nextcloud / server

lib/public/ICertificateManager.php

Indentation +41 added lines, -41 removed lines

@@ -13,50 +13,50 @@
  * @since 8.0.0
  */
 interface ICertificateManager {
-	/**
-	 * Returns all certificates trusted by the system
-	 *
-	 * @return \OCP\ICertificate[]
-	 * @since 8.0.0
-	 */
-	public function listCertificates(): array;
+    /**
+     * Returns all certificates trusted by the system
+     *
+     * @return \OCP\ICertificate[]
+     * @since 8.0.0
+     */
+    public function listCertificates(): array;
 
-	/**
-	 * @param string $certificate the certificate data
-	 * @param string $name the filename for the certificate
-	 * @return \OCP\ICertificate
-	 * @throws \Exception If the certificate could not get added
-	 * @since 8.0.0 - since 8.1.0 throws exception instead of returning false
-	 */
-	public function addCertificate(string $certificate, string $name): \OCP\ICertificate;
+    /**
+     * @param string $certificate the certificate data
+     * @param string $name the filename for the certificate
+     * @return \OCP\ICertificate
+     * @throws \Exception If the certificate could not get added
+     * @since 8.0.0 - since 8.1.0 throws exception instead of returning false
+     */
+    public function addCertificate(string $certificate, string $name): \OCP\ICertificate;
 
-	/**
-	 * @param string $name
-	 * @return bool
-	 * @since 8.0.0
-	 */
-	public function removeCertificate(string $name): bool;
+    /**
+     * @param string $name
+     * @return bool
+     * @since 8.0.0
+     */
+    public function removeCertificate(string $name): bool;
 
-	/**
-	 * Get the path to the certificate bundle
-	 *
-	 * @return string
-	 * @since 8.0.0
-	 */
-	public function getCertificateBundle(): string;
+    /**
+     * Get the path to the certificate bundle
+     *
+     * @return string
+     * @since 8.0.0
+     */
+    public function getCertificateBundle(): string;
 
-	/**
-	 * Get the full local path to the certificate bundle
-	 *
-	 * @return string
-	 * @since 9.0.0
-	 */
-	public function getAbsoluteBundlePath(): string;
+    /**
+     * Get the full local path to the certificate bundle
+     *
+     * @return string
+     * @since 9.0.0
+     */
+    public function getAbsoluteBundlePath(): string;
 
-	/**
-	 * Get the path of the default certificates bundle.
-	 *
-	 * @since 33.0.0
-	 */
-	public function getDefaultCertificatesBundlePath(): string;
+    /**
+     * Get the path of the default certificates bundle.
+     *
+     * @since 33.0.0
+     */
+    public function getDefaultCertificatesBundlePath(): string;
 }

lib/private/Http/Client/Client.php

Indentation +657 added lines, -657 removed lines

@@ -28,661 +28,661 @@
  * @package OC\Http
  */
 class Client implements IClient {
-	/** @var GuzzleClient */
-	private $client;
-	/** @var IConfig */
-	private $config;
-	/** @var ICertificateManager */
-	private $certificateManager;
-	private IRemoteHostValidator $remoteHostValidator;
-
-	public function __construct(
-		IConfig $config,
-		ICertificateManager $certificateManager,
-		GuzzleClient $client,
-		IRemoteHostValidator $remoteHostValidator,
-		protected LoggerInterface $logger,
-		protected ServerVersion $serverVersion,
-	) {
-		$this->config = $config;
-		$this->client = $client;
-		$this->certificateManager = $certificateManager;
-		$this->remoteHostValidator = $remoteHostValidator;
-	}
-
-	private function buildRequestOptions(array $options): array {
-		$proxy = $this->getProxyUri();
-
-		$defaults = [
-			RequestOptions::VERIFY => $this->getCertBundle(),
-			RequestOptions::TIMEOUT => IClient::DEFAULT_REQUEST_TIMEOUT,
-		];
-
-		$options['nextcloud']['allow_local_address'] = $this->isLocalAddressAllowed($options);
-		if ($options['nextcloud']['allow_local_address'] === false) {
-			$onRedirectFunction = function (
-				\Psr\Http\Message\RequestInterface $request,
-				\Psr\Http\Message\ResponseInterface $response,
-				\Psr\Http\Message\UriInterface $uri,
-			) use ($options) {
-				$this->preventLocalAddress($uri->__toString(), $options);
-			};
-
-			$defaults[RequestOptions::ALLOW_REDIRECTS] = [
-				'on_redirect' => $onRedirectFunction
-			];
-		}
-
-		// Only add RequestOptions::PROXY if Nextcloud is explicitly
-		// configured to use a proxy. This is needed in order not to override
-		// Guzzle default values.
-		if ($proxy !== null) {
-			$defaults[RequestOptions::PROXY] = $proxy;
-		}
-
-		$options = array_merge($defaults, $options);
-
-		if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
-			$userAgent = 'Nextcloud-Server-Crawler/' . $this->serverVersion->getVersionString();
-			$options[RequestOptions::HEADERS]['User-Agent'] = $userAgent;
-		}
-
-		if (!isset($options[RequestOptions::HEADERS]['Accept-Encoding'])) {
-			$options[RequestOptions::HEADERS]['Accept-Encoding'] = 'gzip';
-		}
-
-		// Fallback for save_to
-		if (isset($options['save_to'])) {
-			$options['sink'] = $options['save_to'];
-			unset($options['save_to']);
-		}
-
-		return $options;
-	}
-
-	private function getCertBundle(): string {
-		// If the instance is not yet setup we need to use the static path as
-		// $this->certificateManager->getAbsoluteBundlePath() tries to instantiate
-		// a view
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			return $this->certificateManager->getDefaultCertificatesBundlePath();
-		}
-
-		return $this->certificateManager->getAbsoluteBundlePath();
-	}
-
-	/**
-	 * Returns a null or an associative array specifying the proxy URI for
-	 * 'http' and 'https' schemes, in addition to a 'no' key value pair
-	 * providing a list of host names that should not be proxied to.
-	 *
-	 * @return array|null
-	 *
-	 * The return array looks like:
-	 * [
-	 *   'http' => 'username:password@proxy.example.com',
-	 *   'https' => 'username:password@proxy.example.com',
-	 *   'no' => ['foo.com', 'bar.com']
-	 * ]
-	 *
-	 */
-	private function getProxyUri(): ?array {
-		$proxyHost = $this->config->getSystemValueString('proxy', '');
-
-		if ($proxyHost === '') {
-			return null;
-		}
-
-		$proxyUserPwd = $this->config->getSystemValueString('proxyuserpwd', '');
-		if ($proxyUserPwd !== '') {
-			$proxyHost = $proxyUserPwd . '@' . $proxyHost;
-		}
-
-		$proxy = [
-			'http' => $proxyHost,
-			'https' => $proxyHost,
-		];
-
-		$proxyExclude = $this->config->getSystemValue('proxyexclude', []);
-		if ($proxyExclude !== [] && $proxyExclude !== null) {
-			$proxy['no'] = $proxyExclude;
-		}
-
-		return $proxy;
-	}
-
-	private function isLocalAddressAllowed(array $options) : bool {
-		if (($options['nextcloud']['allow_local_address'] ?? false)
-			|| $this->config->getSystemValueBool('allow_local_remote_servers', false)) {
-			return true;
-		}
-
-		return false;
-	}
-
-	protected function preventLocalAddress(string $uri, array $options): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		if ($host === false || $host === null) {
-			throw new LocalServerException('Could not detect any host');
-		}
-
-		if ($this->isLocalAddressAllowed($options)) {
-			return;
-		}
-
-		if (!$this->remoteHostValidator->isValid($host)) {
-			throw new LocalServerException('Host "' . $host . '" violates local access rules');
-		}
-	}
-
-	/**
-	 * Sends a GET request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'query' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function get(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('get', $uri, $this->buildRequestOptions($options));
-		$isStream = isset($options['stream']) && $options['stream'];
-		return new Response($response, $isStream);
-	}
-
-	/**
-	 * Sends a HEAD request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function head(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('head', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a POST request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function post(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-
-		if (isset($options['body']) && is_array($options['body'])) {
-			$options['form_params'] = $options['body'];
-			unset($options['body']);
-		}
-		$response = $this->client->request('post', $uri, $this->buildRequestOptions($options));
-		$isStream = isset($options['stream']) && $options['stream'];
-		return new Response($response, $isStream);
-	}
-
-	/**
-	 * Sends a PUT request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function put(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('put', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a PATCH request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function patch(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('patch', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a DELETE request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function delete(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('delete', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends an OPTIONS request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function options(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('options', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Get the response of a Throwable thrown by the request methods when possible
-	 *
-	 * @param \Throwable $e
-	 * @return IResponse
-	 * @throws \Throwable When $e did not have a response
-	 * @since 29.0.0
-	 */
-	public function getResponseFromThrowable(\Throwable $e): IResponse {
-		if (method_exists($e, 'hasResponse') && method_exists($e, 'getResponse') && $e->hasResponse()) {
-			return new Response($e->getResponse());
-		}
-
-		throw $e;
-	}
-
-	/**
-	 * Sends a HTTP request
-	 *
-	 * @param string $method The HTTP method to use
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'query' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function request(string $method, string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request($method, $uri, $this->buildRequestOptions($options));
-		$isStream = isset($options['stream']) && $options['stream'];
-		return new Response($response, $isStream);
-	}
-
-	protected function wrapGuzzlePromise(PromiseInterface $promise): IPromise {
-		return new GuzzlePromiseAdapter(
-			$promise,
-			$this->logger
-		);
-	}
-
-	/**
-	 * Sends an asynchronous GET request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'query' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function getAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->requestAsync('get', $uri, $this->buildRequestOptions($options));
-		return $this->wrapGuzzlePromise($response);
-	}
-
-	/**
-	 * Sends an asynchronous HEAD request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function headAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->requestAsync('head', $uri, $this->buildRequestOptions($options));
-		return $this->wrapGuzzlePromise($response);
-	}
-
-	/**
-	 * Sends an asynchronous POST request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function postAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-
-		if (isset($options['body']) && is_array($options['body'])) {
-			$options['form_params'] = $options['body'];
-			unset($options['body']);
-		}
-
-		return $this->wrapGuzzlePromise($this->client->requestAsync('post', $uri, $this->buildRequestOptions($options)));
-	}
-
-	/**
-	 * Sends an asynchronous PUT request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function putAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->requestAsync('put', $uri, $this->buildRequestOptions($options));
-		return $this->wrapGuzzlePromise($response);
-	}
-
-	/**
-	 * Sends an asynchronous DELETE request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function deleteAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->requestAsync('delete', $uri, $this->buildRequestOptions($options));
-		return $this->wrapGuzzlePromise($response);
-	}
-
-	/**
-	 * Sends an asynchronous OPTIONS request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *                       'body' => [
-	 *                       'field' => 'abc',
-	 *                       'other_field' => '123',
-	 *                       'file_name' => fopen('/path/to/file', 'r'),
-	 *                       ],
-	 *                       'headers' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'cookies' => [
-	 *                       'foo' => 'bar',
-	 *                       ],
-	 *                       'allow_redirects' => [
-	 *                       'max'       => 10,  // allow at most 10 redirects.
-	 *                       'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                       'referer'   => true,     // add a Referer header
-	 *                       'protocols' => ['https'] // only allow https URLs
-	 *                       ],
-	 *                       'sink' => '/path/to/file', // save to a file or a stream
-	 *                       'verify' => true, // bool or string to CA file
-	 *                       'debug' => true,
-	 *                       'timeout' => 5,
-	 * @return IPromise
-	 */
-	public function optionsAsync(string $uri, array $options = []): IPromise {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->requestAsync('options', $uri, $this->buildRequestOptions($options));
-		return $this->wrapGuzzlePromise($response);
-	}
+    /** @var GuzzleClient */
+    private $client;
+    /** @var IConfig */
+    private $config;
+    /** @var ICertificateManager */
+    private $certificateManager;
+    private IRemoteHostValidator $remoteHostValidator;
+
+    public function __construct(
+        IConfig $config,
+        ICertificateManager $certificateManager,
+        GuzzleClient $client,
+        IRemoteHostValidator $remoteHostValidator,
+        protected LoggerInterface $logger,
+        protected ServerVersion $serverVersion,
+    ) {
+        $this->config = $config;
+        $this->client = $client;
+        $this->certificateManager = $certificateManager;
+        $this->remoteHostValidator = $remoteHostValidator;
+    }
+
+    private function buildRequestOptions(array $options): array {
+        $proxy = $this->getProxyUri();
+
+        $defaults = [
+            RequestOptions::VERIFY => $this->getCertBundle(),
+            RequestOptions::TIMEOUT => IClient::DEFAULT_REQUEST_TIMEOUT,
+        ];
+
+        $options['nextcloud']['allow_local_address'] = $this->isLocalAddressAllowed($options);
+        if ($options['nextcloud']['allow_local_address'] === false) {
+            $onRedirectFunction = function (
+                \Psr\Http\Message\RequestInterface $request,
+                \Psr\Http\Message\ResponseInterface $response,
+                \Psr\Http\Message\UriInterface $uri,
+            ) use ($options) {
+                $this->preventLocalAddress($uri->__toString(), $options);
+            };
+
+            $defaults[RequestOptions::ALLOW_REDIRECTS] = [
+                'on_redirect' => $onRedirectFunction
+            ];
+        }
+
+        // Only add RequestOptions::PROXY if Nextcloud is explicitly
+        // configured to use a proxy. This is needed in order not to override
+        // Guzzle default values.
+        if ($proxy !== null) {
+            $defaults[RequestOptions::PROXY] = $proxy;
+        }
+
+        $options = array_merge($defaults, $options);
+
+        if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
+            $userAgent = 'Nextcloud-Server-Crawler/' . $this->serverVersion->getVersionString();
+            $options[RequestOptions::HEADERS]['User-Agent'] = $userAgent;
+        }
+
+        if (!isset($options[RequestOptions::HEADERS]['Accept-Encoding'])) {
+            $options[RequestOptions::HEADERS]['Accept-Encoding'] = 'gzip';
+        }
+
+        // Fallback for save_to
+        if (isset($options['save_to'])) {
+            $options['sink'] = $options['save_to'];
+            unset($options['save_to']);
+        }
+
+        return $options;
+    }
+
+    private function getCertBundle(): string {
+        // If the instance is not yet setup we need to use the static path as
+        // $this->certificateManager->getAbsoluteBundlePath() tries to instantiate
+        // a view
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            return $this->certificateManager->getDefaultCertificatesBundlePath();
+        }
+
+        return $this->certificateManager->getAbsoluteBundlePath();
+    }
+
+    /**
+     * Returns a null or an associative array specifying the proxy URI for
+     * 'http' and 'https' schemes, in addition to a 'no' key value pair
+     * providing a list of host names that should not be proxied to.
+     *
+     * @return array|null
+     *
+     * The return array looks like:
+     * [
+     *   'http' => 'username:password@proxy.example.com',
+     *   'https' => 'username:password@proxy.example.com',
+     *   'no' => ['foo.com', 'bar.com']
+     * ]
+     *
+     */
+    private function getProxyUri(): ?array {
+        $proxyHost = $this->config->getSystemValueString('proxy', '');
+
+        if ($proxyHost === '') {
+            return null;
+        }
+
+        $proxyUserPwd = $this->config->getSystemValueString('proxyuserpwd', '');
+        if ($proxyUserPwd !== '') {
+            $proxyHost = $proxyUserPwd . '@' . $proxyHost;
+        }
+
+        $proxy = [
+            'http' => $proxyHost,
+            'https' => $proxyHost,
+        ];
+
+        $proxyExclude = $this->config->getSystemValue('proxyexclude', []);
+        if ($proxyExclude !== [] && $proxyExclude !== null) {
+            $proxy['no'] = $proxyExclude;
+        }
+
+        return $proxy;
+    }
+
+    private function isLocalAddressAllowed(array $options) : bool {
+        if (($options['nextcloud']['allow_local_address'] ?? false)
+            || $this->config->getSystemValueBool('allow_local_remote_servers', false)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    protected function preventLocalAddress(string $uri, array $options): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        if ($host === false || $host === null) {
+            throw new LocalServerException('Could not detect any host');
+        }
+
+        if ($this->isLocalAddressAllowed($options)) {
+            return;
+        }
+
+        if (!$this->remoteHostValidator->isValid($host)) {
+            throw new LocalServerException('Host "' . $host . '" violates local access rules');
+        }
+    }
+
+    /**
+     * Sends a GET request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'query' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function get(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('get', $uri, $this->buildRequestOptions($options));
+        $isStream = isset($options['stream']) && $options['stream'];
+        return new Response($response, $isStream);
+    }
+
+    /**
+     * Sends a HEAD request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function head(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('head', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a POST request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function post(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+
+        if (isset($options['body']) && is_array($options['body'])) {
+            $options['form_params'] = $options['body'];
+            unset($options['body']);
+        }
+        $response = $this->client->request('post', $uri, $this->buildRequestOptions($options));
+        $isStream = isset($options['stream']) && $options['stream'];
+        return new Response($response, $isStream);
+    }
+
+    /**
+     * Sends a PUT request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function put(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('put', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a PATCH request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function patch(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('patch', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a DELETE request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function delete(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('delete', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends an OPTIONS request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function options(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('options', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Get the response of a Throwable thrown by the request methods when possible
+     *
+     * @param \Throwable $e
+     * @return IResponse
+     * @throws \Throwable When $e did not have a response
+     * @since 29.0.0
+     */
+    public function getResponseFromThrowable(\Throwable $e): IResponse {
+        if (method_exists($e, 'hasResponse') && method_exists($e, 'getResponse') && $e->hasResponse()) {
+            return new Response($e->getResponse());
+        }
+
+        throw $e;
+    }
+
+    /**
+     * Sends a HTTP request
+     *
+     * @param string $method The HTTP method to use
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'query' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function request(string $method, string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request($method, $uri, $this->buildRequestOptions($options));
+        $isStream = isset($options['stream']) && $options['stream'];
+        return new Response($response, $isStream);
+    }
+
+    protected function wrapGuzzlePromise(PromiseInterface $promise): IPromise {
+        return new GuzzlePromiseAdapter(
+            $promise,
+            $this->logger
+        );
+    }
+
+    /**
+     * Sends an asynchronous GET request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'query' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function getAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->requestAsync('get', $uri, $this->buildRequestOptions($options));
+        return $this->wrapGuzzlePromise($response);
+    }
+
+    /**
+     * Sends an asynchronous HEAD request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function headAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->requestAsync('head', $uri, $this->buildRequestOptions($options));
+        return $this->wrapGuzzlePromise($response);
+    }
+
+    /**
+     * Sends an asynchronous POST request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function postAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+
+        if (isset($options['body']) && is_array($options['body'])) {
+            $options['form_params'] = $options['body'];
+            unset($options['body']);
+        }
+
+        return $this->wrapGuzzlePromise($this->client->requestAsync('post', $uri, $this->buildRequestOptions($options)));
+    }
+
+    /**
+     * Sends an asynchronous PUT request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function putAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->requestAsync('put', $uri, $this->buildRequestOptions($options));
+        return $this->wrapGuzzlePromise($response);
+    }
+
+    /**
+     * Sends an asynchronous DELETE request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function deleteAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->requestAsync('delete', $uri, $this->buildRequestOptions($options));
+        return $this->wrapGuzzlePromise($response);
+    }
+
+    /**
+     * Sends an asynchronous OPTIONS request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *                       'body' => [
+     *                       'field' => 'abc',
+     *                       'other_field' => '123',
+     *                       'file_name' => fopen('/path/to/file', 'r'),
+     *                       ],
+     *                       'headers' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'cookies' => [
+     *                       'foo' => 'bar',
+     *                       ],
+     *                       'allow_redirects' => [
+     *                       'max'       => 10,  // allow at most 10 redirects.
+     *                       'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                       'referer'   => true,     // add a Referer header
+     *                       'protocols' => ['https'] // only allow https URLs
+     *                       ],
+     *                       'sink' => '/path/to/file', // save to a file or a stream
+     *                       'verify' => true, // bool or string to CA file
+     *                       'debug' => true,
+     *                       'timeout' => 5,
+     * @return IPromise
+     */
+    public function optionsAsync(string $uri, array $options = []): IPromise {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->requestAsync('options', $uri, $this->buildRequestOptions($options));
+        return $this->wrapGuzzlePromise($response);
+    }
 }

Spacing +4 added lines, -4 removed lines

@@ -60,7 +60,7 @@ 
 
 		$options['nextcloud']['allow_local_address'] = $this->isLocalAddressAllowed($options);
 		if ($options['nextcloud']['allow_local_address'] === false) {
-			$onRedirectFunction = function (
+			$onRedirectFunction = function(
 				\Psr\Http\Message\RequestInterface $request,
 				\Psr\Http\Message\ResponseInterface $response,
 				\Psr\Http\Message\UriInterface $uri,
@@ -83,7 +83,7 @@ 
 		$options = array_merge($defaults, $options);
 
 		if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
-			$userAgent = 'Nextcloud-Server-Crawler/' . $this->serverVersion->getVersionString();
+			$userAgent = 'Nextcloud-Server-Crawler/'.$this->serverVersion->getVersionString();
 			$options[RequestOptions::HEADERS]['User-Agent'] = $userAgent;
 		}
 
@@ -135,7 +135,7 @@ 
 
 		$proxyUserPwd = $this->config->getSystemValueString('proxyuserpwd', '');
 		if ($proxyUserPwd !== '') {
-			$proxyHost = $proxyUserPwd . '@' . $proxyHost;
+			$proxyHost = $proxyUserPwd.'@'.$proxyHost;
 		}
 
 		$proxy = [
@@ -171,7 +171,7 @@ 
 		}
 
 		if (!$this->remoteHostValidator->isValid($host)) {
-			throw new LocalServerException('Host "' . $host . '" violates local access rules');
+			throw new LocalServerException('Host "'.$host.'" violates local access rules');
 		}
 	}
 

lib/private/Files/ObjectStore/S3ConnectionTrait.php

Indentation +259 added lines, -259 removed lines

@@ -24,263 +24,263 @@
 use Psr\Log\LoggerInterface;
 
