added nextcloud services

services/matrix/.env

@@ -0,0 +1,32 @@
+#version=1.1
+#URL=https://github.com/tailscale-dev/ScaleTail
+#COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure.
+
+# Service Configuration
+SERVICE=matrix
+IMAGE_URL=matrixdotorg/synapse:latest
+
+# Network Configuration
+SERVICEPORT=443 ## The webport will be exposed to the tailnet. Change if needed.
+DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable.
+
+# Tailscale Configuration
+TS_AUTHKEY=
+
+# Time Zone setting for containers 
+TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+
+# Matrix Synapse Settings
+SYNAPSE_SERVER_NAME=matrix.example.com ## Change to your server name (e.g., matrix.yourdomain.com)
+SYNAPSE_REPORT_STATS=no ## Set to "yes" to enable anonymous statistics reporting
+
+# UID/GID for Synapse container (default: 991)
+UID=991
+GID=991
+
+# Postgres Settings (recommended for production)
+POSTGRES_USER=synapse_user ## Please Change
+POSTGRES_PASSWORD=synapse_password ## Please Change
+POSTGRES_DB=synapse
+
+#EXAMPLE_VAR="Environment variable"

services/matrix/README.md

@@ -0,0 +1,92 @@
+# Matrix Synapse with Tailscale Sidecar
+
+Matrix Synapse homeserver with Tailscale sidecar for secure Tailnet access.
+
+## Prerequisites
+
+- Docker & Docker Compose
+- Tailscale account with auth key
+
+## Setup
+
+1. **Configure environment variables:**
+
+   Edit `.env` and set:
+   - `SYNAPSE_SERVER_NAME` - Your server name (e.g., `matrix.yourdomain.com`)
+   - `TS_AUTHKEY` - Tailscale auth key from https://tailscale.com/admin/authkeys
+   - `POSTGRES_USER` / `POSTGRES_PASSWORD` - Database credentials
+
+2. **Start the database first:**
+
+   ```bash
+   docker compose up -d database
+   ```
+
+3. **Generate Synapse configuration:**
+
+   ```bash
+   docker compose run --rm application generate
+   ```
+
+4. **Configure database connection:**
+
+   Edit `matrix-data/homeserver.yaml` and update the database section:
+
+   ```yaml
+   database:
+     name: psycopg2
+     args:
+       user: synapse_user
+       password: synapse_password
+       database: synapse
+       host: db-matrix
+       cp_min: 5
+       cp_max: 10
+   ```
+
+5. **Start all services:**
+
+   ```bash
+   docker compose up -d
+   ```
+
+6. **Create admin user (optional):**
+
+   ```bash
+   docker exec -it app-matrix register_new_matrix_user http://localhost:8008 -c /data/homeserver.yaml
+   ```
+
+## Services
+
+| Service | Description |
+|---------|-------------|
+| `tailscale` | Tailscale sidecar for Tailnet connectivity |
+| `application` | Matrix Synapse homeserver (port 8008) |
+| `database` | PostgreSQL 16 database |
+
+## Access
+
+- **Local:** http://localhost:8008
+- **Tailnet:** Via Tailscale hostname configured in `TS_CERT_DOMAIN`
+
+## Useful Commands
+
+```bash
+# View logs
+docker compose logs -f
+
+# Check status
+docker compose ps
+
+# Restart services
+docker compose restart
+
+# Stop all
+docker compose down
+```
+
+## References
+
+- [Synapse Docker](https://hub.docker.com/r/matrixdotorg/synapse/)
+- [Synapse Documentation](https://element-hq.github.io/synapse/)
+- [Matrix Specification](https://spec.matrix.org/)

