CrowdSec•4w ago

Nextcloud AIO Docker Container and Crowdsec

Hi, I run Nextcloud AIO (NC AIO) in docker and would like to also use the Crowdsec docker container. From my limited understanding, Crowdsec works by parsing the webserver logs and I do know that NC AIO uses apache as it's webserver, so the Crowdsec container will need to be able to parse the apache log files. I'm just not sure how to make this happen and was hoping someone with knowledge could help me out here. Thank you 🙂

31 Replies

CrowdSec•4w ago

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

_KaszpiR_•4w ago

how do you run the container (command or docker-compose please)?

fleabeardOP•4w ago

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 80:80
      - 8080:8080
      - 8443:8443
volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 80:80
      - 8080:8080
      - 8443:8443
volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

_KaszpiR_•4w ago

ok, first of all don't use latest tag, use explicit tag or digest (it will save you some maintenance horrors for later)

fleabeardOP•4w ago

Ah, so pin it to a specific version?

_KaszpiR_•4w ago

yeah

fleabeardOP•4w ago

Cool, I'll pin it to nextcloud/all-in-one:20250325_084656

_KaszpiR_•4w ago

oh god they use supervisord inside

_KaszpiR_•4w ago

seems like they use /usr/local/apache2/logs) ( https://github.com/nextcloud/all-in-one/blob/main/Containers/apache/Dockerfile#L77 ) for apache logs

GitHub

all-in-one/Containers/apache/Dockerfile at main · nextcloud/all-in...

📦 The official Nextcloud installation method. Provides easy deployment and maintenance with most features included in this one Nextcloud instance. - nextcloud/all-in-one

_KaszpiR_•4w ago

chmod 777 -R /usr/local/apache2/logs

chmod 777 -R /usr/local/apache2/logs

um what, I'd serioulsy reconsider not using that XD ok, so you could do docker exec -it <id of the container> --entrypoint=bash ls -la /usr/local/apache2/logs to see if the apache logs are actually there if yes then the easiest fix would to stop te docker-compose, edit docker compose file to add volume as host path from host to the container and then start the container - this way apache logs will be availabe on the host

fleabeardOP•4w ago

docker exec -it nextcloud-aio-apache ls -la /usr/local/apache2/logs
total 8
drwxrwxrwx    2 root     root            60 Sep  6 07:48 .
drwxr-xr-x    1 www-data www-data      4096 Aug 29 05:30 ..
-rw-r--r--    1 www-data www-data         3 Sep  6 07:48 httpd.pid

docker exec -it nextcloud-aio-apache ls -la /usr/local/apache2/logs
total 8
drwxrwxrwx    2 root     root            60 Sep  6 07:48 .
drwxr-xr-x    1 www-data www-data      4096 Aug 29 05:30 ..
-rw-r--r--    1 www-data www-data         3 Sep  6 07:48 httpd.pid

_KaszpiR_•4w ago

then you can edit crowdsec to mount that host path in that container to process the logs

_KaszpiR_•4w ago

https://github.com/nextcloud/all-in-one/blob/main/Containers/apache/supervisord.conf#L16

GitHub

all-in-one/Containers/apache/supervisord.conf at main · nextcloud/...

📦 The official Nextcloud installation method. Provides easy deployment and maintenance with most features included in this one Nextcloud instance. - nextcloud/all-in-one

_KaszpiR_•4w ago

eh, they run apache under supervisord as foreground process and tehy actually drop apache logs - so it will not log to files

fleabeardOP•4w ago

Ah, so it's not possible to have Crowdsec parse logs if they are dropping them huh?

_KaszpiR_•4w ago

well it is possible but it's more complicated few options, first one: - on the host create custom supervisord. config, as on https://github.com/nextcloud/all-in-one/blob/main/Containers/apache/supervisord.conf#L16 and edit line 13 to set stdout_logfile=stdout - edit docker-compose volumes and mount that supervisord.conf from the host inside the container un the path (not sure where, though, would need more investigation) - then run docker compose, you should have a real flood of messages in the docker - then you coudl edit crowdsec container to read logs from the host, but may require adjusting them because apache logs via supervisord may have extra prefixes (such as process name and timestamps from supervisord), so that crwodsec may nedd to be adjusted

fleabeardOP•4w ago

Ah, sounds like going with the all-in-one container has introduced a lot of unnecessary complexity for me.

