feat(admin): installation wizard supports SSL/TLS database connection

admin_manual/configuration_database/linux_database_configuration.rst

@@ -191,9 +191,11 @@ Adjust the paths to the pem files for your environment.
 .. tip::
    The encrypted connection can also be set up during the installation, so that
    no unencrypted connection is used at any point. See
-   :ref:`autoconfig_database_encryption_label` when installing with an
-   autoconfig file, or :ref:`command_line_installation_ssl_label` when
-   installing with ``occ maintenance:install``.
+   :ref:`installation_wizard_database_encryption_label` when installing with the
+   Installation Wizard, :ref:`autoconfig_database_encryption_label` when
+   installing with an autoconfig file, or
+   :ref:`command_line_installation_ssl_label` when installing with
+   ``occ maintenance:install``.
 
 .. _db-config-postgresql-label:
 
@@ -324,9 +326,11 @@ issued for the hostname used to connect. Adjust the paths to the pem files for y
 .. tip::
    The encrypted connection can also be set up during the installation, so that
    no unencrypted connection is used at any point. See
-   :ref:`autoconfig_database_encryption_label` when installing with an
-   autoconfig file, or :ref:`command_line_installation_ssl_label` when
-   installing with ``occ maintenance:install``.
+   :ref:`installation_wizard_database_encryption_label` when installing with the
+   Installation Wizard, :ref:`autoconfig_database_encryption_label` when
+   installing with an autoconfig file, or
+   :ref:`command_line_installation_ssl_label` when installing with
+   ``occ maintenance:install``.
 
 .. _db-troubleshooting-label:
 

admin_manual/installation/automatic_configuration.rst

@@ -68,7 +68,9 @@ Nextcloud, so that the credentials and all queries are not sent in plaintext.
 The following parameters are independent of the database backend. Nextcloud
 translates them into the corresponding :file:`config.php` settings before the
 first connection is opened, so the installation itself already uses an
-encrypted connection.
+encrypted connection. If the setup form is displayed, the values prefill the
+fields of its **Encrypted database connection** section, see
+:ref:`installation_wizard_database_encryption_label`.
 
 .. list-table:: Connection encryption parameters
    :header-rows: 1

admin_manual/installation/command_line_installation.rst

@@ -132,7 +132,8 @@ server against a CA certificate:
 Nextcloud writes the resulting configuration to ``dbdriveroptions``
 (MySQL/MariaDB) or ``pgsql_ssl`` (PostgreSQL) in ``config.php``, see
 :doc:`../configuration_server/config_sample_php_parameters`. The same
-connection can be configured for the Installation Wizard, see
-:ref:`autoconfig_database_encryption_label`.
+connection can be configured in the Installation Wizard, see
+:ref:`installation_wizard_database_encryption_label`, or prefilled with an
+autoconfig file, see :ref:`autoconfig_database_encryption_label`.
 
 See :ref:`command_line_installation_label` for more information.

admin_manual/installation/installation_wizard.rst

@@ -98,6 +98,42 @@ fields:
   name (e.g., localhost:5432)."*
 * **Database tablespace** *(Oracle only)*: Shown only when Oracle is selected.
 
+.. _installation_wizard_database_encryption_label:
+
+Encrypted database connection
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. versionadded:: 35
+
+When the database does not run on the same host as Nextcloud, the connection should be encrypted so
+that the credentials and all queries are not sent in plaintext. For MySQL/MariaDB and PostgreSQL the
+wizard shows a collapsed **Encrypted database connection** section with the following fields. They
+are applied before the first connection is opened, so the installation itself already uses an
+encrypted connection.
+
+* **Encryption mode** *(PostgreSQL only)*: Encryption mode of the connection. Supported modes are
+  ``disable``, ``allow``, ``prefer``, ``require``, ``verify-ca``, and ``verify-full``. Only
+  ``verify-full`` verifies that the certificate of the database server was issued for the hostname
+  used to connect.
+* **CA certificate path**: Path to the CA certificate the database server is verified against.
+* **Client certificate path**: Path to the client certificate used to authenticate against the
+  database server.
+* **Client certificate key path**: Path to the private key belonging to the client certificate.
+* **Certificate revocation list path** *(PostgreSQL only)*: Path to the certificate revocation list.
+* **Do not verify that the server certificate matches the database host** *(MySQL/MariaDB only)*:
+  MySQL and MariaDB verify this by default. Enable this option when the certificate of the database
+  server was not issued for the hostname used to connect.
+
+The client certificate and its key have to be provided together, and all certificates and keys have
+to be readable by the web server. If a value is invalid, the wizard reports the error and the
+installation does not proceed.
+
+Nextcloud stores the resulting configuration as ``dbdriveroptions`` (MySQL/MariaDB) or ``pgsql_ssl``
+(PostgreSQL) in ``config.php``, as described in
+:doc:`../configuration_server/config_sample_php_parameters`. The same connection can be configured
+without using the wizard, see :ref:`autoconfig_database_encryption_label` for autoconfig files and
+:ref:`command_line_installation_ssl_label` for ``occ maintenance:install``.
+
 Automatic database user creation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -139,6 +175,9 @@ values from the config file."* The **Storage & database** section is
 automatically collapsed when the autoconfig provides valid values. For
 details on autoconfig files, see :doc:`automatic_configuration`.
 
+The fields of the **Encrypted database connection** section are prefilled from an autoconfig file as
+well, see :ref:`autoconfig_database_encryption_label`.
+
 .. figure:: images/install-wizard-autoconfig.png
    :scale: 75%
    :alt: Nextcloud wizard screen when an autoconfig file is detected
@@ -187,6 +226,6 @@ A typical configuration looks like this::
 
 When a user tries a URL that is not whitelisted the following error appears:
 
-.. figure:: images/install-wizard-a4.png
+.. figure:: images/install-wizard-untrusted-domain.png
    :scale: 75%
    :alt: Error message when URL is not whitelisted