services/matrix/compose.yaml

@@ -0,0 +1,104 @@
+configs:
+  ts-serve:
+    content: |
+      {"TCP":{"443":{"HTTPS":true}},
+      "Web":{"$${TS_CERT_DOMAIN}:443":
+          {"Handlers":{"/":
+          {"Proxy":"http://127.0.0.1:8008"}}}},
+      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}
+
+services:
+# Make sure you have updated/checked the .env file with the correct variables. 
+# All the ${ xx } need to be defined there.
+  # Tailscale Sidecar Configuration
+  tailscale:
+    image: tailscale/tailscale:latest # Image to be used
+    container_name: tailscale-${SERVICE} # Name for local container management
+    hostname: ${SERVICE} # Name used within your Tailscale environment
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
+      - TS_USERSPACE=false
+      - TS_ENABLE_HEALTH_CHECK=true              # Enable healthcheck endpoint: "/healthz"
+      - TS_LOCAL_ADDR_PORT=127.0.0.1:41234       # The <addr>:<port> for the healthz endpoint
+      #- TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
+      - TS_AUTH_ONCE=true
+    configs:
+      - source: ts-serve
+        target: /config/serve.json
+    volumes:
+      - ./config:/config # Config folder used to store Tailscale files - you may need to change the path
+      - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
+    devices:
+      - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
+    cap_add:
+      - net_admin # Tailscale requirement
+    #ports:
+    #  - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
+    # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
+    # dns: 
+    #   - ${DNS_SERVER}
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
+      interval: 1m # How often to perform the check
+      timeout: 10s # Time to wait for the check to succeed
+      retries: 3 # Number of retries before marking as unhealthy
+      start_period: 10s # Time to wait before starting health checks
+    restart: always
+
+  # Matrix Synapse
+  application:
+    image: ${IMAGE_URL} # Image to be used
+    container_name: app-${SERVICE} # Name for local container management
+    network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
+    environment:
+      - TZ=${TZ}
+      - SYNAPSE_SERVER_NAME=${SYNAPSE_SERVER_NAME}
+      - SYNAPSE_REPORT_STATS=${SYNAPSE_REPORT_STATS}
+      - SYNAPSE_CONFIG_DIR=/data
+      - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
+      - SYNAPSE_DATA_DIR=/data
+      - UID=${UID:-991}
+      - GID=${GID:-991}
+    volumes:
+      - ./${SERVICE}-data:/data
+    depends_on:
+      database:
+        condition: service_healthy
+      tailscale:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-fSs", "http://localhost:8008/health"]
+      interval: 1m # How often to perform the check
+      timeout: 10s # Time to wait for the check to succeed
+      retries: 3 # Number of retries before marking as unhealthy
+      start_period: 30s # Time to wait before starting health checks
+    restart: always
+
+  # PostgreSQL Database (recommended for production)
+  database:
+    image: postgres:16-alpine
+    container_name: db-${SERVICE}
+    restart: always
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 100
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /var/run/postgresql
+    volumes:
+      - ./${SERVICE}-data/postgres:/var/lib/postgresql/data
+    environment:
+      - TZ=${TZ}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 1m
+      timeout: 10s
+      retries: 3
+      start_period: 30s

services/nextcloud/.env

@@ -0,0 +1,35 @@
+#version=1.1
+#URL=https://github.com/tailscale-dev/ScaleTail
+#COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure.
+
+# Service Configuration
+SERVICE=nextcloud
+IMAGE_URL=nextcloud:apache # Docker image URL from container registry
+
+# Network Configuration
+SERVICEPORT=80 # Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable.
+DNS_SERVER=9.9.9.9 # Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable.
+
+# Tailscale Configuration
+TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions.
+
+# Time Zone setting for containers 
+TZ=UTC # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+
+# Database Configuration (MariaDB)
+MYSQL_ROOT_PASSWORD= # Set a strong root password
+MYSQL_DATABASE=nextcloud
+MYSQL_USER=nextcloud
+MYSQL_PASSWORD= # Set a strong database password
+
+# Nextcloud Admin Credentials (auto-created on first run)
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_ADMIN_PASSWORD= # Set a strong admin password
+NEXTCLOUD_TRUSTED_DOMAINS= # Set to your Nextcloud domain (e.g., nextcloud.your-tailnet.ts.net)
+
+# Optional Service variables
+# PUID=1000
+# PHP_MEMORY_LIMIT=512M
+# PHP_UPLOAD_LIMIT=512M
+
+#EXAMPLE_VAR="Environment varibale"

