$ show sunweaver/nextcloud-high-performance-backend-setup
This repository is a Bash-based server provisioning tool that converts a bare Debian 13 (Trixie) VPS into a dedicated Nextcloud High-Performance Backend (HPB) server. It installs and wires together the full Talk/HPB stack: nextcloud-spreed-signaling (built from source or from Debian packages), NATS message bus, coturn TURN/STUN server, Janus WebRTC gateway, and Collabora Online (CODE) for document editing, all fronted by an Nginx reverse proxy with Let's Encrypt certificates (separate RSA and ECDSA chains), UFW firewall, unattended-upgrades, and msmtp for email notifications. The output is a secrets file containing the Talk app credentials, TURN credentials, and per-Nextcloud-domain shared secrets that an administrator pastes into the Nextcloud Talk/Office settings. It supports multiple Nextcloud domains and can run fully unattended via a settings.sh file or interactively through whiptail dialogs. Architecturally it is a monolithic orchestrator (setup-nextcloud-hpb.sh) that loads settings, renders placeholder-based config templates from data/ into a temporary directory, then sources modular install_* functions from src/setup-{ufw,collabora,signaling,nginx,certbot,unattendedupgrades,msmtp}.sh. The configuration files under data/ are upstream service configs (Janus, coturn, signaling-server, nginx, coolwsd) with <PLACEHOLDER> tokens substituted via sed/perl. The design shows real operational craftsmanship: a dry-run mode is threaded through every step, deploy_file() uses SHA-256 checksums to make deployments idempotent, external IP detection has fallback endpoints, and secrets are written to a 0640 file while being masked in logs. The most reusable components are isolated shell patterns rather than whole modules: the checksum-based deploy_file() and perl-based replace_placeholder_in_files() functions in the main script (placeholder substitution that survives arbitrary password characters), the Certbot rate-limit/staging-certificate handling in src/setup-certbot.sh, and the version-marker + .deb cache build system for Janus in src/setup-signaling.sh. These patterns can be lifted into other provisioning projects. Caveats: the code has no tests, relies heavily on global variables shared across sourced modules, and contains a few real defects — the dry-run dialog always sets DRY_RUN=true when the setting is left empty, and the SSH-disable check compares the literal string 'DISABLE_SSH_SERVER' instead of the variable, so that feature never activates. Several commented-out legacy blocks remain. Despite this, the project is actively maintained (release 1.3.6, July 2026) and targets the current Debian release.
The LLM identified 4 files worth highlighting for reuse:
The setup orchestrator contains three genuinely reusable shell patterns. (1) deploy_file() compares SHA-256 checksums of source and target before copying, making repeated runs idempotent and preserving user-modified configs. (2) replace_placeholder_in_files() uses perl with environment variables to replace placeholders with values containing arbitrary characters (backslashes, pipes, slashes), immune to sed escaping bugs — useful anywhere secrets must be injected into config templates. (3) is_dry_run() returns inverted exit codes so callers chain 'is_dry_run "would do X" || actual_command', giving every step a dry-run path. Also noteworthy: external-IP detection with primary/fallback HTTP endpoints and a centralized secrets file generation routine with strict permissions (0640).
A robust Certbot automation module. It parses the human-readable output of 'certbot certificates' to determine whether an existing certificate matches the expected cert name and normalized domain set and has more than 30 days of validity, skipping redundant re-issuance. It detects Let's Encrypt rate-limit errors from log output and offers the user a staging-certificate fallback (--staging --break-my-certs) with an automatic retry loop. It issues separate 4096-bit RSA and ECDSA certificates and orchestrates a renewal deploy hook. The 'check existing cert before issuing, fall back to staging on rate limit' logic is directly portable to any certbot-driven provisioning flow.
Handles building nextcloud-spreed-signaling and Janus from source on Debian 13. The should_skip_build() helper compares a version marker file against the current upstream version and the existence of the installed binary, enabling idempotent rebuilds. The run_with_progress() helper runs a command in the background, prints animated progress dots, captures the exit code without tripping 'set -e', and shows the last 15 log lines on failure. Janus builds are cached as .deb packages under /var/lib/nextcloud-hpb-setup/cache and reused on subsequent runs, avoiding recompilation. Janus configuration is selected by architecture (x86_64, aarch64, powerpc64le). The version-marker + binary-cache pattern generalizes to any periodic 'build from source only when upstream changes' provisioning task.
A self-contained Certbot renewal deploy hook. After each certificate renewal it normalizes permissions on /etc/letsencrypt/{archive,live} so the ssl-cert group (nginx, coturn) can read private keys, then reloads-or-restarts any active service consuming the certificates. It is a small, clean, dependency-free hook that could be adopted in any Let's Encrypt + nginx/coturn deployment without modification.