newkle3r
139 lines
3.8 KiB
Markdown
139 lines
3.8 KiB
Markdown
# Deployment guide
|
||
|
||
## Target layout (example)
|
||
|
||
| Service | Host | Port |
|
||
|---------|------|------|
|
||
| Nextcloud | `https://cloud.example.com` | 443 |
|
||
| Node-RED | same VM, `192.168.1.26` | 1880 |
|
||
|
||
Node-RED must be reachable from users’ browsers (for the iframe) and from itself (for API calls to Nextcloud).
|
||
|
||
## 1. Deploy Node-RED (Docker)
|
||
|
||
On the Ubuntu VM:
|
||
|
||
```bash
|
||
cd /home/ncadmin/nextcloud-node-red # or your clone path
|
||
git pull # get latest nodes + entrypoint
|
||
|
||
docker compose build --no-cache
|
||
docker compose up -d
|
||
```
|
||
|
||
Or without Compose:
|
||
|
||
```bash
|
||
docker build --no-cache -t nextcloud-node-red:latest .
|
||
docker rm -f nextcloud-node-red 2>/dev/null || true
|
||
docker run -d \
|
||
--name nextcloud-node-red \
|
||
--network host \
|
||
-v node-red-data:/data \
|
||
--restart unless-stopped \
|
||
nextcloud-node-red:latest
|
||
```
|
||
|
||
Verify:
|
||
|
||
```bash
|
||
docker logs -n 30 nextcloud-node-red
|
||
# Expect: [entrypoint] Installing nextcloud nodes...
|
||
# User directory : /data
|
||
|
||
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:1880/
|
||
# Expect: 200
|
||
```
|
||
|
||
### Nextcloud URL in config nodes
|
||
|
||
Inside Node-RED, set **Nextcloud URL** to something the **container** can resolve:
|
||
|
||
| Scenario | URL |
|
||
|----------|-----|
|
||
| Nextcloud on same VM, host networking | `https://127.0.0.1` or `https://cloud.example.com` |
|
||
| Nextcloud on another host | `https://192.168.1.x` or public hostname |
|
||
|
||
Test from inside the container:
|
||
|
||
```bash
|
||
docker exec nextcloud-node-red wget -qO- --no-check-certificate \
|
||
https://cloud.example.com/status.php
|
||
```
|
||
|
||
## 2. Deploy Nextcloud app
|
||
|
||
```bash
|
||
sudo cp -r nodered-embed /var/www/nextcloud/apps/
|
||
sudo chown -R www-data:www-data /var/www/nextcloud/apps/nodered-embed
|
||
sudo -u www-data php /var/www/nextcloud/occ app:enable nodered_embed
|
||
```
|
||
|
||
Configure in **Settings → Administration → Node-RED Embed**:
|
||
|
||
- **Node-RED URL:** `http://192.168.1.26:1880` (use the address clients use; not `127.0.0.1` unless only local admins use it)
|
||
|
||
## 3. Reverse proxy (optional)
|
||
|
||
If Node-RED is behind nginx/Apache with TLS:
|
||
|
||
- Ensure the proxy does **not** send `X-Frame-Options: DENY` (blocks iframe embed).
|
||
- Point Nextcloud admin URL to the public HTTPS URL, e.g. `https://nodered.example.com`.
|
||
|
||
If Nextcloud is behind a proxy, CSP host extraction uses the hostname from `nodered_url` — use the same hostname users load in the iframe.
|
||
|
||
## 4. Firewall
|
||
|
||
Allow **1880/tcp** (or your mapped port) from Nextcloud users’ networks if they open the embed from LAN/VPN.
|
||
|
||
## 5. Updating custom nodes
|
||
|
||
After changing files under `nodes/nextcloud-ocs/`:
|
||
|
||
```bash
|
||
docker builder prune -af # optional, avoids stale COPY cache
|
||
docker build --no-cache -t nextcloud-node-red:latest .
|
||
docker restart nextcloud-node-red
|
||
```
|
||
|
||
Confirm version:
|
||
|
||
```bash
|
||
docker exec nextcloud-node-red cat \
|
||
/data/node_modules/node-red-contrib-nextcloud-ocs/package.json | grep version
|
||
```
|
||
|
||
### When to delete the volume
|
||
|
||
Delete `node-red-data` only if:
|
||
|
||
- Palette shows wrong/old nodes after rebuild, or
|
||
- Entrypoint copy failed with permission errors from old root-owned files
|
||
|
||
**Warning:** removes all flows and credentials.
|
||
|
||
```bash
|
||
docker rm -f nextcloud-node-red
|
||
docker volume rm node-red-data
|
||
docker compose up -d
|
||
```
|
||
|
||
## 6. Backup
|
||
|
||
Back up the Docker volume:
|
||
|
||
```bash
|
||
docker run --rm -v node-red-data:/data -v $(pwd):/backup alpine \
|
||
tar czf /backup/node-red-data-backup.tar.gz -C /data .
|
||
```
|
||
|
||
Restore by extracting into a new volume before first start.
|
||
|
||
## 7. Production checklist
|
||
|
||
- [ ] Set `credentialSecret` in Node-RED settings (`/data/settings.js`)
|
||
- [ ] Use app passwords with minimal needed scopes
|
||
- [ ] TLS on Nextcloud; consider TLS on Node-RED if exposed beyond LAN
|
||
- [ ] Restrict who can access Node-RED (firewall / VPN / admin-only NC group)
|
||
- [ ] Enable Nextcloud app only for trusted admins if flows can access sensitive data
|