 trait S3ConnectionTrait {
-	use S3ConfigTrait;
-
-	protected string $id;
-
-	protected bool $test;
-
-	protected ?S3Client $connection = null;
-
-	private ?ICache $existingBucketsCache = null;
-
-	protected function parseParams($params) {
-		if (empty($params['bucket'])) {
-			throw new \Exception('Bucket has to be configured.');
-		}
-
-		$this->id = 'amazon::' . $params['bucket'];
-
-		$this->test = isset($params['test']);
-		$this->bucket = $params['bucket'];
-		// Default to 5 like the S3 SDK does
-		$this->concurrency = $params['concurrency'] ?? 5;
-		$this->proxy = $params['proxy'] ?? false;
-		$this->connectTimeout = $params['connect_timeout'] ?? 5;
-		$this->timeout = $params['timeout'] ?? 15;
-		$this->storageClass = !empty($params['storageClass']) ? $params['storageClass'] : 'STANDARD';
-		$this->uploadPartSize = $params['uploadPartSize'] ?? 524288000;
-		$this->putSizeLimit = $params['putSizeLimit'] ?? 104857600;
-		$this->copySizeLimit = $params['copySizeLimit'] ?? 5242880000;
-		$this->useMultipartCopy = (bool)($params['useMultipartCopy'] ?? true);
-		$this->retriesMaxAttempts = $params['retriesMaxAttempts'] ?? 5;
-		$params['region'] = empty($params['region']) ? 'eu-west-1' : $params['region'];
-		$params['hostname'] = empty($params['hostname']) ? 's3.' . $params['region'] . '.amazonaws.com' : $params['hostname'];
-		$params['s3-accelerate'] = $params['hostname'] === 's3-accelerate.amazonaws.com' || $params['hostname'] === 's3-accelerate.dualstack.amazonaws.com';
-		if (!isset($params['port']) || $params['port'] === '') {
-			$params['port'] = (isset($params['use_ssl']) && $params['use_ssl'] === false) ? 80 : 443;
-		}
-		$params['verify_bucket_exists'] = $params['verify_bucket_exists'] ?? true;
-
-		if ($params['s3-accelerate']) {
-			$params['verify_bucket_exists'] = false;
-		}
-
-		$this->params = $params;
-	}
-
-	public function getBucket() {
-		return $this->bucket;
-	}
-
-	public function getProxy() {
-		return $this->proxy;
-	}
-
-	/**
-	 * Returns the connection
-	 *
-	 * @return S3Client connected client
-	 * @throws \Exception if connection could not be made
-	 */
-	public function getConnection() {
-		if ($this->connection !== null) {
-			return $this->connection;
-		}
-
-		if ($this->existingBucketsCache === null) {
-			$this->existingBucketsCache = Server::get(ICacheFactory::class)
-				->createLocal('s3-bucket-exists-cache');
-		}
-
-		$scheme = (isset($this->params['use_ssl']) && $this->params['use_ssl'] === false) ? 'http' : 'https';
-		$base_url = $scheme . '://' . $this->params['hostname'] . ':' . $this->params['port'] . '/';
-
-		// Adding explicit credential provider to the beginning chain.
-		// Including default credential provider (skipping AWS shared config files).
-		$provider = CredentialProvider::memoize(
-			CredentialProvider::chain(
-				$this->paramCredentialProvider(),
-				CredentialProvider::defaultProvider(['use_aws_shared_config_files' => false])
-			)
-		);
-
-		$options = [
-			'version' => $this->params['version'] ?? 'latest',
-			'credentials' => $provider,
-			'endpoint' => $base_url,
-			'region' => $this->params['region'],
-			'use_path_style_endpoint' => isset($this->params['use_path_style']) ? $this->params['use_path_style'] : false,
-			'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider()),
-			'csm' => false,
-			'use_arn_region' => false,
-			'http' => [
-				'verify' => $this->getCertificateBundlePath(),
-				'connect_timeout' => $this->connectTimeout,
-			],
-			'use_aws_shared_config_files' => false,
-			'retries' => [
-				'mode' => 'standard',
-				'max_attempts' => $this->retriesMaxAttempts,
-			],
-		];
-
-		if ($this->params['s3-accelerate']) {
-			$options['use_accelerate_endpoint'] = true;
-		} else {
-			$options['endpoint'] = $base_url;
-		}
-
-		if (isset($this->params['request_checksum_calculation'])) {
-			$options['request_checksum_calculation'] = $this->params['request_checksum_calculation'];
-		}
-
-		if (isset($this->params['response_checksum_validation'])) {
-			$options['response_checksum_validation'] = $this->params['response_checksum_validation'];
-		}
-
-		if ($this->getProxy()) {
-			$options['http']['proxy'] = $this->getProxy();
-		}
-		if (isset($this->params['legacy_auth']) && $this->params['legacy_auth']) {
-			$options['signature_version'] = 'v2';
-		}
-		$this->connection = new S3Client($options);
-
-		try {
-			$logger = Server::get(LoggerInterface::class);
-			if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
-				$logger->debug('Bucket "' . $this->bucket . '" This bucket name is not dns compatible, it may contain invalid characters.',
-					['app' => 'objectstore']);
-			}
-
-			if ($this->params['verify_bucket_exists']) {
-				$cacheKey = $this->params['hostname'] . $this->bucket;
-				$exist = $this->existingBucketsCache->get($cacheKey) === 1;
-
-				if (!$exist) {
-					if (!$this->connection->doesBucketExist($this->bucket)) {
-						try {
-							$logger->info('Bucket "' . $this->bucket . '" does not exist - creating it.', ['app' => 'objectstore']);
-							if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
-								throw new StorageNotAvailableException('The bucket will not be created because the name is not dns compatible, please correct it: ' . $this->bucket);
-							}
-							$this->connection->createBucket(['Bucket' => $this->bucket]);
-							Server::get(IEventDispatcher::class)
-								->dispatchTyped(new BucketCreatedEvent(
-									$this->bucket,
-									$options['endpoint'],
-									$options['region'],
-									$options['version']
-								));
-							$this->testTimeout();
-						} catch (S3Exception $e) {
-							$logger->debug('Invalid remote storage.', [
-								'exception' => $e,
-								'app' => 'objectstore',
-							]);
-							if ($e->getAwsErrorCode() !== 'BucketAlreadyOwnedByYou') {
-								throw new StorageNotAvailableException('Creation of bucket "' . $this->bucket . '" failed. ' . $e->getMessage());
-							}
-						}
-					}
-					$this->existingBucketsCache->set($cacheKey, 1);
-				}
-			}
-
-			// google cloud's s3 compatibility doesn't like the EncodingType parameter
-			if (strpos($base_url, 'storage.googleapis.com')) {
-				$this->connection->getHandlerList()->remove('s3.auto_encode');
-			}
-		} catch (S3Exception $e) {
-			throw new StorageNotAvailableException('S3 service is unable to handle request: ' . $e->getMessage());
-		}
-
-		return $this->connection;
-	}
-
-	/**
-	 * when running the tests wait to let the buckets catch up
-	 */
-	private function testTimeout() {
-		if ($this->test) {
-			sleep($this->timeout);
-		}
-	}
-
-	public static function legacySignatureProvider($version, $service, $region) {
-		switch ($version) {
-			case 'v2':
-			case 's3':
-				return new S3Signature();
-			default:
-				return null;
-		}
-	}
-
-	/**
-	 * This function creates a credential provider based on user parameter file
-	 */
-	protected function paramCredentialProvider(): callable {
-		return function () {
-			$key = empty($this->params['key']) ? null : $this->params['key'];
-			$secret = empty($this->params['secret']) ? null : $this->params['secret'];
-			$sessionToken = empty($this->params['session_token']) ? null : $this->params['session_token'];
-
-			if ($key && $secret) {
-				return Create::promiseFor(
-					// a null sessionToken match the default signature of the constructor
-					new Credentials($key, $secret, $sessionToken)
-				);
-			}
-
-			$msg = 'Could not find parameters set for credentials in config file.';
-			return new RejectedPromise(new CredentialsException($msg));
-		};
-	}
-
-	protected function getCertificateBundlePath(): ?string {
-		if ((int)($this->params['use_nextcloud_bundle'] ?? '0')) {
-			/** @var ICertificateManager $certManager */
-			$certManager = Server::get(ICertificateManager::class);
-			// since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage
-			if (!isset($this->params['primary_storage'])) {
-				return $certManager->getAbsoluteBundlePath();
-			} else {
-				return $certManager->getDefaultCertificatesBundlePath();
-			}
-		} else {
-			return null;
-		}
-	}
-
-	protected function getSSECKey(): ?string {
-		if (isset($this->params['sse_c_key']) && !empty($this->params['sse_c_key'])) {
-			return $this->params['sse_c_key'];
-		}
-
-		return null;
-	}
-
-	protected function getSSECParameters(bool $copy = false): array {
-		$key = $this->getSSECKey();
-
-		if ($key === null) {
-			return [];
-		}
-
-		$rawKey = base64_decode($key);
-		if ($copy) {
-			return [
-				'CopySourceSSECustomerAlgorithm' => 'AES256',
-				'CopySourceSSECustomerKey' => $rawKey,
-				'CopySourceSSECustomerKeyMD5' => md5($rawKey, true)
-			];
-		}
-		return [
-			'SSECustomerAlgorithm' => 'AES256',
-			'SSECustomerKey' => $rawKey,
-			'SSECustomerKeyMD5' => md5($rawKey, true)
-		];
-	}
+    use S3ConfigTrait;
+
+    protected string $id;
+
+    protected bool $test;
+
+    protected ?S3Client $connection = null;
+
+    private ?ICache $existingBucketsCache = null;
+
+    protected function parseParams($params) {
+        if (empty($params['bucket'])) {
+            throw new \Exception('Bucket has to be configured.');
+        }
+
+        $this->id = 'amazon::' . $params['bucket'];
+
+        $this->test = isset($params['test']);
+        $this->bucket = $params['bucket'];
+        // Default to 5 like the S3 SDK does
+        $this->concurrency = $params['concurrency'] ?? 5;
+        $this->proxy = $params['proxy'] ?? false;
+        $this->connectTimeout = $params['connect_timeout'] ?? 5;
+        $this->timeout = $params['timeout'] ?? 15;
+        $this->storageClass = !empty($params['storageClass']) ? $params['storageClass'] : 'STANDARD';
+        $this->uploadPartSize = $params['uploadPartSize'] ?? 524288000;
+        $this->putSizeLimit = $params['putSizeLimit'] ?? 104857600;
+        $this->copySizeLimit = $params['copySizeLimit'] ?? 5242880000;
+        $this->useMultipartCopy = (bool)($params['useMultipartCopy'] ?? true);
+        $this->retriesMaxAttempts = $params['retriesMaxAttempts'] ?? 5;
+        $params['region'] = empty($params['region']) ? 'eu-west-1' : $params['region'];
+        $params['hostname'] = empty($params['hostname']) ? 's3.' . $params['region'] . '.amazonaws.com' : $params['hostname'];
+        $params['s3-accelerate'] = $params['hostname'] === 's3-accelerate.amazonaws.com' || $params['hostname'] === 's3-accelerate.dualstack.amazonaws.com';
+        if (!isset($params['port']) || $params['port'] === '') {
+            $params['port'] = (isset($params['use_ssl']) && $params['use_ssl'] === false) ? 80 : 443;
+        }
+        $params['verify_bucket_exists'] = $params['verify_bucket_exists'] ?? true;
+
+        if ($params['s3-accelerate']) {
+            $params['verify_bucket_exists'] = false;
+        }
+
+        $this->params = $params;
+    }
+
+    public function getBucket() {
+        return $this->bucket;
+    }
+
+    public function getProxy() {
+        return $this->proxy;
+    }
+
+    /**
+     * Returns the connection
+     *
+     * @return S3Client connected client
+     * @throws \Exception if connection could not be made
+     */
+    public function getConnection() {
+        if ($this->connection !== null) {
+            return $this->connection;
+        }
+
+        if ($this->existingBucketsCache === null) {
+            $this->existingBucketsCache = Server::get(ICacheFactory::class)
+                ->createLocal('s3-bucket-exists-cache');
+        }
+
+        $scheme = (isset($this->params['use_ssl']) && $this->params['use_ssl'] === false) ? 'http' : 'https';
+        $base_url = $scheme . '://' . $this->params['hostname'] . ':' . $this->params['port'] . '/';
+
+        // Adding explicit credential provider to the beginning chain.
+        // Including default credential provider (skipping AWS shared config files).
+        $provider = CredentialProvider::memoize(
+            CredentialProvider::chain(
+                $this->paramCredentialProvider(),
+                CredentialProvider::defaultProvider(['use_aws_shared_config_files' => false])
+            )
+        );
+
+        $options = [
+            'version' => $this->params['version'] ?? 'latest',
+            'credentials' => $provider,
+            'endpoint' => $base_url,
+            'region' => $this->params['region'],
+            'use_path_style_endpoint' => isset($this->params['use_path_style']) ? $this->params['use_path_style'] : false,
+            'signature_provider' => \Aws\or_chain([self::class, 'legacySignatureProvider'], ClientResolver::_default_signature_provider()),
+            'csm' => false,
+            'use_arn_region' => false,
+            'http' => [
+                'verify' => $this->getCertificateBundlePath(),
+                'connect_timeout' => $this->connectTimeout,
+            ],
+            'use_aws_shared_config_files' => false,
+            'retries' => [
+                'mode' => 'standard',
+                'max_attempts' => $this->retriesMaxAttempts,
+            ],
+        ];
+
+        if ($this->params['s3-accelerate']) {
+            $options['use_accelerate_endpoint'] = true;
+        } else {
+            $options['endpoint'] = $base_url;
+        }
+
+        if (isset($this->params['request_checksum_calculation'])) {
+            $options['request_checksum_calculation'] = $this->params['request_checksum_calculation'];
+        }
+
+        if (isset($this->params['response_checksum_validation'])) {
+            $options['response_checksum_validation'] = $this->params['response_checksum_validation'];
+        }
+
+        if ($this->getProxy()) {
+            $options['http']['proxy'] = $this->getProxy();
+        }
+        if (isset($this->params['legacy_auth']) && $this->params['legacy_auth']) {
+            $options['signature_version'] = 'v2';
+        }
+        $this->connection = new S3Client($options);
+
+        try {
+            $logger = Server::get(LoggerInterface::class);
+            if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
+                $logger->debug('Bucket "' . $this->bucket . '" This bucket name is not dns compatible, it may contain invalid characters.',
+                    ['app' => 'objectstore']);
+            }
+
+            if ($this->params['verify_bucket_exists']) {
+                $cacheKey = $this->params['hostname'] . $this->bucket;
+                $exist = $this->existingBucketsCache->get($cacheKey) === 1;
+
+                if (!$exist) {
+                    if (!$this->connection->doesBucketExist($this->bucket)) {
+                        try {
+                            $logger->info('Bucket "' . $this->bucket . '" does not exist - creating it.', ['app' => 'objectstore']);
+                            if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
+                                throw new StorageNotAvailableException('The bucket will not be created because the name is not dns compatible, please correct it: ' . $this->bucket);
+                            }
+                            $this->connection->createBucket(['Bucket' => $this->bucket]);
+                            Server::get(IEventDispatcher::class)
+                                ->dispatchTyped(new BucketCreatedEvent(
+                                    $this->bucket,
+                                    $options['endpoint'],
+                                    $options['region'],
+                                    $options['version']
+                                ));
+                            $this->testTimeout();
+                        } catch (S3Exception $e) {
+                            $logger->debug('Invalid remote storage.', [
+                                'exception' => $e,
+                                'app' => 'objectstore',
+                            ]);
+                            if ($e->getAwsErrorCode() !== 'BucketAlreadyOwnedByYou') {
+                                throw new StorageNotAvailableException('Creation of bucket "' . $this->bucket . '" failed. ' . $e->getMessage());
+                            }
+                        }
+                    }
+                    $this->existingBucketsCache->set($cacheKey, 1);
+                }
+            }
+
+            // google cloud's s3 compatibility doesn't like the EncodingType parameter
+            if (strpos($base_url, 'storage.googleapis.com')) {
+                $this->connection->getHandlerList()->remove('s3.auto_encode');
+            }
+        } catch (S3Exception $e) {
+            throw new StorageNotAvailableException('S3 service is unable to handle request: ' . $e->getMessage());
+        }
+
+        return $this->connection;
+    }
+
+    /**
+     * when running the tests wait to let the buckets catch up
+     */
+    private function testTimeout() {
+        if ($this->test) {
+            sleep($this->timeout);
+        }
+    }
+
+    public static function legacySignatureProvider($version, $service, $region) {
+        switch ($version) {
+            case 'v2':
+            case 's3':
+                return new S3Signature();
+            default:
+                return null;
+        }
+    }
+
+    /**
+     * This function creates a credential provider based on user parameter file
+     */
+    protected function paramCredentialProvider(): callable {
+        return function () {
+            $key = empty($this->params['key']) ? null : $this->params['key'];
+            $secret = empty($this->params['secret']) ? null : $this->params['secret'];
+            $sessionToken = empty($this->params['session_token']) ? null : $this->params['session_token'];
+
+            if ($key && $secret) {
+                return Create::promiseFor(
+                    // a null sessionToken match the default signature of the constructor
+                    new Credentials($key, $secret, $sessionToken)
+                );
+            }
+
+            $msg = 'Could not find parameters set for credentials in config file.';
+            return new RejectedPromise(new CredentialsException($msg));
+        };
+    }
+
+    protected function getCertificateBundlePath(): ?string {
+        if ((int)($this->params['use_nextcloud_bundle'] ?? '0')) {
+            /** @var ICertificateManager $certManager */
+            $certManager = Server::get(ICertificateManager::class);
+            // since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage
+            if (!isset($this->params['primary_storage'])) {
+                return $certManager->getAbsoluteBundlePath();
+            } else {
+                return $certManager->getDefaultCertificatesBundlePath();
+            }
+        } else {
+            return null;
+        }
+    }
+
+    protected function getSSECKey(): ?string {
+        if (isset($this->params['sse_c_key']) && !empty($this->params['sse_c_key'])) {
+            return $this->params['sse_c_key'];
+        }
+
+        return null;
+    }
+
+    protected function getSSECParameters(bool $copy = false): array {
+        $key = $this->getSSECKey();
+
+        if ($key === null) {
+            return [];
+        }
+
+        $rawKey = base64_decode($key);
+        if ($copy) {
+            return [
+                'CopySourceSSECustomerAlgorithm' => 'AES256',
+                'CopySourceSSECustomerKey' => $rawKey,
+                'CopySourceSSECustomerKeyMD5' => md5($rawKey, true)
+            ];
+        }
+        return [
+            'SSECustomerAlgorithm' => 'AES256',
+            'SSECustomerKey' => $rawKey,
+            'SSECustomerKeyMD5' => md5($rawKey, true)
+        ];
+    }
 }

Spacing +12 added lines, -12 removed lines

@@ -39,7 +39,7 @@ 
 			throw new \Exception('Bucket has to be configured.');
 		}
 
-		$this->id = 'amazon::' . $params['bucket'];
+		$this->id = 'amazon::'.$params['bucket'];
 
 		$this->test = isset($params['test']);
 		$this->bucket = $params['bucket'];
@@ -52,10 +52,10 @@ 
 		$this->uploadPartSize = $params['uploadPartSize'] ?? 524288000;
 		$this->putSizeLimit = $params['putSizeLimit'] ?? 104857600;
 		$this->copySizeLimit = $params['copySizeLimit'] ?? 5242880000;
-		$this->useMultipartCopy = (bool)($params['useMultipartCopy'] ?? true);
+		$this->useMultipartCopy = (bool) ($params['useMultipartCopy'] ?? true);
 		$this->retriesMaxAttempts = $params['retriesMaxAttempts'] ?? 5;
 		$params['region'] = empty($params['region']) ? 'eu-west-1' : $params['region'];
-		$params['hostname'] = empty($params['hostname']) ? 's3.' . $params['region'] . '.amazonaws.com' : $params['hostname'];
+		$params['hostname'] = empty($params['hostname']) ? 's3.'.$params['region'].'.amazonaws.com' : $params['hostname'];
 		$params['s3-accelerate'] = $params['hostname'] === 's3-accelerate.amazonaws.com' || $params['hostname'] === 's3-accelerate.dualstack.amazonaws.com';
 		if (!isset($params['port']) || $params['port'] === '') {
 			$params['port'] = (isset($params['use_ssl']) && $params['use_ssl'] === false) ? 80 : 443;
@@ -94,7 +94,7 @@ 
 		}
 
 		$scheme = (isset($this->params['use_ssl']) && $this->params['use_ssl'] === false) ? 'http' : 'https';
-		$base_url = $scheme . '://' . $this->params['hostname'] . ':' . $this->params['port'] . '/';
+		$base_url = $scheme.'://'.$this->params['hostname'].':'.$this->params['port'].'/';
 
 		// Adding explicit credential provider to the beginning chain.
 		// Including default credential provider (skipping AWS shared config files).
@@ -150,20 +150,20 @@ 
 		try {
 			$logger = Server::get(LoggerInterface::class);
 			if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
-				$logger->debug('Bucket "' . $this->bucket . '" This bucket name is not dns compatible, it may contain invalid characters.',
+				$logger->debug('Bucket "'.$this->bucket.'" This bucket name is not dns compatible, it may contain invalid characters.',
 					['app' => 'objectstore']);
 			}
 
 			if ($this->params['verify_bucket_exists']) {
-				$cacheKey = $this->params['hostname'] . $this->bucket;
+				$cacheKey = $this->params['hostname'].$this->bucket;
 				$exist = $this->existingBucketsCache->get($cacheKey) === 1;
 
 				if (!$exist) {
 					if (!$this->connection->doesBucketExist($this->bucket)) {
 						try {
-							$logger->info('Bucket "' . $this->bucket . '" does not exist - creating it.', ['app' => 'objectstore']);
+							$logger->info('Bucket "'.$this->bucket.'" does not exist - creating it.', ['app' => 'objectstore']);
 							if (!$this->connection::isBucketDnsCompatible($this->bucket)) {
-								throw new StorageNotAvailableException('The bucket will not be created because the name is not dns compatible, please correct it: ' . $this->bucket);
+								throw new StorageNotAvailableException('The bucket will not be created because the name is not dns compatible, please correct it: '.$this->bucket);
 							}
 							$this->connection->createBucket(['Bucket' => $this->bucket]);
 							Server::get(IEventDispatcher::class)
@@ -180,7 +180,7 @@ 
 								'app' => 'objectstore',
 							]);
 							if ($e->getAwsErrorCode() !== 'BucketAlreadyOwnedByYou') {
-								throw new StorageNotAvailableException('Creation of bucket "' . $this->bucket . '" failed. ' . $e->getMessage());
+								throw new StorageNotAvailableException('Creation of bucket "'.$this->bucket.'" failed. '.$e->getMessage());
 							}
 						}
 					}
@@ -193,7 +193,7 @@ 
 				$this->connection->getHandlerList()->remove('s3.auto_encode');
 			}
 		} catch (S3Exception $e) {
-			throw new StorageNotAvailableException('S3 service is unable to handle request: ' . $e->getMessage());
+			throw new StorageNotAvailableException('S3 service is unable to handle request: '.$e->getMessage());
 		}
 
 		return $this->connection;
@@ -222,7 +222,7 @@ 
 	 * This function creates a credential provider based on user parameter file
 	 */
 	protected function paramCredentialProvider(): callable {
-		return function () {
+		return function() {
 			$key = empty($this->params['key']) ? null : $this->params['key'];
 			$secret = empty($this->params['secret']) ? null : $this->params['secret'];
 			$sessionToken = empty($this->params['session_token']) ? null : $this->params['session_token'];
@@ -240,7 +240,7 @@ 
 	}
 
 	protected function getCertificateBundlePath(): ?string {
-		if ((int)($this->params['use_nextcloud_bundle'] ?? '0')) {
+		if ((int) ($this->params['use_nextcloud_bundle'] ?? '0')) {
 			/** @var ICertificateManager $certManager */
 			$certManager = Server::get(ICertificateManager::class);
 			// since we store the certificate bundles on the primary storage, we can't get the bundle while setting up the primary storage

lib/private/Security/CertificateManager.php

Indentation +233 added lines, -233 removed lines

@@ -19,237 +19,237 @@
  * Manage trusted certificates for users
  */
 class CertificateManager implements ICertificateManager {
-	private ?string $bundlePath = null;
-
-	public function __construct(
-		protected View $view,
-		protected IConfig $config,
-		protected LoggerInterface $logger,
-		protected ISecureRandom $random,
-	) {
-	}
-
-	/**
-	 * Returns all certificates trusted by the user
-	 *
-	 * @return \OCP\ICertificate[]
-	 */
-	public function listCertificates(): array {
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			return [];
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return [];
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return [];
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file != '.' && $file != '..') {
-				try {
-					$content = $this->view->file_get_contents($path . $file);
-					if ($content !== false) {
-						$result[] = new Certificate($content, $file);
-					} else {
-						$this->logger->error("Failed to read certificate from $path");
-					}
-				} catch (\Exception $e) {
-					$this->logger->error("Failed to read certificate from $path", ['exception' => $e]);
-				}
-			}
-		}
-		closedir($handle);
-		return $result;
-	}
-
-	private function hasCertificates(): bool {
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			return false;
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return false;
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return false;
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file !== '.' && $file !== '..') {
-				return true;
-			}
-		}
-		closedir($handle);
-		return false;
-	}
-
-	/**
-	 * create the certificate bundle of all trusted certificated
-	 */
-	public function createCertificateBundle(): void {
-		$path = $this->getPathToCertificates();
-		$certs = $this->listCertificates();
-
-		if (!$this->view->file_exists($path)) {
-			$this->view->mkdir($path);
-		}
-
-		$defaultCertificates = file_get_contents($this->getDefaultCertificatesBundlePath());
-		if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
-			// log as exception so we have a stacktrace
-			$e = new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle');
-			$this->logger->error($e->getMessage(), ['exception' => $e]);
-			return;
-		}
-
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
-		$fhCerts = $this->view->fopen($tmpPath, 'w');
-
-		if (!is_resource($fhCerts)) {
-			throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
-		}
-
-		// Write user certificates
-		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
-			$data = $this->view->file_get_contents($file);
-			if (strpos($data, 'BEGIN CERTIFICATE')) {
-				fwrite($fhCerts, $data);
-				fwrite($fhCerts, "\r\n");
-			}
-		}
-
-		// Append the default certificates
-		fwrite($fhCerts, $defaultCertificates);
-
-		// Append the system certificate bundle
-		$systemBundle = $this->getCertificateBundle();
-		if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
-			$systemCertificates = $this->view->file_get_contents($systemBundle);
-			fwrite($fhCerts, $systemCertificates);
-		}
-
-		fclose($fhCerts);
-
-		$this->view->rename($tmpPath, $certPath);
-	}
-
-	/**
-	 * Save the certificate and re-generate the certificate bundle
-	 *
-	 * @param string $certificate the certificate data
-	 * @param string $name the filename for the certificate
-	 * @throws \Exception If the certificate could not get added
-	 */
-	public function addCertificate(string $certificate, string $name): ICertificate {
-		$path = $this->getPathToCertificates() . 'uploads/' . $name;
-		$directory = dirname($path);
-
-		$this->view->verifyPath($directory, basename($path));
-		$this->bundlePath = null;
-
-		if (!$this->view->file_exists($directory)) {
-			$this->view->mkdir($directory);
-		}
-
-		try {
-			$certificateObject = new Certificate($certificate, $name);
-			$this->view->file_put_contents($path, $certificate);
-			$this->createCertificateBundle();
-			return $certificateObject;
-		} catch (\Exception $e) {
-			throw $e;
-		}
-	}
-
-	/**
-	 * Remove the certificate and re-generate the certificate bundle
-	 */
-	public function removeCertificate(string $name): bool {
-		$path = $this->getPathToCertificates() . 'uploads/' . $name;
-
-		try {
-			$this->view->verifyPath(dirname($path), basename($path));
-		} catch (\Exception) {
-			return false;
-		}
-
-		$this->bundlePath = null;
-		if ($this->view->file_exists($path)) {
-			$this->view->unlink($path);
-			$this->createCertificateBundle();
-		}
-		return true;
-	}
-
-	/**
-	 * Get the path to the certificate bundle
-	 */
-	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
-	}
-
-	/**
-	 * Get the full local path to the certificate bundle
-	 * @throws \Exception when getting bundle path fails
-	 */
-	public function getAbsoluteBundlePath(): string {
-		try {
-			if ($this->bundlePath === null) {
-				if (!$this->hasCertificates()) {
-					$this->bundlePath = $this->getDefaultCertificatesBundlePath();
-				} else {
-					if ($this->needsRebundling()) {
-						$this->createCertificateBundle();
-					}
-
-					$certificateBundle = $this->getCertificateBundle();
-					$this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
-
-					if ($this->bundlePath === null) {
-						throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
-					}
-				}
-			}
-			return $this->bundlePath;
-		} catch (\Exception $e) {
-			$this->logger->error('Failed to get absolute bundle path. Fallback to default ca-bundle.crt', ['exception' => $e]);
-			return $this->getDefaultCertificatesBundlePath();
-		}
-	}
-
-	private function getPathToCertificates(): string {
-		return '/files_external/';
-	}
-
-	/**
-	 * Check if we need to re-bundle the certificates because one of the sources has updated
-	 */
-	private function needsRebundling(): bool {
-		$targetBundle = $this->getCertificateBundle();
-		if (!$this->view->file_exists($targetBundle)) {
-			return true;
-		}
-
-		$sourceMTime = $this->getFilemtimeOfCaBundle();
-		return $sourceMTime > $this->view->filemtime($targetBundle);
-	}
-
-	/**
-	 * get mtime of ca-bundle shipped by Nextcloud
-	 */
-	protected function getFilemtimeOfCaBundle(): int {
-		return filemtime($this->getDefaultCertificatesBundlePath());
-	}
-
-	public function getDefaultCertificatesBundlePath(): string {
-		return $this->config->getSystemValueString('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-	}
+    private ?string $bundlePath = null;
+
+    public function __construct(
+        protected View $view,
+        protected IConfig $config,
+        protected LoggerInterface $logger,
+        protected ISecureRandom $random,
+    ) {
+    }
+
+    /**
+     * Returns all certificates trusted by the user
+     *
+     * @return \OCP\ICertificate[]
+     */
+    public function listCertificates(): array {
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            return [];
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return [];
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return [];
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file != '.' && $file != '..') {
+                try {
+                    $content = $this->view->file_get_contents($path . $file);
+                    if ($content !== false) {
+                        $result[] = new Certificate($content, $file);
+                    } else {
+                        $this->logger->error("Failed to read certificate from $path");
+                    }
+                } catch (\Exception $e) {
+                    $this->logger->error("Failed to read certificate from $path", ['exception' => $e]);
+                }
+            }
+        }
+        closedir($handle);
+        return $result;
+    }
+
+    private function hasCertificates(): bool {
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            return false;
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return false;
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return false;
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file !== '.' && $file !== '..') {
+                return true;
+            }
+        }
+        closedir($handle);
+        return false;
+    }
+
+    /**
+     * create the certificate bundle of all trusted certificated
+     */
+    public function createCertificateBundle(): void {
+        $path = $this->getPathToCertificates();
+        $certs = $this->listCertificates();
+
+        if (!$this->view->file_exists($path)) {
+            $this->view->mkdir($path);
+        }
+
+        $defaultCertificates = file_get_contents($this->getDefaultCertificatesBundlePath());
+        if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
+            // log as exception so we have a stacktrace
+            $e = new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle');
+            $this->logger->error($e->getMessage(), ['exception' => $e]);
+            return;
+        }
+
+        $certPath = $path . 'rootcerts.crt';
+        $tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+        $fhCerts = $this->view->fopen($tmpPath, 'w');
+
+        if (!is_resource($fhCerts)) {
+            throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
+        }
+
+        // Write user certificates
+        foreach ($certs as $cert) {
+            $file = $path . '/uploads/' . $cert->getName();
+            $data = $this->view->file_get_contents($file);
+            if (strpos($data, 'BEGIN CERTIFICATE')) {
+                fwrite($fhCerts, $data);
+                fwrite($fhCerts, "\r\n");
+            }
+        }
+
+        // Append the default certificates
+        fwrite($fhCerts, $defaultCertificates);
+
+        // Append the system certificate bundle
+        $systemBundle = $this->getCertificateBundle();
+        if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
+            $systemCertificates = $this->view->file_get_contents($systemBundle);
+            fwrite($fhCerts, $systemCertificates);
+        }
+
+        fclose($fhCerts);
+
+        $this->view->rename($tmpPath, $certPath);
+    }
+
+    /**
+     * Save the certificate and re-generate the certificate bundle
+     *
+     * @param string $certificate the certificate data
+     * @param string $name the filename for the certificate
+     * @throws \Exception If the certificate could not get added
+     */
+    public function addCertificate(string $certificate, string $name): ICertificate {
+        $path = $this->getPathToCertificates() . 'uploads/' . $name;
+        $directory = dirname($path);
+
+        $this->view->verifyPath($directory, basename($path));
+        $this->bundlePath = null;
+
+        if (!$this->view->file_exists($directory)) {
+            $this->view->mkdir($directory);
+        }
+
+        try {
+            $certificateObject = new Certificate($certificate, $name);
+            $this->view->file_put_contents($path, $certificate);
+            $this->createCertificateBundle();
+            return $certificateObject;
+        } catch (\Exception $e) {
+            throw $e;
+        }
+    }
+
+    /**
+     * Remove the certificate and re-generate the certificate bundle
+     */
+    public function removeCertificate(string $name): bool {
+        $path = $this->getPathToCertificates() . 'uploads/' . $name;
+
+        try {
+            $this->view->verifyPath(dirname($path), basename($path));
+        } catch (\Exception) {
+            return false;
+        }
+
+        $this->bundlePath = null;
+        if ($this->view->file_exists($path)) {
+            $this->view->unlink($path);
+            $this->createCertificateBundle();
+        }
+        return true;
+    }
+
+    /**
+     * Get the path to the certificate bundle
+     */
+    public function getCertificateBundle(): string {
+        return $this->getPathToCertificates() . 'rootcerts.crt';
+    }
+
+    /**
+     * Get the full local path to the certificate bundle
+     * @throws \Exception when getting bundle path fails
+     */
+    public function getAbsoluteBundlePath(): string {
+        try {
+            if ($this->bundlePath === null) {
+                if (!$this->hasCertificates()) {
+                    $this->bundlePath = $this->getDefaultCertificatesBundlePath();
+                } else {
+                    if ($this->needsRebundling()) {
+                        $this->createCertificateBundle();
+                    }
+
+                    $certificateBundle = $this->getCertificateBundle();
+                    $this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
+
+                    if ($this->bundlePath === null) {
+                        throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
+                    }
+                }
+            }
+            return $this->bundlePath;
+        } catch (\Exception $e) {
+            $this->logger->error('Failed to get absolute bundle path. Fallback to default ca-bundle.crt', ['exception' => $e]);
+            return $this->getDefaultCertificatesBundlePath();
+        }
+    }
+
+    private function getPathToCertificates(): string {
+        return '/files_external/';
+    }
+
+    /**
+     * Check if we need to re-bundle the certificates because one of the sources has updated
+     */
+    private function needsRebundling(): bool {
+        $targetBundle = $this->getCertificateBundle();
+        if (!$this->view->file_exists($targetBundle)) {
+            return true;
+        }
+
+        $sourceMTime = $this->getFilemtimeOfCaBundle();
+        return $sourceMTime > $this->view->filemtime($targetBundle);
+    }
+
+    /**
+     * get mtime of ca-bundle shipped by Nextcloud
+     */
+    protected function getFilemtimeOfCaBundle(): int {
+        return filemtime($this->getDefaultCertificatesBundlePath());
+    }
+
+    public function getDefaultCertificatesBundlePath(): string {
+        return $this->config->getSystemValueString('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+    }
 }

