stat -fc%T "${BASEDIR}")" == "btrfs" ]] && ! is_docker && {
+    echo "BTRFS filesystem detected"
+    rmdir "${BASEDIR}"
+    btrfs subvolume create "${BASEDIR}"
+  }
+
+  # use encryption, if selected
+  if is_active_app nc-encrypt; then
+    # if we have encryption AND BTRFS, then store ncdata_enc in the subvolume
+    mv "$(dirname "${SRCDIR}")"/ncdata_enc "${ENCDIR?}"
+    mkdir "${DATADIR}"                        && mount --bind "${SRCDIR}" "${DATADIR}"
+    mkdir "$(dirname "${SRCDIR}")"/ncdata_enc && mount --bind "${ENCDIR}" "$(dirname "${SRCDIR}")"/ncdata_enc
+  else
+    mv "${SRCDIR}" "${DATADIR}"
+  fi
+  chown www-data: "${DATADIR}"
+
+  # datadir
+  ncc config:system:set datadirectory  --value="${DATADIR}" \
+  || sed -i "s|'datadirectory' =>.*|'datadirectory' => '${DATADIR}',|" "${NCDIR?}"/config/config.php
+
+  ncc config:system:set logfile --value="${DATADIR}/nextcloud.log" \
+  || sed -i "s|'logfile' =>.*|'logfile' => '${DATADIR}/nextcloud.log',|" "${NCDIR?}"/config/config.php
+  set_ncpcfg datadir "${DATADIR}"
+
+  # tmp upload dir
+  create_tmp_upload_dir
+  ncc config:system:set tempdirectory --value "$DATADIR/tmp" \
+  || sed -i "s|'tempdirectory' =>.*|'tempdirectory' => '${DATADIR}/tmp',|" "${NCDIR?}"/config/config.php
+  sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = ${DATADIR}/tmp|"  /etc/php/"${PHPVER?}"/cli/php.ini
+  sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = ${DATADIR}/tmp|" /etc/php/"${PHPVER}"/fpm/php.ini
+  sed -i "s|^;\?sys_temp_dir =.*$|sys_temp_dir = ${DATADIR}/tmp|"     /etc/php/"${PHPVER}"/fpm/php.ini
+
+  # opcache dir
+  create_opcache_dir
+  install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+
+  # update fail2ban logpath
+  [[ -f /etc/fail2ban/jail.local ]] && \
+  sed -i "s|logpath  =.*nextcloud.log|logpath  = ${DATADIR}/nextcloud.log|" /etc/fail2ban/jail.local
+
+  [[ "$BUILD_MODE" == 1 ]] || restore_maintenance_mode
+
+  (
+    . "${BINDIR?}/SYSTEM/metrics.sh"
+    reload_metrics_config || {
+      echo 'WARN: There was an issue reloading ncp metrics. This might not affect your installation,
+      but keep it in mind if there is an issue with metrics.'
+      true
+    }
+  )
+
+  echo "The NC data directory has been moved successfully."
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-httpsonly.sh

@@ -1,32 +1,28 @@
 #!/bin/bash
 
-# HTTPS rewrite configuration script for NextCloudPi
-# Tested with 2017-03-02-raspbian-jessie-lite.img
+# HTTPS rewrite configuration script for NextcloudPi
 #
 # Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
 # GPL licensed (see end of file) * Use at your own risk!
 #
-# Usage:
-# 
-#   ./installer.sh nc-httpsonly.sh <IP> (<img>)
-#
-# See installer.sh instructions for details
-#
 # More at https://ownyourbits.com/2017/03/13/nextcloudpi-gets-nextcloudpi-config/
 #
 
-ACTIVE_=yes
-DESCRIPTION="Force HTTPS"
 
 configure()
 {
-  [[ $ACTIVE_ == "no" ]] && local OPT=Off || local OPT=On
-  sed -i "s|RewriteEngine .*|RewriteEngine $OPT|" /etc/apache2/sites-available/000-default.conf
-  service apache2 reload
+  [[ -f /.ncp-image ]] && return 0
+  if [[ $ACTIVE == "no" ]]; then
+    local opt=Off
+  else
+    local opt=On
+  fi
+  sed -i "s|RewriteEngine .*|RewriteEngine $opt|" /etc/apache2/sites-available/000-default.conf
+  apachectl -k graceful
+  echo "Forcing HTTPS $opt"
 }
 
 install() { :; }
-cleanup() { :; }
 
 # License
 #

bin/ncp/CONFIG/nc-init.sh

@@ -0,0 +1,248 @@
+#!/bin/bash
+
+# Init NextCloud database and perform initial configuration
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+DBADMIN=ncadmin
+
+configure()
+{
+  echo "Setting up a clean Nextcloud instance... wait until message 'NC init done'"
+
+  # checks
+  local REDISPASS=$( grep "^requirepass" /etc/redis/redis.conf  | cut -d' ' -f2 )
+  [[ "$REDISPASS" == "" ]] && { echo "redis server without a password. Abort"; return 1; }
+
+  ## RE-CREATE DATABASE TABLE
+
+  echo "Setting up database..."
+
+  # launch mariadb if not already running
+  if ! [[ -f /run/mysqld/mysqld.pid ]]; then
+    echo "Starting mariaDB"
+    mysqld &
+    local db_pid=$!
+  fi
+
+  # wait for mariadb
+  while :; do
+    [[ -S /run/mysqld/mysqld.sock ]] && break
+    sleep 0.5
+  done
+  sleep 1
+
+  # workaround to emulate DROP USER IF EXISTS ..;)
+  local DBPASSWD=$( grep password /root/.my.cnf | sed 's|password=||' )
+  mysql <<EOF
+DROP DATABASE IF EXISTS nextcloud;
+CREATE DATABASE nextcloud
+    CHARACTER SET utf8mb4
+    COLLATE utf8mb4_general_ci;
+GRANT USAGE ON *.* TO '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+DROP USER '$DBADMIN'@'localhost';
+CREATE USER '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+GRANT ALL PRIVILEGES ON nextcloud.* TO $DBADMIN@localhost;
+EXIT
+EOF
+
+  ## INITIALIZE NEXTCLOUD
+
+  # make sure redis is running first
+  REDISPASS="$( grep "^requirepass" /etc/redis/redis.conf | cut -f2 -d' ' )"
+  if ! pgrep -c redis-server &>/dev/null; then
+    mkdir -p /var/run/redis
+    mkdir -p /var/log/
+    chown redis /var/run/redis
+    sudo -u redis redis-server /etc/redis/redis.conf > /var/log/redis.log 2>&1 &
+    redis_pid=$!
+    for i in {1..5}
+    do
+
+      if redis-cli -s //var/run/redis/redis.sock -a "$REDISPASS" ping | grep PONG
+      then
+        break
+      else
+        if [[ $i -ge 5 ]]
+        then
+          echo "FAILED TO START REDIS"
+          cat /var/log/redis.log /var/log/redis/redis-server.log
+          return 1
+        fi
+      fi
+      sleep 3
+    done
+  fi
+
+  while :; do
+    [[ -S /run/redis/redis.sock ]] && break
+    sleep 0.5
+  done
+
+
+  echo "Setting up Nextcloud..."
+
+  cd /var/www/nextcloud/
+  rm -f config/config.php
+  ncc maintenance:install --database \
+    "mysql" --database-name "nextcloud"  --database-user "$DBADMIN" --database-pass \
+    "$DBPASSWD" --admin-user "$ADMINUSER" --admin-pass "$ADMINPASS"
+
+  # cron jobs
+  ncc background:cron
+
+  # redis cache
+  sed -i '$d' config/config.php
+  cat >> config/config.php <<EOF
+  'memcache.local' => '\\OC\\Memcache\\Redis',
+  'memcache.locking' => '\\OC\\Memcache\\Redis',
+  'redis' =>
+  array (
+    'host' => '/var/run/redis/redis.sock',
+    'port' => 0,
+    'timeout' => 0.0,
+    'password' => '$REDISPASS',
+  ),
+);
+EOF
+
+  # tmp upload dir
+  local UPLOADTMPDIR=/var/www/nextcloud/data/tmp
+  mkdir -p "$UPLOADTMPDIR"
+  chown www-data:www-data "$UPLOADTMPDIR"
+  ncc config:system:set tempdirectory --value "$UPLOADTMPDIR"
+  sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = $UPLOADTMPDIR|" /etc/php/${PHPVER}/cli/php.ini
+  sed -i "s|^;\?upload_tmp_dir =.*$|upload_tmp_dir = $UPLOADTMPDIR|" /etc/php/${PHPVER}/fpm/php.ini
+  sed -i "s|^;\?sys_temp_dir =.*$|sys_temp_dir = $UPLOADTMPDIR|"     /etc/php/${PHPVER}/fpm/php.ini
+
+  # 4 Byte UTF8 support
+  ncc config:system:set mysql.utf8mb4 --type boolean --value="true"
+
+  ncc config:system:set trusted_domains 7 --value="nextcloudpi"
+  ncc config:system:set trusted_domains 5 --value="nextcloudpi.local"
+  ncc config:system:set trusted_domains 8 --value="nextcloudpi.lan"
+  ncc config:system:set trusted_domains 3 --value="nextcloudpi.lan"
+
+  # email
+  ncc config:system:set mail_smtpmode     --value="sendmail"
+  ncc config:system:set mail_smtpauthtype --value="LOGIN"
+  ncc config:system:set mail_from_address --value="noreply"
+  ncc config:system:set mail_domain       --value="nextcloudpi.com"
+
+  # Fix NCP theme
+  [[ -e /usr/local/etc/logo ]] && {
+    local ID=$( grep instanceid config/config.php | awk -F "=> " '{ print $2 }' | sed "s|[,']||g" )
+    [[ "$ID" == "" ]] && { echo "failed to get ID"; return 1; }
+    local theming_base_path="data/appdata_${ID}/theming/global/images"
+    mkdir -p "${theming_base_path}"
+    cp /usr/local/etc/background "${theming_base_path}/"
+    cp /usr/local/etc/logo "${theming_base_path}/logo"
+    cp /usr/local/etc/logo "${theming_base_path}/logoheader"
+    chown -R www-data:www-data "data/appdata_${ID}"
+  }
+
+  mysql nextcloud <<EOF
+replace into  ${DB_PREFIX}appconfig values ( 'theming', 'name'          , "NextCloudPi"             , 2, 0);
+replace into  ${DB_PREFIX}appconfig values ( 'theming', 'slogan'        , "keep your data close"    , 2, 0);
+replace into  ${DB_PREFIX}appconfig values ( 'theming', 'url'           , "https://nextcloudpi.com" , 2, 0);
+replace into  ${DB_PREFIX}appconfig values ( 'theming', 'logoMime'      , "image/svg+xml"           , 2, 0);
+replace into  ${DB_PREFIX}appconfig values ( 'theming', 'backgroundMime', "image/png"               , 2, 0);
+EOF
+
+  # NCP app
+  cp -r /var/www/ncp-app /var/www/nextcloud/apps/nextcloudpi
+  chown -R www-data:     /var/www/nextcloud/apps/nextcloudpi
+  ncc app:enable nextcloudpi
+
+  # enable some apps by default
+  ncc app:install calendar
+  ncc app:enable  calendar
+  ncc app:install contacts
+  ncc app:enable  contacts
+  ncc app:install notes
+  ncc app:enable  notes
+  ncc app:install tasks
+  ncc app:enable  tasks
+
+  # we handle this ourselves
+  ncc app:disable updatenotification
+
+  # Not supported in Nextcloudpi without manual setup
+  ncc app:disable app_api
+
+  # ncp-previewgenerator
+  local ncver
+  ncver="$(ncc status 2>/dev/null | grep "version:" | awk '{ print $3 }')"
+  if is_more_recent_than "21.0.0" "${ncver}"; then
+    local ncprev=/var/www/ncp-previewgenerator/ncp-previewgenerator-nc20
+  else
+    ncc app:install notify_push
+    ncc app:enable  notify_push
+    test -f /.ncp-image || start_notify_push # don't start during build
+    local ncprev=/var/www/ncp-previewgenerator/ncp-previewgenerator-nc21
+  fi
+  ln -snf "${ncprev}" /var/www/nextcloud/apps/previewgenerator
+  chown -R www-data: /var/www/nextcloud/apps/previewgenerator
+  ncc app:enable previewgenerator
+
+  # previews
+  ncc config:app:set previewgenerator squareSizes --value="32 256"
+  ncc config:app:set previewgenerator widthSizes  --value="256 384"
+  ncc config:app:set previewgenerator heightSizes --value="256"
+  ncc config:system:set preview_max_x --value 2048
+  ncc config:system:set preview_max_y --value 2048
+  ncc config:system:set jpeg_quality --value 60
+  ncc config:app:set preview jpeg_quality --value="60"
+
+  # other
+  ncc config:system:set overwriteprotocol --value=https
+  ncc config:system:set overwrite.cli.url --value="https://nextcloudpi/"
+
+  # bash completion for ncc
+  apt_install bash-completion
+  ncc _completion -g --shell-type bash -p ncc | sed 's|/var/www/nextcloud/occ|ncc|g' > /usr/share/bash-completion/completions/ncp
+  echo ". /etc/bash_completion" >> /etc/bash.bashrc
+  echo ". /usr/share/bash-completion/completions/ncp" >> /etc/bash.bashrc
+
+  # TODO temporary workaround for https://github.com/nextcloud/server/pull/13358
+  ncc -n db:convert-filecache-bigint
+  ncc db:add-missing-indices
+  ncc maintenance:repair --include-expensive
+
+  # Default trusted domain (only from ncp-config)
+  test -f /usr/local/bin/nextcloud-domain.sh && {
+    test -f /.ncp-image || bash /usr/local/bin/nextcloud-domain.sh
+  }
+
+  # dettach mysql during the build
+  if [[ "${db_pid}" != "" ]]; then
+    echo "Shutting down mariaDB (${db_pid})"
+    mysqladmin -u root shutdown
+    wait "${db_pid}"
+  fi
+
+  echo "NC init done"
+}
+
+install(){ :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/CONFIG/nc-limits.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+
+# System limits configuration for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/03/13/nextcloudpi-gets-nextcloudpi-config/
+#
+
+get_total_mem() {
+  local total_mem="$(free -b | sed -n 2p | awk '{ print $2 }')"
+  local MAX_32BIT=4096000000
+  if [[ "$ARCH" == 'armv7' ]] && [[ $MAX_32BIT -lt "$total_mem" ]]
+  then
+    echo "$MAX_32BIT"
+  else
+    echo "$total_mem"
+  fi
+
+}
+
+tmpl_innodb_buffer_pool_size() {
+  local TOTAL_MEM="$(get_total_mem)"
+  # DATABASE MEMORY (25%)
+  local AUTOMEM=$(( TOTAL_MEM * 25 / 100 ))
+  # Maximum MySQL Memory Usage = innodb_buffer_pool_size + key_buffer_size + (read_buffer_size + sort_buffer_size) X max_connections
+  # leave 16MiB for key_buffer_size and a bit more
+  AUTOMEM=$(( AUTOMEM - (16 + 32) * 1024 * 1024 ))
+  echo -n "$AUTOMEM"
+}
+
+tmpl_php_max_memory() {
+  local TOTAL_MEM="$( get_total_mem )"
+  local MEMORYLIMIT="$(find_app_param nc-limits MEMORYLIMIT)"
+  [[ "$MEMORYLIMIT" == "0" ]] && echo -n "$(( TOTAL_MEM * 75 / 100 ))" || echo -n "$MEMORYLIMIT"
+}
+
+tmpl_php_max_filesize() {
+  local FILESIZE="$(find_app_param nc-limits MAXFILESIZE)"
+  [[ "$FILESIZE" == "0" ]] && echo -n "10G" || echo -n "$FILESIZE"
+}
+
+tmpl_php_threads() {
+  local TOTAL_MEM="$( get_total_mem )"
+  local PHPTHREADS="$(find_app_param nc-limits PHPTHREADS)"
+  # By default restricted by memory / 100MB
+  [[ $PHPTHREADS -eq 0 ]] && PHPTHREADS=$(( TOTAL_MEM / ( 100 * 1024 * 1024 ) ))
+  # Minimum 16
+  [[ $PHPTHREADS -lt 16 ]] && PHPTHREADS=16
+   echo -n "$PHPTHREADS"
+}
+
+configure()
+{
+  # Set auto memory limit to 75% of the total memory
+  local TOTAL_MEM="$( get_total_mem )"
+  # special case of 32bit emulation (e.g. 32bit-docker on 64bit hardware)
+  file /bin/bash | grep 64-bit > /dev/null || TOTAL_MEM="$(( 1024 * 1024 * 1024 * 4 ))"
+  local AUTOMEM=$(( TOTAL_MEM * 75 / 100 ))
+
+  # MAX FILESIZE
+
+  # MAX PHP MEMORY
+  local require_fpm_restart=false
+  local CONF=/etc/php/${PHPVER}/fpm/conf.d/90-ncp.ini
+  local CONF_VALUE="$(cat "$CONF" 2> /dev/null || true)"
+  echo "Using $(tmpl_php_max_memory) for PHP max memory"
+  install_template "php/90-ncp.ini.sh" "$CONF"
+  [[ "$CONF_VALUE" == "$(cat "$CONF")" ]] || require_fpm_restart=true
+
+  # MAX PHP THREADS
+  local CONF=/etc/php/${PHPVER}/fpm/pool.d/www.conf
+  CONF_VALUE="$(cat "$CONF" 2> /dev/null || true)"
+  echo "Using $(tmpl_php_threads) PHP threads"
+  install_template "php/pool.d.www.conf.sh" "$CONF"
+  [[ "$CONF_VALUE"  == "$(cat "$CONF")"   ]] || require_fpm_restart=true
+
+  local CONF=/etc/mysql/mariadb.conf.d/91-ncp.cnf
+  CONF_VALUE="$(cat "$CONF" 2> /dev/null || true)"
+  install_template "mysql/91-ncp.cnf.sh" "$CONF"
+  [[ "$CONF_VALUE" == "$(cat "$CONF")" ]] || service mariadb restart
+
+  # RESTART PHP
+  [[ "$require_fpm_restart" != "true" ]] || {
+    bash -c "sleep 3; source /usr/local/etc/library.sh; clear_opcache; service php${PHPVER}-fpm restart" &>/dev/null &
+  }
+
+  # redis max memory
+  local CONF=/etc/redis/redis.conf
+  local CURRENT_REDIS_MEM="$( grep "^maxmemory" "$CONF" | awk '{ print $2 }' )"
+  [[ "$REDISMEM" == "$CURRENT_REDIS_MEM" ]] || {
+    sed -i "s|^maxmemory .*|maxmemory $REDISMEM|" "$CONF"
+    chown redis:redis "$CONF"
+    service redis-server restart
+  }
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-nextcloud.sh