services/nextcloud/README.md

@@ -0,0 +1,61 @@
+# Nextcloud with Tailscale Sidecar Configuration
+
+This Docker Compose configuration sets up [Nextcloud](https://github.com/nextcloud/docker) with Tailscale as a sidecar container to securely access your files and collaboration tools over your Tailnet. By using Tailscale in a sidecar configuration, you get automatic HTTPS with a URL like `https://nextcloud.your-tailnet.ts.net` without exposing anything to the public internet.
+
+## Nextcloud
+
+[Nextcloud](https://nextcloud.com) is a self-hosted platform for file sync, sharing, and collaboration. It provides a web interface for documents, calendars, contacts, and media, along with desktop and mobile apps for all major platforms. When paired with Tailscale, your Nextcloud instance becomes accessible across all your trusted devices through your secure Tailnet, with no need for port forwarding or complex reverse proxy configurations.
+
+## Configuration Overview
+
+In this setup, the `tailscale-nextcloud` service runs Tailscale, which manages secure networking for the Nextcloud stack. The `nextcloud`, `db`, and `redis` services all use the Tailscale network stack via Docker's `network_mode: service:` configuration. This keeps your entire Nextcloud stack Tailnet-only unless you intentionally expose ports.
+
+This stack includes four containers:
+- **Tailscale** - Manages networking and exposes Nextcloud via Tailscale Serve with automatic HTTPS
+- **Nextcloud** - The application server (Apache image, port 80)
+- **MariaDB** - Database backend (LTS release)
+- **Redis** - Caching and file locking to prevent performance issues
+
+## Prerequisites
+
+- Docker and Docker Compose installed
+- A Tailscale auth key from the [Tailscale Admin Console](https://login.tailscale.com/admin/settings/keys)
+- Your host user should be in the `docker` group
+
+## Getting Started
+
+1. Copy `templates/service-template` into `services/nextcloud` (or clone this repo)
+2. Edit the `.env` file and set strong passwords for:
+   - `MYSQL_ROOT_PASSWORD`
+   - `MYSQL_PASSWORD`
+   - `NEXTCLOUD_ADMIN_PASSWORD`
+3. Set your Tailscale auth key in `TS_AUTHKEY`
+4. Run `docker compose up -d`
+5. Access Nextcloud at `https://nextcloud.your-tailnet.ts.net` from any device on your Tailnet
+
+## Trusted Domains
+
+The `NEXTCLOUD_TRUSTED_DOMAINS` variable in `compose.yaml` is set to `${SERVICE}.tail12345.ts.net` by default. You should update this to match your actual Tailscale domain. You can find your domain in the Tailscale Admin Console under **DNS** settings.
+
+## Volumes
+
+| Volume | Purpose |
+|--------|---------|
+| `./nextcloud-data/html` | Nextcloud application and configuration files |
+| `./nextcloud-data/db` | MariaDB database files |
+
+Pre-creating these directories is optional; Docker will create them automatically with root ownership.
+
+## Files to check
+
+Please check the following contents for validity as some variables need to be defined upfront.
+
+- `.env`
+  - Required: `TS_AUTHKEY`
+  - Required: `MYSQL_ROOT_PASSWORD`, `MYSQL_PASSWORD`, `NEXTCLOUD_ADMIN_PASSWORD` - change all from defaults
+
+## Upstream Documentation
+
+- [Nextcloud Docker Documentation](https://github.com/nextcloud/docker)
+- [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/)
+- [Nextcloud Docker Compose Examples](https://github.com/nextcloud/docker#usage)