Spacing +12 added lines, -12 removed lines

@@ -39,7 +39,7 @@ 
 			return [];
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return [];
 		}
@@ -51,7 +51,7 @@ 
 		while (false !== ($file = readdir($handle))) {
 			if ($file != '.' && $file != '..') {
 				try {
-					$content = $this->view->file_get_contents($path . $file);
+					$content = $this->view->file_get_contents($path.$file);
 					if ($content !== false) {
 						$result[] = new Certificate($content, $file);
 					} else {
@@ -71,7 +71,7 @@ 
 			return false;
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return false;
 		}
@@ -108,17 +108,17 @@ 
 			return;
 		}
 
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+		$certPath = $path.'rootcerts.crt';
+		$tmpPath = $certPath.'.tmp'.$this->random->generate(10, ISecureRandom::CHAR_DIGITS);
 		$fhCerts = $this->view->fopen($tmpPath, 'w');
 
 		if (!is_resource($fhCerts)) {
-			throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
+			throw new \RuntimeException('Unable to open file handler to create certificate bundle "'.$tmpPath.'".');
 		}
 
 		// Write user certificates
 		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
+			$file = $path.'/uploads/'.$cert->getName();
 			$data = $this->view->file_get_contents($file);
 			if (strpos($data, 'BEGIN CERTIFICATE')) {
 				fwrite($fhCerts, $data);
@@ -149,7 +149,7 @@ 
 	 * @throws \Exception If the certificate could not get added
 	 */
 	public function addCertificate(string $certificate, string $name): ICertificate {
-		$path = $this->getPathToCertificates() . 'uploads/' . $name;
+		$path = $this->getPathToCertificates().'uploads/'.$name;
 		$directory = dirname($path);
 
 		$this->view->verifyPath($directory, basename($path));
@@ -173,7 +173,7 @@ 
 	 * Remove the certificate and re-generate the certificate bundle
 	 */
 	public function removeCertificate(string $name): bool {
-		$path = $this->getPathToCertificates() . 'uploads/' . $name;
+		$path = $this->getPathToCertificates().'uploads/'.$name;
 
 		try {
 			$this->view->verifyPath(dirname($path), basename($path));
@@ -193,7 +193,7 @@ 
 	 * Get the path to the certificate bundle
 	 */
 	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
+		return $this->getPathToCertificates().'rootcerts.crt';
 	}
 
 	/**
@@ -214,7 +214,7 @@ 
 					$this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
 
 					if ($this->bundlePath === null) {
-						throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
+						throw new \RuntimeException('Unable to get certificate bundle "'.$certificateBundle.'".');
 					}
 				}
 			}
@@ -250,6 +250,6 @@ 
 	}
 
 	public function getDefaultCertificatesBundlePath(): string {
-		return $this->config->getSystemValueString('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+		return $this->config->getSystemValueString('default_certificates_bundle_path', \OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 	}
 }