@@ -0,0 +1,309 @@
+#!/bin/bash
+
+# Nextcloud installation on Raspbian over LAMP base
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+DBADMIN=ncadmin
+REDIS_MEM=3gb
+
+APTINSTALL="apt-get install -y --no-install-recommends"
+export DEBIAN_FRONTEND=noninteractive
+
+tmpl_max_transfer_time()
+{
+  find_app_param nc-nextcloud MAXTRANSFERTIME
+}
+
+install()
+{
+  # During build, this step is run before ncp.sh. Avoid executing twice
+  [[ -f /usr/lib/systemd/system/nc-provisioning.service ]] && return 0
+
+  # Optional packets for Nextcloud and Apps
+  apt-get update
+  $APTINSTALL lbzip2 iputils-ping jq wget
+  # NOTE: php-smbclient in sury but not in Debian sources, we'll use the binary version
+  # https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/external_storage/smb.html
+  $APTINSTALL -t $RELEASE smbclient exfat-fuse exfatprogs                      # for external storage
+  $APTINSTALL -t $RELEASE exfat-fuse exfatprogs                                # for external storage
+  $APTINSTALL -t $RELEASE php${PHPVER}-exif                                     # for gallery
+  $APTINSTALL -t $RELEASE php${PHPVER}-bcmath                                   # for LDAP
+  $APTINSTALL -t $RELEASE php${PHPVER}-gmp                                      # for bookmarks
+  #$APTINSTALL -t imagemagick php${PHPVER}-imagick ghostscript   # for gallery
+
+
+  # POSTFIX
+  $APTINSTALL postfix || {
+    # [armbian] workaround for bug - https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1531299
+    echo "[NCP] Please, ignore the previous postfix installation error ..."
+    mv /usr/bin/newaliases /
+    ln -s /bin/true /usr/bin/newaliases
+    $APTINSTALL postfix
+    rm /usr/bin/newaliases
+    mv /newaliases /usr/bin/newaliases
+  }
+
+  $APTINSTALL redis-server
+  $APTINSTALL -t $RELEASE php${PHPVER}-redis
+
+  local REDIS_CONF=/etc/redis/redis.conf
+  local REDISPASS="default"
+  sed -i "s|# unixsocket .*|unixsocket /var/run/redis/redis.sock|" $REDIS_CONF
+  sed -i "s|# unixsocketperm .*|unixsocketperm 770|"               $REDIS_CONF
+  sed -i "s|# requirepass .*|requirepass $REDISPASS|"              $REDIS_CONF
+  sed -i 's|# maxmemory-policy .*|maxmemory-policy allkeys-lru|'   $REDIS_CONF
+  sed -i 's|# rename-command CONFIG ""|rename-command CONFIG ""|'  $REDIS_CONF
+  sed -i "s|^port.*|port 0|"                                       $REDIS_CONF
+  echo "maxmemory $REDIS_MEM" >> $REDIS_CONF
+  if [[ "$ARMBIAN_BUILD" == "yes" ]]
+  then
+    echo "ignore-warnings ARM64-COW-BUG" >> $REDIS_CONF
+  fi
+  echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf
+
+  if is_lxc; then
+    # Otherwise it fails to start in Buster LXC container
+    mkdir -p /etc/systemd/system/redis-server.service.d
+    cat > /etc/systemd/system/redis-server.service.d/lxc_fix.conf <<'EOF'
+[Service]
+ReadOnlyDirectories=
+EOF
+    systemctl daemon-reload
+  fi
+
+  chown redis: "$REDIS_CONF"
+  usermod -a -G redis www-data
+
+  service redis-server restart
+  update-rc.d redis-server enable
+  clear_opcache
+
+  # NC service workers
+  cat > /etc/systemd/system/nextcloud-ai-worker@.service <<'EOF'
+[Unit]
+Description=Nextcloud AI worker %i
+After=network.target
+
+[Service]
+ExecStart=php occ background-job:worker -t 60 'OC\\TaskProcessing\\SynchronousBackgroundJob'
+Restart=always
+StartLimitInterval=60
+StartLimitBurst=10
+WorkingDirectory=/var/www/nextcloud
+User=www-data
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+
+  # service to randomize passwords on first boot
+  mkdir -p /usr/lib/systemd/system
+  cat > /usr/lib/systemd/system/nc-provisioning.service <<'EOF'
+[Unit]
+Description=Randomize passwords on first boot
+Requires=network.target
+After=mysql.service redis.service
+
+[Service]
+ExecStart=/bin/bash /usr/local/bin/ncp-provisioning.sh
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  [[ "$DOCKERBUILD" != 1 ]] && systemctl enable nc-provisioning
+  return 0
+}
+
+configure()
+{
+  ## DOWNLOAD AND (OVER)WRITE NEXTCLOUD
+  cd /var/www/
+
+  local URL="https://download.nextcloud.com/server/${PREFIX}releases/nextcloud-$VER.tar.bz2"
+  echo "Downloading Nextcloud $VER..."
+  wget -q "$URL" -O nextcloud.tar.bz2 || {
+    echo "couldn't download $URL"
+    return 1
+  }
+  rm -rf nextcloud
+
+  echo "Installing  Nextcloud $VER..."
+  tar -xf nextcloud.tar.bz2
+  rm nextcloud.tar.bz2
+
+  ## CONFIGURE FILE PERMISSIONS
+  local ocpath='/var/www/nextcloud'
+  local htuser='www-data'
+  local htgroup='www-data'
+  local rootuser='root'
+
+  printf "Creating possible missing Directories\n"
+  mkdir -p $ocpath/data
+  mkdir -p $ocpath/updater
+
+  printf "chmod Files and Directories\n"
+  find ${ocpath}/ -type f -print0 | xargs -0 chmod 0640
+  find ${ocpath}/ -type d -print0 | xargs -0 chmod 0750
+
+  printf "chown Directories\n"
+
+  chown -R ${htuser}:${htgroup} ${ocpath}/
+  chown -R ${htuser}:${htgroup} ${ocpath}/apps/
+  chown -R ${htuser}:${htgroup} ${ocpath}/config/
+  chown -R ${htuser}:${htgroup} ${ocpath}/data/
+  chown -R ${htuser}:${htgroup} ${ocpath}/themes/
+  chown -R ${htuser}:${htgroup} ${ocpath}/updater/
+
+  chmod +x ${ocpath}/occ
+
+  printf "chmod/chown .htaccess\n"
+  if [ -f ${ocpath}/.htaccess ]; then
+    chmod 0644 ${ocpath}/.htaccess
+    chown ${htuser}:${htgroup} ${ocpath}/.htaccess
+  fi
+  if [ -f ${ocpath}/data/.htaccess ]; then
+    chmod 0644 ${ocpath}/data/.htaccess
+    chown ${htuser}:${htgroup} ${ocpath}/data/.htaccess
+  fi
+
+  # create and configure opcache dir
+  local OPCACHEDIR="$(
+    # shellcheck disable=SC2015
+    [ -f "${BINDIR}/CONFIG/nc-datadir.sh" ] && { source "${BINDIR}/CONFIG/nc-datadir.sh"; tmpl_opcache_dir; } || true
+  )"
+  if [[ -z "${OPCACHEDIR}" ]]
+  then
+    install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini" --defaults
+  else
+    mkdir -p "$OPCACHEDIR"
+    chown -R www-data:www-data "$OPCACHEDIR"
+    install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+  fi
+
+  ## RE-CREATE DATABASE TABLE
+  # launch mariadb if not already running (for docker build)
+  if ! [[ -f /run/mysqld/mysqld.pid ]]; then
+    echo "Starting mariaDB"
+    mysqld &
+    local db_pid=$!
+  fi
+
+  while :; do
+    [[ -S /var/run/mysqld/mysqld.sock ]] && break
+    sleep 0.5
+  done
+
+  echo "Setting up database..."
+
+  # workaround to emulate DROP USER IF EXISTS ..;)
+  local DBPASSWD=$( grep password /root/.my.cnf | sed 's|password=||' )
+  mysql <<EOF
+DROP DATABASE IF EXISTS nextcloud;
+CREATE DATABASE nextcloud
+    CHARACTER SET utf8mb4
+    COLLATE utf8mb4_general_ci;
+GRANT USAGE ON *.* TO '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+DROP USER '$DBADMIN'@'localhost';
+CREATE USER '$DBADMIN'@'localhost' IDENTIFIED BY '$DBPASSWD';
+GRANT ALL PRIVILEGES ON nextcloud.* TO $DBADMIN@localhost;
+EXIT
+EOF
+
+## SET APACHE VHOST
+  echo "Setting up Apache..."
+  install_template nextcloud.conf.sh /etc/apache2/sites-available/001-nextcloud.conf --allow-fallback || {
+      echo "ERROR: Parsing template failed. Nextcloud will not work."
+      exit 1
+  }
+  a2ensite 001-nextcloud
+
+  cat > /etc/apache2/sites-available/000-default.conf <<'EOF'
+<VirtualHost _default_:80>
+  DocumentRoot /var/www/nextcloud
+  <IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteRule ^.well-known/acme-challenge/ - [L]
+    RewriteCond %{HTTPS} !=on
+    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
+  </IfModule>
+  <Directory /var/www/nextcloud/>
+    Options +FollowSymlinks
+    AllowOverride All
+    <IfModule mod_dav.c>
+      Dav off
+    </IfModule>
+    LimitRequestBody 0
+  </Directory>
+</VirtualHost>
+EOF
+
+  # for notify_push app in NC21
+  a2enmod proxy proxy_http proxy_wstunnel
+
+  arch="$(uname -m)"
+  [[ "${arch}" =~ "armv7" ]] && arch="armv7"
+  install_template systemd/notify_push.service.sh /etc/systemd/system/notify_push.service
+  [[ -f /.docker-image ]] || systemctl enable notify_push
+
+  # some added security
+  sed -i 's|^ServerSignature .*|ServerSignature Off|' /etc/apache2/conf-enabled/security.conf
+  sed -i 's|^ServerTokens .*|ServerTokens Prod|'      /etc/apache2/conf-enabled/security.conf
+
+  echo "Setting up system..."
+
+  ## SET LIMITS
+  cat > /etc/php/${PHPVER}/fpm/conf.d/90-ncp.ini <<EOF
+; disable .user.ini files for performance and workaround NC update bugs
+user_ini.filename =
+
+; from Nextcloud .user.ini
+upload_max_filesize=$MAXFILESIZE
+post_max_size=$MAXFILESIZE
+memory_limit=$MEMORYLIMIT
+mbstring.func_overload=0
+always_populate_raw_post_data=-1
+default_charset='UTF-8'
+output_buffering=0
+
+; slow transfers will be killed after this time
+max_execution_time=$MAXTRANSFERTIME
+max_input_time=$MAXTRANSFERTIME
+EOF
+
+  ## SET CRON
+  echo "*/5  *  *  *  * php -f /var/www/nextcloud/cron.php" > /tmp/crontab_http
+  crontab -u www-data /tmp/crontab_http
+  rm /tmp/crontab_http
+
+  # dettach mysql during the build
+  if [[ "${db_pid}" != "" ]]; then
+    echo "Shutting down mariaDB (${db_pid})"
+    mysqladmin -u root shutdown
+    wait "${db_pid}"
+  fi
+  echo "Don't forget to run nc-init"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-passwd.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Change password for the ncp-web user
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+configure()
+{
+  # update password
+  echo -e "$PASSWORD\n$CONFIRM" | passwd ncp &>/dev/null && \
+    echo "password updated successfully" || \
+    { echo "passwords do not match"; return 1; }
+
+  # persist ncp-web password in docker container
+  [[ -f /.docker-image ]] && {
+    mv /etc/shadow /data/etc/shadow
+    ln -s /data/etc/shadow /etc/shadow
+  }
+
+  # activate NCP
+  if ! is_ncp_activated; then
+    # Run cron.php once now to get all checks right in CI.
+    sudo -u www-data php /var/www/nextcloud/cron.php
+
+    a2dissite ncp-activation
+    a2ensite  ncp 001-nextcloud
+    apachectl -k graceful
+    sed -i -e 's/^NCP is not activated yet.*$//' /etc/issue
+
+    # Trusted Domain (local/public IP), also configures notify_push
+    bash /usr/local/bin/nextcloud-domain.sh
+  fi
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/CONFIG/nc-prettyURL.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+#
+# Activate/deactivate a pretty URL without index.php
+#
+#
+# Copyleft 2018 by Timo Stiefel and xxx
+# GPL licensed (see end of file) * Use at your own risk!
+
+
+
+install() { :; }
+
+isactive()
+{
+  local REWRITEBASE
+  REWRITEBASE="$( grep RewriteBase /var/www/nextcloud/.htaccess )" || return 1
+  [[ $REWRITEBASE != 1 ]]
+}
+
+configure()
+{
+  # make sure overwrite.cli.url end with a '/'
+  local URL
+  URL="$(ncc config:system:get overwrite.cli.url)"
+  [[ "${URL: -1}" != "/" ]] && ncc config:system:set overwrite.cli.url --value="${URL}/"
+
+  if [[ $ACTIVE != "yes" ]]; then
+    ncc config:system:set htaccess.RewriteBase --value=""
+    ncc maintenance:update:htaccess
+    [[ $? -ne 0 ]] && {
+      echo "There has been an error."
+      return 1
+    }
+    echo "Your cloud does no longer have a pretty domain name."
+  else
+    ncc config:system:set htaccess.RewriteBase --value="/"
+    ncc maintenance:update:htaccess
+    [[ $? -ne 0 ]] && {
+      echo "There has been an error."
+      return 1
+    }
+    echo "Your cloud now has a pretty domain name."
+  fi
+  apachectl -k graceful
+  return 0
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/CONFIG/nc-previews-auto.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+
+# Periodically generate previews for the gallery
+#
+# Copyleft 2019 by Timo Stiefel and Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+isactive()
+{
+  [[ -f "/etc/cron.d/nc-previews-auto" ]]
+}
+
+configure()
+{
+  [[ "$ACTIVE" != "yes" ]] && {
+    rm -f /etc/cron.d/nc-previews-auto
+    service cron restart
+    echo "Automatic preview generation disabled"
+    return 0
+  }
+
+  grep -qP "^\d+$" <<<"$RUNTIME" || { echo "Invalid RUNTIME value $RUNTIME"; return 1; }
+  RUNTIME=$((RUNTIME*60))
+
+  echo "0  2  *  *  *  root  /usr/local/bin/nc-previews" >  /etc/cron.d/nc-previews-auto
+  chmod 644 /etc/cron.d/nc-previews-auto
+
+  cat > /usr/local/bin/nc-previews <<EOF
+#!/bin/bash
+echo -e "\n[ nc-previews-auto ]" >> /var/log/ncp.log
+(
+    for i in \$(seq 1 \$(nproc)); do
+      ionice -c3 nice -n20 /usr/local/bin/ncc preview:pre-generate -n -vvv &
+    done
+    wait
+) 2>&1 >>/var/log/ncp.log &
+
+PID=\$!
+[[ "$RUNTIME" != 0 ]] && {
+  for i in \$(seq 1 1 $RUNTIME); do
+    sleep 1
+    kill -0 "\$PID" &>/dev/null || break
+  done
+  pkill -f preview:pre-generate
+  pkill -f preview:generate-all
+}
+wait "\$PID"
+EOF
+chmod +x /usr/local/bin/nc-previews
+
+  service cron restart
+  echo "Automatic preview generation enabled"
+  return 0
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/CONFIG/nc-scan-auto.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# Periodically synchronize NextCloud for externally modified files
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+
+configure()
+{
+    [[ $ACTIVE != "yes" ]] && {
+    rm -f /etc/cron.d/ncp-scan-auto
+    service cron restart
+    echo "automatic scans disabled"
+    return 0
+  }
+
+  # set crontab
+  local days hour mins
+  days=$(( SCANINTERVAL / 1440 ))
+  if [[ "$days" != "0" ]]; then
+    days="*/$days" hour="1" mins="15"
+  else
+    days="*"
+    hour=$(( SCANINTERVAL / 60   ))
+    mins=$(( SCANINTERVAL % 60   ))
+    mins="*/$mins"
+    [[ $hour == 0 ]] && hour="*" || { hour="*/$hour" mins="15"; }
+  fi
+
+  [[ "$RECURSIVE"   == no  ]] && local recursive=--shallow
+  [[ "$NONEXTERNAL" == yes ]] && local non_external=--home-only
+
+  cat > /usr/local/bin/ncp-scan-auto <<EOF
+#!/bin/bash
+(
+
+  echo -e "\n[ nc-scan-auto ]"
+
+  [[ "$PATH1" != "" ]] && /usr/local/bin/ncc files:scan $recursive $non_external -n -p "$PATH1"
+  [[ "$PATH2" != "" ]] && /usr/local/bin/ncc files:scan $recursive $non_external -n -p "$PATH2"
+  [[ "$PATH3" != "" ]] && /usr/local/bin/ncc files:scan $recursive $non_external -n -p "$PATH3"
+
+  [[ "${PATH1}${PATH2}${PATH3}" == "" ]] && /usr/local/bin/ncc files:scan $recursive $non_external -n --all
+
+) 2>&1 >>/var/log/ncp.log
+EOF
+chmod +x /usr/local/bin/ncp-scan-auto
+
+  echo "${mins}  ${hour}  ${days}  *  *  root /usr/local/bin/ncp-scan-auto" > /etc/cron.d/ncp-scan-auto
+  chmod 644 /etc/cron.d/ncp-scan-auto
+  service cron restart
+
+  echo "automatic scans enabled"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-trusted-domains.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Manually add trusted domains in NextcloudPi
+#
+# Copyleft 2019 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/
+#
+
+configure()
+{
+  [[ "$DOMAIN1" != "" ]] && ncc config:system:set trusted_domains 20 --value="$DOMAIN1"
+  [[ "$DOMAIN2" != "" ]] && ncc config:system:set trusted_domains 21 --value="$DOMAIN2"
+  [[ "$DOMAIN3" != "" ]] && ncc config:system:set trusted_domains 22 --value="$DOMAIN3"
+  return 0
+}
+
+install(){ :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/nc-webui.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Periodically synchronize NextCloud for externally modified files
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+is_active()
+{
+  a2query -s ncp &>/dev/null
+}
+
+configure() 
+{
+  if [[ $ACTIVE != "yes" ]]; then
+    a2dissite ncp
+    echo "ncp-web disabled"
+  else
+    a2ensite ncp
+    echo "ncp-web enabled"
+  fi
+
+  # delayed in bg so it does not kill the connection, and we get AJAX response
+  bash -c "sleep 2 && service apache2 reload" &>/dev/null &
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/CONFIG/ncp-community.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Configure various settings for community participation
+
+install() { :; }
+
+configure() { :; }

