Help using networks with quadlet

[samuel-garmany]

I'm pretty new to using quadlets outside of simple stuff but I am trying to setup nextcloud. I have three containers, and I know they run okay as a compose file but when I converted them to quadlets using the podlet tool I ran into issues that I've spent the afternoon debugging and I just don't understand what's wrong.

I have these four files right now:

nextcloud.network:

[Network]
Driver=bridge

nextcloud-db.container:

[Unit]
Description=MariaDB container for Nextcloud
Requires=nextcloud.network
After=nextcloud.network

[Container]
Environment=MYSQL_ROOT_PASSWORD=(hidden) MYSQL_PASSWORD= MYSQL_DATABASE=nextcloud MYSQL_USER=nextcloud
Exec='--transaction-isolation=READ-COMMITTED' '--log-bin=binlog' '--binlog-format=ROW'
Image=mariadb:10.6
Network=nextcloud
Volume=db:/var/lib/mysql

[Service]
Restart=always

nextcloud-app.container:

[Unit]
Description=Nextcloud application container
Wants=db.service
After=db.service

[Container]
Environment=MYSQL_PASSWORD=(hidden) MYSQL_DATABASE=nextcloud MYSQL_USER=nextcloud MYSQL_HOST=db
Image=nextcloud
Network=nextcloud
Volume=/mnt/data/nextcloud:/var/www/html:Z

[Service]
Restart=always

nextcloud-caddy.container:

[Unit]
Description=Caddy reverse proxy for Nextcloud
Wants=app.service
After=app.service

[Container]
AddCapability=NET_ADMIN
Image=caddy:latest
Network=nextcloud
PublishPort=80:80
PublishPort=443:443
PublishPort=443:443/udp
Volume=%h/.config/caddy/Caddyfile:/etc/caddy/Caddyfile:Z
Volume=caddy_data:/data
Volume=caddy_config:/config

[Service]
Restart=always

For some reason when I try to start any of them I get: Error: unable to find network with name or ID nextcloud: network not found and the container fails to start.

I assume theres some issue with how I use the Network= tag or maybe with the db.container Wants section but I can't figure out what's wrong, I'm pretty sure it's simple I'm just new to this. Thanks everyone!

[eriksjolund]

Does it work if you append .network?

Network=mynet.network

Reference:
If the name of the network ends with .network, a Podman network called systemd-$name is used, and the generated systemd service contains a dependency on the $name-network.service. Such a network can be automatically created by using a $name.network Quadlet file. Note: the corresponding .network file must exist.

https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#network

Side note 1
Regarding

PublishPort=80:80
PublishPort=443:443
PublishPort=443:443/udp

in your file nextcloud-caddy.container

Assuming you are running podman on a Linux system that has systemd, you could remove those lines and instead use socket activation

https://github.com/eriksjolund/podman-caddy-socket-activation/tree/main/examples/example4

Caddy will then see the correct source IP address of incoming connections. That can otherwise be a problem when running a container in a custom network with rootless Podman.

Side note 2
I also tried writing quadlets for nextcloud
https://github.com/eriksjolund/nextcloud-podman/
(but I used nginx instead of caddy).

[samuel-garmany]

That was it thank you!

I think nginx might makes more sense for this so I could use the nextcloud-fpm package and only have one webserver but I don't have any experience with reverse proxies and I saw that Caddy was supposedly easier. Do you still use your setup?

Because quadlets are pretty new and Podman isn't as popular I haven't seen that many nextcloud setups, and I've seen none with https support. I would love to have a really good one that I could put in these forums or something so other people don't have to struggle through all this.

[eriksjolund]

nginx might makes more sense for this so I could use the nextcloud-fpm package

I think it should be possible to use caddy together with the image docker.io/library/nextcloud:fpm

A google search provided:
https://help.nextcloud.com/t/how-to-setup-caddy-container-for-nextcloud-fpm-alpine/184230

That example uses a pod. I think it's probably better to not use a pod because then you have the possibility
to map UIDs and GIDs with UIDMap=, GIDMap= or UserNS= differently for each container.

Do you still use your setup?

I never actually used it. I just did this as an experiment to see if it is possible to use keep-id to map uids and gids so that
all files in the bind-mounted directories would have the ownership of the regular user on the host.
This can be important for people that use a bind-mounted directory on NFS (where subuids and subgids might not be able to write files)

For example

UserNS=keep-id:uid=33,gid=33

can be used together with

Image=docker.io/library/nextcloud:fpm

to have all files and directories in ~/nextcloud-data owned by the regular user on the host

$ podman unshare find ~/nextcloud-data -not -user 0
$ podman unshare find ~/nextcloud-data -not -group 0
$

For details, see
https://github.com/eriksjolund/nextcloud-podman/blob/9b01bdfa282f84d6a5b4d18cd9df5d62ae9e0ea2/nextcloud.container#L23