config/config.sample.php

Indentation +2857 added lines, -2857 removed lines

@@ -29,2861 +29,2861 @@
 $CONFIG = [
 
 
-	/**
-	 * Default Parameters
-	 *
-	 * These parameters are configured by the Nextcloud installer, and are required
-	 * for your Nextcloud server to operate.
-	 */
-
-
-	/**
-	 * This is a unique identifier for your Nextcloud installation, created
-	 * automatically by the installer. This example is for documentation only,
-	 * and you should never use it because it will not work. A valid ``instanceid``
-	 * is created when you install Nextcloud.
-	 */
-	'instanceid' => '',
-
-	/**
-	 * This is a unique identifier for your server.
-	 * It is useful when your Nextcloud instance is using different PHP servers.
-	 * Once it's set it shouldn't be changed.
-	 *
-	 * Value must be an integer, comprised between 0 and 1023.
-	 *
-	 * When config.php is shared between different servers, this value should be overriden with "NC_serverid=<int>" on each server.
-	 * Note that it must be overriden for CLI and for your webserver.
-	 *
-	 * Example for CLI: NC_serverid=42 occ config:list system
-	 */
-	'serverid' => -1,
-
-	/**
-	 * The salt used to hash all passwords, auto-generated by the Nextcloud
-	 * installer. (There are also per-user salts.) If you lose this salt, you lose
-	 * all your passwords. This example is for documentation only, and you should
-	 * never use it.
-	 *
-	 * @deprecated 9.0.0 This salt is deprecated and only used for legacy-compatibility,
-	 * developers should *NOT* use this value for anything nowadays.
-	 */
-	'passwordsalt' => '',
-
-	/**
-	 * Secret used by Nextcloud for various purposes, e.g., to encrypt data. If you
-	 * lose this string, there will be data corruption.
-	 */
-	'secret' => '',
-
-	/**
-	 * Your list of trusted domains that users can log into. Specifying trusted
-	 * domains prevents host header poisoning. Do not remove this, as it performs
-	 * necessary security checks.
-	 *
-	 * You can specify:
-	 *
-	 * - The exact hostname of your host or virtual host, e.g. ``demo.example.org``.
-	 * - The exact hostname with permitted port, e.g. ``demo.example.org:443``. This disallows all other ports on this host
-	 * - Use ``*`` as a wildcard, e.g., ``ubos-raspberry-pi*.local`` will allow ``ubos-raspberry-pi.local`` and ``ubos-raspberry-pi-2.local``
-	 * - The IP address with or without permitted port, e.g. ``[2001:db8::1]:8080`` Using TLS certificates where ``commonName=<IP address>`` is deprecated
-	 */
-	'trusted_domains' => [
-		'demo.example.org',
-		'otherdomain.example.org',
-		'10.111.112.113',
-		'[2001:db8::1]'
-	],
-
-	/**
-	 * The validity domain for cookies, for example ``''`` (cookies will be sent only
-	 * the domain that defined it, e.g. ``'demo.example.org'``), ``'demo.example.org'``
-	 * (cookies will be valid for the domain and all subdomains), ...
-	 *
-	 * Defaults to ``''`` (safe option)
-	 */
-	'cookie_domain' => '',
-
-	/**
-	 * Where user files are stored. The SQLite database is also stored here, when
-	 * you use SQLite.
-	 *
-	 * Default to ``data/`` in the Nextcloud directory.
-	 */
-	'datadirectory' => '/var/www/nextcloud/data',
-
-	/**
-	 * The current version number of your Nextcloud installation. This is set up
-	 * during installation and update, so you shouldn't need to change it.
-	 */
-	'version' => '',
-
-	/**
-	 * Identifies the database used with this installation. See also config option
-	 * ``supportedDatabases``
-	 *
-	 * Available:
-	 *  - sqlite3 (SQLite3)
-	 *  - mysql (MySQL/MariaDB)
-	 *  - pgsql (PostgreSQL)
-	 *
-	 * Defaults to ``sqlite3``
-	 */
-	'dbtype' => 'sqlite3',
-
-	/**
-	 * Your host server name, for example ``localhost``, ``hostname``,
-	 * ``hostname.example.com``, or the IP address.
-	 * To specify a port, use ``hostname:####``; for IPv6 addresses, use the URI notation ``[ip]:port``.
-	 * To specify a Unix socket, use ``localhost:/path/to/directory/containing/socket`` or
-	 * ``:/path/to/directory/containing/socket``, e.g., ``localhost:/run/postgresql/``.
-	 */
-	'dbhost' => '',
-
-	/**
-	 * The name of the Nextcloud database, which is set during installation. You
-	 * should not need to change this.
-	 */
-	'dbname' => 'nextcloud',
-
-	/**
-	 * The user that Nextcloud uses to write to the database. This must be unique
-	 * across Nextcloud instances using the same SQL database. This is set up during
-	 * installation, so you shouldn't need to change it.
-	 */
-	'dbuser' => '',
-
-	/**
-	 * The password for the database user. This is set up during installation, so
-	 * you shouldn't need to change it.
-	 */
-	'dbpassword' => '',
-
-	/**
-	 * Prefix for the Nextcloud tables in the database.
-	 *
-	 * Default to ``oc_``
-	 */
-	'dbtableprefix' => 'oc_',
-
-	/**
-	 * Enable persistent connections to the database.
-	 * This setting uses the ``persistent`` option from Doctrine DBAL, which in turn
-	 * uses the PDO::ATTR_PERSISTENT option from the PDO driver.
-	 */
-	'dbpersistent' => '',
-
-	/**
-	 * Specify read-only replicas to be used by Nextcloud when querying the database
-	 */
-	'dbreplica' => [
-		['user' => 'nextcloud', 'password' => 'password1', 'host' => 'replica1', 'dbname' => ''],
-		['user' => 'nextcloud', 'password' => 'password2', 'host' => 'replica2', 'dbname' => ''],
-	],
-
-	/**
-	 * Add request ID to the database query in a comment.
-	 *
-	 * This can be enabled to assist in mapping database logs to Nextcloud logs.
-	 */
-	'db.log_request_id' => false,
-
-	/**
-	 * Indicates whether the Nextcloud instance was installed successfully; ``true``
-	 * indicates a successful installation, and ``false`` indicates an unsuccessful
-	 * installation.
-	 *
-	 * Defaults to ``false``
-	 */
-	'installed' => false,
-
-
-	/**
-	 * User Experience
-	 *
-	 * These optional parameters control some aspects of the user interface. Default
-	 * values, where present, are shown.
-	 */
-
-	/**
-	 * This sets the default language on your Nextcloud server, using ISO_639-1
-	 * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for
-	 * French. The default_language parameter is only used when the browser does
-	 * not send any language, and the user hasn’t configured their own language
-	 * preferences.
-	 *
-	 * Nextcloud has two distinguished language codes for German, ``de`` and ``de_DE``.
-	 * ``de`` is used for informal German and ``de_DE`` for formal German. By setting
-	 * this value to ``de_DE``, you can enforce the formal version of German unless
-	 * the user has chosen something different explicitly.
-	 *
-	 * Defaults to ``en``
-	 */
-	'default_language' => 'en',
-
-	/**
-	 * With this setting, a language can be forced for all users. If a language is
-	 * forced, the users are also unable to change their language in the personal
-	 * settings. If users shall be unable to change their language, but users have
-	 * different languages, this value can be set to ``true`` instead of a language
-	 * code.
-	 *
-	 * Defaults to ``false``
-	 */
-	'force_language' => 'en',
-
-	/**
-	 * This sets the default locale on your Nextcloud server, using ISO_639
-	 * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for
-	 * French, and ISO-3166 country codes such as ``GB``, ``US``, ``CA``, as defined
-	 * in RFC 5646. It overrides automatic locale detection on public pages like
-	 * login or shared items. User's locale preferences configured under "personal
-	 * -> locale" override this setting after they have logged in.
-	 *
-	 * Defaults to ``en``
-	 */
-	'default_locale' => 'en_US',
-
-	/**
-	 * With this setting, it is possible to reduce the languages available in the
-	 * language chooser. The languages have to be set as array values using ISO_639-1
-	 * language codes such as ``en`` for English, ``de`` for German, etc.
-	 *
-	 * For example: Set to ``['de', 'fr']`` to only allow German and French languages.
-	 */
-	'reduce_to_languages' => [],
-
-	/**
-	 * This sets the default region for phone numbers on your Nextcloud server,
-	 * using ISO 3166-1 country codes such as ``DE`` for Germany, ``FR`` for France, …
-	 * It is required to allow inserting phone numbers in the user profiles starting
-	 * without the country code (e.g., +49 for Germany).
-	 *
-	 * No default value!
-	 */
-	'default_phone_region' => 'GB',
-
-	/**
-	 * With this setting, a locale can be forced for all users. If a locale is
-	 * forced, the users are also unable to change their locale in the personal
-	 * settings. If users shall be unable to change their locale, but users have
-	 * different languages, this value can be set to ``true`` instead of a locale
-	 * code.
-	 *
-	 * Defaults to ``false``
-	 */
-	'force_locale' => 'en_US',
-
-	/**
-	 * This sets the default timezone on your Nextcloud server, using IANA
-	 * identifiers like ``Europe/Berlin`` or ``Pacific/Auckland``. The default
-	 * timezone parameter is only used when the timezone of the user cannot be
-	 * determined.
-	 *
-	 * Defaults to ``UTC``
-	 */
-	'default_timezone' => 'Europe/Berlin',
-
-	/**
-	 * ``true`` enables the Help menu item in the user menu (top right of the
-	 * Nextcloud Web interface).
-	 * ``false`` removes the Help item.
-	 */
-	'knowledgebaseenabled' => true,
-
-	/**
-	 * ``true`` embeds the documentation in an iframe inside Nextcloud.
-	 * ``false`` only shows buttons to the online documentation.
-	 */
-	'knowledgebase.embedded' => false,
-
-	/**
-	 * ``true`` allows users to change their display names (on their Personal
-	 * pages), and ``false`` prevents them from changing their display names.
-	 */
-	'allow_user_to_change_display_name' => true,
-
-	/**
-	 * The directory where the skeleton files are located. These files will be
-	 * copied to the data directory of new users. Set empty string to not copy any
-	 * skeleton files. If unset and templatedirectory is an empty string, shipped
-	 * templates will be used to create a template directory for the user.
-	 * ``{lang}`` can be used as a placeholder for the language of the user.
-	 * If the directory does not exist, it falls back to non-dialect (from ``de_DE``
-	 * to ``de``). If that does not exist either, it falls back to ``default``
-	 *
-	 * Defaults to ``core/skeleton`` in the Nextcloud directory.
-	 */
-	'skeletondirectory' => '/path/to/nextcloud/core/skeleton',
-
-	/**
-	 * The directory where the template files are located. These files will be
-	 * copied to the template directory of new users. Set empty string to not copy any
-	 * template files.
-	 * ``{lang}`` can be used as a placeholder for the language of the user.
-	 * If the directory does not exist, it falls back to non-dialect (from ``de_DE``
-	 * to ``de``). If that does not exist either, it falls back to ``default``
-	 *
-	 * To disable creating a template directory, set both skeletondirectory and
-	 * templatedirectory to empty strings.
-	 */
-	'templatedirectory' => '/path/to/nextcloud/templates',
-
-	/**
-	 * User session
-	 */
-
-	/**
-	 * Lifetime of the remember login cookie. This should be larger than the
-	 * session_lifetime. If it is set to 0, remember me is disabled.
-	 *
-	 * Defaults to ``60*60*24*15`` seconds (15 days)
-	 */
-	'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,
-
-	/**
-	 * The lifetime of a session after inactivity.
-	 *
-	 * The maximum possible time is limited by the ``session.gc_maxlifetime`` php.ini setting
-	 * which would overwrite this option if it is less than the value in the ``config.php``
-	 *
-	 * Defaults to ``60*60*24`` seconds (24 hours)
-	 */
-	'session_lifetime' => 60 * 60 * 24,
-
-	/**
-	 * The timeout in seconds for requests to servers made by the DAV component (e.g., needed for federated shares).
-	 */
-	'davstorage.request_timeout' => 30,
-
-	/**
-	 * The timeout in seconds for synchronizing address books, e.g., federated system address books (as run by ``occ federation:sync-addressbooks``).
-	 *
-	 * Defaults to ``30`` seconds
-	 */
-	'carddav_sync_request_timeout' => 30,
-
-	/**
-	 * The limit applied to the synchronization report request, e.g. federated system address books (as run by ``occ federation:sync-addressbooks``).
-	 */
-	'carddav_sync_request_truncation' => 2500,
-
-	/**
-	 * ``true`` enables a relaxed session timeout, where the session timeout would no longer be
-	 * handled by Nextcloud but by either the PHP garbage collection or the expiration of
-	 * potential other session backends like Redis.
-	 *
-	 * This may lead to sessions being available for longer than what ``session_lifetime`` uses but
-	 * comes with performance benefits as sessions are no longer a locking operation for concurrent
-	 * requests.
-	 */
-	'session_relaxed_expiry' => false,
-
-	/**
-	 * Enable or disable session keep-alive when a user is logged in to the Web UI.
-	 * Enabling this sends a "heartbeat" to the server to keep it from timing out.
-	 *
-	 * Defaults to ``true``
-	 */
-	'session_keepalive' => true,
-
-	/**
-	 * Enable or disable the automatic logout after session_lifetime, even if session
-	 * keepalive is enabled. This will make sure that an inactive browser will log itself out
-	 * even if requests to the server might extend the session lifetime.
-	 *
-	 * NOTE: The logout is handled on the client side. This is not a way to
-	 * limit the duration of potentially compromised sessions.
-	 *
-	 * Defaults to ``false``
-	 */
-	'auto_logout' => false,
-
-	/**
-	 * Enforce token authentication for clients, which blocks requests using the user
-	 * password for enhanced security. Users need to generate tokens in personal settings
-	 * which can be used as passwords on their clients.
-	 *
-	 * Defaults to ``false``
-	 */
-	'token_auth_enforced' => false,
-
-	/**
-	 * The interval at which token activity should be updated.
-	 * Increasing this value means that the last activity on the security page gets
-	 * more outdated.
-	 *
-	 * Tokens are still checked every 5 minutes for validity
-	 * max value: 300
-	 *
-	 * Defaults to ``60``
-	 */
-	'token_auth_activity_update' => 60,
-
-	/**
-	 * Whether the brute force protection shipped with Nextcloud should be enabled or not.
-	 *
-	 * WARNING: Disabling this is discouraged for security reasons.
-	 *
-	 * Defaults to ``true``
-	 */
-	'auth.bruteforce.protection.enabled' => true,
-
-	/**
-	 * Whether the brute force protection should write into the database even when a memory cache is available
-	 *
-	 * Using the database is most likely worse for performance, but makes investigating
-	 * issues a lot easier as it's possible to look directly at the table to see all
-	 * logged remote addresses and actions.
-	 *
-	 * Defaults to ``false``
-	 */
-	'auth.bruteforce.protection.force.database' => false,
-
-	/**
-	 * Whether the brute force protection shipped with Nextcloud should be set to testing mode.
-	 *
-	 * In testing mode, brute force attempts are still recorded, but the requests do
-	 * not sleep/wait for the specified time. They will still abort with
-	 * "429 Too Many Requests" when the maximum delay is reached.
-	 * Enabling this is discouraged for security reasons
-	 * and should only be done for debugging and on CI when running tests.
-	 *
-	 * Defaults to ``false``
-	 */
-	'auth.bruteforce.protection.testing' => false,
-
-	/**
-	 * Brute force protection: maximum number of attempts before blocking
-	 *
-	 * When more than max-attempts login requests are sent to Nextcloud, requests
-	 * will abort with "429 Too Many Requests".
-	 * For security reasons, change it only if you know what you are doing.
-	 *
-	 * Defaults to ``10``
-	 */
-	'auth.bruteforce.max-attempts' => 10,
-
-	/**
-	 * Whether the rate limit protection shipped with Nextcloud should be enabled or not.
-	 *
-	 * WARNING: Disabling this is discouraged for security reasons.
-	 *
-	 * Defaults to ``true``
-	 */
-	'ratelimit.protection.enabled' => true,
-
-	/**
-	 * Overwrite the individual rate limit for a specific route
-	 *
-	 * From time to time it can be necessary to extend the rate limit of a specific route,
-	 * depending on your usage pattern or when you script some actions.
-	 * Instead of completely disabling the rate limit or excluding an IP address from the
-	 * rate limit, the following config allows to overwrite the rate limit duration and period.
-	 *
-	 * The first level key is the name of the route. You can find the route name from a URL
-	 * using the ``occ router:list`` command of your server.
-	 *
-	 * You can also specify different limits for logged-in users with the ``user`` key
-	 * and not-logged-in users with the ``anon`` key. However, if there is no specific ``user`` limit,
-	 * the ``anon`` limit is also applied for logged-in users.
-	 *
-	 * Defaults to empty array ``[]``
-	 */
-	'ratelimit_overwrite' => [
-		'profile.profilepage.index' => [
-			'user' => ['limit' => 300, 'period' => 3600],
-			'anon' => ['limit' => 1, 'period' => 300],
-		]
-	],
-
-	/**
-	 * Size of subnet used to normalize IPv6
-	 *
-	 * For Brute Force Protection and Rate Limiting, IPv6 addresses are truncated using subnet size.
-	 * It defaults to /56, but you can set it between /32 and /64
-	 *
-	 * Defaults to ``56``
-	 */
-	'security.ipv6_normalized_subnet_size' => 56,
-
-	/**
-	 * By default, WebAuthn is available, but it can be explicitly disabled by admins
-	 */
-	'auth.webauthn.enabled' => true,
-
-	/**
-	 * Whether encrypted passwords should be stored in the database
-	 *
-	 * The passwords are only decrypted using the login token stored uniquely in the
-	 * clients and allow connecting to external storages, autoconfiguring mail accounts in
-	 * the mail app, and periodically checking if the password is still valid.
-	 *
-	 * This might be desirable to disable this functionality when using one-time
-	 * passwords or when having a password policy enforcing long passwords (> 300
-	 * characters).
-	 *
-	 * By default, the passwords are stored encrypted in the database.
-	 *
-	 * WARNING: If disabled, password changes on the user backend (e.g., on LDAP) no
-	 * longer log connected clients out automatically. Users can still disconnect
-	 * the clients by deleting the app token from the security settings.
-	 */
-	'auth.storeCryptedPassword' => true,
-
-	/**
-	 * By default, the login form is always available. There are cases (SSO) where an
-	 * admin wants to avoid users entering their credentials to the system if the SSO
-	 * app is unavailable.
-	 *
-	 * This will show an error. But the direct login still works with adding ``?direct=1``
-	 */
-	'hide_login_form' => false,
-
-	/**
-	 * If your user backend does not allow password resets (e.g., when it's a
-	 * read-only user backend like LDAP), you can specify a custom link, where the
-	 * user is redirected to, when clicking the "Reset password" link after a failed
-	 * login attempt.
-	 * In case you do not want to provide any link, replace the URL with ``'disabled'``
-	 */
-	'lost_password_link' => 'https://example.org/link/to/password/reset',
-
-	/**
-	 * URL to use as target for the logo link in the header (top-left logo)
-	 *
-	 * Defaults to the base URL of your Nextcloud instance
-	 */
-	'logo_url' => 'https://example.org',
-
-	/**
-	 * Mail Parameters
-	 *
-	 * These configure the email settings for Nextcloud notifications and password
-	 * resets.
-	 */
-
-	/**
-	 * The return address that you want to appear on emails sent by the Nextcloud
-	 * server, for example ``nc-admin@example.com``, substituting your own domain,
-	 * of course.
-	 */
-	'mail_domain' => 'example.com',
-
-	/**
-	 * FROM address that overrides the built-in ``sharing-noreply`` and
-	 * ``lostpassword-noreply`` FROM addresses.
-	 *
-	 * Defaults to different FROM addresses depending on the feature.
-	 */
-	'mail_from_address' => 'nextcloud',
-
-	/**
-	 * Enable SMTP class debugging.
-	 * NOTE: ``loglevel`` will likely need to be adjusted too. See docs:
-	 *   https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html#enabling-debug-mode
-	 *
-	 * Defaults to ``false``
-	 */
-	'mail_smtpdebug' => false,
-
-	/**
-	 * Which mode to use for sending mail: ``sendmail``, ``smtp``, ``qmail``, or ``null``.
-	 *
-	 * If you are using local or remote SMTP, set this to ``smtp``.
-	 *
-	 * For the ``sendmail`` option, you need an installed and working email system on
-	 * the server, with ``/usr/sbin/sendmail`` installed on your Unix system.
-	 *
-	 * For ``qmail``, the binary is /var/qmail/bin/sendmail, and it must be installed
-	 * on your Unix system.
-	 *
-	 * Use the string ``null`` to send no mails (disable mail delivery). This can be
-	 * useful if mails should be sent via APIs and rendering messages is not necessary.
-	 *
-	 * Defaults to ``smtp``
-	 */
-	'mail_smtpmode' => 'smtp',
-
-	/**
-	 * This depends on ``mail_smtpmode``. Specify the IP address of your mail
-	 * server host. This may contain multiple hosts separated by a semicolon. If
-	 * you need to specify the port number, append it to the IP address separated by
-	 * a colon, like this: ``127.0.0.1:24``.
-	 *
-	 * Defaults to ``127.0.0.1``
-	 */
-	'mail_smtphost' => '127.0.0.1',
-
-	/**
-	 * This depends on ``mail_smtpmode``. Specify the port for sending mail.
-	 *
-	 * Defaults to ``25``
-	 */
-	'mail_smtpport' => 25,
-
-	/**
-	 * This depends on ``mail_smtpmode``. This sets the SMTP server timeout, in
-	 * seconds. You may need to increase this if you are running an anti-malware or
-	 * spam scanner.
-	 *
-	 * Defaults to ``10`` seconds
-	 */
-	'mail_smtptimeout' => 10,
-
-	/**
-	 * This depends on ``mail_smtpmode``. Specify ``ssl`` when you are using SSL/TLS. Any other value will be ignored.
-	 *
-	 * If the server advertises STARTTLS capabilities, they might be used, but they cannot be enforced by
-	 * this config option.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'mail_smtpsecure' => '',
-
-	/**
-	 * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail
-	 * server requires authentication.
-	 *
-	 * Defaults to ``false``
-	 */
-	'mail_smtpauth' => false,
-
-	/**
-	 * This depends on ``mail_smtpauth``. Specify the username for authenticating to
-	 * the SMTP server.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'mail_smtpname' => '',
-
-	/**
-	 * This depends on ``mail_smtpauth``. Specify the password for authenticating to
-	 * the SMTP server.
-	 *
-	 * Default to ``''`` (empty string)
-	 */
-	'mail_smtppassword' => '',
-
-	/**
-	 * Replaces the default mail template layout. This can be utilized if the
-	 * options to modify the mail texts with the theming app are not enough.
-	 * The class must extend ``\OC\Mail\EMailTemplate``
-	 */
-	'mail_template_class' => '\OC\Mail\EMailTemplate',
-
-	/**
-	 * Email will be sent by default with an HTML and a plain text body. This option
-	 * allows sending only plain text emails.
-	 */
-	'mail_send_plaintext_only' => false,
-
-	/**
-	 * This depends on ``mail_smtpmode``. Array of additional streams options that
-	 * will be passed to underlying Swift mailer implementation.
-	 * Defaults to an empty array.
-	 */
-	'mail_smtpstreamoptions' => [],
-
-	/**
-	 * Which mode is used for sendmail/qmail: ``smtp`` or ``pipe``.
-	 *
-	 * For ``smtp``, the sendmail binary is started with the parameter ``-bs``:
-	 *   - Use the SMTP protocol on standard input and output.
-	 *
-	 * For ``pipe``, the binary is started with the parameters ``-t``:
-	 *   - Read message from STDIN and extract recipients.
-	 *
-	 * Defaults to ``smtp``
-	 */
-	'mail_sendmailmode' => 'smtp',
-
-	/**
-	 * Proxy Configurations
-	 */
-
-	/**
-	 * The automatic hostname detection of Nextcloud can fail in certain reverse
-	 * proxy and CLI/cron situations. This option allows you to manually override
-	 * the automatic detection; for example, ``www.example.com``, or specify the port
-	 * ``www.example.com:8080``.
-	 */
-	'overwritehost' => '',
-
-	/**
-	 * When generating URLs, Nextcloud attempts to detect whether the server is
-	 * accessed via ``https`` or ``http``. However, if Nextcloud is behind a proxy
-	 * and the proxy handles the ``https`` calls, Nextcloud would not know that
-	 * ``ssl`` is in use, which would result in incorrect URLs being generated.
-	 * Valid values are ``http`` and ``https``.
-	 */
-	'overwriteprotocol' => '',
-
-	/**
-	 * Nextcloud attempts to detect the webroot for generating URLs automatically.
-	 * For example, if ``www.example.com/nextcloud`` is the URL pointing to the
-	 * Nextcloud instance, the webroot is ``/nextcloud``. When proxies are in use,
-	 * it may be difficult for Nextcloud to detect this parameter, resulting in
-	 * invalid URLs.
-	 */
-	'overwritewebroot' => '',
-
-	/**
-	 * This option allows you to define a manual override condition as a regular
-	 * expression for the remote IP address. For example, defining a range of IP
-	 * addresses starting with ``10.0.0.`` and ending with 1 to 3:
-	 * ``^10\.0\.0\.[1-3]$``
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'overwritecondaddr' => '',
-
-	/**
-	 * Use this configuration parameter to specify the base URL for any URLs which
-	 * are generated within Nextcloud using any kind of command line tools (cron or
-	 * occ). The value should contain the full base URL:
-	 * ``https://www.example.com/nextcloud``
-	 * Please make sure to set the value to the URL that your users mainly use to access this Nextcloud.
-	 * Otherwise, there might be problems with the URL generation via cron.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'overwrite.cli.url' => '',
-
-	/**
-	 * To have clean URLs without ``/index.php``, this parameter needs to be configured.
-	 *
-	 * This parameter will be written as "RewriteBase" on update and installation of
-	 * Nextcloud to your ``.htaccess`` file. While this value is often simply the URL
-	 * path of the Nextcloud installation, it cannot be set automatically properly in
-	 * every scenario and needs thus some manual configuration.
-	 *
-	 * In a standard Apache setup, this usually equals the folder that Nextcloud is
-	 * accessible at. So if Nextcloud is accessible via ``https://mycloud.org/nextcloud``,
-	 * the correct value would most likely be ``/nextcloud``. If Nextcloud is running
-	 * under ``https://mycloud.org/``, then it would be ``/``.
-	 *
-	 * Note that the above rule is not valid in every case, as there are some rare setup
-	 * cases where this may not apply. However, to avoid any update problems, this
-	 * configuration value is explicitly opt-in.
-	 *
-	 * After setting this value, run ``occ maintenance:update:htaccess``. Now, when the
-	 * following conditions are met, Nextcloud URLs won't contain ``index.php``:
-	 *
-	 * - ``mod_rewrite`` is installed
-	 * - ``mod_env`` is installed
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'htaccess.RewriteBase' => '/',
-
-	/**
-	 * For server setups that don't have ``mod_env`` enabled or restricted (e.g., suEXEC),
-	 * this parameter has to be set to true and will assume mod_rewrite.
-	 *
-	 * Please check if ``mod_rewrite`` is active and functional before setting this
-	 * parameter, and you updated your .htaccess with ``occ maintenance:update:htaccess``.
-	 * Otherwise, your Nextcloud installation might not be reachable any more.
-	 * For example, try accessing resources by leaving out ``index.php`` in the URL.
-	 */
-	'htaccess.IgnoreFrontController' => false,
-
-	/**
-	 * The URL of your proxy server, for example, ``proxy.example.com:8081``.
-	 *
-	 * NOTE: Guzzle (the HTTP library used by Nextcloud) reads the environment
-	 * variables ``HTTP_PROXY`` (only for CLI requests), ``HTTPS_PROXY``, and ``NO_PROXY`` by default.
-	 *
-	 * If you configure a proxy with Nextcloud, any default configuration by Guzzle
-	 * is overwritten. Make sure to set ``proxyexclude`` accordingly if necessary.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'proxy' => '',
-
-	/**
-	 * The optional authentication for the proxy to use to connect to the internet.
-	 * The format is: ``username:password``.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'proxyuserpwd' => '',
-
-	/**
-	 * List of hostnames that should not be proxied to.
-	 * For example: ``['.mit.edu', 'foo.com']``.
-	 *
-	 * Hint: Use something like ``explode(',', getenv('NO_PROXY'))`` to sync this
-	 * value with the global ``NO_PROXY`` option.
-	 *
-	 * Defaults to empty array.
-	 */
-	'proxyexclude' => [],
-
-	/**
-	 * Allow remote servers with local addresses, e.g., in federated shares, webcal services, and more
-	 *
-	 * Defaults to ``false``
-	 */
-	'allow_local_remote_servers' => true,
-
-	/**
-	 * Deleted Items (trash bin)
-	 *
-	 * These parameters control the Deleted files app.
-	 */
-
-	/**
-	 * If the trash bin app is enabled (default), this setting defines the policy
-	 * for when files and folders in the trash bin will be permanently deleted.
-	 *
-	 * If the user quota limit is exceeded due to deleted files in the trash bin,
-	 * retention settings will be ignored and files will be cleaned up until
-	 * the quota requirements are met.
-	 *
-	 * The app allows for two settings, a minimum time for trash bin retention,
-	 * and a maximum time for trash bin retention.
-	 *
-	 * Minimum time is the number of days a file will be kept, after which it
-	 * *may be* deleted. A file may be deleted after the minimum number of days
-	 * has expired if space is needed. The file will not be deleted if space is
-	 * not needed.
-	 *
-	 * Whether "space is needed" depends on whether a user quota is defined or not:
-	 *
-	 *  * If no user quota is defined, the available space on the Nextcloud data
-	 *    partition sets the limit for the trashbin
-	 *    (issues: see https://github.com/nextcloud/server/issues/28451).
-	 *  * If a user quota is defined, 50% of the user's remaining quota space sets
-	 *    the limit for the trashbin.
-	 *
-	 * Maximum time is the number of days at which it is *guaranteed
-	 * to be* deleted. There is no further dependency on the available space.
-	 *
-	 * Both minimum and maximum times can be set together to explicitly define
-	 * file and folder deletion. For migration purposes, this setting is installed
-	 * initially set to "auto", which is equivalent to the default setting in
-	 * Nextcloud.
-	 *
-	 * Available values (D1 and D2 are configurable numbers):
-	 *
-	 * * ``auto``
-	 *     | Default setting. Keeps files and folders in the trash bin for at least **30** days.
-	 *     | Then, **if space is needed**, deletes trashed files anytime after that.
-	 * * ``D1, auto``
-	 *     | Keeps files and folders in the trash bin for at least **D1** days.
-	 *     | Then, **if space is needed**, deletes trashed files anytime after that.
-	 * * ``auto, D2``
-	 *     | **If space is needed**, deletes trashed files anytime.
-	 *     | After **D2** days, delete all trashed files automatically
-	 * * ``D1, D2``
-	 *     | Keeps files and folders in the trash bin for at least **D1** days.
-	 *     | Then, after **D2** days, delete all trashed files automatically.
-	 * * ``disabled``
-	 *     | Trash bin auto clean is disabled, files and folders will be kept forever.
-	 *
-	 * Defaults to ``auto``
-	 */
-	'trashbin_retention_obligation' => 'auto',
-
-
-	/**
-	 * File versions
-	 *
-	 * These parameters control the Versions app.
-	 */
-
-	/**
-	 * If the versions app is enabled (default), this setting defines the policy
-	 * for when versions will be permanently deleted.
-	 * The app allows for two settings, a minimum time for version retention,
-	 * and a maximum time for version retention.
-	 * Minimum time is the number of days a version will be kept, after which it
-	 * may be deleted. Maximum time is the number of days at which it is guaranteed
-	 * to be deleted.
-	 * Both minimum and maximum times can be set together to explicitly define
-	 * version deletion. For migration purposes, this setting is installed
-	 * initially set to "auto", which is equivalent to the default setting in
-	 * Nextcloud.
-	 *
-	 * Available values:
-	 *
-	 * * ``auto``
-	 *     default setting. Automatically expire versions according to expire
-	 *     rules. Please refer to :doc:`../configuration_files/file_versioning` for
-	 *     more information.
-	 * * ``D, auto``