bin/ncp/NETWORKING/NFS.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# NFS server for Raspbian 
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y nfs-kernel-server 
+  systemctl disable nfs-kernel-server
+  systemctl mask nfs-blkmap
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && { 
+    service nfs-kernel-server stop
+    systemctl disable nfs-kernel-server
+    echo -e "NFS disabled"
+    return
+  } 
+
+  # CHECKS
+  ################################
+  id    "$USER"  &>/dev/null || { echo "user $USER does not exist"  ; return 1; }
+  id -g "$GROUP" &>/dev/null || { echo "group $GROUP does not exist"; return 1; }
+  [ -d "$DIR" ] || { echo -e "INFO: directory $DIR does not exist. Creating"; mkdir -p "$DIR"; }
+  [[ $( stat -fc%d / ) == $( stat -fc%d $DIR ) ]] && \
+    echo -e "INFO: mounting a in the SD card\nIf you want to use an external mount, make sure it is properly set up"
+
+  # CONFIG
+  ################################
+  cat > /etc/exports <<EOF
+$DIR $SUBNET(rw,sync,all_squash,anonuid=$(id -u $USER),anongid=$(id -g $GROUP),no_subtree_check)
+EOF
+
+  systemctl enable rpcbind
+  systemctl enable nfs-kernel-server
+  service nfs-kernel-server restart
+  echo -e "NFS enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/SSH.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+
+# Activate/deactivate SSH
+#
+#
+# Copyleft 2017 by Courtney Hicks and Ignacio Nunez Hernanz
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+install() {
+  apt-get update
+  apt-get install -y --no-install-recommends openssh-server
+  if grep '^PermitRootLogin' /etc/ssh/sshd_config
+  then
+    sed -i -e 's/^PermitRootLogin.*$/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
+  else
+    echo 'PermitRootLogin prohibit-password' >> /etc/ssh/sshd_config
+  fi
+  systemctl reload ssh
+ }
+
+is_active()
+{
+  systemctl -q is-enabled ssh &>/dev/null
+}
+
+configure()
+{
+  [[ "$ACTIVE" != "yes" ]]  && {
+    systemctl stop    ssh
+    systemctl disable ssh
+    echo "SSH disabled"
+    return 0
+  }
+
+  # Check for bad ideas
+  [[ "${USER,,}" == "pi" ]] && [[ "${PASS,,}" == "raspberry" ]] && {
+    echo "Refusing to use the default Raspbian user and password. It's insecure"
+    return 1
+  }
+  [[ "${USER,,}" == "root" ]] && {
+    echo "Refusing to use the root user for SSH. It's insecure"
+    return 1
+  }
+  # Disallow the webadmin to be used for SSH
+  [[ "${USER,,}" == "ncp" ]] && {
+    echo "The webadmin is not allowed to be used, pick another username"
+    return 1
+  }
+
+  # --force: exit successfully if the group already exists
+  groupadd --force ncp-ssh
+
+  # Change or create credentials
+  if id "$USER" &>/dev/null
+  then
+    usermod --append --groups ncp-ssh "$USER"
+    echo "$USER exists, changing password"
+    echo -e "$PASS\n$CONFIRM" | passwd "$USER" || return 1
+    # Unlocks the user if previously locked
+    # This one needs to be after passwd becuase it will fail
+    # if the user didn't have a password set when the account was locked
+    usermod --unlock --expiredate -1 "$USER"
+  else
+    echo "Creating $USER & setting password"
+    useradd --create-home --home-dir /home/"$USER" --shell /bin/bash --groups ncp-ssh "$USER" || return 1
+    echo -e "$PASS\n$CONFIRM" | passwd "$USER" || return 1
+  fi
+
+  # Get the current users of the group to an array
+  mapfile -d ',' -t GROUP_USERS < <(awk -F':' '/ncp-ssh/{printf $4}' /etc/group)
+
+  if [[ "${#GROUP_USERS[@]}" -gt 0 ]]
+  then
+    # Loop through each user in the group
+    for U in "${GROUP_USERS[@]}"
+    do
+      # Test if extra users exists in the group
+      if [[ "$U" != "$USER" ]]
+      then
+        echo "Disabling user '$U'..."
+        # Locks any extra accounts
+        usermod --lock --expiredate 1 "$U"
+      fi
+    done
+  fi
+
+  # Unsets the group array variable (cleanup)
+  unset GROUP_USERS
+
+  [[ "$SUDO" == "yes" ]] && {
+    usermod --append --groups sudo "$USER"
+    echo "Enabled sudo for $USER"
+  }
+
+  # Enable
+  systemctl enable ssh
+  systemctl start  ssh
+  echo "SSH enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/dnsmasq.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+
+# dnsmasq DNS server with cache installation on Raspbian
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com/2017/03/09/dnsmasq-as-dns-cache-server-for-nextcloudpi-and-raspbian/
+#
+
+
+install()
+{
+  set -x
+  apt-get update
+  apt-get install --no-install-recommends -y dnsmasq
+  sleep 10
+  rc=0
+  service dnsmasq status > /dev/null 2>&1 || rc=$?
+  if [[ $rc -eq 3 ]] && ! [[ "$INIT_SYSTEM" =~ ^("chroot"|"unknown")$ ]]
+  then
+    echo "Applying workaround for dnsmasq bug (compare issue #1446)"
+    mkdir -p /etc/systemd/resolved.conf.d
+    if systemctl status systemd-resolved
+    then
+  cat <<EOF > /etc/systemd/resolved.conf.d/nostublistener.conf
+[Resolve]
+DNSStubListener=no
+EOF
+      [[ "$INIT_SYSTEM" != "systemd" ]] || systemctl restart systemd-resolved
+    elif systemctl status resolvconf
+    then
+      systemctl stop resolvconf
+      systemctl start dnsmasq
+      systemctl status dnsmasq
+    else
+      echo "dnsmasq failed to start and no workaround could be found. This means, the installer failed."
+      false
+    fi
+#    service systemd-resolved stop || true
+    systemctl start dnsmasq
+    systemctl status dnsmasq
+  fi
+
+  service dnsmasq stop
+  if [[ "$INIT_SYSTEM" == "systemd" ]] && systemctl list-unit-files resolvconf.service
+  then
+    systemctl start resolvconf
+  fi
+  update-rc.d dnsmasq disable || rm /etc/systemd/system/multi-user.target.wants/dnsmasq.service
+
+  return 0
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    service dnsmasq stop
+    update-rc.d dnsmasq disable
+    echo "dnmasq disabled"
+    return
+  }
+
+  local IFACE IP
+  IFACE=$( ip r | grep "default via"   | awk '{ print $5 }' | head -1 )
+  IP=$( ncc config:system:get trusted_domains 6 | grep -oP '\d{1,3}(.\d{1,3}){3}' )
+  [[ "$IP" == "" ]] && IP="$(get_ip)"
+
+  [[ "$IP" == "" ]] && { echo "could not detect IP"; return 1; }
+
+  cat > /etc/dnsmasq.conf <<EOF
+interface=$IFACE
+domain-needed         # Never forward plain names (without a dot or domain part)
+bogus-priv            # Never forward addresses in the non-routed address spaces.
+no-poll               # Don't poll for changes in /etc/resolv.conf
+no-resolv             # Don't use /etc/resolv.conf or any other file
+cache-size=$CACHESIZE
+server=$DNSSERVER
+address=/$DOMAIN/$IP  # This is optional if we add it to /etc/hosts
+EOF
+
+  # required to run in container
+  test -d /data && echo "user=root" >> /etc/dnsmasq.conf
+
+  sed -i 's|#\?IGNORE_RESOLVCONF=.*|IGNORE_RESOLVCONF=yes|' /etc/default/dnsmasq
+
+  update-rc.d dnsmasq defaults
+  update-rc.d dnsmasq enable
+  service dnsmasq restart
+  ncc config:system:set trusted_domains 2 --value="$DOMAIN"
+  set-nc-domain "$DOMAIN" --no-trusted-domain
+  echo "dnsmasq enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/NETWORKING/duckDNS.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+# DuckDNS installation on Raspbian for NextcloudPi
+#
+#
+# Copyleft 2017 by Courtney Hicks
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+INSTALLDIR=duckdns
+INSTALLPATH=/usr/local/etc/$INSTALLDIR
+CRONFILE=/etc/cron.d/duckdns
+
+configure() 
+{
+  local DOMAIN="$( sed 's|.duckdns.org||' <<<"$DOMAIN" )"
+  if [[ $ACTIVE == "yes" ]]; then
+    mkdir -p "$INSTALLPATH"
+
+    # Creates duck.sh script that checks for updates to DNS records
+    touch "$INSTALLPATH"/duck.sh
+    touch "$INSTALLPATH"/duck.log
+    echo -e "echo url=\"https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&ip=\" | curl -k -o "$INSTALLPATH"/duck.log -K -" > "$INSTALLPATH"/duck.sh
+
+    # Adds file to cron to run script for DNS record updates and change permissions 
+    touch $CRONFILE
+    echo "*/5 * * * * root $INSTALLPATH/duck.sh >/dev/null 2>&1" > "$CRONFILE"
+    chmod 700 "$INSTALLPATH"/duck.sh
+    chmod 644 "$CRONFILE"
+
+    # First-time execution of duck script
+    "$INSTALLPATH"/duck.sh > /dev/null 2>&1
+
+    SUCCESS="$( cat $INSTALLPATH/duck.log )"
+
+    # Checks for successful run of duck.sh
+    if [[ $SUCCESS == "OK" ]]; then
+      echo "DuckDNS is enabled"
+    elif [[ $SUCCESS == "KO" ]]; then
+      echo "DuckDNS install failed, is your information correct?"
+    fi
+
+    # Removes config files and cron job if ACTIVE_ is set to no
+  elif [[ $ACTIVE == "no" ]]; then
+    rm -f "$CRONFILE"
+    rm -f "$INSTALLPATH"/duck.sh
+    rm -f "$INSTALLPATH"/duck.log
+    rmdir "$INSTALLPATH"
+    echo "DuckDNS is now disabled"
+  fi
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/freeDNS.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+# FreeDNS updater client installation on Raspbian 
+#
+# Copyleft 2017 by Panteleimon Sarantos <pantelis.fedora _a_t_ gmail _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y dnsutils
+}
+
+configure() 
+{
+  local updateurl=https://freedns.afraid.org/dynamic/update.php
+  local url="${updateurl}?${UPDATEHASH}"
+
+  [[ $ACTIVE != "yes" ]] && { 
+    rm -f /etc/cron.d/freeDNS
+    service cron restart
+    echo "FreeDNS client is disabled"
+    return 0
+  }
+
+  cat > /usr/local/bin/freedns.sh <<EOF
+#!/bin/bash
+echo "FreeDNS client started"
+echo "${url}"
+registeredIP=\$(dig +short "$DOMAIN"|tail -n1)
+currentIP=\$(wget -q -O - http://checkip.dyndns.org|sed s/[^0-9.]//g)
+    [ "\$currentIP" != "\$registeredIP" ] && {
+        wget -q -O /dev/null ${url}
+  }
+echo "Registered IP: \$registeredIP | Current IP: \$currentIP"
+EOF
+  chmod +744 /usr/local/bin/freedns.sh
+
+  echo "*/${UPDATEINTERVAL}  *  *  *  *  root  /bin/bash /usr/local/bin/freedns.sh" > /etc/cron.d/freeDNS
+  chmod 644 /etc/cron.d/freeDNS
+  service cron restart
+
+  set-nc-domain "$DOMAIN"
+
+  echo "FreeDNS client is enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/letsencrypt.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+
+# Let's encrypt certbot installation on NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/03/17/lets-encrypt-installer-for-apache/
+
+
+ncdir=/var/www/nextcloud