_KaszpiR_•4w ago

another option: - similiar to above but make apache run in the background (but supervisord would see the process would exit which is a problem) - in that case apache would log to the file paths, and you could cross mount that path to host and from host to crowdsec - having raw apache logs would be the best

fleabeardOP•4w ago

Well, this is all far too complicated for me and would make things far more difficult to maintain in the future I'm sure. I appreciate you looking into this for me. I may reconsider the choice of using AIO.

_KaszpiR_•4w ago

frankly speaking I'd use https://hub.docker.com/_/nextcloud/

nextcloud - Official Image | Docker Hub

Nextcloud manual docker image

_KaszpiR_•4w ago

or even fpm tag, and link it via nginx or apache this way you have just the app with the php worker, and nothing else

fleabeardOP•4w ago

@KaszpiR I'm curious, would we be able to instead parse the nextcloud.log?

fleabeardOP•4w ago

https://app.crowdsec.net/hub/author/crowdsecurity/collections/nextcloud if you look at the nextcloud collection, it only uses the nextcloud log

Collections, AppSec Rules & Configurations | CrowdSec Hub

Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.

fleabeardOP•4w ago

After much searching I found it in

sudo ls -l /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data
total 65192
-rw-r----- 1 www-data www-data  8354254 Sep  7 17:09 audit.log
-rw-r--r-- 1 www-data www-data        0 Aug  4 16:46 index.html
-rw-r--r-- 1 www-data www-data   463824 Aug  4 16:48 install.log
-rw-r----- 1 www-data www-data    20191 Sep  7 17:09 nextcloud.log
-rw-r----- 1 www-data www-data 57876918 Aug 27 19:37 nextcloud.log.1
-rw-r--r-- 1 www-data www-data    11347 Aug 27 19:37 update.log

sudo ls -l /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data
total 65192
-rw-r----- 1 www-data www-data  8354254 Sep  7 17:09 audit.log
-rw-r--r-- 1 www-data www-data        0 Aug  4 16:46 index.html
-rw-r--r-- 1 www-data www-data   463824 Aug  4 16:48 install.log
-rw-r----- 1 www-data www-data    20191 Sep  7 17:09 nextcloud.log
-rw-r----- 1 www-data www-data 57876918 Aug 27 19:37 nextcloud.log.1
-rw-r--r-- 1 www-data www-data    11347 Aug 27 19:37 update.log

I'm going to see if I can bind mount it

light•4w ago

I have been using crowdsec with nextcloud for many years now and more recently started using it with AIO. The main difference with AIO is that now the logs are inside a AIO defined docker volume rather than a human defined persistent volume. Usually it's as simple as mounting the nextcloud logs path to crowdsec, but I use Unraid which stores non user defined storage in an image, so I had to convert that to a file storage rather than image storage, and then mount the logs to the crowdsec container. For you it might be as simple as mounting the logs

light•4w ago

That's my crowdsec mount points if helpful

_KaszpiR_•4w ago

@fleabeard you probably want to parse both - apache and nextcloud logs

light•4w ago

Last I checked, AIO recommends using reverse proxy, and does not expose access logs - https://github.com/nextcloud/all-in-one/discussions/1563 In my case, the traefik access logs are parsed by crowdsec

GitHub

Where is my access log? · nextcloud all-in-one · Discussion #1563

I recently moved from a classic nextcloud installation to aio and do only start to get comfortable with docker. So sry if this question is somehow "stupid". My basic setup is working incl...

fleabeardOP•4w ago

Thanks, I've used SWAG in the past but wasn't sure if it would help in this case or not. I may go back to it just to see. Actually it won't help here because CrowdSec doesn't use the reverse proxy logs...

light•4w ago

In my case Crowdsec uses the reverse proxy - traefik logs

Willpower•4w ago

this is what I use as well /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data/nextcloud.log I have it mounted at /var/log/nextcloud/nextcloud.log within the container Also on unraid

Gaming

Programming

Nextcloud AIO Docker Container and Crowdsec

Did you find this page helpful?