-	 *     keep versions at least for D days, apply expiration rules to all versions
-	 *     that are older than D days
-	 * * ``auto, D``
-	 *     delete all versions that are older than D days automatically, delete
-	 *     other versions according to expire rules
-	 * * ``D1, D2``
-	 *     keep versions for at least D1 days and delete when exceeds D2 days
-	 * * ``disabled``
-	 *     versions auto clean disabled, versions will be kept forever
-	 *
-	 * Defaults to ``auto``
-	 */
-	'versions_retention_obligation' => 'auto',
-
-	/**
-	 * Nextcloud Verifications
-	 *
-	 * Nextcloud performs several verification checks. There are two options,
-	 * ``true`` and ``false``.
-	 */
-
-	/**
-	 * Checks an app before install whether it uses private APIs instead of the
-	 * proper public APIs. If this is set to true, it will only allow installing or
-	 * enabling apps that pass this check.
-	 *
-	 * Defaults to ``false``
-	 */
-	'appcodechecker' => true,
-
-	/**
-	 * Check if Nextcloud is up-to-date and shows a notification if a new version is
-	 * available. It sends current version, PHP version, installation and last update
-	 * time, and release channel to the updater server which responds with the latest
-	 * available version based on those metrics.
-	 *
-	 * Defaults to ``true``
-	 */
-	'updatechecker' => true,
-
-	/**
-	 * URL that Nextcloud should use to look for updates
-	 *
-	 * Defaults to ``https://updates.nextcloud.com/updater_server/``
-	 */
-	'updater.server.url' => 'https://updates.nextcloud.com/updater_server/',
-
-	/**
-	 * The channel that Nextcloud should use to look for updates
-	 *
-	 * Supported values:
-	 *
-	 * - ``daily``
-	 * - ``beta``
-	 * - ``stable``
-	 */
-	'updater.release.channel' => 'stable',
-
-	/**
-	 * Is Nextcloud connected to the Internet or running in a closed network?
-	 *
-	 * Defaults to ``true``
-	 */
-	'has_internet_connection' => true,
-
-	/**
-	 * Which domains to request to determine the availability of an Internet
-	 * connection. If none of these hosts are reachable, the administration panel
-	 * will show a warning. Set to an empty list to not do any such checks (warning
-	 * will still be shown).
-	 * If no protocol is provided, both http and https will be tested.
-	 * For example, ``http://www.nextcloud.com`` and ``https://www.nextcloud.com``
-	 * will be tested for ``www.nextcloud.com``
-	 * If a protocol is provided, only this one will be tested.
-	 *
-	 * Defaults to the following domains:
-	 *
-	 *  - https://www.nextcloud.com
-	 *  - https://www.startpage.com
-	 *  - https://www.eff.org
-	 *  - https://www.edri.org
-	 */
-	'connectivity_check_domains' => [
-		'https://www.nextcloud.com',
-		'https://www.startpage.com',
-		'https://www.eff.org',
-		'https://www.edri.org'
-	],
-
-	/**
-	 * Allows Nextcloud to verify a working .well-known URL redirects. This is done
-	 * by attempting to make a request from JS to
-	 * ``https://example.tld/.well-known/caldav/``
-	 *
-	 * Defaults to ``true``
-	 */
-	'check_for_working_wellknown_setup' => true,
-
-	/**
-	 * This is a crucial security check on Apache servers that should always be set
-	 * to ``true``. This verifies that the ``.htaccess`` file is writable and works.
-	 * If it is not, then any options controlled by ``.htaccess``, such as large
-	 * file uploads, will not work. It also runs checks on the ``data/`` directory,
-	 * which verifies that it can't be accessed directly through the Web server.
-	 *
-	 * Defaults to ``true``
-	 */
-	'check_for_working_htaccess' => true,
-
-	/**
-	 * In rare setups (e.g., on OpenShift or Docker on Windows), the permissions check
-	 * might block the installation while the underlying system offers no means to
-	 * "correct" the permissions. In this case, set the value to false.
-	 *
-	 * In regular cases, if issues with permissions are encountered, they should be
-	 * adjusted accordingly. Changing the flag is discouraged.
-	 *
-	 * Defaults to ``true``
-	 */
-	'check_data_directory_permissions' => true,
-
-	/**
-	 * In certain environments, it is desired to have a read-only configuration file.
-	 * When this switch is set to ``true``, writing to the config file will be
-	 * forbidden. Therefore, it will not be possible to configure all options via
-	 * the Web interface. Furthermore, when updating Nextcloud, it is required to
-	 * make the configuration file writable again and to set this switch to ``false``
-	 * for the update process.
-	 *
-	 * Defaults to ``false``
-	 */
-	'config_is_read_only' => false,
-
-	/**
-	 * Logging
-	 */
-
-	/**
-	 * This parameter determines where the Nextcloud logs are sent.
-	 *
-	 * - ``file``: the logs are written to file ``nextcloud.log`` in the default Nextcloud data directory. The log file can be changed with parameter ``logfile``.
-	 * - ``syslog``: the logs are sent to the system log. This requires a syslog daemon to be active.
-	 * - ``errorlog``: the logs are sent to the PHP ``error_log`` function.
-	 * - ``systemd``: the logs are sent to the Systemd journal. This requires a system that runs Systemd and the Systemd journal. The PHP extension ``systemd`` must be installed and active.
-	 *
-	 * Defaults to ``file``
-	 */
-	'log_type' => 'file',
-
-	/**
-	 * This parameter determines where the audit logs are sent. See ``log_type`` for more information.
-	 *
-	 * Defaults to ``file``
-	 */
-	'log_type_audit' => 'file',
-
-	/**
-	 * Name of the file to which the Nextcloud logs are written if parameter
-	 * ``log_type`` is set to ``file``.
-	 *
-	 * Defaults to ``[datadirectory]/nextcloud.log``
-	 */
-	'logfile' => '/var/log/nextcloud.log',
-
-	/**
-	 * Name of the file to which the audit logs are written if parameter
-	 * ``log_type`` is set to ``file``.
-	 *
-	 * Defaults to ``[datadirectory]/audit.log``
-	 */
-	'logfile_audit' => '/var/log/audit.log',
-
-	/**
-	 * Log file mode for the Nextcloud logging type in octal notation.
-	 *
-	 * Defaults to ``0640`` (writable by user, readable by group).
-	 */
-	'logfilemode' => 0640,
-
-	/**
-	 * Loglevel to start logging at. Valid values are:
-	 *
-	 * - ``0`` = Debug
-	 * - ``1`` = Info
-	 * - ``2`` = Warning
-	 * - ``3`` = Error
-	 * - ``4`` = Fatal.
-	 *
-	 *
-	 * Defaults to ``2`` (Warning)
-	 */
-	'loglevel' => 2,
-
-	/**
-	 * Loglevel used by the frontend to start logging at. The same values as
-	 * for ``loglevel`` can be used. If not set, it defaults to the value
-	 * configured for ``loglevel`` or Warning if that is not set either.
-	 *
-	 * Defaults to ``2``
-	 */
-	'loglevel_frontend' => 2,
-
-	/**
-	 * Loglevel used by the dirty database query detection. Useful to identify
-	 * potential database bugs in production. Set this to loglevel or higher to
-	 * see dirty queries in the logs.
-	 *
-	 * Defaults to ``0`` (debug)
-	 */
-	'loglevel_dirty_database_queries' => 0,
-
-	/**
-	 * If you maintain different instances and aggregate the logs, you may want
-	 * to distinguish between them. ``syslog_tag`` can be set per instance
-	 * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or
-	 * ``systemd``.
-	 *
-	 * The default value is ``Nextcloud``.
-	 */
-	'syslog_tag' => 'Nextcloud',
-
-	/**
-	 * If you maintain different instances and aggregate the logs, you may want
-	 * to distinguish between them. ``syslog_tag_audit`` can be set per instance
-	 * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or
-	 * ``systemd``.
-	 *
-	 * The default value is the value of ``syslog_tag``.
-	 */
-	'syslog_tag_audit' => 'Nextcloud',
-
-	/**
-	 * Log condition for log level increase based on conditions. Once one of these
-	 * conditions is met, the required log level is set to debug. This allows
-	 * debugging specific requests, users, or apps
-	 *
-	 * Supported conditions:
-	 *  - ``shared_secret``: if a request parameter with the name `log_secret` is set to
-	 *                this value, the condition is met
-	 *  - ``users``:  if the current request is done by one of the specified users,
-	 *                this condition is met
-	 *  - ``apps``:   if the log message is invoked by one of the specified apps,
-	 *                this condition is met
-	 *  - ``matches``: if all the conditions inside a group match,
-	 *                this condition is met. This allows logging only entries to an app
-	 *                by a few users.
-	 *
-	 * Defaults to an empty array.
-	 */
-	'log.condition' => [
-		'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9',
-		'users' => ['sample-user'],
-		'apps' => ['files'],
-		'matches' => [
-			[
-				'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9',
-				'users' => ['sample-user'],
-				'apps' => ['files'],
-				'loglevel' => 1,
-				'message' => 'contains substring'
-			],
-		],
-	],
-
-	/**
-	 * Enables logging a backtrace with each log line. Normally, only Exceptions
-	 * carry backtrace information, which are logged automatically. This
-	 * switch turns them on for any log message. Enabling this option will lead
-	 * to increased log data size.
-	 *
-	 * Defaults to ``false``.
-	 */
-	'log.backtrace' => false,
-
-	/**
-	 * This uses PHP.date formatting; see https://www.php.net/manual/en/function.date.php
-	 *
-	 * Defaults to ISO 8601 ``2005-08-15T15:52:01+00:00``, see ``\DateTime::ATOM``
-	 * https://www.php.net/manual/en/class.datetimeinterface.php#datetimeinterface.constants.atom
-	 */
-	'logdateformat' => 'F d, Y H:i:s',
-
-	/**
-	 * The timezone for logfiles. See https://www.php.net/manual/en/timezones.php
-	 *
-	 * Defaults to ``UTC``
-	 */
-	'logtimezone' => 'Europe/Berlin',
-
-	/**
-	 * Append all database queries and parameters to the log file. Use this only for
-	 * debugging, as your logfile will become huge.
-	 */
-	'log_query' => false,
-
-	/**
-	 * Enables log rotation and limits the total size of logfiles. Set it to 0 for
-	 * no rotation. Specify a size in bytes, for example, 104857600 (100 megabytes
-	 * = 100 * 1024 * 1024 bytes). A new logfile is created with a new name when the
-	 * old logfile reaches your limit. If a rotated log file is already present, it
-	 * will be overwritten.
-	 *
-	 * Defaults to 100 MB
-	 */
-	'log_rotate_size' => 100 * 1024 * 1024,
-
-	/**
-	 * Enable built-in profiler. Helpful when trying to debug performance
-	 * issues.
-	 *
-	 * Note that this has a performance impact and shouldn't be enabled
-	 * on production.
-	 */
-	'profiler' => false,
-
-	/**
-	 * Enable profiling for individual requests if profiling single requests is enabled or the secret is passed.
-	 * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data.
-	 *
-	 * The profile data will be stored as a JSON file in the profiling.path directory that can be analyzed with speedscope.
-	 *
-	 * Defaults to ``false``
-	 */
-	'profiling.request' => false,
-
-	/**
-	 * The rate at which profiling data is collected for individual requests.
-	 * A lower value means more data points but higher overhead.
-	 *
-	 * Defaults to ``0.001``
-	 */
-	'profiling.request.rate' => 0.001,
-
-	/**
-	 * A secret token that can be passed via ?profile_secret=<secret> to enable profiling for a specific request.
-	 * This allows profiling specific requests in production without enabling it globally.
-	 *
-	 * No default value.
-	 */
-	'profiling.secret' => '',
-
-	/**
-	 * Enable sampling-based profiling. This collects profiling data periodically rather than per-request.
-	 * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data.
-	 *
-	 * The profile data will be stored as a plain text file in the profiling.path directory that can be analyzed with speedscope.
-	 *
-	 * Defaults to ``false``
-	 */
-	'profiling.sample' => false,
-
-	/**
-	 * The rate at which sampling profiling data is collected in seconds.
-	 * A lower value means more frequent samples but higher overhead.
-	 *
-	 * Defaults to ``1``
-	 */
-	'profiling.sample.rate' => 1,
-
-	/**
-	 * How often (in minutes) the sample log files are rotated.
-	 *
-	 * Defaults to ``60``
-	 */
-	'profiling.sample.rotation' => 60,
-
-	/**
-	 * The directory where profiling data is stored.
-	 *
-	 * Note that this directory must be writable by the web server user and will not be cleaned up automatically.
-	 */
-	'profiling.path' => '/tmp',
-
-
-	/**
-	 * Alternate Code Locations
-	 *
-	 * Some Nextcloud code may be stored in alternate locations.
-	 */
-
-	/**
-	 * This section is for configuring the download links for Nextcloud clients, as
-	 * seen in the first-run wizard and on Personal pages.
-	 *
-	 * Defaults to:
-	 *
-	 * - Desktop client: ``https://nextcloud.com/install/#install-clients``
-	 * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client``
-	 * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8``
-	 * - iOS client app ID: ``1125420102``
-	 * - F-Droid client: ``https://f-droid.org/packages/com.nextcloud.client/``
-	 */
-	'customclient_desktop'
-		=> 'https://nextcloud.com/install/#install-clients',
-	'customclient_android'
-		=> 'https://play.google.com/store/apps/details?id=com.nextcloud.client',
-	'customclient_ios'
-		=> 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8',
-	'customclient_ios_appid'
-		=> '1125420102',
-	'customclient_fdroid'
-		=> 'https://f-droid.org/packages/com.nextcloud.client/',
-
-	/**
-	 * Activity
-	 *
-	 * Options for the activity app.
-	 */
-
-	/**
-	 * Retention of activities.
-	 *
-	 * A daily cron job deletes all activities for all users which are older than
-	 * the number of days specified here.
-	 *
-	 * Defaults to ``365``
-	 */
-	'activity_expire_days' => 365,
-
-	/**
-	 * Activities in Team Folders and External Storages.
-	 *
-	 * By default, activities in team folders or external storages are only generated
-	 * for the current user. This is due to a limitations in current implementations.
-	 * This config flag makes activities in group folders and external storages work
-	 * like in normal shares (when set to ``true``).
-	 *
-	 * WARNING: Enabling this comes with some CRITICAL trade-offs:
-	 *
-	 * - If team folder "Advanced Permissions" (ACLs) are used, activities do not
-	 *   respect the permissions and therefore all users see all activities, even
-	 *   for files and directories they do not have access to.
-	 * - Users who had access to a team folder, share, or external storage can see
-	 *   activities in their stream and emails that happen after they are removed
-	 *   until they log in again.
-	 * - Users who are newly added to a team folder, share, or external storage
-	 *   cannot see activities in their stream or emails that happen after they
-	 *   are added until they log in again.
-	 *
-	 * Defaults to ``false``
-	 */
-	'activity_use_cached_mountpoints' => false,
-
-	/**
-	 * Apps
-	 *
-	 * Options for the Apps folder, Apps store, and App code checker.
-	 */
-
-	/**
-	 * Set the default app to open on login. The entry IDs can be retrieved from
-	 * the Navigations OCS API endpoint: https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/core-navigation-get-apps-navigation.
-	 * You can use a comma-separated list of app names, so if the first
-	 * app is not enabled for a user, then Nextcloud will try the second one, and so
-	 * on. If no enabled apps are found, it defaults to the dashboard app.
-	 *
-	 * Defaults to ``dashboard,files``
-	 */
-	'defaultapp' => 'dashboard,files',
-
-	/**
-	 * When enabled, admins may install apps from the Nextcloud app store.
-	 *
-	 * Defaults to ``true``
-	 */
-	'appstoreenabled' => true,
-
-	/**
-	 * Enables the installation of apps from a self-hosted apps store.
-	 * Requires that at least one of the configured apps directories is writable.
-	 *
-	 * Defaults to ``https://apps.nextcloud.com/api/v1``
-	 */
-	'appstoreurl' => 'https://apps.nextcloud.com/api/v1',
-
-	/**
-	 * Filters allowed installable apps from the appstore.
-	 * Empty array will prevent all apps from the store to be found.
-	 */
-	'appsallowlist' => [],
-
-	/**
-	 * Use the ``apps_paths`` parameter to set the location of the Apps directory,
-	 * which should be scanned for available apps, and where user-specific apps
-	 * should be installed from the Apps store. The ``path`` defines the absolute
-	 * file system path to the app folder. The key ``url`` defines the HTTP Web path
-	 * to that folder, starting from the Nextcloud webroot. The key ``writable``
-	 * indicates if a Web server can write files to that folder.
-	 */
-	'apps_paths' => [
-		[
-			'path' => '/var/www/nextcloud/apps',
-			'url' => '/apps',
-			'writable' => true,
-		],
-	],
-
-	/**
-	 * @see appcodechecker
-	 */
-
-	/**
-	 * Previews
-	 *
-	 * Nextcloud supports generating previews for various file types, such as images, audio files, and text files.
-	 * These options control enabling and disabling previews, and thumbnail size.
-	 */
-
-	/**
-	 * By default, Nextcloud can generate previews for the following filetypes:
-	 *
-	 * - Image files
-	 * - Text documents
-	 *
-	 * Valid values are ``true``, to enable previews, or
-	 * ``false``, to disable previews
-	 *
-	 * Defaults to ``true``
-	 */
-	'enable_previews' => true,
-
-	/**
-	 * Number of all preview requests being processed concurrently,
-	 * including previews that need to be newly generated, and those that have
-	 * been generated.
-	 *
-	 * This should be greater than ``preview_concurrency_new``.
-	 * If unspecified, defaults to twice the value of ``preview_concurrency_new``.
-	 */
-	'preview_concurrency_all' => 8,
-
-	/**
-	 * Number of new previews that are being concurrently generated.
-	 *
-	 * Depending on the max preview size set by ``preview_max_x`` and ``preview_max_y``,
-	 * the generation process can consume considerable CPU and memory resources.
-	 * It's recommended to limit this to be no greater than the number of CPU cores.
-	 * If unspecified, defaults to the number of CPU cores, or 4 if that cannot
-	 * be determined.
-	 */
-	'preview_concurrency_new' => 4,
-
-	/**
-	 * The maximum width, in pixels, of a preview. A value of ``null`` means there
-	 * is no limit.
-	 *
-	 * Defaults to ``4096``
-	 */
-	'preview_max_x' => 4096,
-	/**
-	 * The maximum height, in pixels, of a preview. A value of ``null`` means there
-	 * is no limit.
-	 *
-	 * Defaults to ``4096``
-	 */
-	'preview_max_y' => 4096,
-
-	/**
-	 * Max file size for generating image previews with imagegd (default behavior).
-	 * If the image is bigger, it'll try other preview generators, but will most
-	 * likely either show the default mimetype icon or not display the image at all.
-	 * Set to ``-1`` for no limit and try to generate image previews on all file sizes.
-	 *
-	 * Defaults to ``50`` megabytes
-	 */
-	'preview_max_filesize_image' => 50,
-
-	/**
-	 * Max memory for generating image previews with imagegd (default behavior)
-	 * Reads the image dimensions from the header and assumes 32 bits per pixel.
-	 * If creating the image would allocate more memory, preview generation will
-	 * be disabled and the default mimetype icon is shown. Set to ``-1`` for no limit.
-	 *
-	 * Defaults to ``256`` megabytes
-	 */
-	'preview_max_memory' => 256,
-
-	/**
-	 * Custom path for LibreOffice/OpenOffice binary
-	 *
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'preview_libreoffice_path' => '/usr/bin/libreoffice',
-
-	/**
-	 * Custom path for ffmpeg binary
-	 *
-	 * Defaults to ``null`` and falls back to searching ``ffmpeg``
-	 * in the configured ``PATH`` environment
-	 */
-	'preview_ffmpeg_path' => '/usr/bin/ffmpeg',
-
-	/**
-	 * Custom path for ffprobe binary
-	 *
-	 * Defaults to ``null`` and falls back to using the same path as ffmpeg.
-	 * ffprobe is typically packaged with ffmpeg and is required for
-	 * enhanced preview generation for HDR videos.
-	 */
-	'preview_ffprobe_path' => '/usr/bin/ffprobe',
-
-	/**
-	 * Set the URL of the Imaginary service to send image previews to.
-	 * Also requires the ``OC\Preview\Imaginary`` provider to be enabled in the
-	 * ``enabledPreviewProviders`` array, to create previews for these mimetypes: bmp,
-	 * x-bitmap, png, jpeg, gif, heic, heif, svg+xml, tiff, webp, and illustrator.
-	 *
-	 * If you want Imaginary to also create preview images from PDF documents, you
-	 * have to add the ``OC\Preview\ImaginaryPDF`` provider as well.
-	 *
-	 * See https://github.com/h2non/imaginary
-	 */
-	'preview_imaginary_url' => 'http://previews_hpb:8088/',
-
-	/**
-	 * If you want to set an API key for Imaginary.
-	 */
-	'preview_imaginary_key' => 'secret',
-
-	/**
-	 * Only register providers that have been explicitly enabled
-	 *
-	 * The following providers are disabled by default due to performance or privacy
-	 * concerns:
-	 *
-	 *  - ``OC\Preview\EMF``
-	 *  - ``OC\Preview\Font``
-	 *  - ``OC\Preview\HEIC``
-	 *  - ``OC\Preview\Illustrator``
-	 *  - ``OC\Preview\Movie``
-	 *  - ``OC\Preview\MP3``
-	 *  - ``OC\Preview\MSOffice2003``
-	 *  - ``OC\Preview\MSOffice2007``
-	 *  - ``OC\Preview\MSOfficeDoc``
-	 *  - ``OC\Preview\PDF``
-	 *  - ``OC\Preview\Photoshop``
-	 *  - ``OC\Preview\Postscript``
-	 *  - ``OC\Preview\SGI``
-	 *  - ``OC\Preview\StarOffice``
-	 *  - ``OC\Preview\SVG``
-	 *  - ``OC\Preview\TGA``
-	 *  - ``OC\Preview\TIFF``
-	 *
-	 * The following providers are disabled by default, because they provide an alternative to the built-in providers:
-	 *   - ``OC\Preview\Imaginary``
-	 *   - ``OC\Preview\ImaginaryPDF``
-	 *
-	 * Defaults to the following providers:
-	 *
-	 *  - ``OC\Preview\PNG``
-	 *  - ``OC\Preview\JPEG``
-	 *  - ``OC\Preview\GIF``
-	 *  - ``OC\Preview\BMP``
-	 *  - ``OC\Preview\XBitmap``
-	 *  - ``OC\Preview\Krita``
-	 *  - ``OC\Preview\WebP``
-	 *  - ``OC\Preview\MarkDown``
-	 *  - ``OC\Preview\TXT``
-	 *  - ``OC\Preview\OpenDocument``
-	 *
-	 */
-	'enabledPreviewProviders' => [
-		'OC\Preview\PNG',
-		'OC\Preview\JPEG',
-		'OC\Preview\GIF',
-		'OC\Preview\BMP',
-		'OC\Preview\XBitmap',
-		'OC\Preview\Krita',
-		'OC\Preview\WebP',
-		'OC\Preview\MarkDown',
-		'OC\Preview\TXT',
-		'OC\Preview\OpenDocument',
-	],
-
-	/**
-	 * Maximum file size for metadata generation.
-	 * If a file exceeds this size, metadata generation will be skipped.
-	 *
-	 * NOTE: memory equivalent to this size will be used for metadata generation.
-	 *
-	 * Default: 256 megabytes.
-	 */
-	'metadata_max_filesize' => 256,
-
-	/**
-	 * Maximum file size for file conversion.
-	 * If a file exceeds this size, the file will not be converted.
-	 *
-	 * Default: 100 MiB
-	 */
-	'max_file_conversion_filesize' => 100,
-
-	/**
-	 * LDAP
-	 *
-	 * Global settings used by LDAP User and Group Backend
-	 */
-
-	/**
-	 * Defines the interval in minutes for the background job that checks user
-	 * existence and marks them as ready to be cleaned up. The number is always
-	 * minutes. Setting it to 0 disables the feature.
-	 * See command line (occ) methods ``ldap:show-remnants`` and ``user:delete``
-	 *
-	 * Defaults to ``51`` minutes
-	 */
-	'ldapUserCleanupInterval' => 51,
-
-	/**
-	 * Sort groups in the user settings by name instead of the user count
-	 *
-	 * By enabling this, the user count beside the group name is disabled as well.
-	 *
-	 * @deprecated 29.0.0 Use the frontend instead or set the app config value ``group.sortBy`` for ``core`` to ``2``
-	 */
-	'sort_groups_by_name' => false,
-
-	/**
-	 * Comments
-	 *
-	 * Global settings for the Comments infrastructure
-	 */
-
-	/**
-	 * Replaces the default Comments Manager Factory. This can be utilized if an
-	 * own or 3rd-party CommentsManager should be used that – for instance – uses the
-	 * filesystem instead of the database to keep the comments.
-	 *
-	 * Defaults to ``\OC\Comments\ManagerFactory``
-	 */
-	'comments.managerFactory' => '\OC\Comments\ManagerFactory',
-
-	/**
-	 * Replaces the default System Tags Manager Factory. This can be utilized if an
-	 * own or 3rd-party SystemTagsManager should be used that – for instance – uses the
-	 * filesystem instead of the database to keep the tags.
-	 *
-	 * Defaults to ``\OC\SystemTag\ManagerFactory``
-	 */
-	'systemtags.managerFactory' => '\OC\SystemTag\ManagerFactory',
-
-	/**
-	 * Maintenance
-	 *
-	 * These options are for halting user activity when you are performing server
-	 * maintenance.
-	 */
-
-	/**
-	 * Enable maintenance mode to disable Nextcloud
-	 *
-	 * If you want to prevent users from logging in to Nextcloud before you start
-	 * doing some maintenance work, you need to set the value of the maintenance
-	 * parameter to true. Please keep in mind that users who are already logged in
-	 * are kicked out of Nextcloud instantly.
-	 *
-	 * Defaults to ``false``
-	 */
-	'maintenance' => false,
-
-	/**
-	 * UTC Hour for maintenance windows
-	 *
-	 * Some background jobs only run once a day. When an hour is defined for this config,
-	 * the background jobs which advertise themselves as not time sensitive will be
-	 * delayed during the "working" hours and only run in the 4 hours after the given time.
-	 * This is, e.g., used for activity expiration, suspicious login training, and update checks.
-	 *
-	 * A value of 1, e.g., will only run these background jobs between 01:00am UTC and 05:00am UTC.
-	 *
-	 * Defaults to ``100`` which disables the feature
-	 */
-	'maintenance_window_start' => 1,
-
-	/**
-	 * Log all LDAP requests into a file
-	 *
-	 * Warning: This heavily decreases the performance of the server and is only
-	 * meant to debug/profile the LDAP interaction manually.
-	 * Also, it might log sensitive data into a plain text file.
-	 */
-	'ldap_log_file' => '',
-
-	/**
-	 * SSL
-	 */
-
-	/**
-	 * Extra SSL options to be used for configuration.
-	 *
-	 * Defaults to an empty array.
-	 */
-	'openssl' => [
-		'config' => '/absolute/location/of/openssl.cnf',
-	],
-
-	/**
-	 * Memory caching backend configuration
-	 *
-	 * Available cache backends:
-	 *
-	 * * ``\OC\Memcache\APCu``       APC user backend
-	 * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended)
-	 * * ``\OC\Memcache\Memcached``  Memcached backend
-	 * * ``\OC\Memcache\Redis``      Redis backend
-	 *
-	 * Advice on choosing between the various backends:
-	 *
-	 * * APCu should be easiest to install. Almost all distributions have packages.
-	 *   Use this for single user environment for all caches.
-	 * * Use Redis or Memcached for distributed environments.
-	 *   For the local cache (you can configure two) take APCu.
-	 */
-
-	/**
-	 * Memory caching backend for locally stored data
-	 *
-	 * * Used for host-specific data, e.g., file paths
-	 *
-	 * Defaults to ``none``
-	 */
-	'memcache.local' => '\\OC\\Memcache\\APCu',
-
-	/**
-	 * Memory caching backend for distributed data
-	 *
-	 * * Used for installation-specific data, e.g., database caching
-	 * * If unset, defaults to the value of memcache.local
-	 *
-	 * Defaults to ``none``
-	 */
-	'memcache.distributed' => '\\OC\\Memcache\\Memcached',
-
-	/**
-	 * Connection details for Redis to use for memory caching in a single server configuration.
-	 *
-	 * For enhanced security, it is recommended to configure Redis
-	 * to require a password. See http://redis.io/topics/security
-	 * for more information.
-	 *
-	 * We also support Redis SSL/TLS encryption as of version 6.
-	 * See https://redis.io/topics/encryption for more information.
-	 */
-	'redis' => [
-		'host' => 'localhost', // can also be a Unix domain socket: '/tmp/redis.sock'
-		'port' => 6379,
-		'timeout' => 0.0,
-		'read_timeout' => 0.0,
-		'user' => '', // Optional: if not defined, no password will be used.
-		'password' => '', // Optional: if not defined, no password will be used.
-		'dbindex' => 0, // Optional: if undefined, SELECT will not run and will use Redis Server's default DB Index.
-		// If Redis in-transit encryption is enabled, provide certificates
-		// SSL context https://www.php.net/manual/en/context.ssl.php
-		'ssl_context' => [
-			'local_cert' => '/certs/redis.crt',
-			'local_pk' => '/certs/redis.key',
-			'cafile' => '/certs/ca.crt'
-		]
-	],
-
-	/**
-	 * Connection details for a Redis Cluster.
-	 *
-	 * Redis Cluster support requires the PHP module phpredis in version 3.0.0 or
-	 * higher.
-	 *
-	 * Available failover modes:
-	 *  - ``\RedisCluster::FAILOVER_NONE`` - only send commands to master nodes (default)
-	 *  - ``\RedisCluster::FAILOVER_ERROR`` - failover to slaves for read commands if master is unavailable (recommended)
-	 *  - ``\RedisCluster::FAILOVER_DISTRIBUTE`` - randomly distribute read commands across master and slaves
-	 *
-	 * WARNING: ``\RedisCluster::FAILOVER_DISTRIBUTE`` is a not recommended setting, and we strongly
-	 * suggest to not use it if you use Redis for file locking. Due to the way Redis
-	 * is synchronized, it could happen that the read for an existing lock is
-	 * scheduled to a slave that is not fully synchronized with the connected master
-	 * which then causes a FileLocked exception.
-	 *
-	 * See https://redis.io/topics/cluster-spec for details about the Redis cluster
-	 *
-	 * Authentication works with phpredis version 4.2.1+. See
-	 * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1
-	 */
-	'redis.cluster' => [
-		'seeds' => [ // provide some or all of the cluster servers to bootstrap discovery, port required
-			'localhost:7000',
-			'localhost:7001',
-		],
-		'timeout' => 0.0,
-		'read_timeout' => 0.0,
-		'failover_mode' => \RedisCluster::FAILOVER_ERROR,
-		'user' => '', // Optional: if not defined, no password will be used.
-		'password' => '', // Optional: if not defined, no password will be used.
-		// If Redis in-transit encryption is enabled, provide certificates
-		// SSL context https://www.php.net/manual/en/context.ssl.php
-		'ssl_context' => [
-			'local_cert' => '/certs/redis.crt',
-			'local_pk' => '/certs/redis.key',
-			'cafile' => '/certs/ca.crt'
-		]
-	],
-
-
-	/**
-	 * Server details for one or more Memcached servers to use for memory caching.
-	 */
-	'memcached_servers' => [
-		// hostname, port and optional weight
-		// or path and port 0 for Unix socket. Also see:
-		// https://www.php.net/manual/en/memcached.addservers.php
-		// https://www.php.net/manual/en/memcached.addserver.php
-		['localhost', 11211],
-		//array('other.host.local', 11211),
-	],
-
-	/**
-	 * Connection options for Memcached
-	 */
-	'memcached_options' => [
-		// Set timeouts to 50ms
-		\Memcached::OPT_CONNECT_TIMEOUT => 50,
-		\Memcached::OPT_RETRY_TIMEOUT => 50,
-		\Memcached::OPT_SEND_TIMEOUT => 50,
-		\Memcached::OPT_RECV_TIMEOUT => 50,
-		\Memcached::OPT_POLL_TIMEOUT => 50,
-
-		// Enable compression
-		\Memcached::OPT_COMPRESSION => true,
-
-		// Turn on consistent hashing
-		\Memcached::OPT_LIBKETAMA_COMPATIBLE => true,
-
-		// Enable Binary Protocol
-		\Memcached::OPT_BINARY_PROTOCOL => true,
-
-		// Binary serializer will be enabled if the igbinary PECL module is available
-		//\Memcached::OPT_SERIALIZER => \Memcached::SERIALIZER_IGBINARY,
-	],
-
-
-	/**
-	 * Location of the cache folder, defaults to ``data/$user/cache`` where
-	 * ``$user`` is the current user. When specified, the format will change to
-	 * ``$cache_path/$user`` where ``$cache_path`` is the configured cache directory
-	 * and ``$user`` is the user.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'cache_path' => '',
-
-	/**
-	 * TTL of chunks located in the cache folder before they're removed by
-	 * garbage collection (in seconds). Increase this value if users have
-	 * issues uploading very large files via the Nextcloud Client as upload isn't
-	 * completed within one day.
-	 *
-	 * Defaults to ``60*60*24`` (1 day)
-	 */
-	'cache_chunk_gc_ttl' => 60 * 60 * 24,
-
-	/**
-	 * Enable caching of the app config values.
-	 * If enabled the app config will be cached locally for a short TTL,
-	 * reducing database load significantly on larger setups.
-	 *
-	 * Defaults to ``true``
-	 */
-	'cache_app_config' => true,
-
-	/**
-	 * Using Object Store with Nextcloud
-	 */
-
-	/**
-	 * This example shows how to configure Nextcloud to store all files in a
-	 * Swift object storage.
-	 *
-	 * It is important to note that Nextcloud in object store mode will expect
-	 * exclusive access to the object store container because it only stores the
-	 * binary data for each file. The metadata is currently kept in the local