+nc_vhostcfg=/etc/apache2/sites-available/001-nextcloud.conf
+ncp_vhostcfg=/etc/apache2/sites-available/ncp.conf
+letsencrypt=/usr/bin/letsencrypt
+
+is_active()
+{
+  [[ "${ACTIVE}" == "yes" ]] && [[ $( find /etc/letsencrypt/live/ -maxdepth 0 -empty | wc -l ) == 0 ]]
+}
+
+tmpl_letsencrypt_domain() {
+  (
+  . /usr/local/etc/library.sh
+  if is_active_app letsencrypt; then
+    find_app_param letsencrypt DOMAIN
+  fi
+  )
+}
+
+install()
+{
+  cd /etc || return 1
+  apt-get update
+  apt-get install --no-install-recommends -y letsencrypt
+  rm -f /etc/cron.d/certbot
+  mkdir -p /etc/letsencrypt/live
+
+  is_docker && {
+    # execute before lamp stack
+    cat > /etc/services-available.d/009letsencrypt <<EOF
+#!/bin/bash
+
+source /usr/local/etc/library.sh
+persistent_cfg /etc/letsencrypt
+
+exit 0
+EOF
+    chmod +x /etc/services-available.d/009letsencrypt
+  }
+  return 0
+}
+
+configure()
+{
+  [[ "${ACTIVE}" != "yes" ]] && {
+    rm -rf /etc/letsencrypt/live/*
+    rm -f /etc/cron.weekly/letsencrypt-ncp
+    rm -f /etc/letsencrypt/renewal-hooks/deploy/ncp
+    [[ "$DOCKERBUILD" == 1 ]] && update-rc.d letsencrypt disable
+    install_template nextcloud.conf.sh "${nc_vhostcfg}"
+    local cert_path="$(grep SSLCertificateFile   "${nc_vhostcfg}" | awk '{ print $2 }')"
+    local key_path="$(grep SSLCertificateKeyFile "${nc_vhostcfg}" | awk '{ print $2 }')"
+    sed -i "s|SSLCertificateFile.*|SSLCertificateFile ${cert_path}|"      "${ncp_vhostcfg}"
+    sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile ${key_path}|" "${ncp_vhostcfg}"
+    apachectl -k graceful
+    echo "letsencrypt certificates disabled. Using self-signed certificates instead."
+    exit 0
+  }
+  local DOMAIN_LOWERCASE="${DOMAIN,,}"
+
+  [[ "$DOMAIN" == "" ]] && { echo "empty domain"; return 1; }
+
+  local IFS_BK="$IFS"
+
+  # Do it
+  local domain_string=""
+  for domain in "${DOMAIN}" "${OTHER_DOMAIN}"; do
+    [[ "$domain" != "" ]] && {
+      [[ $domain_string == "" ]] && \
+        domain_string+="${domain}" || \
+        domain_string+=",${domain}"
+    }
+  done
+  "${letsencrypt}" certonly -n --cert-name "${DOMAIN}" --force-renew --no-self-upgrade --webroot -w "${ncdir}" \
+    --hsts --agree-tos -m "${EMAIL}" -d "${domain_string}" && {
+
+    # Set up auto-renewal
+    cat > /etc/cron.weekly/letsencrypt-ncp <<EOF
+#!/bin/bash
+source /usr/local/etc/library.sh
+
+# renew and notify
+$letsencrypt renew --quiet
+
+# notify if fails
+[[ \$? -ne 0 ]] && notify_admin \
+                     "SSL renewal error" \
+                     "SSL certificate renewal failed. See /var/log/letsencrypt/letsencrypt.log"
+
+# cleanup
+rm -rf $ncdir/.well-known
+EOF
+    chmod 755 /etc/cron.weekly/letsencrypt-ncp
+
+    mkdir -p /etc/letsencrypt/renewal-hooks/deploy
+    cat > /etc/letsencrypt/renewal-hooks/deploy/ncp <<EOF
+#!/bin/bash
+source /usr/local/etc/library.sh
+notify_admin \
+  "SSL renewal" \
+  "Your SSL certificate(s) \$RENEWED_DOMAINS has been renewed for another 90 days"
+exit 0
+EOF
+    chmod +x /etc/letsencrypt/renewal-hooks/deploy/ncp
+
+    # Configure Apache
+    install_template nextcloud.conf.sh "${nc_vhostcfg}"
+    local cert_path="$(grep SSLCertificateFile   "${nc_vhostcfg}" | awk '{ print $2 }')"
+    local key_path="$(grep SSLCertificateKeyFile "${nc_vhostcfg}" | awk '{ print $2 }')"
+    sed -i "s|SSLCertificateFile.*|SSLCertificateFile ${cert_path}|"      "${ncp_vhostcfg}"
+    sed -i "s|SSLCertificateKeyFile.*|SSLCertificateKeyFile ${key_path}|" "${ncp_vhostcfg}"
+
+    # Configure Nextcloud
+    local domain_index=11
+    for dom in $DOMAIN "${OTHER_DOMAINS_ARRAY[@]}"; do
+      [[ "$dom" != "" ]] && {
+        [[ $domain_index -lt 20 ]] || {
+          echo "WARN: $dom will not be included in trusted domains for Nextcloud (maximum reached)." \
+            "It will still be included in the SSL certificate"
+          continue
+        }
+        ncc config:system:set trusted_domains "$domain_index" --value="$dom"
+        ((domain_index++))
+      }
+    done
+    set-nc-domain "$DOMAIN"
+
+    apachectl -k graceful
+    rm -rf $ncdir/.well-known
+
+    # Update configuration
+    is_docker && update-rc.d letsencrypt enable
+
+    return 0
+  }
+  rm -rf $ncdir/.well-known
+  return 1
+}
+
+cleanup()
+{
+  apt-get purge -y \
+    augeas-lenses \
+    libpython-dev \
+    libpython2.7-dev \
+    libssl-dev \
+    python-dev \
+    python2.7-dev \
+    python-pip-whl
+}
+
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/NETWORKING/namecheapDNS.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+
+# Namecheap DNS updater client installation on Raspbian 
+#
+# Copyleft 2020 by ndunks and Huizerd
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# Based on:
+# - https://gist.github.com/ndunks/c756030c0757b667c9a478c97ca5a9b7
+# - https://www.namecheap.com/support/knowledgebase/article.aspx/29/11/how-do-i-use-a-browser-to-dynamically-update-the-hosts-ip
+#
+# Further steps to be taken:
+# - Buying a Namecheap domain
+# - https://www.namecheap.com/support/knowledgebase/article.aspx/595/11/how-do-i-enable-dynamic-dns-for-a-domain/
+# - https://www.namecheap.com/support/knowledgebase/article.aspx/43/11/how-do-i-set-up-a-host-for-dynamic-dns
+
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y dnsutils
+}
+
+configure() 
+{
+  local updateurl=https://dynamicdns.park-your-domain.com/update
+  local url="${updateurl}?host=${HOST}&domain=${DOMAIN}&password=${PASSWORD}"
+
+  [[ $ACTIVE != "yes" ]] && { 
+    rm -f /etc/cron.d/namecheapDNS
+    service cron restart
+    echo "Namecheap DNS client is disabled"
+    return 0
+  }
+
+  cat > /usr/local/bin/namecheapdns.sh <<EOF
+#!/bin/bash
+echo "Namecheap DNS client started"
+registeredIP=\$(dig +short "$FULLDOMAIN"|tail -n1)
+currentIP=\$(wget -q -O - http://checkip.dyndns.org|sed s/[^0-9.]//g)
+echo "${url}&ip=${currentIP}"
+    [ "\$currentIP" != "\$registeredIP" ] && {
+        wget -q -O /dev/null "${url}&ip=${currentIP}"
+  }
+echo "Registered IP: \$registeredIP | Current IP: \$currentIP"
+EOF
+  chmod +744 /usr/local/bin/namecheapdns.sh
+
+  echo "*/${UPDATEINTERVAL}  *  *  *  *  root  /bin/bash /usr/local/bin/namecheapdns.sh" > /etc/cron.d/namecheapDNS
+  chmod 644 /etc/cron.d/namecheapDNS
+  service cron restart
+
+  set-nc-domain "$FULLDOMAIN"
+
+  echo "Namecheap DNS client is enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/nc-forward-ports.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Use uPnP to forward router ports for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+install()
+{
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends miniupnpc
+}
+
+configure() 
+{
+  local ip
+  ip="$(get_ip)"
+  upnpc -d "$HTTPSPORT" TCP
+  upnpc -d "$HTTPPORT"  TCP
+  upnpc -a "$ip" 443 "$HTTPSPORT" TCP | tee >(cat - >&2) | grep -q "is redirected to internal" || \
+    { echo -e "\nCould not forward ports automatically.\nDo it manually, or activate UPnP in your router and try again"; return 1; }
+  upnpc -a "$ip" 80  "$HTTPPORT"  TCP | tee >(cat - >&2) | grep -q "is redirected to internal" || \
+    { echo -e "\nCould not forward ports automatically.\nDo it manually, or activate UPnP in your router and try again"; return 1; }
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/NETWORKING/nc-static-IP.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+
+# Enable static IP or DHCP for Raspbian
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+configure() 
+{
+  local GW="$( ip r | grep "default via"   | awk '{ print $3 }' | head -1 )"
+  local DNS="$( grep nameserver /etc/resolv.conf | head -1 | awk '{ print $2 }' )"
+  [[ "$DNS" == "" ]] && DNS="$GW"
+  local IFACE="$( ip r | grep "default via" | awk '{ print $5 }' | head -1 )"
+  [[ "$IFACE" == "" ]] && { echo "Couldn't find default interface"; exit 1; }
+
+  ## DHCPCD
+  [[ -f /etc/dhcpcd.conf ]] && {
+    # delete NCP config
+    grep -q "^# NextCloudPi autogenerated" /etc/dhcpcd.conf && \
+      sed -i '/^# NextCloudPi autogenerated/,+6d' /etc/dhcpcd.conf
+
+    [[ $ACTIVE != "yes" ]] && {
+      systemctl restart dhcpcd
+      echo "DHCP enabled"
+      return
+    }
+
+    cat >> /etc/dhcpcd.conf <<EOF
+# NextCloudPi autogenerated
+# don't modify! better use ncp-config
+interface $IFACE
+static ip_address=$IP/24
+static routers=$GW
+static domain_name_servers=$DNS
+
+# Local loopback
+auto lo
+iface lo inet loopback
+EOF
+
+    systemctl restart dhcpcd
+  } || {
+    ## NETWORK MANAGER
+
+    cp -n /etc/network/interfaces /etc/network/interfaces-ncp-backup-orig
+
+    [[ $ACTIVE != "yes" ]] && {
+      cat > /etc/network/interfaces <<EOF
+# Wired adapter #1
+allow-hotplug $IFACE
+no-auto-down $IFACE
+auto $IFACE
+iface $IFACE inet dhcp
+
+# Local loopback
+auto lo
+iface lo inet loopback
+EOF
+      ifdown "${IFACE}"
+      ifup "${IFACE}"
+      echo "DHCP enabled"
+      return
+    }
+
+    cat > /etc/network/interfaces <<EOF
+# ncp-config generated
+source /etc/network/interfaces.d/*
+
+# Local loopback
+auto lo
+iface lo inet loopback
+
+# Interface $IFACE
+auto $IFACE
+allow-hotplug $IFACE
+iface $IFACE inet static
+    address $IP
+    netmask 255.255.255.0
+    gateway $GW
+    dns-nameservers $DNS 8.8.8.8
+EOF
+    pkill dhclient
+    ifdown "${IFACE}"
+    ifup "${IFACE}"
+  }
+ 
+  ncc config:system:set trusted_domains 1 --value="$IP"
+  set-nc-domain "${IP}"
+  echo "Static IP set to $IP"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/NETWORKING/nc-trusted-proxies.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Manually add trusted proxies in NextcloudPi
+#
+# Copyleft 2019 by Pascal Haefliger <45995338+paschaef_a_t_users_d_o_t_noreply_d_o_tgithub_d_o_t_com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+#
+
+configure()
+{
+  [[ "$PROXY1" != "" ]] && ncc config:system:set trusted_proxies 0 --value="$PROXY1"
+  [[ "$PROXY2" != "" ]] && ncc config:system:set trusted_proxies 1 --value="$PROXY2"
+  [[ "$PROXY3" != "" ]] && ncc config:system:set trusted_proxies 2 --value="$PROXY3"
+
+  exit 0
+}
+
+install(){ :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/NETWORKING/no-ip.sh

