Isolate Nextcloud-AIO in DMZ and the required outbound Connection

[tweak19]

Hi,
I wanna ask if anybody can tell me what DNS-Destinations are required to completly isolate my nextcloud aio setup.
My idea is to block it completly from the internet (outbound) and only allow the needed destinations.

Thanks for your feedback

[szaimen]

Hi, see https://github.com/nextcloud/all-in-one?tab=readme-ov-file#can-i-run-aio-offline-or-in-an-airgapped-system

[tweak19]

Hi,
yeah that's not new. But as far as I know nextcloud is able to run airgapped.
So i think it should be possible to filter only for the needed dns-destinations, like market-place, dockerhub, e.g.

Nobody done this before?

[szaimen]

Nobody done this before?

It looks like you are the first one. So you would need to investigate which domains are actually required to be reachable yourself. We could then add this to the readme.

Some starting points:

• https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#connections-to-remote-servers

• all-in-one/php/src/Docker/DockerHubManager.php

  Line 30 in 97dcab5

  'https://auth.docker.io/token?service=registry.docker.io&scope=repository:' . $name . ':pull'

• all-in-one/php/src/Docker/DockerHubManager.php

  Line 38 in 97dcab5

  'https://registry-1.docker.io/v2/'.$name.'/manifests/' . $tag,

• probably more