-	 * database for performance reasons.
-	 *
-	 * WARNING: The current implementation is incompatible with any app that uses
-	 * direct file I/O and circumvents our virtual filesystem. That includes
-	 * Encryption and Gallery. Gallery will store thumbnails directly in the
-	 * filesystem, and encryption will cause severe overhead because key files need
-	 * to be fetched in addition to any requested file.
-	 *
-	 */
-	'objectstore' => [
-		'class' => 'OC\\Files\\ObjectStore\\Swift',
-		'arguments' => [
-			// trystack will use your Facebook ID as the username
-			'username' => 'facebook100000123456789',
-			// in the trystack dashboard, go to user -> settings -> API Password to
-			// generate a password
-			'password' => 'Secr3tPaSSWoRdt7',
-			// must already exist in the objectstore, name can be different
-			'container' => 'nextcloud',
-			// prefix to prepend to the fileid, default is 'oid:urn:'
-			'objectPrefix' => 'oid:urn:',
-			// create the container if it does not exist. default is false
-			'autocreate' => true,
-			// required, dev-/trystack defaults to 'RegionOne'
-			'region' => 'RegionOne',
-			// The Identity / Keystone endpoint
-			'url' => 'http://8.21.28.222:5000/v2.0',
-			// uploadPartSize: size of the uploaded chunks, defaults to 524288000
-			'uploadPartSize' => 524288000,
-			// required on dev-/trystack
-			'tenantName' => 'facebook100000123456789',
-			// dev-/trystack uses swift by default, the lib defaults to 'cloudFiles'
-			// if omitted
-			'serviceName' => 'swift',
-			// The Interface / URL Type, optional
-			'urlType' => 'internal',
-			// Maximum amount of data that can be uploaded
-			'totalSizeLimit' => 1024 * 1024 * 1024,
-		],
-	],
-
-	/**
-	 * To use Swift V3
-	 */
-	'objectstore' => [
-		'class' => 'OC\\Files\\ObjectStore\\Swift',
-		'arguments' => [
-			'autocreate' => true,
-			'user' => [
-				'name' => 'swift',
-				'password' => 'swift',
-				'domain' => [
-					'name' => 'default',
-				],
-			],
-			'scope' => [
-				'project' => [
-					'name' => 'service',
-					'domain' => [
-						'name' => 'default',
-					],
-				],
-			],
-			'tenantName' => 'service',
-			'serviceName' => 'swift',
-			'region' => 'regionOne',
-			'url' => 'http://yourswifthost:5000/v3',
-			'bucket' => 'nextcloud',
-		],
-	],
-
-	/**
-	 * To use S3 object storage
-	 */
-	'objectstore' => [
-		'class' => 'OC\\Files\\ObjectStore\\S3',
-		'arguments' => [
-			'bucket' => 'nextcloud',
-			'key' => 'your-access-key',
-			'secret' => 'your-secret-key',
-			'hostname' => 's3.example.com',
-			'port' => 443,
-			'use_ssl' => true,
-			'region' => 'us-east-1',
-			// optional: Maximum number of retry attempts for failed S3 requests
-			// Default: 5
-			'retriesMaxAttempts' => 5,
-		],
-	],
-
-	/**
-	 * If this is set to true and a multibucket object store is configured, then
-	 * newly created previews are put into 256 dedicated buckets.
-	 *
-	 * Those buckets are named like the multibucket version but with the postfix
-	 * ``-preview-NUMBER`` where NUMBER is between 0 and 255.
-	 *
-	 * Keep in mind that only previews of files are put in there that don't have
-	 * some already. Otherwise, the old bucket will be used.
-	 *
-	 * To migrate existing previews to this new multibucket distribution of previews,
-	 * use the occ command ``preview:repair``. For now, this will only migrate
-	 * previews that were generated before Nextcloud 19 in the flat
-	 * ``appdata_INSTANCEID/previews/FILEID`` folder structure.
-	 */
-	'objectstore.multibucket.preview-distribution' => false,
-
-
-	/**
-	 * Sharing
-	 *
-	 * Global settings for Sharing
-	 */
-
-	/**
-	 * Replaces the default Share Provider Factory. This can be utilized if
-	 * own or 3rd-party Share Providers are used that – for instance – use the
-	 * filesystem instead of the database to keep the share information.
-	 *
-	 * Defaults to ``\OC\Share20\ProviderFactory``
-	 */
-	'sharing.managerFactory' => '\OC\Share20\ProviderFactory',
-
-	/**
-	 * Enables expiration for link share passwords sent by email (sharebymail).
-	 * The passwords will expire after the configured interval; the users can
-	 * still request a new one on the public link page.
-	 */
-	'sharing.enable_mail_link_password_expiration' => false,
-
-	/**
-	 * Expiration interval for passwords, in seconds.
-	 */
-	'sharing.mail_link_password_expiration_interval' => 3600,
-
-	/**
-	 * Define max number of results returned by the search for auto-completion of
-	 * users, groups, etc. The value must not be lower than 0 (for unlimited).
-	 *
-	 * If more, different sources are requested (e.g., different user backends; or
-	 * both users and groups), the value is applied per source and might not be
-	 * truncated after collecting the results. I.e., more results can appear than
-	 * configured here.
-	 *
-	 * Default is 25.
-	 */
-	'sharing.maxAutocompleteResults' => 25,
-
-	/**
-	 * Define the minimum length of the search string before we start auto-completion
-	 * Default is no limit (value set to 0)
-	 */
-	'sharing.minSearchStringLength' => 0,
-
-	/**
-	 * Set to true to enable that internal shares need to be accepted by the users by default.
-	 * Users can change this for their account in their personal sharing settings
-	 */
-	'sharing.enable_share_accept' => false,
-
-	/**
-	 * Set to ``true`` to enforce that internal shares need to be accepted
-	 */
-	'sharing.force_share_accept' => false,
-
-	/**
-	 * Set to ``false`` to prevent users from setting a custom share_folder
-	 */
-	'sharing.allow_custom_share_folder' => true,
-
-	/**
-	 * Define a default folder for shared files and folders other than root.
-	 * Changes to this value will only have effect on new shares.
-	 *
-	 * Defaults to ``/``
-	 */
-	'share_folder' => '/',
-
-	/**
-	 * Set to ``false`` to stop sending a mail when users receive a share
-	 */
-	'sharing.enable_share_mail' => true,
-
-	/**
-	 * Set to true to enable the feature to add exceptions for share password enforcement
-	 */
-	'sharing.allow_disabled_password_enforcement_groups' => false,
-
-	/**
-	 * Set to true to always transfer incoming shares by default
-	 * when running ``occ files:transfer-ownership``.
-	 * Defaults to ``false``, so incoming shares are not transferred if not specifically requested
-	 * by a command line argument.
-	 */
-	'transferIncomingShares' => false,
-
-	/**
-	 * Federated Cloud Sharing
-	 */
-
-	/**
-	 * Allow self-signed certificates for federated shares
-	 */
-	'sharing.federation.allowSelfSignedCertificates' => false,
-
-	/**
-	 * Hashing
-	 */
-
-	/**
-	 * By default, Nextcloud will use the Argon2 password hashing if available.
-	 * However, if for whatever reason you want to stick with the PASSWORD_DEFAULT
-	 * of your PHP version, then set the setting to true.
-	 *
-	 * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its
-	 * own and exposes its configuration options as following. More information can
-	 * be found at: https://www.php.net/manual/en/function.password-hash.php
-	 */
-	'hashing_default_password' => false,
-
-	/**
-	 * The number of CPU threads to be used by the algorithm for computing a hash.
-	 * The value must be an integer, and the minimum value is ``1``. Rationally, it does
-	 * not help to provide a number higher than the available threads on the machine.
-	 * Values that undershoot the minimum will be ignored in favor of the minimum.
-	 */
-	'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS,
-
-	/**
-	 * The memory in KiB to be used by the algorithm for computing a hash. The value
-	 * must be an integer, and the minimum value is 8 times the number of CPU threads.
-	 * Values that undershoot the minimum will be ignored in favor of the minimum.
-	 */
-	'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
-
-	/**
-	 * The number of iterations that are used by the algorithm for computing a hash.
-	 * The value must be an integer, and the minimum value is ``1``. Values that
-	 * undershoot the minimum will be ignored in favor of the minimum.
-	 */
-	'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST,
-
-	/**
-	 * The hashing cost used by hashes generated by Nextcloud
-	 * Using a higher value requires more time and CPU power to calculate the hashes
-	 */
-	'hashingCost' => 10,
-
-	/**
-	 * All other configuration options
-	 */
-
-	/**
-	 * Additional driver options for the database connection, e.g., to enable SSL
-	 * encryption in MySQL or specify a custom wait timeout on a cheap hoster.
-	 *
-	 * When setting up TLS/SSL for encrypting the connections, you need to ensure that
-	 * the passed keys and certificates are readable by the PHP process. In addition,
-	 * ``PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT`` might need to be set to false, if the
-	 * database server's certificate CN does not match with the hostname used to connect.
-	 * The standard behavior here is different from the MySQL/MariaDB CLI client, which
-	 * does not verify the server cert except ``--ssl-verify-server-cert`` is passed manually.
-	 */
-	'dbdriveroptions' => [
-		PDO::MYSQL_ATTR_SSL_CA => '/file/path/to/ca_cert.pem',
-		PDO::MYSQL_ATTR_SSL_KEY => '/file/path/to/mysql-client-key.pem',
-		PDO::MYSQL_ATTR_SSL_CERT => '/file/path/to/mysql-client-cert.pem',
-		PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false,
-		PDO::MYSQL_ATTR_INIT_COMMAND => 'SET wait_timeout = 28800'
-	],
-
-	/**
-	 * SQLite3 journal mode can be specified using this configuration parameter -
-	 * can be ``'WAL'`` or ``'DELETE'``. See https://www.sqlite.org/wal.html for more details.
-	 */
-	'sqlite.journal_mode' => 'DELETE',
-
-	/**
-	 * During setup, if requirements are met (see below), this setting is set to true
-	 * to enable MySQL to handle 4-byte characters instead of 3-byte characters.
-	 *
-	 * To convert an existing 3-byte setup to a 4-byte setup, configure the MySQL
-	 * parameters as described below and run the migration command:
-	 * ``./occ db:convert-mysql-charset``
-	 * This config setting will be automatically updated after a successful migration.
-	 *
-	 * Refer to the documentation for more details.
-	 *
-	 * MySQL requires specific settings for longer indexes (> 767 bytes), which are
-	 * necessary for 4-byte character support::
-	 *
-	 *     [mysqld]
-	 *     innodb_large_prefix=ON
-	 *     innodb_file_format=Barracuda
-	 *     innodb_file_per_table=ON
-	 *
-	 * Tables will be created with:
-	 *  * character set: ``utf8mb4``
-	 *  * collation:     ``utf8mb4_bin``
-	 *  * row_format:    ``dynamic``
-	 *
-	 * See:
-	 *  * https://dev.mysql.com/doc/refman/5.7/en/charset-unicode-utf8mb4.html
-	 *  * https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_large_prefix
-	 *  * https://mariadb.com/kb/en/mariadb/xtradbinnodb-server-system-variables/#innodb_large_prefix
-	 *  * http://www.tocker.ca/2013/10/31/benchmarking-innodb-page-compression-performance.html
-	 *  * http://mechanics.flite.com/blog/2014/07/29/using-innodb-large-prefix-to-avoid-error-1071/
-	 */
-	'mysql.utf8mb4' => false,
-
-	/**
-	 * For search queries in the database, a default collation is chosen based on the
-	 * character set. In some cases, a different collation is desired, such as for
-	 * accent-sensitive searches.
-	 *
-	 * MariaDB and MySQL share some collations, but also have incompatible ones,
-	 * depending on the database server version.
-	 *
-	 * This option allows overriding the automatic collation choice. Example::
-	 *
-	 *     'mysql.collation' => 'utf8mb4_0900_as_ci',
-	 *
-	 * This setting does not affect table creation or setup, where utf8[mb4]_bin is
-	 * always used. It applies only to SQL queries using LIKE comparison operators.
-	 */
-	'mysql.collation' => null,
-
-	/**
-	 * PostgreSQL SSL connection
-	 */
-	'pgsql_ssl' => [
-		'mode' => '',
-		'cert' => '',
-		'rootcert' => '',
-		'key' => '',
-		'crl' => '',
-	],
-
-	/**
-	 * Database types supported for installation.
-	 *
-	 * Available:
-	 *  - sqlite (SQLite3)
-	 *  - mysql (MySQL)
-	 *  - pgsql (PostgreSQL)
-	 *  - oci (Oracle)
-	 *
-	 * Defaults to:
-	 *  - sqlite (SQLite3)
-	 *  - mysql (MySQL)
-	 *  - pgsql (PostgreSQL)
-	 */
-	'supportedDatabases' => [
-		'sqlite',
-		'mysql',
-		'pgsql',
-		'oci',
-	],
-
-	/**
-	 * Override the location where Nextcloud stores temporary files. Useful in setups
-	 * where the system temporary directory is on a limited-space ramdisk, restricted,
-	 * or when using external storage that does not support streaming.
-	 *
-	 * The web server user/PHP must have write access to this directory. Ensure that
-	 * PHP configuration recognizes this as a valid temporary directory by setting
-	 * the TMP, TMPDIR, and TEMP environment variables accordingly. Additional
-	 * permissions may be required for AppArmor or SELinux.
-	 */
-	'tempdirectory' => '/tmp/nextcloudtemp',
-
-	/**
-	 * Override the location where Nextcloud stores update files during updates.
-	 * Useful when the default ``datadirectory`` is on a network disk like NFS or is
-	 * otherwise restricted. Defaults to the value of ``datadirectory`` if unset.
-	 *
-	 * If set, the directory must be located outside the Nextcloud installation
-	 * directory and writable by the web server user.
-	 */
-	'updatedirectory' => '',
-
-	/**
-	 * Block specific files or filenames, disallowing uploads or access (read and write).
-	 * ``.htaccess`` is blocked by default.
-	 *
-	 * WARNING: Use this only if you understand the implications.
-	 *
-	 * NOTE: This list is case-insensitive.
-	 *
-	 * Defaults to ``['.htaccess']``
-	 */
-	'forbidden_filenames' => ['.htaccess'],
-
-	/**
-	 * Disallow uploads of files with specific basenames. Matching existing files
-	 * cannot be updated, and no new files can be created in matching folders.
-	 *
-	 * The basename is the filename without the extension, e.g., for "archive.tar.gz",
-	 * the basename is "archive".
-	 *
-	 * NOTE: This list is case-insensitive.
-	 *
-	 * Defaults to ``[]`` (empty array)
-	 */
-	'forbidden_filename_basenames' => [],
-
-	/**
-	 * Block specific characters in filenames. Useful for filesystems or operating
-	 * systems (e.g., Windows) that do not support certain characters. Matching
-	 * existing files cannot be updated, and no new files can be created in matching
-	 * folders.
-	 *
-	 * The ``/`` and ``\`` characters, as well as ASCII characters [0-31], are always
-	 * forbidden.
-	 *
-	 * Example for Windows: ``['?', '<', '>', ':', '*', '|', '"']``
-	 * See: https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits
-	 *
-	 * Defaults to ``[]`` (empty array)
-	 */
-	'forbidden_filename_characters' => [],
-
-	/**
-	 * Deny specific file extensions. Matching existing files cannot be updated, and
-	 * no new files can be created in matching folders.
-	 *
-	 * The ``'.part'`` extension is always forbidden, as it is used internally by Nextcloud.
-	 *
-	 * Defaults to ``['.filepart', '.part']``
-	 */
-	'forbidden_filename_extensions' => ['.part', '.filepart'],
-
-	/**
-	 * Specify the name of a theme to apply to Nextcloud. Themes are located in
-	 * ``nextcloud/themes/`` by default.
-	 *
-	 * Defaults to the theming app, included since Nextcloud 9.
-	 */
-	'theme' => '',
-
-	/**
-	 * Enforce a specific user theme, disabling user theming settings. Must be a
-	 * valid ITheme ID, e.g., ``dark``, ``dark-highcontrast``, ``default``, ``light``,
-	 * ``light-highcontrast``, ``opendyslexic``.
-	 */
-	'enforce_theme' => '',
-
-	/**
-	 * Enable or disable Progressive Web App (PWA) functionality, which allows
-	 * browsers to open web applications in dedicated windows.
-	 *
-	 * Defaults to ``true``
-	 */
-	'theming.standalone_window.enabled' => true,
-
-	/**
-	 * Specify the default cipher for encrypting files. Supported ciphers:
-	 *  - AES-256-CTR
-	 *  - AES-128-CTR
-	 *  - AES-256-CFB
-	 *  - AES-128-CFB
-	 *
-	 * Defaults to ``AES-256-CTR``
-	 */
-	'cipher' => 'AES-256-CTR',
-
-	/**
-	 * Use the legacy base64 format for encrypted files instead of the more
-	 * space-efficient binary format. This affects only newly written files; existing
-	 * encrypted files remain readable regardless of the format.
-	 *
-	 * Defaults to ``false``
-	 */
-	'encryption.use_legacy_base64_encoding' => false,
-
-	/**
-	 * Specify the minimum Nextcloud desktop client version allowed to sync with this
-	 * server. Connections from earlier clients will be denied. Defaults to the
-	 * minimum officially supported version at the time of this server release.
-	 *
-	 * Changing this may cause older, unsupported clients to malfunction, potentially
-	 * leading to data loss or unexpected behavior.
-	 *
-	 * Defaults to ``3.1.0``
-	 */
-	'minimum.supported.desktop.version' => '3.1.0',
-
-	/**
-	 * Specify the maximum Nextcloud desktop client version allowed to sync with this
-	 * server. Connections from later clients will be denied.
-	 *
-	 * Defaults to ``99.99.99``
-	 */
-	'maximum.supported.desktop.version' => '99.99.99',
-
-	/**
-	 * Allow local storage to contain symlinks.
-	 * WARNING: Not recommended, as this allows Nextcloud to access files outside the
-	 * data directory, posing a potential security risk.
-	 *
-	 * Defaults to ``false``
-	 */
-	'localstorage.allowsymlinks' => false,
-
-	/**
-	 * Nextcloud overrides umask to ensure suitable access permissions regardless of
-	 * web server or PHP-FPM configuration. Modifying this value has security
-	 * implications and may cause issues with the installation.
-	 *
-	 * Most installations should not modify this value.
-	 *
-	 * Defaults to ``0022``
-	 */
-	'localstorage.umask' => 0022,
-
-	/**
-	 * Allow storage systems that do not support modifying existing files to overcome
-	 * this limitation by removing files before overwriting.
-	 *
-	 * Defaults to ``false``
-	 */
-	'localstorage.unlink_on_truncate' => false,
-
-	/**
-	 * EXPERIMENTAL: Include external storage in quota calculations.
-	 *
-	 * Defaults to ``false``
-	 */
-	'quota_include_external_storage' => false,
-
-	/**
-	 * When an external storage is unavailable (e.g., due to failed authentication),
-	 * it is flagged as such for a specified duration. For authentication failures,
-	 * this delay can be customized to reduce the likelihood of account lockouts in
-	 * systems like Active Directory.
-	 *
-	 * Defaults to ``1800`` seconds (30 minutes)
-	 */
-	'external_storage.auth_availability_delay' => 1800,
-
-	/**
-	 * Allow creation of external storages of type "Local" via the web interface and
-	 * APIs. When disabled, local storages can still be created using the occ command::
-	 *
-	 *      occ files_external:create /mountpoint local null::null -c datadir=/path/to/data
-	 *
-	 * Defaults to ``true``
-	 */
-	'files_external_allow_create_new_local' => true,
-
-	/**
-	 * Specify how often the local filesystem (Nextcloud data/ directory and NFS
-	 * mounts in data/) is checked for changes made outside Nextcloud. This does not
-	 * apply to external storage.
-	 *
-	 * - ``0`` -> Never check the filesystem for outside changes, improving performance when no external changes are expected.
-	 * - ``1`` -> Check each file or folder at most once per request, recommended for general use if outside changes are possible.
-	 *
-	 * Defaults to ``0``
-	 */
-	'filesystem_check_changes' => 0,
-
-	/**
-	 * Store part files created during upload in the same storage as the upload
-	 * target. Setting this to false stores part files in the root of the user's
-	 * folder, which may be necessary for external storage with limited rename
-	 * capabilities.
-	 *
-	 * Defaults to ``true``
-	 */
-	'part_file_in_storage' => true,
-
-	/**
-	 * Specify the location of the ``mount.json`` file.
-	 *
-	 * Defaults to ``data/mount.json`` in the Nextcloud directory.
-	 */
-	'mount_file' => '/var/www/nextcloud/data/mount.json',
-
-	/**
-	 * Prevent Nextcloud from updating the cache due to filesystem changes for all
-	 * storage.
-	 *
-	 * Defaults to ``false``
-	 */
-	'filesystem_cache_readonly' => false,
-
-	/**
-	 * List of trusted proxy servers. Supported formats:
-	 *
-	 * - IPv4 addresses, e.g., ``192.168.2.123``
-	 * - IPv4 ranges in CIDR notation, e.g., ``192.168.2.0/24``
-	 * - IPv6 addresses, e.g., ``fd9e:21a7:a92c:2323::1``
-	 * - IPv6 ranges in CIDR notation, e.g., ``2001:db8:85a3:8d3:1319:8a20::/95``
-	 *
-	 * If a request's ``REMOTE_ADDR`` matches an address here, it is treated as a proxy,
-	 * and the client IP is read from the HTTP header specified in
-	 * ``forwarded_for_headers`` instead of ``REMOTE_ADDR``.
-	 *
-	 * Ensure ``forwarded_for_headers`` is configured if ``trusted_proxies`` is set.
-	 *
-	 * Defaults to ``[]`` (empty array)
-	 */
-	'trusted_proxies' => ['203.0.113.45', '198.51.100.128', '192.168.2.0/24'],
-
-	/**
-	 * Headers trusted as containing the client IP address when used with
-	 * ``trusted_proxies``. For example, use ``HTTP_X_FORWARDED_FOR`` for the
-	 * ``X-Forwarded-For`` header.
-	 *
-	 * Incorrect configuration allows clients to spoof their IP address, bypassing
-	 * access controls and rendering logs unreliable.
-	 *
-	 * Defaults to ``['HTTP_X_FORWARDED_FOR']``
-	 */
-	'forwarded_for_headers' => ['HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'],
-
-	/**
-	 * List of trusted IP ranges for admin actions. If non-empty, all admin actions
-	 * must originate from IPs within these ranges.
-	 *
-	 * Supported formats:
-	 * - IPv4 addresses or ranges, e.g., ``192.0.2.42/32``, ``233.252.0.0/24``
-	 * - IPv6 addresses or ranges, e.g., ``2001:db8::13:37/64``
-	 *
-	 * Defaults to ``[]`` (empty array)
-	 */
-	'allowed_admin_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'],
-
-	/**
-	 * Maximum file size (in megabytes) for animating GIFs on public sharing pages.
-	 * If a GIF exceeds this size, a static preview is shown.
-	 *
-	 * Set to ``-1`` for no limit.
-	 *
-	 * Defaults to ``10`` megabytes
-	 */
-	'max_filesize_animated_gifs_public_sharing' => 10,
-
-	/**
-	 * Set the lock's time-to-live (TTL) in seconds. Locks older than this are
-	 * automatically cleaned up.
-	 *
-	 * Defaults to ``3600`` seconds (1 hour) or the PHP ``max_execution_time``,
-	 * whichever is higher.
-	 */
-	'filelocking.ttl' => 60 * 60,
-
-	/**
-	 * Memory caching backend for file locking. Redis is highly recommended to avoid
-	 * data loss, as many memcache backends may evict values unexpectedly.
-	 *
-	 * Defaults to ``none``
-	 */
-	'memcache.locking' => '\\OC\\Memcache\\Redis',
-
-	/**
-	 * Enable debug logging for file locking. This can generate a large volume of log
-	 * entries, potentially causing performance degradation and large log files on
-	 * busy instances.
-	 *
-	 * Use with ``log.condition`` to limit logging in production environments.
-	 *
-	 * Defaults to ``false``
-	 */
-	'filelocking.debug' => false,
-
-	/**
-	 * Disable the web-based updater.
-	 *
-	 * Defaults to ``false``
-	 */
-	'upgrade.disable-web' => false,
-
-	/**
-	 * Customize the CLI upgrade documentation link.
-	 */
-	'upgrade.cli-upgrade-link' => '',
-
-	/**
-	 * Additional line(s) (string or array of strings)
-	 * that will be added to .user.ini on each update by the updater.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'user_ini_additional_lines' => '',
-
-	/**
-	 * Customize the server logs documentation link for exception handling.
-	 */
-	'documentation_url.server_logs' => '',
-
-	/**
-	 * Enable debugging mode for Nextcloud. Only use for local development, not in
-	 * production, as it disables minification and outputs additional debug
-	 * information.
-	 *
-	 * Defaults to ``false``
-	 */
-	'debug' => false,
-
-	/**
-	 * Set the data fingerprint for the current data served. Used by clients to
-	 * detect if a backup has been restored. Update this by running::
-	 *
-	 *      occ maintenance:data-fingerprint
-	 *
-	 * Changing or deleting this value may cause connected clients to stall until
-	 * conflicts are resolved.
-	 *
-	 * Defaults to ``''`` (empty string)
-	 */
-	'data-fingerprint' => '',
-
-	/**
-	 * This entry serves as a warning if the sample configuration was copied.
-	 * DO NOT ADD THIS TO YOUR CONFIGURATION!
-	 *
-	 * Ensure all settings are modified only after consulting the documentation.
-	 */
-	'copied_sample_config' => true,
-
-	/**
-	 * Use a custom lookup server to publish user data.
-	 *
-	 * Defaults to ``https://lookup.nextcloud.com``
-	 */
-	'lookup_server' => 'https://lookup.nextcloud.com',
-
-	/**
-	 * Enable Nextcloud's Global Scale architecture.
-	 *
-	 * Defaults to ``false``
-	 */
-	'gs.enabled' => false,
-
-	/**
-	 * Configure federation for Global Scale setups. Set to ``global`` to allow
-	 * federation outside the environment.
-	 *
-	 * Defaults to ``internal``
-	 */
-	'gs.federation' => 'internal',
-
-	/**
-	 * List of user agents exempt from SameSite cookie protection due to non-standard
-	 * HTTP behavior.
-	 *
-	 * WARNING: Use only if you understand the implications.
-	 *
-	 * Defaults to:
-	 *
-	 * - ``/^WebDAVFS/`` (OS X Finder)
-	 * - ``/^Microsoft-WebDAV-MiniRedir/`` (Windows WebDAV drive)
-	 */
-	'csrf.optout' => [
-		'/^WebDAVFS/', // OS X Finder
-		'/^Microsoft-WebDAV-MiniRedir/', // Windows WebDAV drive
-	],
-
-	/**
-	 * Specify allowed user agents for Login Flow V2 using regular expressions.
-	 * User agents not matching this list are denied access to Login Flow V2.
-	 *
-	 * WARNING: Use only if you understand the implications.
-	 *
-	 * Example: Allow only the Nextcloud Android app::
-	 *
-	 *    'core.login_flow_v2.allowed_user_agents' => ['/Nextcloud-android/i'],
-	 *
-	 * Defaults to ``[]`` (empty array)
-	 */
-	'core.login_flow_v2.allowed_user_agents' => [],
-
-	/**
-	 * Show or hide the "simple sign up" link on public pages.
-	 * See: https://nextcloud.com/signup/
-	 *
-	 * Defaults to ``true``
-	 */
-	'simpleSignUpLink.shown' => true,
-
-	/**
-	 * Enable or disable autocompletion for the login form. Disabling this prevents
-	 * browsers from remembering login credentials, which may be required for
-	 * compliance with certain security policies.
-	 *
-	 * Defaults to ``true``
-	 */
-	'login_form_autocomplete' => true,
-
-	/**
-	 * Set a timeout (in seconds) for the login form. After this period, the form is
-	 * reset to prevent password leaks on public devices if the user forgets to clear
-	 * it.
-	 *
-	 * A value of 0 disables the timeout.
-	 *
-	 * Defaults to ``300`` seconds (5 minutes)
-	 */
-	'login_form_timeout' => 300,
-
-	/**
-	 * Suppress warnings for outdated or unsupported browsers. When enabled, users
-	 * can bypass the warning after reading it.
-	 *
-	 * Set to ``true`` to disable the warning.
-	 *
-	 * Defaults to ``false``
-	 */
-	'no_unsupported_browser_warning' => false,
-
-	/**
-	 * Disable background scanning of files. When enabled, a background job runs
-	 * every 10 minutes to sync the filesystem and database for up to 500 users with
-	 * unscanned files (size < 0 in filecache).
-	 *
-	 * Defaults to ``false``
-	 */
-	'files_no_background_scan' => false,
-
-	/**
-	 * Log all database queries to a file.
-	 *
-	 * WARNING: This significantly reduces server performance and is intended only
-	 * for debugging or profiling query interactions. Sensitive data may be logged in
-	 * plain text.
-	 */
-	'query_log_file' => '',
-
-	/**
-	 * Prefix all queries with the request ID when set to `yes`.
-	 *
-	 * Requires ``query_log_file`` to be set.
-	 */
-	'query_log_file_requestid' => '',
-
-	/**
-	 * Include all query parameters in the query log when set to `yes`.
-	 *
-	 * Requires ``query_log_file`` to be set.
-	 * WARNING: This may log sensitive data in plain text.
-	 */
-	'query_log_file_parameters' => '',
-
-	/**
-	 * Include a backtrace in the query log when set to `yes`.
-	 *
-	 * Requires ``query_log_file`` to be set.
-	 */
-	'query_log_file_backtrace' => '',
-
-	/**
-	 * Log all Redis requests to a file.
-	 *
-	 * WARNING: This significantly reduces server performance and is intended only
-	 * for debugging or profiling Redis interactions. Sensitive data may be logged in
-	 * plain text.
-	 */
-	'redis_log_file' => '',
-
-	/**
-	 * Enable diagnostics event logging. Logs timings of common execution steps at
-	 * debug level. Use with ``log.condition`` to enable conditionally in production.
-	 *
-	 * Defaults to ``true``
-	 */
-	'diagnostics.logging' => true,
-
-	/**
-	 * Limit diagnostics event logging to events longer than the specified threshold
-	 * (in milliseconds). A value of 0 disables diagnostics event logging.
-	 */
-	'diagnostics.logging.threshold' => 0,
-
-	/**
-	 * Enable profiling globally.
-	 *
-	 * Defaults to ``true``
-	 */
-	'profile.enabled' => true,
-
-	/**
-	 * Override default scopes for account data. Valid properties and scopes are
-	 * defined in ``OCP\Accounts\IAccountManager``. Values are merged with defaults
-	 * from ``OC\Accounts\AccountManager``.
-	 *
-	 * Example: Set phone property to private scope:
-	 * ``[\OCP\Accounts\IAccountManager::PROPERTY_PHONE => \OCP\Accounts\IAccountManager::SCOPE_PRIVATE]``
-	 */
-	'account_manager.default_property_scope' => [],
-
-	/**
-	 * Enable the deprecated Projects feature, superseded by Related Resources since
-	 * Nextcloud 25.
-	 *
-	 * Defaults to ``false``
-	 */
-	'projects.enabled' => false,
-
-	/**
-	 * Enable the bulk upload feature.
-	 *
-	 * Defaults to ``true``
-	 */
-	'bulkupload.enabled' => true,
-
-	/**
-	 * Enable fetching Open Graph metadata from remote URLs.
-	 *
-	 * Defaults to ``true``
-	 */
-	'reference_opengraph' => true,
-
-	/**
-	 * Enable the legacy unified search.
-	 *
-	 * Defaults to ``false``
-	 */
-	'unified_search.enabled' => false,
-
-	/**
-	 * Enable features that do not yet comply with accessibility standards.
-	 *
-	 * Defaults to ``true``
-	 */
-	'enable_non-accessible_features' => true,
-
-	/**
-	 * Directories where Nextcloud searches for external binaries (e.g., LibreOffice,
-	 * sendmail, ffmpeg).
-	 *
-	 * Defaults to:
-	 * - /usr/local/sbin
-	 * - /usr/local/bin
-	 * - /usr/sbin
-	 * - /usr/bin
-	 * - /sbin
-	 * - /bin
-	 * - /opt/bin
-	 */
-	'binary_search_paths' => [
-		'/usr/local/sbin',
-		'/usr/local/bin',
-		'/usr/sbin',
-		'/usr/bin',
-		'/sbin',
-		'/bin',
-		'/opt/bin',
-	],
-
-	/**
-	 * Maximum chunk size for chunked uploads (in bytes). Larger chunks increase
-	 * throughput but yield diminishing returns above 100 MiB. Services like
-	 * Cloudflare may limit to 100 MiB.
-	 *
-	 * Defaults to ``100 * 1024 * 1024`` (100 MiB)
-	 */
-	'files.chunked_upload.max_size' => 100 * 1024 * 1024,
-
-	/**
-	 * Maximum number of chunks uploaded in parallel during chunked uploads. Higher
-	 * counts increase throughput but consume more server resources, with diminishing
-	 * returns.
-	 *
-	 * Defaults to ``5``
-	 */
-	'files.chunked_upload.max_parallel_count' => 5,
-
-	/**
-	 * Allow users to manually delete files from their trashbin. Automated deletions
-	 * (e.g., due to low quota) are unaffected.
-	 *
-	 * Defaults to ``true``
-	 */
-	'files.trash.delete' => true,
-
-	/**
-	 * Enable PHP 8.4 lazy objects for Dependency Injection to improve performance by
-	 * avoiding instantiation of unused objects.
-	 *
-	 * Defaults to ``true``
-	 */
-	'enable_lazy_objects' => true,
-
-	/**
-	 * Change the default certificates bundle used for trusting certificates.
-	 *
-	 * Nextcloud ships its own up-to-date certificates bundle, but in certain cases admins may wish to specify a different bundle, for example the one shipped by their distro.
-	 *
-	 * Defaults to `\OC::$SERVERROOT . '/resources/config/ca-bundle.crt'`.
-	 */
-	'default_certificates_bundle_path' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
+    /**
+     * Default Parameters
+     *
+     * These parameters are configured by the Nextcloud installer, and are required
+     * for your Nextcloud server to operate.
+     */
+
+
+    /**
+     * This is a unique identifier for your Nextcloud installation, created
+     * automatically by the installer. This example is for documentation only,
+     * and you should never use it because it will not work. A valid ``instanceid``
+     * is created when you install Nextcloud.
+     */
+    'instanceid' => '',
+
+    /**
+     * This is a unique identifier for your server.