@@ -1,32 +1,25 @@
 #!/bin/bash
 
-# no-ip.org installation on Raspbian 
-# Tested with 2017-03-02-raspbian-jessie-lite.img
+# no-ip.org installation on NextcloudPi
 #
 # Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
 # GPL licensed (see end of file) * Use at your own risk!
 #
-# Usage:
-# 
-#   ./installer.sh no-ip.sh <IP> (<img>)
-#
-# See installer.sh instructions for details
-#
 # More at https://ownyourbits.com/2017/03/05/dynamic-dns-for-raspbian-with-no-ip-org-installer/
 #
 
-ACTIVE_=yes
-USER_=my-noip-user@email.com
-PASS_=noip-pass
-TIME_=30
-DESCRIPTION="Free Dynamic DNS provider (need account)"
 
 install()
 {
-  mkdir /tmp/noip && cd /tmp/noip
-  wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz
-  tar vzxf noip-duc-linux.tar.gz
-  cd -; cd $OLDPWD/noip-*
+  apt-get update
+  apt-get install --no-install-recommends -y make gcc libc-dev
+
+  local TEMPDIR="$( mktemp -d /tmp/noip.XXXXXX )"
+  cd "$TEMPDIR"
+  wget -O- --content-disposition https://github.com/nachoparker/noip-DDNS/archive/master/latest.tar.gz \
+  | tar -xz \
+  || return 1
+  cd -; cd "$OLDPWD"/noip-DDNS-master/
   make
   cp noip2 /usr/local/bin/
 
@@ -44,26 +37,62 @@ install()
 ### END INIT INFO
 EOF
 
-  cat debian.noip2.sh >> /etc/init.d/noip2 
+  cat debian.noip2.sh >> /etc/init.d/noip2
 
   chmod +x /etc/init.d/noip2
   cd -
-  rm -r /tmp/noip
+  rm -r "$TEMPDIR"
+
+  update-rc.d noip2 defaults
+  update-rc.d noip2 disable
+
+  mkdir -p /usr/local/etc/noip2
+
+  [[ "$DOCKERBUILD" == 1 ]] && {
+    cat > /etc/services-available.d/100noip <<EOF
+#!/bin/bash
+
+source /usr/local/etc/library.sh
+
+[[ "\$1" == "stop" ]] && {
+  echo "stopping noip..."
+  service noip2 stop
+  exit 0
 }
 
-configure() 
-{
-  [[ $ACTIVE_ == "no" ]] && { service noip2 stop; update-rc.d noip2 disable; return; }
+persistent_cfg /usr/local/etc/noip2 /data/etc/noip2
 
-  /usr/local/bin/noip2 -C -c /usr/local/etc/no-ip2.conf -U $TIME_ -u $USER_ -p $PASS_
-  update-rc.d noip2 defaults
+echo "Starting noip..."
+service noip2 start
+
+exit 0
+EOF
+    chmod +x /etc/services-available.d/100noip
+  }
+  return 0
+}
+
+configure()
+{
+  service noip2 stop
+  [[ $ACTIVE != "yes" ]] && { update-rc.d noip2 disable; return 0; }
+
+  local IF=$( ip -br l | awk '{ if ( $2 == "UP" ) print $1 }' | head -1 )
+  [[ "$IF" != "" ]] && IF="-I $IF"
+
+  /usr/local/bin/noip2 -C -c /usr/local/etc/no-ip2.conf $IF -U "$TIME" -u "$USER" -p "$PASS" 2>&1 | tee >(cat - >&2) \
+    | grep -q "New configuration file .* created" || return 1
+
+  update-rc.d noip2 enable
   service noip2 restart
+  set-nc-domain "$DOMAIN"
+  echo "noip DDNS enabled"
+
 }
 
 cleanup()
 {
-  rm -f /home/pi/.bash_history
-  systemctl disable ssh
+  apt-get purge -y make gcc libc-dev
 }
 
 # License

bin/ncp/NETWORKING/samba.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# SAMBA server for Raspbian
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y samba
+  update-rc.d smbd disable
+  update-rc.d nmbd disable
+
+  # the directory needs to be recreated if we are using nc-ramlogs
+  grep -q mkdir /etc/init.d/smbd || sed -i "/\<start)/amkdir -p /var/log/samba" /etc/init.d/smbd
+
+  # disable SMB1 and SMB2
+  grep -q SMB3 /etc/samba/smb.conf || sed -i '/\[global\]/aprotocol = SMB3' /etc/samba/smb.conf
+
+  # disable the [homes] share by default
+  sed -i /\[homes\]/s/homes/homes_disabled_ncp/ /etc/samba/smb.conf
+
+  cat >> /etc/samba/smb.conf <<EOF
+
+# NextCloudPi automatically generated from here. Do not remove this comment
+EOF
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    service smbd stop
+    update-rc.d smbd disable
+    update-rc.d nmbd disable
+    echo "SMB disabled"
+    return
+  }
+
+  # CHECKS
+  ################################
+  local DATADIR
+  DATADIR=$( get_nc_config_value datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running and configured?";
+    return 1;
+  }
+  [ -d "$DATADIR" ] || { echo -e "data directory $DATADIR not found"   ; return 1; }
+
+  # CONFIG
+  ################################
+
+  # remove files from this line to the end
+  sed -i '/# NextCloudPi automatically/,/\$/d' /etc/samba/smb.conf
+
+  # restore this line
+  cat >> /etc/samba/smb.conf <<EOF
+# NextCloudPi automatically generated from here. Do not remove this comment
+EOF
+
+  # create a share per Nextcloud user
+  local USERS=()
+  while read -r path; do
+    USERS+=( "$( basename "$(dirname "$path")" )" )
+  done < <( ls -d "$DATADIR"/*/files )
+
+  for user in "${USERS[@]}"; do
+    # Exclude users not matching group filter (if enabled)
+    if [[ -n "$FILTER_BY_GROUP" ]] \
+    && [[ -z "$(ncc user:info "$user" --output=json | jq ".groups[] | select( . == \"${FILTER_BY_GROUP}\" )")" ]]
+    then
+      echo "Omitting user $user (not in group ${FILTER_BY_GROUP})...";
+      continue;
+    fi
+
+    echo "adding SAMBA share for user $user"
+    local DIR="$DATADIR/$user/files"
+    [ -d "$DIR" ] || { echo -e "INFO: directory $DIR does not exist."; return 1; }
+
+    cat >> /etc/samba/smb.conf <<EOF
+
+[ncp-$user]
+    path = $DIR
+    writeable = yes
+;	browseable = yes
+    valid users = $user
+    force user = www-data
+    force group = www-data
+    create mask = 0770
+    directory mask = 0771
+    force create mode = 0660
+    force directory mode = 0770
+
+EOF
+
+    ## create user with no login if it doesn't exist
+    id "$user" &>/dev/null || adduser --disabled-password --force-badname --gecos "" "$user" || return 1
+    echo -e "$PWD\n$PWD" | smbpasswd -s -a "${user}"
+
+    usermod -aG www-data "${user}"
+    sudo chmod g+w "${DIR}"
+  done
+
+  update-rc.d smbd defaults
+  update-rc.d smbd enable
+  service smbd restart
+
+  update-rc.d nmbd enable
+  service nmbd restart
+
+  echo "SMB enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/NETWORKING/spDYN.sh

@@ -0,0 +1,130 @@
+#!/bin/bash
+
+# spDYN setup for NextcloudPi
+#
+#
+# Copyleft 2017/2018 by Timm Goldenstein and Timo Stiefel
+# https://github.com/TimmThaler/spdnsUpdater
+#
+# GPL licensed (see end of file) * Use at your own risk!
+#
+
+
+INSTALLDIR=spdnsupdater
+INSTALLPATH=/usr/local/etc/$INSTALLDIR
+CRONFILE=/etc/cron.d/spdnsupdater
+
+install()
+{
+  # Create the spdnsUpdater.sh
+  mkdir -p "$INSTALLPATH"
+  # Write the script to file
+  cat > "$INSTALLPATH"/spdnsUpdater.sh <<'EOF' 
+#!/bin/bash
+
+### Usage
+#
+#	Recommended usage:	./spdnsUpdater.sh <hostname> <token>
+#	Alternative usage:	./spdnsUpdater.sh <hostname> <user> <passwd> (not implemented)
+#
+
+### Configuration
+HOST=$1
+TOKEN=$2
+
+# Get current IP address from
+get_ip_url="http://checkip.spdyn.de"
+
+update_url="https://update.spdyn.de/nic/update"
+
+
+### Update procedure
+function spdnsUpdater { 
+	# Send the current IP address to spdyn.de
+	# and show the response
+	
+	params=$1
+	updater=$(wget -qO- --post-data $params $update_url)
+	updater=$(echo $updater | grep -o '^[a-z]*')
+	
+	case "$updater" in
+		abuse) echo "[$updater] Der Host kann nicht aktualisiert werden, da er aufgrund vorheriger fehlerhafter Updateversuche gesperrt ist."
+			;;
+		badauth) echo "[$updater] Ein ungültiger Benutzername und / oder ein ungültiges Kennwort wurde eingegeben."
+			;;
+		good) echo "[$updater] Die Hostname wurde erfolgreich auf die neue IP aktualisiert."
+			;;
+		yours) echo "[$updater] Der angegebene Host kann nicht unter diesem Benutzer-Account verwendet werden."
+			;;
+		notfqdn) echo "[$updater] Der angegebene Host ist kein FQDN."
+			;;
+		numhost) echo "[$updater] Es wurde versucht, mehr als 20 Hosts in einer Anfrage zu aktualisieren."
+			;;
+		nochg) echo "[$updater] Die IP hat sich zum letzten Update nicht geändert."
+			;;
+		nohost) echo "[$updater] Der angegebene Host existiert nicht oder wurde gelöscht."
+			;;
+		fatal) echo "[$updater] Der angegebene Host wurde manuell deaktiviert."
+			;;
+		*) echo "[$updater]"
+			;;
+	esac
+
+}
+
+	# Get registered IP address
+	registered_ip=$(dig +short "$HOST"|tail -n1)
+	# Get current IP address
+	current_ip=$(wget -qO- "$get_ip_url");
+	# Update only when IP address has changed.
+	[ "\$current_ip" == "\$registered_ip" ] && {
+    	return 0
+	}
+	params="hostname=$HOST&myip=$current_ip&user=$HOST&pass=$TOKEN"
+	spdnsUpdater "$params"
+EOF
+
+    chmod 700 "$INSTALLPATH"/spdnsUpdater.sh
+    chmod a+x "$INSTALLPATH"/spdnsUpdater.sh
+
+}
+
+configure() 
+{
+  if [[ $ACTIVE == "yes" ]]; then
+    
+    # Adds file to cron to run script for DNS record updates and change permissions
+    touch $CRONFILE
+    echo "10 * * * * root $INSTALLPATH/spdnsUpdater.sh $DOMAIN $TOKEN >/dev/null 2>&1" > "$CRONFILE"
+    chmod 644 "$CRONFILE"
+
+    # First-time execution of update script and print response from spdns.de server
+    "$INSTALLPATH"/spdnsUpdater.sh "$DOMAIN" "$TOKEN"
+		
+		echo -e "\nspdnsUpdater is now enabled"
+
+    # Removes config files and cron job if ACTIVE_ is set to no
+  elif [[ $ACTIVE == "no" ]]; then
+    echo "... removing cronfile: $CRONFILE"
+    rm -f "$CRONFILE"
+    echo -e "\nspdnsUpdater is now disabled"
+  fi
+  service cron restart
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/SECURITY/UFW.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+
+# Uncomplicated Firewall
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+
+install()
+{
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ufw
+  systemctl disable ufw
+
+  # Disable logging to kernel
+  grep -q maxsize /etc/logrotate.d/ufw || sed -i '/weekly/amaxsize 2M' /etc/logrotate.d/ufw
+
+  return 0
+}
+
+configure()
+{
+  [[ "$ACTIVE" != yes ]] && {
+    ufw --force reset
+    systemctl disable ufw
+    systemctl stop ufw
+    echo "UFW disabled"
+    return 0
+  }
+  ufw --force enable
+  systemctl enable ufw
+  systemctl start ufw
+
+  echo -e "\n# web server rules"
+  ufw allow $HTTP/tcp
+  ufw allow $HTTPS/tcp
+  ufw allow 4443/tcp
+
+  echo -e "\n# SSH rules"
+  ufw allow $SSH
+
+  echo -e "\n# DNS rules"
+  ufw allow dns
+
+  echo -e "\n# SAMBA rules"
+  ufw allow samba
+
+  echo -e "\n# NFS rules"
+  ufw allow nfs
+
+  echo -e "\n# UPnP rules"
+  ufw allow proto udp from 192.168.0.0/16
+
+  echo "UFW enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SECURITY/fail2ban.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+
+# Fail2ban for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com/2017/02/24/nextcloudpi-fail2ban-installer/
+#
+
+
+# time to ban an IP that exceeded attempts
+
+# cooldown time for incorrect passwords
+
+# bad attempts before banning an IP
+
+
+# Option to activate email notifications
+
+# email to send notifications to
+
+
+install()
+{
+  apt-get update
+  apt-get install --no-install-recommends -y python3-systemd
+  apt-get install --no-install-recommends -y fail2ban whois
+  update-rc.d fail2ban disable
+  rm -f /etc/fail2ban/jail.d/defaults-debian.conf
+
+  # tweak fail2ban email
+  local F=/etc/fail2ban/action.d/sendmail-common.conf
+  sed -i 's|Fail2Ban|NextCloudPi|' /etc/fail2ban/action.d/sendmail-whois-lines.conf
+  grep -q actionstart_ "$F" || sed -i 's|actionstart|actionstart_|' "$F"
+  grep -q actionstop_  "$F" || sed -i 's|actionstop|actionstop_|'   "$F"
+
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    service fail2ban stop
+    update-rc.d fail2ban disable
+    echo "fail2ban disabled"
+    return
+  }
+
+  local NCLOG="/var/www/nextcloud/data/nextcloud.log"
+  local NCLOG1="$(ncc config:system:get logfile)"
+
+  [[ "$NCLOG1" != "" ]] && NCLOG="$NCLOG1"
+
+  local BASEDIR=$( dirname "$NCLOG" )
+  [ -d "$BASEDIR" ] || { echo -e "directory $BASEDIR not found"; return 1; }
+
+  sudo -u www-data touch "$NCLOG" || { echo -e "ERROR: user www-data does not have write permissions on $NCLOG"; return 1; }
+
+  ncc config:system:set loglevel --value=2
+  ncc config:system:set log_type --value=file
+
+  # Filters
+  cat > /etc/fail2ban/filter.d/nextcloud.conf <<'EOF'
+[INCLUDES]
+before = common.conf
+
+[Definition]
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
+ignoreregex =
+EOF
+
+  cat > /etc/fail2ban/filter.d/ufwban.conf <<'EOF'
+[INCLUDES]
+before = common.conf
+
+[Definition]
+failregex = UFW BLOCK.* SRC=<HOST>
+ignoreregex =
+EOF
+  mkdir -p /etc/systemd/system/fail2ban.service.d
+  cat > /etc/systemd/system/fail2ban.service.d/touch-ufw-log.conf <<'EOF'
+[Service]
+ExecStartPre=/bin/touch /var/log/ufw.log
+EOF
+
+  [[ "$MAILALERTS" == "yes" ]] && local ACTION=action_mwl || local ACTION=action_
+
+  # Jails
+  cat > /etc/fail2ban/jail.conf <<EOF
+# The DEFAULT allows a global definition of the options. They can be overridden
+# in each jail afterwards.
+[DEFAULT]
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space separator.
+ignoreip = 127.0.0.1/8
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = $BANTIME
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime = $FINDTIME
+maxretry = $MAXRETRY
+
+#
+# ACTIONS
+#
+banaction  = iptables-multiport
+protocol   = tcp
+chain      = INPUT
+action_    = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+           sendmail-whois-lines[name=%(__name__)s, dest=$EMAIL, sender=ncp-fail2ban@nextcloudpi.com]
+action = %($ACTION)s
+
+#
+# SSH
+#
+[ssh]
+enabled  = true
+port     = ssh
+filter   = sshd
+backend  = systemd
+logpath  = /var/log/auth.log
+maxretry = $MAXRETRY
+
+#
+# HTTP servers
+#
+[nextcloud]
+enabled  = true
+port     = http,https
+filter   = nextcloud
+logpath  = $NCLOG
+maxretry = $MAXRETRY
+backend  = auto
+
+#
+# UFW
+#
+[ufwban]
+enabled = true
+port    = ssh, http, https
+filter  = ufwban
+logpath = /var/log/ufw.log
+action  = ufw
+backend = auto
+EOF
+
+  cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
+  touch /var/log/ufw.log
+  update-rc.d fail2ban defaults
+  update-rc.d fail2ban enable
+  systemctl daemon-reload
+  service fail2ban restart
+  echo "fail2ban enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SECURITY/modsecurity.sh

@@ -1,73 +1,60 @@
 #!/bin/bash
 
 # modsecurity WAF installation on Raspbian 
-# Tested with 2017-03-02-raspbian-jessie-lite.img
 #
 # Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
 # GPL licensed (see end of file) * Use at your own risk!
 #
-# Usage:
-# 
-#   ./installer.sh modsecurity.sh <IP> (<img>)
-#
-# See installer.sh instructions for details
-#
 # More at ownyourbits.com
 #
 
-ACTIVE_=no
-NCDIR_=/var/www/nextcloud/
-DESCRIPTION="Web Application Firewall for extra security (experimental)"
-
 install()
 {
   apt-get update
   apt-get install -y --no-install-recommends libapache2-mod-security2 modsecurity-crs
+  a2dismod security2
 
-  # COPY RULES
-  cd /usr/share/modsecurity-crs/base_rules/
-  for ruleFile in * ; do sudo ln -s /usr/share/modsecurity-crs/base_rules/$ruleFile /etc/modsecurity/$ruleFile ; done
-  cd /usr/share/modsecurity-crs/optional_rules/
-  for ruleFile in * ; do sudo ln -s /usr/share/modsecurity-crs/optional_rules/$ruleFile /etc/modsecurity/$ruleFile ; done
-  rm /etc/modsecurity/modsecurity_crs_16_session_hijacking.conf # https://github.com/SpiderLabs/owasp-modsecurity-crs/commit/e2fbef4ce89fed0c4dd338002b9a090dd2f6491d
+  cat >> /etc/modsecurity/crs/crs-setup.conf <<'EOF'
+
+  # NextCloudPi: allow PROPFIND for webDAV
+  SecAction "id:900200, phase:1, nolog, pass, t:none, setvar:'tx.allowed_methods=GET HEAD POST OPTIONS PROPFIND'"
+EOF
 
   # CONFIGURE
   cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
+  sed -i "s|SecRuleEngine .*|SecRuleEngine Off|"               /etc/modsecurity/modsecurity.conf
   sed -i 's|SecTmpDir .*|SecTmpDir   /var/cache/modsecurity/|' /etc/modsecurity/modsecurity.conf
   sed -i 's|SecDataDir .*|SecDataDir /var/cache/modsecurity/|' /etc/modsecurity/modsecurity.conf
+  sed -i 's|^SecRequestBodyLimit .*|#SecRequestBodyLimit 13107200|' /etc/modsecurity/modsecurity.conf
 
-  cp /usr/share/modsecurity-crs/modsecurity_crs_10_setup.conf /etc/modsecurity/modsecurity_crs_10_setup.conf
-  patch /etc/modsecurity/modsecurity_crs_10_setup.conf <<<'66,67c66
-< SecDefaultAction "phase:1,deny,log"
-< SecDefaultAction "phase:2,deny,log"
----
-> SecDefaultAction "phase:2,pass,log"
-152c151
-< #SecAction \
----
-> SecAction \
-278c277
-<   setvar:'\''tx.allowed_methods=GET HEAD POST OPTIONS'\'', \
----
->   setvar:'\''tx.allowed_methods=GET HEAD POST OPTIONS PROPFIND'\'', \
-280c279
-<   setvar:'\''tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1'\'', \
----
->   setvar:'\''tx.allowed_http_versions=HTTP/1.1 HTTP/2.0'\'', \'
+  # turn modsecurity logs off, too spammy
+  sed -i 's|SecAuditEngine .*|SecAuditEngine Off|' /etc/modsecurity/modsecurity.conf
 
-cat >> /etc/modsecurity/modsecurity_crs_99_whitelist.conf <<EOF
-<Directory $NCDIR_>
+  cat >> /etc/apache2/apache2.conf <<EOF
+<IfModule mod_security2.c>
+  SecServerSignature " "
+</IfModule>
+EOF
+}
+
+configure() 
+{ 
+  local NCDIR=/var/www/nextcloud/
+  local NCPWB=/var/www/ncp-web/
+
+  cat > /etc/modsecurity/modsecurity_crs_99_whitelist.conf <<EOF
+<Directory $NCDIR>
   # VIDEOS
   SecRuleRemoveById 958291             # Range Header Checks
-  SecRuleRemoveById 981203             # Correlated Attack Attempt
+  SecRuleRemoveById 980120             # Correlated Attack Attempt
 
   # PDF
-  SecRuleRemoveById 950109             # Check URL encodings
+  SecRuleRemoveById 920230             # Check URL encodings
 
   # ADMIN (webdav)
   SecRuleRemoveById 960024             # Repeatative Non-Word Chars (heuristic)
   SecRuleRemoveById 981173             # SQL Injection Character Anomaly Usage
-  SecRuleRemoveById 981204             # Correlated Attack Attempt
+  SecRuleRemoveById 980130             # Correlated Attack Attempt
   SecRuleRemoveById 981243             # PHPIDS - Converted SQLI Filters
   SecRuleRemoveById 981245             # PHPIDS - Converted SQLI Filters
   SecRuleRemoveById 981246             # PHPIDS - Converted SQLI Filters
@@ -78,29 +65,34 @@ cat >> /etc/modsecurity/modsecurity_crs_99_whitelist.conf <<EOF
 
   # COMING BACK FROM OLD SESSION
   SecRuleRemoveById 970903             # Microsoft Office document properties leakage
+
+  # NOTES APP
+  SecRuleRemoveById 981401             # Content-Type Response Header is Missing and X-Content-Type-Options is either missing or not set to 'nosniff'
+  SecRuleRemoveById 200002             # Failed to parse request body
+
+  # UPLOADS ( https://github.com/nextcloud/nextcloudpi/issues/959#issuecomment-529150562 )
+  SecRequestBodyNoFilesLimit 536870912
+
+  # GENERAL
+  SecRuleRemoveById 920350             # Host header is a numeric IP address
+
+  # REGISTERED WARNINGS, BUT DID NOT HAVE TO DISABLE THEM
+  #SecRuleRemoveById 981220 900046 981407
+  #SecRuleRemoveById 981222 981405 981185 949160
+
+</Directory>
+<Directory $NCPWB>
+  # GENERAL
+  SecRuleRemoveById 920350             # Host header is a numeric IP address
 </Directory>
 EOF
-  cat >> /etc/apache2/apache2.conf <<EOF
-<IfModule mod_security2.c>
-  SecServerSignature " "
-</IfModule>
-EOF
-}
 
-configure() 
-{ 
-  [[ $ACTIVE_ == "yes" ]] && local STATE=On || local STATE=Off
+  [[ $ACTIVE == "yes" ]] && local STATE=On || local STATE=Off
   sed -i "s|SecRuleEngine .*|SecRuleEngine $STATE|" /etc/modsecurity/modsecurity.conf
-  service apache2 restart
-}
+  [[ $ACTIVE == "yes" ]] && echo "Enabling module security2" || echo "Disabling module security2"
+  [[ $ACTIVE == "yes" ]] && a2enmod security2 &>/dev/null || a2dismod security2 &>/dev/null
 
-cleanup()
-{
-  apt-get autoremove -y
-  apt-get clean
-  rm /var/lib/apt/lists/* -r
-  rm -f /home/pi/.bash_history
-  systemctl disable ssh
+  apachectl -k graceful
 }
 
 # License

bin/ncp/SECURITY/nc-audit.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+
+# Launch security audit reports for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+install()
+{
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    lynis debsecan debian-goodies debsums
+  cp /etc/lynis/default.prf /etc/lynis/ncp.prf
+  cat >> /etc/lynis/ncp.prf <<EOF
+# Won't install apt-listbugs and all its ruby dependencies
+skip-test=CUST-0810
+
+# Won't install puppet or similar
+skip-test=TOOL-5002
+
+# Raspbian doesn't have security sources ( https://www.raspberrypi.org/forums/viewtopic.php?t=98006&p=680175 ) 
+skip-test=PKGS-7388
+
+# We have a preset partition scheme in the SD card
+skip-test=FILE-6310
+
+# We don't use firewire
+skip-test=STRG-1846
+
+# We use USB in NCP
+skip-test=STRG-1840
+
+# Won't recompile kernel to support auditd
+skip-test=ACCT-9628
+
+# Won't be protected against DDOS in self-hosting, will save the resources
+skip-test=HTTP-6640
+skip-test=HTTP-6641
+
+# False positive about mysql root password ( https://github.com/CISOfy/lynis/issues/288 )
+skip-test=DBS-1816
+
+# vmlinuz missing at least in Raspbian
+skip-test=KRNL-5788
+
+# won't recompile kernels for PAE NX
+skip-test=KRNL-5677
+
+# false positive with DNS settings. We use mDNS and dnsmasq (and they work)
+skip-test=NAME-4028
+
+# false positive due to fail2ban
+skip-test=FIRE-4513
+EOF
+}
+
+configure()
+{
+  echo "General security audit"
+  lynis audit system --profile /etc/lynis/ncp.prf --no-colors
+
+  echo "Known vulnerabilities in this system"
+  debsecan
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SECURITY/nc-encrypt.sh

@@ -0,0 +1,130 @@
+#!/bin/bash
+
+# Data at rest encryption for NextcloudPi
+#
+# Copyleft 2021 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: nextcloudpi.com
+#
+
+is_active()
+{
+  mount | grep ncdata_enc | grep -q gocryptfs
+}
+
+install()
+{
+  apt_install gocryptfs
+}
+
+configure()
+{
+
+  set -e -o pipefail
+  local datadir parentdir encdir tmpdir
+  datadir="$(get_ncpcfg datadir)"
+  [[ "${datadir?}" == "null" ]] && datadir=/var/www/nextcloud/data
+  parentdir="$(dirname "${datadir}")"
+  encdir="${parentdir?}/ncdata_enc"
+  tmpdir="$(mktemp -u -p "${parentdir}" -t nc-data-crypt.XXXXXX)"
+
+  [[ "${ACTIVE?}" != "yes" ]] && {
+    if ! is_active; then
+      echo "Data not currently encrypted"
+      return 0
+    fi
+    save_maintenance_mode
+    trap restore_maintenance_mode EXIT
+    echo "Decrypting data..."
+    mkdir "${tmpdir?}"
+    chown www-data: "${tmpdir}"
+    pkill tail # prevents from umounting in docker
+    mv "${datadir?}"/* "${datadir}"/.[!.]* "${tmpdir}"
+    fusermount -u "${datadir}"
+    rmdir "${datadir}"
+    mv "${tmpdir}" "${datadir}"
+    rm "${encdir?}"/gocryptfs.*
+    rmdir "${encdir}"
+    echo "Data no longer encrypted"
+    return
+  }
+
+  if is_active; then
+    echo "Encrypted data already in use"
+    return
+  fi
+
+  export PASSWORD
+  # Just mount already encrypted data
+  if [[ -f "${encdir?}"/gocryptfs.conf ]]; then
+    systemctl reset-failed ncp-encrypt 2>/dev/null ||:
+    systemd-run -u ncp-encrypt -E PASSWORD bash -c "gocryptfs -fg -allow_other -q '${encdir}' '${datadir}' <<<\"\${PASSWORD}\" 2>&1 | sed /^Switch/d |& tee /var/log/ncp-encrypt.log"
+
+    # switch to the regular virtual hosts after we decrypt, so we can access NC and ncp-web
+    a2ensite ncp 001-nextcloud
+    a2dissite ncp-activation
+    apache2ctl -k graceful
+
+    echo "Encrypted data now accessible"
+    return
+  fi
+  mkdir -p "${encdir?}"
+  echo "${PASSWORD?}" | gocryptfs -init -q "${encdir}"
+  save_maintenance_mode
+  cleanup() {
+    umount "${datadir}" ||:
+    [[ -f "${tmpdir}" ]] && {
+      rm -rf "${datadir?}" ||:
+      mv "${tmpdir}" "${datadir}"
+
+      chown -R www-data:www-data "${datadir}"
+    }
+  }
+
+  trap cleanup 1
+  trap restore_maintenance_mode EXIT
+
+  mv "${datadir?}" "${tmpdir?}"
+
+  mkdir "${datadir}"
+  systemctl reset-failed ncp-encrypt 2>/dev/null ||:
+  systemd-run -u ncp-encrypt -E PASSWORD bash -c "gocryptfs -fg -allow_other -q '${encdir}' '${datadir}' <<<\"\${PASSWORD}\" 2>&1 | sed /^Switch/d |& tee /var/log/ncp-encrypt.log"
+
+  maxtries=5
+  while [[ "$(systemctl is-active ncp-encrypt)" != "active" ]] || ! mount | grep -1 "${datadir}"
+  do
+    echo "Wating for encryption process to start... (${maxtries})"
+    sleep 3
+    maxtries=$((maxtries - 1))
+    [[ $maxtries -gt 0 ]] || return 1
+  done
+
+  echo "Encrypting data..."
+  mv "${tmpdir}"/* "${tmpdir}"/.[!.]* "${datadir}"
+  chown -R www-data: "${datadir}"
+  rmdir "${tmpdir}"
+
+  set_ncpcfg datadir "${datadir}"
+
+  echo "Data is now encrypted"
+
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SYSTEM/metrics.sh