+     * It is useful when your Nextcloud instance is using different PHP servers.
+     * Once it's set it shouldn't be changed.
+     *
+     * Value must be an integer, comprised between 0 and 1023.
+     *
+     * When config.php is shared between different servers, this value should be overriden with "NC_serverid=<int>" on each server.
+     * Note that it must be overriden for CLI and for your webserver.
+     *
+     * Example for CLI: NC_serverid=42 occ config:list system
+     */
+    'serverid' => -1,
+
+    /**
+     * The salt used to hash all passwords, auto-generated by the Nextcloud
+     * installer. (There are also per-user salts.) If you lose this salt, you lose
+     * all your passwords. This example is for documentation only, and you should
+     * never use it.
+     *
+     * @deprecated 9.0.0 This salt is deprecated and only used for legacy-compatibility,
+     * developers should *NOT* use this value for anything nowadays.
+     */
+    'passwordsalt' => '',
+
+    /**
+     * Secret used by Nextcloud for various purposes, e.g., to encrypt data. If you
+     * lose this string, there will be data corruption.
+     */
+    'secret' => '',
+
+    /**
+     * Your list of trusted domains that users can log into. Specifying trusted
+     * domains prevents host header poisoning. Do not remove this, as it performs
+     * necessary security checks.
+     *
+     * You can specify:
+     *
+     * - The exact hostname of your host or virtual host, e.g. ``demo.example.org``.
+     * - The exact hostname with permitted port, e.g. ``demo.example.org:443``. This disallows all other ports on this host
+     * - Use ``*`` as a wildcard, e.g., ``ubos-raspberry-pi*.local`` will allow ``ubos-raspberry-pi.local`` and ``ubos-raspberry-pi-2.local``
+     * - The IP address with or without permitted port, e.g. ``[2001:db8::1]:8080`` Using TLS certificates where ``commonName=<IP address>`` is deprecated
+     */
+    'trusted_domains' => [
+        'demo.example.org',
+        'otherdomain.example.org',
+        '10.111.112.113',
+        '[2001:db8::1]'
+    ],
+
+    /**
+     * The validity domain for cookies, for example ``''`` (cookies will be sent only
+     * the domain that defined it, e.g. ``'demo.example.org'``), ``'demo.example.org'``
+     * (cookies will be valid for the domain and all subdomains), ...
+     *
+     * Defaults to ``''`` (safe option)
+     */
+    'cookie_domain' => '',
+
+    /**
+     * Where user files are stored. The SQLite database is also stored here, when
+     * you use SQLite.
+     *
+     * Default to ``data/`` in the Nextcloud directory.
+     */
+    'datadirectory' => '/var/www/nextcloud/data',
+
+    /**
+     * The current version number of your Nextcloud installation. This is set up
+     * during installation and update, so you shouldn't need to change it.
+     */
+    'version' => '',
+
+    /**
+     * Identifies the database used with this installation. See also config option
+     * ``supportedDatabases``
+     *
+     * Available:
+     *  - sqlite3 (SQLite3)
+     *  - mysql (MySQL/MariaDB)
+     *  - pgsql (PostgreSQL)
+     *
+     * Defaults to ``sqlite3``
+     */
+    'dbtype' => 'sqlite3',
+
+    /**
+     * Your host server name, for example ``localhost``, ``hostname``,
+     * ``hostname.example.com``, or the IP address.
+     * To specify a port, use ``hostname:####``; for IPv6 addresses, use the URI notation ``[ip]:port``.
+     * To specify a Unix socket, use ``localhost:/path/to/directory/containing/socket`` or
+     * ``:/path/to/directory/containing/socket``, e.g., ``localhost:/run/postgresql/``.
+     */
+    'dbhost' => '',
+
+    /**
+     * The name of the Nextcloud database, which is set during installation. You
+     * should not need to change this.
+     */
+    'dbname' => 'nextcloud',
+
+    /**
+     * The user that Nextcloud uses to write to the database. This must be unique
+     * across Nextcloud instances using the same SQL database. This is set up during
+     * installation, so you shouldn't need to change it.
+     */
+    'dbuser' => '',
+
+    /**
+     * The password for the database user. This is set up during installation, so
+     * you shouldn't need to change it.
+     */
+    'dbpassword' => '',
+
+    /**
+     * Prefix for the Nextcloud tables in the database.
+     *
+     * Default to ``oc_``
+     */
+    'dbtableprefix' => 'oc_',
+
+    /**
+     * Enable persistent connections to the database.
+     * This setting uses the ``persistent`` option from Doctrine DBAL, which in turn
+     * uses the PDO::ATTR_PERSISTENT option from the PDO driver.
+     */
+    'dbpersistent' => '',
+
+    /**
+     * Specify read-only replicas to be used by Nextcloud when querying the database
+     */
+    'dbreplica' => [
+        ['user' => 'nextcloud', 'password' => 'password1', 'host' => 'replica1', 'dbname' => ''],
+        ['user' => 'nextcloud', 'password' => 'password2', 'host' => 'replica2', 'dbname' => ''],
+    ],
+
+    /**
+     * Add request ID to the database query in a comment.
+     *
+     * This can be enabled to assist in mapping database logs to Nextcloud logs.
+     */
+    'db.log_request_id' => false,
+
+    /**
+     * Indicates whether the Nextcloud instance was installed successfully; ``true``
+     * indicates a successful installation, and ``false`` indicates an unsuccessful
+     * installation.
+     *
+     * Defaults to ``false``
+     */
+    'installed' => false,
+
+
+    /**
+     * User Experience
+     *
+     * These optional parameters control some aspects of the user interface. Default
+     * values, where present, are shown.
+     */
+
+    /**
+     * This sets the default language on your Nextcloud server, using ISO_639-1
+     * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for
+     * French. The default_language parameter is only used when the browser does
+     * not send any language, and the user hasn’t configured their own language
+     * preferences.
+     *
+     * Nextcloud has two distinguished language codes for German, ``de`` and ``de_DE``.
+     * ``de`` is used for informal German and ``de_DE`` for formal German. By setting
+     * this value to ``de_DE``, you can enforce the formal version of German unless
+     * the user has chosen something different explicitly.
+     *
+     * Defaults to ``en``
+     */
+    'default_language' => 'en',
+
+    /**
+     * With this setting, a language can be forced for all users. If a language is
+     * forced, the users are also unable to change their language in the personal
+     * settings. If users shall be unable to change their language, but users have
+     * different languages, this value can be set to ``true`` instead of a language
+     * code.
+     *
+     * Defaults to ``false``
+     */
+    'force_language' => 'en',
+
+    /**
+     * This sets the default locale on your Nextcloud server, using ISO_639
+     * language codes such as ``en`` for English, ``de`` for German, and ``fr`` for
+     * French, and ISO-3166 country codes such as ``GB``, ``US``, ``CA``, as defined
+     * in RFC 5646. It overrides automatic locale detection on public pages like
+     * login or shared items. User's locale preferences configured under "personal
+     * -> locale" override this setting after they have logged in.
+     *
+     * Defaults to ``en``
+     */
+    'default_locale' => 'en_US',
+
+    /**
+     * With this setting, it is possible to reduce the languages available in the
+     * language chooser. The languages have to be set as array values using ISO_639-1
+     * language codes such as ``en`` for English, ``de`` for German, etc.
+     *
+     * For example: Set to ``['de', 'fr']`` to only allow German and French languages.
+     */
+    'reduce_to_languages' => [],
+
+    /**
+     * This sets the default region for phone numbers on your Nextcloud server,
+     * using ISO 3166-1 country codes such as ``DE`` for Germany, ``FR`` for France, …
+     * It is required to allow inserting phone numbers in the user profiles starting
+     * without the country code (e.g., +49 for Germany).
+     *
+     * No default value!
+     */
+    'default_phone_region' => 'GB',
+
+    /**
+     * With this setting, a locale can be forced for all users. If a locale is
+     * forced, the users are also unable to change their locale in the personal
+     * settings. If users shall be unable to change their locale, but users have
+     * different languages, this value can be set to ``true`` instead of a locale
+     * code.
+     *
+     * Defaults to ``false``
+     */
+    'force_locale' => 'en_US',
+
+    /**
+     * This sets the default timezone on your Nextcloud server, using IANA
+     * identifiers like ``Europe/Berlin`` or ``Pacific/Auckland``. The default
+     * timezone parameter is only used when the timezone of the user cannot be
+     * determined.
+     *
+     * Defaults to ``UTC``
+     */
+    'default_timezone' => 'Europe/Berlin',
+
+    /**
+     * ``true`` enables the Help menu item in the user menu (top right of the
+     * Nextcloud Web interface).
+     * ``false`` removes the Help item.
+     */
+    'knowledgebaseenabled' => true,
+
+    /**
+     * ``true`` embeds the documentation in an iframe inside Nextcloud.
+     * ``false`` only shows buttons to the online documentation.
+     */
+    'knowledgebase.embedded' => false,
+
+    /**
+     * ``true`` allows users to change their display names (on their Personal
+     * pages), and ``false`` prevents them from changing their display names.
+     */
+    'allow_user_to_change_display_name' => true,
+
+    /**
+     * The directory where the skeleton files are located. These files will be
+     * copied to the data directory of new users. Set empty string to not copy any
+     * skeleton files. If unset and templatedirectory is an empty string, shipped
+     * templates will be used to create a template directory for the user.
+     * ``{lang}`` can be used as a placeholder for the language of the user.
+     * If the directory does not exist, it falls back to non-dialect (from ``de_DE``
+     * to ``de``). If that does not exist either, it falls back to ``default``
+     *
+     * Defaults to ``core/skeleton`` in the Nextcloud directory.
+     */
+    'skeletondirectory' => '/path/to/nextcloud/core/skeleton',
+
+    /**
+     * The directory where the template files are located. These files will be
+     * copied to the template directory of new users. Set empty string to not copy any
+     * template files.
+     * ``{lang}`` can be used as a placeholder for the language of the user.
+     * If the directory does not exist, it falls back to non-dialect (from ``de_DE``
+     * to ``de``). If that does not exist either, it falls back to ``default``
+     *
+     * To disable creating a template directory, set both skeletondirectory and
+     * templatedirectory to empty strings.
+     */
+    'templatedirectory' => '/path/to/nextcloud/templates',
+
+    /**
+     * User session
+     */
+
+    /**
+     * Lifetime of the remember login cookie. This should be larger than the
+     * session_lifetime. If it is set to 0, remember me is disabled.
+     *
+     * Defaults to ``60*60*24*15`` seconds (15 days)
+     */
+    'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,
+
+    /**
+     * The lifetime of a session after inactivity.
+     *
+     * The maximum possible time is limited by the ``session.gc_maxlifetime`` php.ini setting
+     * which would overwrite this option if it is less than the value in the ``config.php``
+     *
+     * Defaults to ``60*60*24`` seconds (24 hours)
+     */
+    'session_lifetime' => 60 * 60 * 24,
+
+    /**
+     * The timeout in seconds for requests to servers made by the DAV component (e.g., needed for federated shares).
+     */
+    'davstorage.request_timeout' => 30,
+
+    /**
+     * The timeout in seconds for synchronizing address books, e.g., federated system address books (as run by ``occ federation:sync-addressbooks``).
+     *
+     * Defaults to ``30`` seconds
+     */
+    'carddav_sync_request_timeout' => 30,
+
+    /**
+     * The limit applied to the synchronization report request, e.g. federated system address books (as run by ``occ federation:sync-addressbooks``).
+     */
+    'carddav_sync_request_truncation' => 2500,
+
+    /**
+     * ``true`` enables a relaxed session timeout, where the session timeout would no longer be
+     * handled by Nextcloud but by either the PHP garbage collection or the expiration of
+     * potential other session backends like Redis.
+     *
+     * This may lead to sessions being available for longer than what ``session_lifetime`` uses but
+     * comes with performance benefits as sessions are no longer a locking operation for concurrent
+     * requests.
+     */
+    'session_relaxed_expiry' => false,
+
+    /**
+     * Enable or disable session keep-alive when a user is logged in to the Web UI.
+     * Enabling this sends a "heartbeat" to the server to keep it from timing out.
+     *
+     * Defaults to ``true``
+     */
+    'session_keepalive' => true,
+
+    /**
+     * Enable or disable the automatic logout after session_lifetime, even if session
+     * keepalive is enabled. This will make sure that an inactive browser will log itself out
+     * even if requests to the server might extend the session lifetime.
+     *
+     * NOTE: The logout is handled on the client side. This is not a way to
+     * limit the duration of potentially compromised sessions.
+     *
+     * Defaults to ``false``
+     */
+    'auto_logout' => false,
+
+    /**
+     * Enforce token authentication for clients, which blocks requests using the user
+     * password for enhanced security. Users need to generate tokens in personal settings
+     * which can be used as passwords on their clients.
+     *
+     * Defaults to ``false``
+     */
+    'token_auth_enforced' => false,
+
+    /**
+     * The interval at which token activity should be updated.
+     * Increasing this value means that the last activity on the security page gets
+     * more outdated.
+     *
+     * Tokens are still checked every 5 minutes for validity
+     * max value: 300
+     *
+     * Defaults to ``60``
+     */
+    'token_auth_activity_update' => 60,
+
+    /**
+     * Whether the brute force protection shipped with Nextcloud should be enabled or not.
+     *
+     * WARNING: Disabling this is discouraged for security reasons.
+     *
+     * Defaults to ``true``
+     */
+    'auth.bruteforce.protection.enabled' => true,
+
+    /**
+     * Whether the brute force protection should write into the database even when a memory cache is available
+     *
+     * Using the database is most likely worse for performance, but makes investigating
+     * issues a lot easier as it's possible to look directly at the table to see all
+     * logged remote addresses and actions.
+     *
+     * Defaults to ``false``
+     */
+    'auth.bruteforce.protection.force.database' => false,
+
+    /**
+     * Whether the brute force protection shipped with Nextcloud should be set to testing mode.
+     *
+     * In testing mode, brute force attempts are still recorded, but the requests do
+     * not sleep/wait for the specified time. They will still abort with
+     * "429 Too Many Requests" when the maximum delay is reached.
+     * Enabling this is discouraged for security reasons
+     * and should only be done for debugging and on CI when running tests.
+     *
+     * Defaults to ``false``
+     */
+    'auth.bruteforce.protection.testing' => false,
+
+    /**
+     * Brute force protection: maximum number of attempts before blocking
+     *
+     * When more than max-attempts login requests are sent to Nextcloud, requests
+     * will abort with "429 Too Many Requests".
+     * For security reasons, change it only if you know what you are doing.
+     *
+     * Defaults to ``10``
+     */
+    'auth.bruteforce.max-attempts' => 10,
+
+    /**
+     * Whether the rate limit protection shipped with Nextcloud should be enabled or not.
+     *
+     * WARNING: Disabling this is discouraged for security reasons.
+     *
+     * Defaults to ``true``
+     */
+    'ratelimit.protection.enabled' => true,
+
+    /**
+     * Overwrite the individual rate limit for a specific route
+     *
+     * From time to time it can be necessary to extend the rate limit of a specific route,
+     * depending on your usage pattern or when you script some actions.
+     * Instead of completely disabling the rate limit or excluding an IP address from the
+     * rate limit, the following config allows to overwrite the rate limit duration and period.
+     *
+     * The first level key is the name of the route. You can find the route name from a URL
+     * using the ``occ router:list`` command of your server.
+     *
+     * You can also specify different limits for logged-in users with the ``user`` key
+     * and not-logged-in users with the ``anon`` key. However, if there is no specific ``user`` limit,
+     * the ``anon`` limit is also applied for logged-in users.
+     *
+     * Defaults to empty array ``[]``
+     */
+    'ratelimit_overwrite' => [
+        'profile.profilepage.index' => [
+            'user' => ['limit' => 300, 'period' => 3600],
+            'anon' => ['limit' => 1, 'period' => 300],
+        ]
+    ],
+
+    /**
+     * Size of subnet used to normalize IPv6
+     *
+     * For Brute Force Protection and Rate Limiting, IPv6 addresses are truncated using subnet size.
+     * It defaults to /56, but you can set it between /32 and /64
+     *
+     * Defaults to ``56``
+     */
+    'security.ipv6_normalized_subnet_size' => 56,
+
+    /**
+     * By default, WebAuthn is available, but it can be explicitly disabled by admins
+     */
+    'auth.webauthn.enabled' => true,
+
+    /**
+     * Whether encrypted passwords should be stored in the database
+     *
+     * The passwords are only decrypted using the login token stored uniquely in the
+     * clients and allow connecting to external storages, autoconfiguring mail accounts in
+     * the mail app, and periodically checking if the password is still valid.
+     *
+     * This might be desirable to disable this functionality when using one-time
+     * passwords or when having a password policy enforcing long passwords (> 300
+     * characters).
+     *
+     * By default, the passwords are stored encrypted in the database.
+     *
+     * WARNING: If disabled, password changes on the user backend (e.g., on LDAP) no
+     * longer log connected clients out automatically. Users can still disconnect
+     * the clients by deleting the app token from the security settings.
+     */
+    'auth.storeCryptedPassword' => true,
+
+    /**
+     * By default, the login form is always available. There are cases (SSO) where an
+     * admin wants to avoid users entering their credentials to the system if the SSO
+     * app is unavailable.
+     *
+     * This will show an error. But the direct login still works with adding ``?direct=1``
+     */
+    'hide_login_form' => false,
+
+    /**
+     * If your user backend does not allow password resets (e.g., when it's a
+     * read-only user backend like LDAP), you can specify a custom link, where the
+     * user is redirected to, when clicking the "Reset password" link after a failed
+     * login attempt.
+     * In case you do not want to provide any link, replace the URL with ``'disabled'``
+     */
+    'lost_password_link' => 'https://example.org/link/to/password/reset',
+
+    /**
+     * URL to use as target for the logo link in the header (top-left logo)
+     *
+     * Defaults to the base URL of your Nextcloud instance
+     */
+    'logo_url' => 'https://example.org',
+
+    /**
+     * Mail Parameters
+     *
+     * These configure the email settings for Nextcloud notifications and password
+     * resets.
+     */
+
+    /**
+     * The return address that you want to appear on emails sent by the Nextcloud
+     * server, for example ``nc-admin@example.com``, substituting your own domain,
+     * of course.
+     */
+    'mail_domain' => 'example.com',
+
+    /**
+     * FROM address that overrides the built-in ``sharing-noreply`` and
+     * ``lostpassword-noreply`` FROM addresses.
+     *
+     * Defaults to different FROM addresses depending on the feature.
+     */
+    'mail_from_address' => 'nextcloud',
+
+    /**
+     * Enable SMTP class debugging.
+     * NOTE: ``loglevel`` will likely need to be adjusted too. See docs:
+     *   https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html#enabling-debug-mode
+     *
+     * Defaults to ``false``
+     */
+    'mail_smtpdebug' => false,
+
+    /**
+     * Which mode to use for sending mail: ``sendmail``, ``smtp``, ``qmail``, or ``null``.
+     *
+     * If you are using local or remote SMTP, set this to ``smtp``.
+     *
+     * For the ``sendmail`` option, you need an installed and working email system on
+     * the server, with ``/usr/sbin/sendmail`` installed on your Unix system.
+     *
+     * For ``qmail``, the binary is /var/qmail/bin/sendmail, and it must be installed
+     * on your Unix system.
+     *
+     * Use the string ``null`` to send no mails (disable mail delivery). This can be
+     * useful if mails should be sent via APIs and rendering messages is not necessary.
+     *
+     * Defaults to ``smtp``
+     */
+    'mail_smtpmode' => 'smtp',
+
+    /**
+     * This depends on ``mail_smtpmode``. Specify the IP address of your mail
+     * server host. This may contain multiple hosts separated by a semicolon. If
+     * you need to specify the port number, append it to the IP address separated by
+     * a colon, like this: ``127.0.0.1:24``.
+     *
+     * Defaults to ``127.0.0.1``
+     */
+    'mail_smtphost' => '127.0.0.1',
+
+    /**
+     * This depends on ``mail_smtpmode``. Specify the port for sending mail.
+     *
+     * Defaults to ``25``
+     */
+    'mail_smtpport' => 25,
+
+    /**
+     * This depends on ``mail_smtpmode``. This sets the SMTP server timeout, in
+     * seconds. You may need to increase this if you are running an anti-malware or
+     * spam scanner.
+     *
+     * Defaults to ``10`` seconds
+     */
+    'mail_smtptimeout' => 10,
+
+    /**
+     * This depends on ``mail_smtpmode``. Specify ``ssl`` when you are using SSL/TLS. Any other value will be ignored.
+     *
+     * If the server advertises STARTTLS capabilities, they might be used, but they cannot be enforced by
+     * this config option.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'mail_smtpsecure' => '',
+
+    /**
+     * This depends on ``mail_smtpmode``. Change this to ``true`` if your mail
+     * server requires authentication.
+     *
+     * Defaults to ``false``
+     */
+    'mail_smtpauth' => false,
+
+    /**
+     * This depends on ``mail_smtpauth``. Specify the username for authenticating to
+     * the SMTP server.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'mail_smtpname' => '',
+
+    /**
+     * This depends on ``mail_smtpauth``. Specify the password for authenticating to
+     * the SMTP server.
+     *
+     * Default to ``''`` (empty string)
+     */
+    'mail_smtppassword' => '',
+
+    /**
+     * Replaces the default mail template layout. This can be utilized if the
+     * options to modify the mail texts with the theming app are not enough.
+     * The class must extend ``\OC\Mail\EMailTemplate``
+     */
+    'mail_template_class' => '\OC\Mail\EMailTemplate',
+
+    /**
+     * Email will be sent by default with an HTML and a plain text body. This option
+     * allows sending only plain text emails.
+     */
+    'mail_send_plaintext_only' => false,
+
+    /**
+     * This depends on ``mail_smtpmode``. Array of additional streams options that
+     * will be passed to underlying Swift mailer implementation.
+     * Defaults to an empty array.
+     */
+    'mail_smtpstreamoptions' => [],
+
+    /**
+     * Which mode is used for sendmail/qmail: ``smtp`` or ``pipe``.
+     *
+     * For ``smtp``, the sendmail binary is started with the parameter ``-bs``:
+     *   - Use the SMTP protocol on standard input and output.
+     *
+     * For ``pipe``, the binary is started with the parameters ``-t``:
+     *   - Read message from STDIN and extract recipients.
+     *
+     * Defaults to ``smtp``
+     */
+    'mail_sendmailmode' => 'smtp',
+
+    /**
+     * Proxy Configurations
+     */
+
+    /**
+     * The automatic hostname detection of Nextcloud can fail in certain reverse
+     * proxy and CLI/cron situations. This option allows you to manually override
+     * the automatic detection; for example, ``www.example.com``, or specify the port
+     * ``www.example.com:8080``.
+     */
+    'overwritehost' => '',
+
+    /**
+     * When generating URLs, Nextcloud attempts to detect whether the server is
+     * accessed via ``https`` or ``http``. However, if Nextcloud is behind a proxy
+     * and the proxy handles the ``https`` calls, Nextcloud would not know that
+     * ``ssl`` is in use, which would result in incorrect URLs being generated.
+     * Valid values are ``http`` and ``https``.
+     */
+    'overwriteprotocol' => '',
+
+    /**
+     * Nextcloud attempts to detect the webroot for generating URLs automatically.
+     * For example, if ``www.example.com/nextcloud`` is the URL pointing to the
+     * Nextcloud instance, the webroot is ``/nextcloud``. When proxies are in use,
+     * it may be difficult for Nextcloud to detect this parameter, resulting in
+     * invalid URLs.
+     */
+    'overwritewebroot' => '',
+
+    /**
+     * This option allows you to define a manual override condition as a regular
+     * expression for the remote IP address. For example, defining a range of IP
+     * addresses starting with ``10.0.0.`` and ending with 1 to 3:
+     * ``^10\.0\.0\.[1-3]$``
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'overwritecondaddr' => '',
+
+    /**
+     * Use this configuration parameter to specify the base URL for any URLs which
+     * are generated within Nextcloud using any kind of command line tools (cron or
+     * occ). The value should contain the full base URL:
+     * ``https://www.example.com/nextcloud``
+     * Please make sure to set the value to the URL that your users mainly use to access this Nextcloud.
+     * Otherwise, there might be problems with the URL generation via cron.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'overwrite.cli.url' => '',
+
+    /**
+     * To have clean URLs without ``/index.php``, this parameter needs to be configured.
+     *
+     * This parameter will be written as "RewriteBase" on update and installation of
+     * Nextcloud to your ``.htaccess`` file. While this value is often simply the URL
+     * path of the Nextcloud installation, it cannot be set automatically properly in
+     * every scenario and needs thus some manual configuration.
+     *
+     * In a standard Apache setup, this usually equals the folder that Nextcloud is
+     * accessible at. So if Nextcloud is accessible via ``https://mycloud.org/nextcloud``,
+     * the correct value would most likely be ``/nextcloud``. If Nextcloud is running
+     * under ``https://mycloud.org/``, then it would be ``/``.
+     *
+     * Note that the above rule is not valid in every case, as there are some rare setup
+     * cases where this may not apply. However, to avoid any update problems, this
+     * configuration value is explicitly opt-in.
+     *
+     * After setting this value, run ``occ maintenance:update:htaccess``. Now, when the
+     * following conditions are met, Nextcloud URLs won't contain ``index.php``:
+     *
+     * - ``mod_rewrite`` is installed
+     * - ``mod_env`` is installed
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'htaccess.RewriteBase' => '/',
+
+    /**
+     * For server setups that don't have ``mod_env`` enabled or restricted (e.g., suEXEC),
+     * this parameter has to be set to true and will assume mod_rewrite.
+     *
+     * Please check if ``mod_rewrite`` is active and functional before setting this
+     * parameter, and you updated your .htaccess with ``occ maintenance:update:htaccess``.
+     * Otherwise, your Nextcloud installation might not be reachable any more.
+     * For example, try accessing resources by leaving out ``index.php`` in the URL.
+     */
+    'htaccess.IgnoreFrontController' => false,
+
+    /**
+     * The URL of your proxy server, for example, ``proxy.example.com:8081``.
+     *
+     * NOTE: Guzzle (the HTTP library used by Nextcloud) reads the environment
+     * variables ``HTTP_PROXY`` (only for CLI requests), ``HTTPS_PROXY``, and ``NO_PROXY`` by default.
+     *
+     * If you configure a proxy with Nextcloud, any default configuration by Guzzle
+     * is overwritten. Make sure to set ``proxyexclude`` accordingly if necessary.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'proxy' => '',
+
+    /**
+     * The optional authentication for the proxy to use to connect to the internet.
+     * The format is: ``username:password``.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'proxyuserpwd' => '',
+
+    /**
+     * List of hostnames that should not be proxied to.
+     * For example: ``['.mit.edu', 'foo.com']``.
+     *
+     * Hint: Use something like ``explode(',', getenv('NO_PROXY'))`` to sync this
+     * value with the global ``NO_PROXY`` option.
+     *
+     * Defaults to empty array.
+     */
+    'proxyexclude' => [],
+
+    /**
+     * Allow remote servers with local addresses, e.g., in federated shares, webcal services, and more
+     *
+     * Defaults to ``false``
+     */
+    'allow_local_remote_servers' => true,
+
+    /**
+     * Deleted Items (trash bin)
+     *
+     * These parameters control the Deleted files app.
+     */
+
+    /**
+     * If the trash bin app is enabled (default), this setting defines the policy
+     * for when files and folders in the trash bin will be permanently deleted.
+     *
+     * If the user quota limit is exceeded due to deleted files in the trash bin,
+     * retention settings will be ignored and files will be cleaned up until
+     * the quota requirements are met.
+     *
+     * The app allows for two settings, a minimum time for trash bin retention,
+     * and a maximum time for trash bin retention.
+     *
+     * Minimum time is the number of days a file will be kept, after which it
+     * *may be* deleted. A file may be deleted after the minimum number of days
+     * has expired if space is needed. The file will not be deleted if space is
+     * not needed.
+     *
+     * Whether "space is needed" depends on whether a user quota is defined or not:
+     *
+     *  * If no user quota is defined, the available space on the Nextcloud data
+     *    partition sets the limit for the trashbin
+     *    (issues: see https://github.com/nextcloud/server/issues/28451).
+     *  * If a user quota is defined, 50% of the user's remaining quota space sets
+     *    the limit for the trashbin.
+     *
+     * Maximum time is the number of days at which it is *guaranteed
+     * to be* deleted. There is no further dependency on the available space.
+     *
+     * Both minimum and maximum times can be set together to explicitly define
+     * file and folder deletion. For migration purposes, this setting is installed
+     * initially set to "auto", which is equivalent to the default setting in
+     * Nextcloud.
+     *
+     * Available values (D1 and D2 are configurable numbers):
+     *
+     * * ``auto``
+     *     | Default setting. Keeps files and folders in the trash bin for at least **30** days.
+     *     | Then, **if space is needed**, deletes trashed files anytime after that.
+     * * ``D1, auto``
+     *     | Keeps files and folders in the trash bin for at least **D1** days.