@@ -0,0 +1,262 @@
+#!/bin/bash
+
+is_supported() {
+  [[ "${DOCKERBUILD:-0}" == 1 ]] && [[ "$(lsb_release -r)" =~ .*10 ]] && return 1
+  return 0
+}
+
+is_active() {
+  is_supported || return 1
+
+  metrics_services status > /dev/null 2>&1 || return 1
+  # systemctl is-active -q prometheus-node-exporter || return 1
+  return 0
+}
+
+tmpl_metrics_enabled() {
+  (
+  . /usr/local/etc/library.sh
+  local param_active="$(find_app_param metrics.sh ACTIVE)"
+  [[ "$param_active" == yes ]] || exit 1
+  )
+}
+
+reload_metrics_config() {
+  is_supported || return 0
+
+  install_template ncp-metrics.cfg.sh "/usr/local/etc/ncp-metrics.cfg" || {
+    echo -e "ERROR while generating ncp-metrics.conf!"
+    return 1
+  }
+  service ncp-metrics-exporter status > /dev/null && {
+    service ncp-metrics-exporter restart
+    service ncp-metrics-exporter status > /dev/null 2>&1 || {
+      rc=$?
+      echo -e "WARNING: ncp-metrics-exporter failed to start (exit-code $rc)!"
+      return $rc
+    }
+  } || return 0
+}
+
+metrics_services() {
+  cmd="${1?}"
+
+  if [[ "$cmd" =~ (start|stop|restart|reload|status) ]]
+  then
+    if ! is_docker && [[ "$INIT_SYSTEM" != "systemd" ]]
+    then
+      echo "Probably running in chroot. Ignoring 'metrics_services $cmd'..."
+      return 0
+    fi
+    rc1=0
+    rc2=0
+    service prometheus-node-exporter "$cmd" || rc1=$?
+    service ncp-metrics-exporter "$cmd" || rc2=$?
+    [[ $rc1 > $rc2 ]] && return $rc1
+    return $rc2
+  fi
+
+  if ! [[ "$cmd" =~ (en|dis)able ]]
+  then
+    echo -e "ERROR: Invalid command: metrics_services ${cmd}!"
+    exit 1
+  fi
+
+  if is_docker
+  then
+    rc1=0
+    rc2=0
+    update-rc.d ncp-metrics-exporter "$cmd" || rc1=$?
+    update-rc.d prometheus-node-exporter "$cmd" || rc2=$?
+    [[ $rc1 > $rc2 ]] && return $rc1
+    return $rc2
+  else
+    systemctl "$cmd" prometheus-node-exporter ncp-metrics-exporter
+    return $?
+  fi
+}
+
+install() {
+
+  # Subshell to return on failure  instead of exiting (due to set -e)
+  (
+
+  set -e
+  set +u
+
+  is_supported || {
+    echo -e "Metrics app is not supported in debian 10 docker containers. Installation will be skipped."
+    return 0
+  }
+
+  cat > /etc/default/prometheus-node-exporter <<'EOF'
+ARGS="--collector.filesystem.ignored-mount-points=\"^/(dev|proc|run|sys|mnt|var/log|var/lib/docker)($|/)\""
+EOF
+
+  arch="$(uname -m)"
+  [[ "${arch}" =~ ^"arm" ]] && arch="armv7"
+
+  mkdir -p /usr/local/lib/ncp-metrics
+  wget -qO "/usr/local/lib/ncp-metrics/ncp-metrics-exporter" \
+    "https://github.com/theCalcaholic/ncp-metrics-exporter/releases/download/v1.1.0/ncp-metrics-exporter-${arch}"
+  chmod +x /usr/local/lib/ncp-metrics/ncp-metrics-exporter
+
+  # Apply fix to init-d-script (https://salsa.debian.org/debian/sysvinit/-/commit/aa40516c)
+  # Otherwise the init.d scripts of prometheus-node-exporter won't work
+  # shellcheck disable=SC2016
+  sed -i 's|status_of_proc "$DAEMON" "$NAME" ${PIDFILE:="-p ${PIDFILE}"}|status_of_proc ${PIDFILE:+-p "$PIDFILE"} "$DAEMON" "$NAME"|' /lib/init/init-d-script
+
+  apt-get update --allow-releaseinfo-change
+  install_with_shadow_workaround -o Dpkg::Options::=--force-confdef -o Dpkg::Options::="--force-confold" prometheus-node-exporter
+
+  if is_docker
+  then
+    cat > /etc/init.d/ncp-metrics-exporter <<'EOF'
+#!/bin/sh
+# Generated by sysd2v v0.3  --  http://www.trek.eu.org/devel/sysd2v
+# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing.
+if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then
+    set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script
+fi
+### BEGIN INIT INFO
+# Provides:       ncp-metrics-exporter
+# Required-Start: $remote_fs
+# Required-Stop:  $remote_fs
+# Default-Start:  2 3 4 5
+# Default-Stop:   0 1 6
+# Description:    NCP Metrics Exporter
+### END INIT INFO
+set -a
+NCP_CONFIG_DIR=/usr/local/etc
+set +a
+
+NAME=ncp-exporter
+DAEMON=/usr/local/lib/ncp-metrics/ncp-metrics-exporter
+PIDFILE=/var/run/ncp-metrics-exporter.pid
+LOGFILE=/var/log/ncp-metrics.log
+START_ARGS="--background --make-pidfile"
+EOF
+    chmod +x /etc/init.d/ncp-metrics-exporter
+    update-rc.d ncp-metrics-exporter defaults
+
+    cat > /etc/services-available.d/101ncp-metrics <<EOF
+#!/bin/bash
+
+source /usr/local/etc/library.sh
+[[ "\$1" == "stop" ]] && {
+  echo "stopping prometheus-node-exporter..."
+  service prometheus-node-exporter stop
+  echo "done."
+  echo "stopping ncp-metrics-exporter"
+  service ncp-metrics-exporter stop
+  echo "done."
+  exit 0
+}
+
+persistent_cfg /etc/default/prometheus-node-exporter
+
+echo "starting prometheus-node-exporter..."
+service prometheus-node-exporter start
+[[ -n "\$(pgrep prometheus)" ]] || echo -e "ERROR: prometheus-node-exporter failed to start!"
+echo "starting ncp-metrics-exporter
+service ncp-metrics-exporter start
+EOF
+  chmod +x /etc/services-available.d/101ncp-metrics
+
+  else #=> if not is_docker
+
+    cat <<EOF > /etc/systemd/system/ncp-metrics-exporter.service
+[Unit]
+Description=NCP Metrics Exporter
+
+[Service]
+Environment=NCP_CONFIG_DIR=/usr/local/etc
+ExecStart=/usr/local/lib/ncp-metrics/ncp-metrics-exporter
+SyslogIdentifier=ncp-metrics
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    systemctl daemon-reload
+
+  fi
+
+  metrics_services stop
+  metrics_services disable
+
+  )
+}
+
+configure() {
+  set +u
+
+  if [[ "$ACTIVE" != yes ]]
+  then
+
+    install_template nextcloud.conf.sh /etc/apache2/sites-available/001-nextcloud.conf || {
+      install_template nextcloud.conf.sh /etc/apache2/sites-available/001-nextcloud.conf --allow-fallback
+      echo -e "ERROR while generating nextcloud.conf! Exiting..."
+      return 1
+    }
+    echo "Disabling and stopping services..."
+    metrics_services disable
+    metrics_services stop
+    echo "done."
+  else
+
+    is_supported || {
+      echo -e "Metrics app is not supported in debian 10 docker containers. Terminating..."
+      return 0
+    }
+
+    [[ -n "$USER" ]] || {
+      echo -e "ERROR: User can not be empty!" >&2
+      return 1
+    }
+
+    if [[ "$METRICS_SKIP_PASSWORD_CONFIG" != "true" ]]
+    then
+      [[ -n "$PASSWORD" ]] || {
+        echo -e "ERROR: Password can not be empty!" >&2
+        return 1
+      }
+
+      [[ ${#PASSWORD} -ge 10 ]] || {
+        echo -e "ERROR: Password must be at least 10 characters long!" >&2
+        return 1
+      }
+
+      local htpasswd_file="/usr/local/etc/metrics.htpasswd"
+      rm -f "${htpasswd_file}"
+      echo "$PASSWORD" | htpasswd -ciB "${htpasswd_file}" "$USER"
+    fi
+
+    echo "Generate config..."
+    reload_metrics_config
+    echo "done."
+
+    echo "Enabling and starting services..."
+    metrics_services enable
+    metrics_services start
+    metrics_services status || {
+      echo -e "ERROR: Metrics services not running!"
+      return 1
+    }
+    echo "done."
+
+
+    install_template nextcloud.conf.sh /etc/apache2/sites-available/001-nextcloud.conf || {
+      install_template nextcloud.conf.sh /etc/apache2/sites-available/001-nextcloud.conf --allow-fallback
+      echo -e "ERROR while generating nextcloud.conf! Exiting..."
+      return 1
+    }
+
+    echo "Metrics endpoint enabled. You can test it at https://nextcloudpi.local/metrics/system and https://nextcloudpi.local/metrics/ncp (or under your NC domain under the same paths)"
+  fi
+
+  bash -c "sleep 2 && service apache2 reload" &>/dev/null &
+
+}

bin/ncp/SYSTEM/nc-automount.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+
+# Automount configuration for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/
+#
+
+
+install()
+{
+  apt-get update
+  apt-get install -y --no-install-recommends udiskie inotify-tools
+
+  cat > /etc/udev/rules.d/99-udisks2.rules <<'EOF'
+ENV{ID_FS_USAGE}=="filesystem|other|crypto", ENV{UDISKS_FILESYSTEM_SHARED}="1"
+EOF
+
+  cat > /usr/lib/systemd/system/nc-automount.service <<'EOF'
+[Unit]
+Description=Automount USB drives
+Before=mysqld.service dphys-swapfile.service fail2ban.service smbd.service nfs-server.service
+
+[Service]
+Restart=always
+ExecStartPre=/bin/bash -c "rmdir /media/* || true"
+ExecStart=/usr/bin/udiskie -NTFv
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+  cat > /usr/lib/systemd/system/nc-automount-links.service <<'EOF'
+[Unit]
+Description=Monitor /media for mountpoints and create USBdrive* symlinks
+Before=nc-automount.service
+
+[Service]
+Restart=always
+ExecStart=/usr/local/etc/nc-automount-links-mon
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+  cat > /usr/local/etc/nc-automount-links <<'EOF'
+#!/bin/bash
+
+ls -d /media/* &>/dev/null && {
+
+  # remove old links
+  for l in $( ls /media/ ); do
+    test -L /media/"$l" && rm /media/"$l"
+  done
+
+  # create links
+  i=0
+  for d in $( ls -d /media/* 2>/dev/null ); do
+    if [ $i -eq 0 ]; then
+      test -e /media/USBdrive   || test -d "$d" && ln -sT "$d" /media/USBdrive
+    else
+      test -e /media/USBdrive$i || test -d "$d" && ln -sT "$d" /media/USBdrive$i
+    fi
+    i=$(( i + 1 ))
+  done
+
+}
+EOF
+  chmod +x /usr/local/etc/nc-automount-links
+
+  cat > /usr/local/etc/nc-automount-links-mon <<'EOF'
+#!/bin/bash
+inotifywait --monitor --event create --event delete --format '%f %e' /media/ | \
+  grep --line-buffered ISDIR | while read f; do
+    echo $f
+    sleep 0.5
+    /usr/local/etc/nc-automount-links
+done
+EOF
+  chmod +x /usr/local/etc/nc-automount-links-mon
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && {
+    systemctl disable --now nc-automount
+    systemctl disable --now nc-automount-links
+    rm -rf /etc/systemd/system/{mariadb,nfs-server,dphys-swapfile,fail2ban}.service.d
+    systemctl daemon-reload
+    echo "automount disabled"
+    return 0
+  }
+  systemctl enable  --now nc-automount
+  systemctl enable  --now nc-automount-links
+
+  # create delays in some units
+  mkdir -p /etc/systemd/system/mariadb.service.d
+  cat > /etc/systemd/system/mariadb.service.d/ncp-delay-automount.conf <<'EOF'
+[Service]
+ExecStartPre=/bin/sleep 20
+Restart=on-failure
+EOF
+
+  mkdir -p /etc/systemd/system/nfs-server.service.d
+  cat > /etc/systemd/system/nfs-server.service.d/ncp-delay-automount.conf <<'EOF'
+[Service]
+ExecStartPre=
+ExecStartPre=/bin/bash -c "/bin/sleep 30; /usr/sbin/exportfs -r"
+EOF
+
+  mkdir -p /etc/systemd/system/dphys-swapfile.service.d
+  cat > /etc/systemd/system/dphys-swapfile.service.d/ncp-delay-automount.conf <<'EOF'
+[Service]
+ExecStartPre=/bin/sleep 30
+EOF
+
+  mkdir -p /etc/systemd/system/fail2ban.service.d
+  cat > /etc/systemd/system/fail2ban.service.d/ncp-delay-automount.conf <<'EOF'
+[Service]
+ExecStartPre=/bin/sleep 10
+EOF
+
+  systemctl daemon-reload
+  echo "automount enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SYSTEM/nc-hdd-monitor.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+
+# Monitor HDD health automatically
+#
+# Copyleft 2018 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com
+#
+
+
+
+is_active()
+{
+  systemctl -q is-enabled smartmontools &>/dev/null
+}
+
+configure()
+{
+  local DRIVES=($(lsblk -ln | grep "^sd[[:alpha:]].*disk" | awk '{ print $1 }'))
+
+  [[ ${#DRIVES[@]} == 0 ]] && {
+    echo "no drives detected. Disabling.."
+  }
+
+  [[ "$ACTIVE" != yes ]] && {
+    systemctl disable --now smartmontools
+    echo "HDD monitor disabled"
+    return 0
+  }
+
+  cat > /usr/local/etc/ncp-hdd-notif.sh <<EOF
+#!/bin/bash
+EOF
+
+  [[ "$EMAIL" != "" ]] && {
+    cat >> /usr/local/etc/ncp-hdd-notif.sh <<EOF
+sendmail "$EMAIL" <<EOFMAIL
+Subject: Hard drive problems found
+
+"\$SMARTD_MESSAGE"
+EOFMAIL
+EOF
+  }
+
+  cat >> /usr/local/etc/ncp-hdd-notif.sh <<EOF
+source /usr/local/etc/library.sh
+wall "\$SMARTD_MESSAGE"
+notify_admin \
+  "NextCloudPi HDD health \$SMARTD_FAILTYPE" \
+  "\$SMARTD_MESSAGE"
+EOF
+chmod +x /usr/local/etc/ncp-hdd-notif.sh
+
+  cat > /etc/smartd.conf <<EOF
+# short scan every day at 1am, long one on sundays at 2am
+EOF
+
+  for dr in "${DRIVES[@]}"; do
+    local type=""
+    smartctl -d test /dev/${dr} &>/dev/null || {
+      smartctl -d sat -i /dev/${dr} &>/dev/null && type="-d sat"
+    }
+    smartctl ${type} --smart=on /dev/${dr} | sed 1,2d;
+
+    cat >> /etc/smartd.conf <<EOF
+/dev/${dr} -a ${type} -m ${EMAIL} -M exec /usr/local/etc/ncp-hdd-notif.sh -s (S/../.././01|L/../../7/02)
+EOF
+
+  done
+
+  systemctl enable --now smartmontools
+  echo "HDD monitor enabled"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/SYSTEM/nc-hdd-test.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# Check HDD health
+#
+# Copyleft 2018 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com
+#
+
+
+
+install()
+{
+  apt_install smartmontools
+  systemctl disable smartd
+  return
+}
+
+configure()
+{
+  local DRIVES=($(lsblk -ln | grep "^sd[[:alpha:]].*disk" | awk '{ print $1 }'))
+
+  [[ ${#DRIVES[@]} == 0 ]] && {
+    echo "no drives detected. Abort"
+    return 0
+  }
+
+  for dr in "${DRIVES[@]}"; do
+
+    local type=""
+    smartctl -d test /dev/${dr} &>/dev/null || {
+      smartctl -d sat -i /dev/${dr} &>/dev/null || { echo "couldnt detect device type"; return 1; }
+      type="-d sat"
+    }
+
+    smartctl --smart=on /dev/${dr} | sed 1,2d
+    if [[ "$SHORTTEST" == yes ]]; then
+      echo "* Starting test on $dr. Check results later"
+      smartctl $type -X "/dev/$dr" &>/dev/null
+      smartctl $type -t short "/dev/$dr" | sed 1,2d
+    elif [[ "$LONGTEST" == yes ]]; then
+      echo "* Starting test on $dr. Check results later"
+      smartctl $type -X "/dev/$dr" &>/dev/null
+      smartctl $type -t long "/dev/$dr" | sed 1,2d
+    else
+      echo "* Stats for $dr"
+      smartctl $type -a "/dev/$dr" | sed 1,2d
+    fi
+  done
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/SYSTEM/nc-info.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Print NCP sytem info
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+install()
+{ 
+  apt-get update
+  apt-get install -y --no-install-recommends bsdmainutils
+}
+
+configure() 
+{
+  echo "Gathering information..."
+  local OUT="$( bash /usr/local/bin/ncp-diag )"
+
+  # info
+  echo "$OUT" | column -t -s'|'
+
+  # suggestions
+  echo
+  bash /usr/local/bin/ncp-suggestions "$OUT"
+ 
+  return 0
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/SYSTEM/nc-ramlogs.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+
+# Data dir configuration script for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/
+#
+
+
+
+is_active()
+{
+  systemctl -q is-active log2ram &>/dev/null || systemctl -q is-active armbian-ramlog &>/dev/null
+}
+
+install()
+{
+  VERSION=1.5.2
+  [[ -d /var/log.hdd ]] || [[ -d /var/hdd.log ]] && { echo "log2ram detected, not installing"; return; }
+  cd /tmp
+  curl -Lo log2ram.tar.gz https://github.com/azlux/log2ram/archive/${VERSION}.tar.gz
+  tar xf log2ram.tar.gz
+  cd log2ram-${VERSION}
+  sed -i '/systemctl -q is-active log2ram/d' install.sh
+  sed -i '/systemctl enable log2ram/d' install.sh
+  chmod +x install.sh && sudo ./install.sh
+  cd ..
+  rm -r log2ram-${VERSION} log2ram.tar.gz
+  rm /etc/cron.daily/log2ram /usr/local/bin/uninstall-log2ram.sh
+}
+
+configure()
+{
+  [[ -f /lib/systemd/system/armbian-ramlog.service ]] && local ramlog=armbian-ramlog || local ramlog=log2ram
+
+  [[ $ACTIVE != "yes" ]] && {
+    systemctl disable "$ramlog"
+    systemctl stop    "$ramlog"
+    echo "Logs in SD. Reboot to take effect"
+    return
+  }
+
+  systemctl enable "$ramlog"
+  systemctl start  "$ramlog"
+
+  echo "Logs in RAM. Reboot to take effect"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/SYSTEM/nc-swapfile.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+
+# Data dir configuration script for NextcloudPi
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/
+#
+
+
+is_active()
+{
+  local DIR=$( swapon -s | sed -n 2p | awk '{ print $1 }' )
+  [[ "$DIR" != "" ]] && [[ "$DIR" != "/var/swap" ]]
+}
+
+configure()
+{
+  local ORIG="$( swapon | tail -1 | awk '{ print $1 }' )"
+  local DSTDIR="$(dirname "$SWAPFILE")"
+  [[ "$ORIG" == "$SWAPFILE" ]] && { echo "nothing to do";                    return 0; }
+  [[ -d "$SWAPFILE"         ]] && { echo "$SWAPFILE is a directory. Abort"; return 1; }
+  [[ -d "$DSTDIR"            ]] || { echo "$DSTDIR Doesn't exist. Abort";     return 1; }
+
+  [[ "$( stat -fc%T "$DSTDIR" )" == "btrfs" ]] && {
+    echo "BTRFS doesn't support swapfiles. You can still use nc-zram"
+    return 1
+  }
+
+  [[ $( stat -fc%d / ) == $( stat -fc%d "$DSTDIR" ) ]] && \
+    echo -e "INFO: moving swapfile to another place in the same SD card\nIf you want to use an external mount, make sure it is properly set up"
+
+  sed -i "s|#\?CONF_SWAPFILE=.*|CONF_SWAPFILE=$SWAPFILE|" /etc/dphys-swapfile
+  sed -i "s|#\?CONF_SWAPSIZE=.*|CONF_SWAPSIZE=$SWAPSIZE|" /etc/dphys-swapfile
+  grep -q vm.swappiness /etc/sysctl.conf || echo "vm.swappiness = 10" >> /etc/sysctl.conf && sysctl --load &>/dev/null
+
+  dphys-swapfile setup && dphys-swapfile swapon && {
+    [[ -f "$ORIG" ]] && swapoff "$ORIG" && rm -f "$ORIG"
+    echo "swapfile moved successfully"
+    return 0
+  }
+
+  echo "moving swapfile failed"
+  return 1
+}
+
+install()
+{
+  if [[ "$(stat -fc%T /var)" != "btrfs" ]]; then
+    apt_install dphys-swapfile
+  fi
+}
+
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/SYSTEM/nc-zram.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+
+# NextcloudPi ZRAM settings
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/
+#
+
+
+install()
+{
+  cat > /etc/systemd/system/zram.service <<EOF
+[Unit]
+Description=Set up ZRAM
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/ncp-zram start
+ExecStop=/usr/local/bin/ncp-zram  stop
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sysinit.target
+EOF
+
+cat > /usr/local/bin/ncp-zram <<'EOF'
+#!/bin/bash
+# inspired by https://github.com/novaspirit/rpi_zram/blob/master/zram.sh
+
+case "$1" in
+  start)
+      CORES=$(nproc --all)
+      modprobe zram num_devices=$CORES || exit 1
+
+      swapoff -a
+
+      TOTALMEM=`free | grep -e "^Mem:" | awk '{print $2}'`
+      MEM=$(( ($TOTALMEM / $CORES)* 1024 ))
+
+      core=0
+      while [ $core -lt $CORES ]; do
+        echo $MEM > /sys/block/zram$core/disksize
+        mkswap /dev/zram$core
+        swapon -p 5 /dev/zram$core
+        let core=core+1
+      done
+      ;;
+
+  stop)
+      swapoff -a
+      rmmod zram
+      ;;
+  *)
+      echo "Usage: $0 {start|stop}" >&2
+      exit 1
+      ;;
+esac
+EOF
+chmod +x /usr/local/bin/ncp-zram
+}
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && { 
+    systemctl stop    zram
+    systemctl disable zram
+    echo "ZRAM disabled"
+    return 0
+  }
+  systemctl start  zram
+  systemctl enable zram
+  echo "ZRAM enabled"
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/TOOLS/clear-php-opcache.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# Fix permissions of the data files, in case they were copied externally
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+configure()
+{
+  echo "Clearing opcache..."
+  bash -c "sleep 5; source /usr/local/etc/library.sh; clear_opcache;" &>/dev/null &
+  echo "Done."
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/TOOLS/nc-fix-permissions.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Fix permissions of the data files, in case they were copied externally
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+configure()
+{
+  local DATADIR
+  DATADIR=$( get_nc_config_value datadirectory ) || {
+    echo "data directory not found";
+    return 1;
+  }
+  echo -ne "fixing permissions in $DATADIR... "
+  chown -R www-data:www-data "$DATADIR"/*/files
+  chmod -R u+rw              "$DATADIR"/*/files
+  echo "done"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/TOOLS/nc-format-USB.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+
+# Format a USB external drive as a unique BTRFS partition
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+configure()
+{
+  # count all disk devices except mmcblk0
+  local mounts
+  local found=false
+  local root_disk
+
+  while read -r line
+  do
+    if [[ "$found" != "true" ]]
+    then
+      mounts="$(rev <<<"$line" | cut -d" " -f1 | rev)"
+      [[ "$mounts" =~ (^|'\x0a')/($|'\x0a') ]] && {
+        echo "$line"
+        found=true
+      }
+    fi
+
+    if [[ "$found" == "true" ]]
+    then
+      if [[ "$(cut -d" " -f6 <<<"$line")" == "disk" ]]
+      then
+        root_disk="$(cut -d" " -f1 <<<"$line")"
+        break
+      fi
+    fi
+  done < <( lsblk -nr | tac )
+
+  [[ -n "$root_disk" ]] || {
+    echo "ERROR: Could not determine root disk!"
+    return 1
+  }
+
+  local NUM=$( lsblk -ln | grep "^sd[[:alpha:]].*disk" | grep -v "^$root_disk" | awk '{ print $1 }' | wc -l )
+
+  # only one plugged in
+  [[ $NUM != 1 ]] && {
+    echo "ERROR: counted $NUM devices. Please, only plug in the USB drive you want to format";
+    return 1;
+  }
+
+  DATADIR="$(get_nc_config_value datadirectory || true)"
+  if [[ $( stat -fc%d / ) != $( stat -fc%d "$DATADIR" ) ]] || [[ -z "$DATADIR" ]] && [[ "$ALLOW_DATADIR_REMOVAL" != "yes" ]]
+  then
+    echo "ERROR: Data directory is on USB drive (or can't be determined) and removal of data directory was not explicitly allowed." \
+      "Please move the data directory to SD before formatting the USB drive." \
+      "If you are certain that the data directory is not on this USB drive, check 'Allow data directory removal'." \
+      "Exiting..."
+    return 1
+  fi
+
+  # disable nc-automount if enabled
+  killall -STOP udiskie 2>/dev/null
+
+  # umount if mounted
+  umount /media/USBdrive* &> /dev/null
+
+  # check still not mounted
+  for dir in $( ls -d /media/* 2>/dev/null ); do
+    mountpoint -q $dir && { echo "$dir is still mounted"; return 1; }
+  done
+
+  # do it
+  local NAME=( $( lsblk -ln | grep "^sd[[:alpha:]].*disk" | awk '{ print $1 }' ) )
+  [[ ${#NAME[@]} != 1 ]] && { echo "unexpected error"; return 1; }
+
+  wipefs -a -f /dev/"$NAME"                              || return 1
+  parted /dev/"$NAME" --script -- mklabel gpt            || return 2
+  parted /dev/"$NAME" --script -- mkpart primary 0% 100% || return 3
+  sleep 0.5
+  mkfs.btrfs -q /dev/"${NAME}1" -f -L "$LABEL"
+  local RET=$?
+
+  # enable nc-automount if enabled
+  killall -CONT udiskie 2>/dev/null
+  [ $RET -eq 0 ] && echo "Drive $NAME formatted successfuly and labeled $LABEL"
+  return $RET
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/TOOLS/nc-maintenance.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Turn maintenance mode on or off
+#
+# Copyleft 2019 by Yi Chi 齊一 <chiyi4869 _a_t_ gmail _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://www.cotpear.com
+# Made in Taiwan (Republic of China)
+#
+
+is_active()
+{
+  grep -q enabled <(ncc maintenance:mode)
+}
+
+configure()
+{
+  [[ "$ACTIVE" != "yes" ]] && {
+    ncc maintenance:mode --off
+    return $?
+  }
+  ncc maintenance:mode --on
+}
+
+install(){ :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/TOOLS/nc-previews.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# Generate previews for the gallery
+#
+# Copyleft 2018 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at nextcloudpi.com
+#
+
+
+configure()
+{
+  pgrep -af preview:pre-generate &>/dev/null || pgrep -af preview:generate-all &>/dev/null && {
+    echo "nc-previews is already running"
+    return 1
+  }
+
+  [[ "$CLEAN" == "yes" ]] && {
+    local datadir
+    datadir=$( get_nc_config_value datadirectory ) || {
+      echo "data directory not found";
+      return 1;
+    }
+
+    rm -r "$datadir"/appdata_*/preview/* &>/dev/null
+    mysql nextcloud <<<"delete from ${DB_PREFIX?}filecache where path like \"appdata_%/preview/%\""
+    ncc files:scan-app-data -n
+  }
+
+  [[ "$INCREMENTAL" == "yes" ]] && {
+    for i in $(seq 1 $(nproc)); do
+      ncc preview:pre-generate -n -vvv &
+    done
+    wait
+    return
+  }
+
+  for i in $(seq 1 $(nproc)); do
+    [[ "$PATH1" != "" ]] && PATH_ARG=(-p "$PATH1")
+    ncc preview:generate-all -n -v ${PATH_ARG[@]} &
+  done
+  wait
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/TOOLS/nc-scan.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+
+# Synchronize NextCloud for externally modified files
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+install()
+{
+  cat > /usr/local/bin/ncp-scan <<'EOF'
+#!/bin/bash
+ncc files:scan -n -v --all
+EOF
+  chmod +x /usr/local/bin/ncp-scan
+}
+
+configure()
+{
+  grep -q enabled <(ncc maintenance:mode) && { echo "Cannot run ncp-scan while in maintenance mode"; exit 1; }
+
+  local ret=0
+
+  [[ "$RECURSIVE"   == no  ]] && local recursive=--shallow
+  [[ "$NONEXTERNAL" == yes ]] && local non_external=--home-only
+
+  [[ "$PATH1" != "" ]] && {
+    ncc files:scan -n -v $recursive $non_external -p "$PATH1"
+    [[ $? -ne 0 ]] && ret=1
+  }
+
+  [[ "$PATH2" != "" ]] && {
+    ncc files:scan -n -v $recursive $non_external -p "$PATH2"
+    [[ $? -ne 0 ]] && ret=1
+  }
+
+  [[ "$PATH3" != "" ]] && {
+    ncc files:scan -n -v $recursive $non_external -p "$PATH3"
+    [[ $? -ne 0 ]] && ret=1
+  }
+
+  [[ "${PATH1}${PATH2}${PATH3}" == "" ]] && {
+    ncc files:scan -n -v $recursive $non_external --all
+    [[ $? -ne 0 ]] && ret=1
+  }
+
+  return ${ret}
+}
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA

bin/ncp/UPDATES/nc-autoupdate-nc.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Automatically apply Nextcloud updates
+#
+# Copyleft 2018 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+# just change NCLATESTVER and re-activate in update.sh to upgrade users
+
+configure()
+{
+  [[ "$ACTIVE" != "yes" ]] && {
+    rm -f /etc/cron.daily/ncp-autoupdate-nc
+    echo "automatic Nextcloud updates disabled"
+    return 0
+  }
+
+  cat > /etc/cron.daily/ncp-autoupdate-nc <<EOF
+#!/bin/bash
+source /usr/local/etc/library.sh
+
+echo -e "[ncp-update-nc]"                              >> /var/log/ncp.log
+/usr/local/bin/ncp-update-nc "latest" 2>&1 | tee -a /var/log/ncp.log
+
+if [[ \${PIPESTATUS[0]} -eq 0 ]]; then
+
+  VER="\$(nc_version)"
+
+  notify_admin "NextCloudPi" "Nextcloud was updated to \$VER"
+fi
+echo "" >> /var/log/ncp.log
+EOF
+  chmod 755 /etc/cron.daily/ncp-autoupdate-nc
+  echo "automatic Nextcloud updates enabled"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+

bin/ncp/UPDATES/nc-autoupdate-ncp.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# Automatically apply NextcloudPi updates
+#
+# Copyleft 2017 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
+# GPL licensed (see end of file) * Use at your own risk!
+#
+# More at: https://ownyourbits.com
+#
+
+
+configure()
+{
+  [[ $ACTIVE != "yes" ]] && { 
+    rm -f /etc/cron.daily/ncp-autoupdate
+    echo "automatic NextCloudPi updates disabled"
+    return 0
+  }
+
+  cat > /etc/cron.daily/ncp-autoupdate <<EOF
+#!/bin/bash
+source /usr/local/etc/library.sh
+# Forward all output to the ncp log
+exec >> /var/log/ncp.log 2>&1
+echo "\$(date) - Running \$0..."
+if /usr/local/bin/ncp-test-updates; then
+  /usr/local/bin/ncp-update || exit 1
+  notify_admin "NextCloudPi" "NextCloudPi was updated to \$(cat /usr/local/etc/ncp-version)"
+fi
+EOF
+  chmod 755 /etc/cron.daily/ncp-autoupdate
+  echo "automatic NextCloudPi updates enabled"
+}
+
+install() { :; }
+
+# License
+#
+# This script is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This script is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this script; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+# Boston, MA  02111-1307  USA
+