+     *     | Then, **if space is needed**, deletes trashed files anytime after that.
+     * * ``auto, D2``
+     *     | **If space is needed**, deletes trashed files anytime.
+     *     | After **D2** days, delete all trashed files automatically
+     * * ``D1, D2``
+     *     | Keeps files and folders in the trash bin for at least **D1** days.
+     *     | Then, after **D2** days, delete all trashed files automatically.
+     * * ``disabled``
+     *     | Trash bin auto clean is disabled, files and folders will be kept forever.
+     *
+     * Defaults to ``auto``
+     */
+    'trashbin_retention_obligation' => 'auto',
+
+
+    /**
+     * File versions
+     *
+     * These parameters control the Versions app.
+     */
+
+    /**
+     * If the versions app is enabled (default), this setting defines the policy
+     * for when versions will be permanently deleted.
+     * The app allows for two settings, a minimum time for version retention,
+     * and a maximum time for version retention.
+     * Minimum time is the number of days a version will be kept, after which it
+     * may be deleted. Maximum time is the number of days at which it is guaranteed
+     * to be deleted.
+     * Both minimum and maximum times can be set together to explicitly define
+     * version deletion. For migration purposes, this setting is installed
+     * initially set to "auto", which is equivalent to the default setting in
+     * Nextcloud.
+     *
+     * Available values:
+     *
+     * * ``auto``
+     *     default setting. Automatically expire versions according to expire
+     *     rules. Please refer to :doc:`../configuration_files/file_versioning` for
+     *     more information.
+     * * ``D, auto``
+     *     keep versions at least for D days, apply expiration rules to all versions
+     *     that are older than D days
+     * * ``auto, D``
+     *     delete all versions that are older than D days automatically, delete
+     *     other versions according to expire rules
+     * * ``D1, D2``
+     *     keep versions for at least D1 days and delete when exceeds D2 days
+     * * ``disabled``
+     *     versions auto clean disabled, versions will be kept forever
+     *
+     * Defaults to ``auto``
+     */
+    'versions_retention_obligation' => 'auto',
+
+    /**
+     * Nextcloud Verifications
+     *
+     * Nextcloud performs several verification checks. There are two options,
+     * ``true`` and ``false``.
+     */
+
+    /**
+     * Checks an app before install whether it uses private APIs instead of the
+     * proper public APIs. If this is set to true, it will only allow installing or
+     * enabling apps that pass this check.
+     *
+     * Defaults to ``false``
+     */
+    'appcodechecker' => true,
+
+    /**
+     * Check if Nextcloud is up-to-date and shows a notification if a new version is
+     * available. It sends current version, PHP version, installation and last update
+     * time, and release channel to the updater server which responds with the latest
+     * available version based on those metrics.
+     *
+     * Defaults to ``true``
+     */
+    'updatechecker' => true,
+
+    /**
+     * URL that Nextcloud should use to look for updates
+     *
+     * Defaults to ``https://updates.nextcloud.com/updater_server/``
+     */
+    'updater.server.url' => 'https://updates.nextcloud.com/updater_server/',
+
+    /**
+     * The channel that Nextcloud should use to look for updates
+     *
+     * Supported values:
+     *
+     * - ``daily``
+     * - ``beta``
+     * - ``stable``
+     */
+    'updater.release.channel' => 'stable',
+
+    /**
+     * Is Nextcloud connected to the Internet or running in a closed network?
+     *
+     * Defaults to ``true``
+     */
+    'has_internet_connection' => true,
+
+    /**
+     * Which domains to request to determine the availability of an Internet
+     * connection. If none of these hosts are reachable, the administration panel
+     * will show a warning. Set to an empty list to not do any such checks (warning
+     * will still be shown).
+     * If no protocol is provided, both http and https will be tested.
+     * For example, ``http://www.nextcloud.com`` and ``https://www.nextcloud.com``
+     * will be tested for ``www.nextcloud.com``
+     * If a protocol is provided, only this one will be tested.
+     *
+     * Defaults to the following domains:
+     *
+     *  - https://www.nextcloud.com
+     *  - https://www.startpage.com
+     *  - https://www.eff.org
+     *  - https://www.edri.org
+     */
+    'connectivity_check_domains' => [
+        'https://www.nextcloud.com',
+        'https://www.startpage.com',
+        'https://www.eff.org',
+        'https://www.edri.org'
+    ],
+
+    /**
+     * Allows Nextcloud to verify a working .well-known URL redirects. This is done
+     * by attempting to make a request from JS to
+     * ``https://example.tld/.well-known/caldav/``
+     *
+     * Defaults to ``true``
+     */
+    'check_for_working_wellknown_setup' => true,
+
+    /**
+     * This is a crucial security check on Apache servers that should always be set
+     * to ``true``. This verifies that the ``.htaccess`` file is writable and works.
+     * If it is not, then any options controlled by ``.htaccess``, such as large
+     * file uploads, will not work. It also runs checks on the ``data/`` directory,
+     * which verifies that it can't be accessed directly through the Web server.
+     *
+     * Defaults to ``true``
+     */
+    'check_for_working_htaccess' => true,
+
+    /**
+     * In rare setups (e.g., on OpenShift or Docker on Windows), the permissions check
+     * might block the installation while the underlying system offers no means to
+     * "correct" the permissions. In this case, set the value to false.
+     *
+     * In regular cases, if issues with permissions are encountered, they should be
+     * adjusted accordingly. Changing the flag is discouraged.
+     *
+     * Defaults to ``true``
+     */
+    'check_data_directory_permissions' => true,
+
+    /**
+     * In certain environments, it is desired to have a read-only configuration file.
+     * When this switch is set to ``true``, writing to the config file will be
+     * forbidden. Therefore, it will not be possible to configure all options via
+     * the Web interface. Furthermore, when updating Nextcloud, it is required to
+     * make the configuration file writable again and to set this switch to ``false``
+     * for the update process.
+     *
+     * Defaults to ``false``
+     */
+    'config_is_read_only' => false,
+
+    /**
+     * Logging
+     */
+
+    /**
+     * This parameter determines where the Nextcloud logs are sent.
+     *
+     * - ``file``: the logs are written to file ``nextcloud.log`` in the default Nextcloud data directory. The log file can be changed with parameter ``logfile``.
+     * - ``syslog``: the logs are sent to the system log. This requires a syslog daemon to be active.
+     * - ``errorlog``: the logs are sent to the PHP ``error_log`` function.
+     * - ``systemd``: the logs are sent to the Systemd journal. This requires a system that runs Systemd and the Systemd journal. The PHP extension ``systemd`` must be installed and active.
+     *
+     * Defaults to ``file``
+     */
+    'log_type' => 'file',
+
+    /**
+     * This parameter determines where the audit logs are sent. See ``log_type`` for more information.
+     *
+     * Defaults to ``file``
+     */
+    'log_type_audit' => 'file',
+
+    /**
+     * Name of the file to which the Nextcloud logs are written if parameter
+     * ``log_type`` is set to ``file``.
+     *
+     * Defaults to ``[datadirectory]/nextcloud.log``
+     */
+    'logfile' => '/var/log/nextcloud.log',
+
+    /**
+     * Name of the file to which the audit logs are written if parameter
+     * ``log_type`` is set to ``file``.
+     *
+     * Defaults to ``[datadirectory]/audit.log``
+     */
+    'logfile_audit' => '/var/log/audit.log',
+
+    /**
+     * Log file mode for the Nextcloud logging type in octal notation.
+     *
+     * Defaults to ``0640`` (writable by user, readable by group).
+     */
+    'logfilemode' => 0640,
+
+    /**
+     * Loglevel to start logging at. Valid values are:
+     *
+     * - ``0`` = Debug
+     * - ``1`` = Info
+     * - ``2`` = Warning
+     * - ``3`` = Error
+     * - ``4`` = Fatal.
+     *
+     *
+     * Defaults to ``2`` (Warning)
+     */
+    'loglevel' => 2,
+
+    /**
+     * Loglevel used by the frontend to start logging at. The same values as
+     * for ``loglevel`` can be used. If not set, it defaults to the value
+     * configured for ``loglevel`` or Warning if that is not set either.
+     *
+     * Defaults to ``2``
+     */
+    'loglevel_frontend' => 2,
+
+    /**
+     * Loglevel used by the dirty database query detection. Useful to identify
+     * potential database bugs in production. Set this to loglevel or higher to
+     * see dirty queries in the logs.
+     *
+     * Defaults to ``0`` (debug)
+     */
+    'loglevel_dirty_database_queries' => 0,
+
+    /**
+     * If you maintain different instances and aggregate the logs, you may want
+     * to distinguish between them. ``syslog_tag`` can be set per instance
+     * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or
+     * ``systemd``.
+     *
+     * The default value is ``Nextcloud``.
+     */
+    'syslog_tag' => 'Nextcloud',
+
+    /**
+     * If you maintain different instances and aggregate the logs, you may want
+     * to distinguish between them. ``syslog_tag_audit`` can be set per instance
+     * with a unique ID. Only available if ``log_type`` is set to ``syslog`` or
+     * ``systemd``.
+     *
+     * The default value is the value of ``syslog_tag``.
+     */
+    'syslog_tag_audit' => 'Nextcloud',
+
+    /**
+     * Log condition for log level increase based on conditions. Once one of these
+     * conditions is met, the required log level is set to debug. This allows
+     * debugging specific requests, users, or apps
+     *
+     * Supported conditions:
+     *  - ``shared_secret``: if a request parameter with the name `log_secret` is set to
+     *                this value, the condition is met
+     *  - ``users``:  if the current request is done by one of the specified users,
+     *                this condition is met
+     *  - ``apps``:   if the log message is invoked by one of the specified apps,
+     *                this condition is met
+     *  - ``matches``: if all the conditions inside a group match,
+     *                this condition is met. This allows logging only entries to an app
+     *                by a few users.
+     *
+     * Defaults to an empty array.
+     */
+    'log.condition' => [
+        'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9',
+        'users' => ['sample-user'],
+        'apps' => ['files'],
+        'matches' => [
+            [
+                'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9',
+                'users' => ['sample-user'],
+                'apps' => ['files'],
+                'loglevel' => 1,
+                'message' => 'contains substring'
+            ],
+        ],
+    ],
+
+    /**
+     * Enables logging a backtrace with each log line. Normally, only Exceptions
+     * carry backtrace information, which are logged automatically. This
+     * switch turns them on for any log message. Enabling this option will lead
+     * to increased log data size.
+     *
+     * Defaults to ``false``.
+     */
+    'log.backtrace' => false,
+
+    /**
+     * This uses PHP.date formatting; see https://www.php.net/manual/en/function.date.php
+     *
+     * Defaults to ISO 8601 ``2005-08-15T15:52:01+00:00``, see ``\DateTime::ATOM``
+     * https://www.php.net/manual/en/class.datetimeinterface.php#datetimeinterface.constants.atom
+     */
+    'logdateformat' => 'F d, Y H:i:s',
+
+    /**
+     * The timezone for logfiles. See https://www.php.net/manual/en/timezones.php
+     *
+     * Defaults to ``UTC``
+     */
+    'logtimezone' => 'Europe/Berlin',
+
+    /**
+     * Append all database queries and parameters to the log file. Use this only for
+     * debugging, as your logfile will become huge.
+     */
+    'log_query' => false,
+
+    /**
+     * Enables log rotation and limits the total size of logfiles. Set it to 0 for
+     * no rotation. Specify a size in bytes, for example, 104857600 (100 megabytes
+     * = 100 * 1024 * 1024 bytes). A new logfile is created with a new name when the
+     * old logfile reaches your limit. If a rotated log file is already present, it
+     * will be overwritten.
+     *
+     * Defaults to 100 MB
+     */
+    'log_rotate_size' => 100 * 1024 * 1024,
+
+    /**
+     * Enable built-in profiler. Helpful when trying to debug performance
+     * issues.
+     *
+     * Note that this has a performance impact and shouldn't be enabled
+     * on production.
+     */
+    'profiler' => false,
+
+    /**
+     * Enable profiling for individual requests if profiling single requests is enabled or the secret is passed.
+     * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data.
+     *
+     * The profile data will be stored as a JSON file in the profiling.path directory that can be analyzed with speedscope.
+     *
+     * Defaults to ``false``
+     */
+    'profiling.request' => false,
+
+    /**
+     * The rate at which profiling data is collected for individual requests.
+     * A lower value means more data points but higher overhead.
+     *
+     * Defaults to ``0.001``
+     */
+    'profiling.request.rate' => 0.001,
+
+    /**
+     * A secret token that can be passed via ?profile_secret=<secret> to enable profiling for a specific request.
+     * This allows profiling specific requests in production without enabling it globally.
+     *
+     * No default value.
+     */
+    'profiling.secret' => '',
+
+    /**
+     * Enable sampling-based profiling. This collects profiling data periodically rather than per-request.
+     * This requires the excimer extension to be installed. Be careful with this, as it can generate a lot of data.
+     *
+     * The profile data will be stored as a plain text file in the profiling.path directory that can be analyzed with speedscope.
+     *
+     * Defaults to ``false``
+     */
+    'profiling.sample' => false,
+
+    /**
+     * The rate at which sampling profiling data is collected in seconds.
+     * A lower value means more frequent samples but higher overhead.
+     *
+     * Defaults to ``1``
+     */
+    'profiling.sample.rate' => 1,
+
+    /**
+     * How often (in minutes) the sample log files are rotated.
+     *
+     * Defaults to ``60``
+     */
+    'profiling.sample.rotation' => 60,
+
+    /**
+     * The directory where profiling data is stored.
+     *
+     * Note that this directory must be writable by the web server user and will not be cleaned up automatically.
+     */
+    'profiling.path' => '/tmp',
+
+
+    /**
+     * Alternate Code Locations
+     *
+     * Some Nextcloud code may be stored in alternate locations.
+     */
+
+    /**
+     * This section is for configuring the download links for Nextcloud clients, as
+     * seen in the first-run wizard and on Personal pages.
+     *
+     * Defaults to:
+     *
+     * - Desktop client: ``https://nextcloud.com/install/#install-clients``
+     * - Android client: ``https://play.google.com/store/apps/details?id=com.nextcloud.client``
+     * - iOS client: ``https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8``
+     * - iOS client app ID: ``1125420102``
+     * - F-Droid client: ``https://f-droid.org/packages/com.nextcloud.client/``
+     */
+    'customclient_desktop'
+        => 'https://nextcloud.com/install/#install-clients',
+    'customclient_android'
+        => 'https://play.google.com/store/apps/details?id=com.nextcloud.client',
+    'customclient_ios'
+        => 'https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8',
+    'customclient_ios_appid'
+        => '1125420102',
+    'customclient_fdroid'
+        => 'https://f-droid.org/packages/com.nextcloud.client/',
+
+    /**
+     * Activity
+     *
+     * Options for the activity app.
+     */
+
+    /**
+     * Retention of activities.
+     *
+     * A daily cron job deletes all activities for all users which are older than
+     * the number of days specified here.
+     *
+     * Defaults to ``365``
+     */
+    'activity_expire_days' => 365,
+
+    /**
+     * Activities in Team Folders and External Storages.
+     *
+     * By default, activities in team folders or external storages are only generated
+     * for the current user. This is due to a limitations in current implementations.
+     * This config flag makes activities in group folders and external storages work
+     * like in normal shares (when set to ``true``).
+     *
+     * WARNING: Enabling this comes with some CRITICAL trade-offs:
+     *
+     * - If team folder "Advanced Permissions" (ACLs) are used, activities do not
+     *   respect the permissions and therefore all users see all activities, even
+     *   for files and directories they do not have access to.
+     * - Users who had access to a team folder, share, or external storage can see
+     *   activities in their stream and emails that happen after they are removed
+     *   until they log in again.
+     * - Users who are newly added to a team folder, share, or external storage
+     *   cannot see activities in their stream or emails that happen after they
+     *   are added until they log in again.
+     *
+     * Defaults to ``false``
+     */
+    'activity_use_cached_mountpoints' => false,
+
+    /**
+     * Apps
+     *
+     * Options for the Apps folder, Apps store, and App code checker.
+     */
+
+    /**
+     * Set the default app to open on login. The entry IDs can be retrieved from
+     * the Navigations OCS API endpoint: https://docs.nextcloud.com/server/latest/developer_manual/_static/openapi.html#/operations/core-navigation-get-apps-navigation.
+     * You can use a comma-separated list of app names, so if the first
+     * app is not enabled for a user, then Nextcloud will try the second one, and so
+     * on. If no enabled apps are found, it defaults to the dashboard app.
+     *
+     * Defaults to ``dashboard,files``
+     */
+    'defaultapp' => 'dashboard,files',
+
+    /**
+     * When enabled, admins may install apps from the Nextcloud app store.
+     *
+     * Defaults to ``true``
+     */
+    'appstoreenabled' => true,
+
+    /**
+     * Enables the installation of apps from a self-hosted apps store.
+     * Requires that at least one of the configured apps directories is writable.
+     *
+     * Defaults to ``https://apps.nextcloud.com/api/v1``
+     */
+    'appstoreurl' => 'https://apps.nextcloud.com/api/v1',
+
+    /**
+     * Filters allowed installable apps from the appstore.
+     * Empty array will prevent all apps from the store to be found.
+     */
+    'appsallowlist' => [],
+
+    /**
+     * Use the ``apps_paths`` parameter to set the location of the Apps directory,
+     * which should be scanned for available apps, and where user-specific apps
+     * should be installed from the Apps store. The ``path`` defines the absolute
+     * file system path to the app folder. The key ``url`` defines the HTTP Web path
+     * to that folder, starting from the Nextcloud webroot. The key ``writable``
+     * indicates if a Web server can write files to that folder.
+     */
+    'apps_paths' => [
+        [
+            'path' => '/var/www/nextcloud/apps',
+            'url' => '/apps',
+            'writable' => true,
+        ],
+    ],
+
+    /**
+     * @see appcodechecker
+     */
+
+    /**
+     * Previews
+     *
+     * Nextcloud supports generating previews for various file types, such as images, audio files, and text files.
+     * These options control enabling and disabling previews, and thumbnail size.
+     */
+
+    /**
+     * By default, Nextcloud can generate previews for the following filetypes:
+     *
+     * - Image files
+     * - Text documents
+     *
+     * Valid values are ``true``, to enable previews, or
+     * ``false``, to disable previews
+     *
+     * Defaults to ``true``
+     */
+    'enable_previews' => true,
+
+    /**
+     * Number of all preview requests being processed concurrently,
+     * including previews that need to be newly generated, and those that have
+     * been generated.
+     *
+     * This should be greater than ``preview_concurrency_new``.
+     * If unspecified, defaults to twice the value of ``preview_concurrency_new``.
+     */
+    'preview_concurrency_all' => 8,
+
+    /**
+     * Number of new previews that are being concurrently generated.
+     *
+     * Depending on the max preview size set by ``preview_max_x`` and ``preview_max_y``,
+     * the generation process can consume considerable CPU and memory resources.
+     * It's recommended to limit this to be no greater than the number of CPU cores.
+     * If unspecified, defaults to the number of CPU cores, or 4 if that cannot
+     * be determined.
+     */
+    'preview_concurrency_new' => 4,
+
+    /**
+     * The maximum width, in pixels, of a preview. A value of ``null`` means there
+     * is no limit.
+     *
+     * Defaults to ``4096``
+     */
+    'preview_max_x' => 4096,
+    /**
+     * The maximum height, in pixels, of a preview. A value of ``null`` means there
+     * is no limit.
+     *
+     * Defaults to ``4096``
+     */
+    'preview_max_y' => 4096,
+
+    /**
+     * Max file size for generating image previews with imagegd (default behavior).
+     * If the image is bigger, it'll try other preview generators, but will most
+     * likely either show the default mimetype icon or not display the image at all.
+     * Set to ``-1`` for no limit and try to generate image previews on all file sizes.
+     *
+     * Defaults to ``50`` megabytes
+     */
+    'preview_max_filesize_image' => 50,
+
+    /**
+     * Max memory for generating image previews with imagegd (default behavior)
+     * Reads the image dimensions from the header and assumes 32 bits per pixel.
+     * If creating the image would allocate more memory, preview generation will
+     * be disabled and the default mimetype icon is shown. Set to ``-1`` for no limit.
+     *
+     * Defaults to ``256`` megabytes
+     */
+    'preview_max_memory' => 256,
+
+    /**
+     * Custom path for LibreOffice/OpenOffice binary
+     *
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'preview_libreoffice_path' => '/usr/bin/libreoffice',
+
+    /**
+     * Custom path for ffmpeg binary
+     *
+     * Defaults to ``null`` and falls back to searching ``ffmpeg``
+     * in the configured ``PATH`` environment
+     */
+    'preview_ffmpeg_path' => '/usr/bin/ffmpeg',
+
+    /**
+     * Custom path for ffprobe binary
+     *
+     * Defaults to ``null`` and falls back to using the same path as ffmpeg.
+     * ffprobe is typically packaged with ffmpeg and is required for
+     * enhanced preview generation for HDR videos.
+     */
+    'preview_ffprobe_path' => '/usr/bin/ffprobe',
+
+    /**
+     * Set the URL of the Imaginary service to send image previews to.
+     * Also requires the ``OC\Preview\Imaginary`` provider to be enabled in the
+     * ``enabledPreviewProviders`` array, to create previews for these mimetypes: bmp,
+     * x-bitmap, png, jpeg, gif, heic, heif, svg+xml, tiff, webp, and illustrator.
+     *
+     * If you want Imaginary to also create preview images from PDF documents, you
+     * have to add the ``OC\Preview\ImaginaryPDF`` provider as well.
+     *
+     * See https://github.com/h2non/imaginary
+     */
+    'preview_imaginary_url' => 'http://previews_hpb:8088/',
+
+    /**
+     * If you want to set an API key for Imaginary.
+     */
+    'preview_imaginary_key' => 'secret',
+
+    /**
+     * Only register providers that have been explicitly enabled
+     *
+     * The following providers are disabled by default due to performance or privacy
+     * concerns:
+     *
+     *  - ``OC\Preview\EMF``
+     *  - ``OC\Preview\Font``
+     *  - ``OC\Preview\HEIC``
+     *  - ``OC\Preview\Illustrator``
+     *  - ``OC\Preview\Movie``
+     *  - ``OC\Preview\MP3``
+     *  - ``OC\Preview\MSOffice2003``
+     *  - ``OC\Preview\MSOffice2007``
+     *  - ``OC\Preview\MSOfficeDoc``
+     *  - ``OC\Preview\PDF``
+     *  - ``OC\Preview\Photoshop``
+     *  - ``OC\Preview\Postscript``
+     *  - ``OC\Preview\SGI``
+     *  - ``OC\Preview\StarOffice``
+     *  - ``OC\Preview\SVG``
+     *  - ``OC\Preview\TGA``
+     *  - ``OC\Preview\TIFF``
+     *
+     * The following providers are disabled by default, because they provide an alternative to the built-in providers:
+     *   - ``OC\Preview\Imaginary``
+     *   - ``OC\Preview\ImaginaryPDF``
+     *
+     * Defaults to the following providers:
+     *
+     *  - ``OC\Preview\PNG``
+     *  - ``OC\Preview\JPEG``
+     *  - ``OC\Preview\GIF``
+     *  - ``OC\Preview\BMP``
+     *  - ``OC\Preview\XBitmap``
+     *  - ``OC\Preview\Krita``
+     *  - ``OC\Preview\WebP``
+     *  - ``OC\Preview\MarkDown``
+     *  - ``OC\Preview\TXT``
+     *  - ``OC\Preview\OpenDocument``
+     *
+     */
+    'enabledPreviewProviders' => [
+        'OC\Preview\PNG',
+        'OC\Preview\JPEG',
+        'OC\Preview\GIF',
+        'OC\Preview\BMP',
+        'OC\Preview\XBitmap',
+        'OC\Preview\Krita',
+        'OC\Preview\WebP',
+        'OC\Preview\MarkDown',
+        'OC\Preview\TXT',
+        'OC\Preview\OpenDocument',
+    ],
+
+    /**
+     * Maximum file size for metadata generation.
+     * If a file exceeds this size, metadata generation will be skipped.
+     *
+     * NOTE: memory equivalent to this size will be used for metadata generation.
+     *
+     * Default: 256 megabytes.
+     */
+    'metadata_max_filesize' => 256,
+
+    /**
+     * Maximum file size for file conversion.
+     * If a file exceeds this size, the file will not be converted.
+     *
+     * Default: 100 MiB
+     */
+    'max_file_conversion_filesize' => 100,
+
+    /**
+     * LDAP
+     *
+     * Global settings used by LDAP User and Group Backend
+     */
+
+    /**
+     * Defines the interval in minutes for the background job that checks user
+     * existence and marks them as ready to be cleaned up. The number is always
+     * minutes. Setting it to 0 disables the feature.
+     * See command line (occ) methods ``ldap:show-remnants`` and ``user:delete``
+     *
+     * Defaults to ``51`` minutes
+     */
+    'ldapUserCleanupInterval' => 51,
+
+    /**
+     * Sort groups in the user settings by name instead of the user count
+     *
+     * By enabling this, the user count beside the group name is disabled as well.
+     *
+     * @deprecated 29.0.0 Use the frontend instead or set the app config value ``group.sortBy`` for ``core`` to ``2``
+     */
+    'sort_groups_by_name' => false,
+
+    /**
+     * Comments
+     *
+     * Global settings for the Comments infrastructure
+     */
+
+    /**
+     * Replaces the default Comments Manager Factory. This can be utilized if an
+     * own or 3rd-party CommentsManager should be used that – for instance – uses the
+     * filesystem instead of the database to keep the comments.
+     *
+     * Defaults to ``\OC\Comments\ManagerFactory``
+     */
+    'comments.managerFactory' => '\OC\Comments\ManagerFactory',
+
+    /**
+     * Replaces the default System Tags Manager Factory. This can be utilized if an
+     * own or 3rd-party SystemTagsManager should be used that – for instance – uses the
+     * filesystem instead of the database to keep the tags.
+     *
+     * Defaults to ``\OC\SystemTag\ManagerFactory``
+     */
+    'systemtags.managerFactory' => '\OC\SystemTag\ManagerFactory',
+
+    /**
+     * Maintenance
+     *
+     * These options are for halting user activity when you are performing server
+     * maintenance.
+     */
+
+    /**
+     * Enable maintenance mode to disable Nextcloud
+     *
+     * If you want to prevent users from logging in to Nextcloud before you start
+     * doing some maintenance work, you need to set the value of the maintenance
+     * parameter to true. Please keep in mind that users who are already logged in
+     * are kicked out of Nextcloud instantly.
+     *
+     * Defaults to ``false``
+     */
+    'maintenance' => false,
+
+    /**
+     * UTC Hour for maintenance windows
+     *
+     * Some background jobs only run once a day. When an hour is defined for this config,
+     * the background jobs which advertise themselves as not time sensitive will be
+     * delayed during the "working" hours and only run in the 4 hours after the given time.
+     * This is, e.g., used for activity expiration, suspicious login training, and update checks.
+     *
+     * A value of 1, e.g., will only run these background jobs between 01:00am UTC and 05:00am UTC.
+     *
+     * Defaults to ``100`` which disables the feature
+     */
+    'maintenance_window_start' => 1,
+
+    /**
+     * Log all LDAP requests into a file
+     *
+     * Warning: This heavily decreases the performance of the server and is only
+     * meant to debug/profile the LDAP interaction manually.
+     * Also, it might log sensitive data into a plain text file.
+     */
+    'ldap_log_file' => '',
+
+    /**
+     * SSL
+     */
+
+    /**
+     * Extra SSL options to be used for configuration.
+     *
+     * Defaults to an empty array.
+     */
+    'openssl' => [
+        'config' => '/absolute/location/of/openssl.cnf',
+    ],
+
+    /**
+     * Memory caching backend configuration
+     *
+     * Available cache backends:
+     *
+     * * ``\OC\Memcache\APCu``       APC user backend
+     * * ``\OC\Memcache\ArrayCache`` In-memory array-based backend (not recommended)
+     * * ``\OC\Memcache\Memcached``  Memcached backend
+     * * ``\OC\Memcache\Redis``      Redis backend
+     *
+     * Advice on choosing between the various backends:
+     *
+     * * APCu should be easiest to install. Almost all distributions have packages.
+     *   Use this for single user environment for all caches.
+     * * Use Redis or Memcached for distributed environments.
+     *   For the local cache (you can configure two) take APCu.
+     */
+
+    /**
+     * Memory caching backend for locally stored data
+     *
+     * * Used for host-specific data, e.g., file paths
+     *
+     * Defaults to ``none``
+     */
+    'memcache.local' => '\\OC\\Memcache\\APCu',
+
+    /**
+     * Memory caching backend for distributed data
+     *
+     * * Used for installation-specific data, e.g., database caching
+     * * If unset, defaults to the value of memcache.local
+     *
+     * Defaults to ``none``
+     */
+    'memcache.distributed' => '\\OC\\Memcache\\Memcached',
+
+    /**
+     * Connection details for Redis to use for memory caching in a single server configuration.
+     *
+     * For enhanced security, it is recommended to configure Redis
+     * to require a password. See http://redis.io/topics/security
+     * for more information.
+     *
+     * We also support Redis SSL/TLS encryption as of version 6.
+     * See https://redis.io/topics/encryption for more information.
+     */
+    'redis' => [
+        'host' => 'localhost', // can also be a Unix domain socket: '/tmp/redis.sock'
+        'port' => 6379,
+        'timeout' => 0.0,
+        'read_timeout' => 0.0,
+        'user' => '', // Optional: if not defined, no password will be used.
+        'password' => '', // Optional: if not defined, no password will be used.
+        'dbindex' => 0, // Optional: if undefined, SELECT will not run and will use Redis Server's default DB Index.
+        // If Redis in-transit encryption is enabled, provide certificates
+        // SSL context https://www.php.net/manual/en/context.ssl.php
+        'ssl_context' => [
+            'local_cert' => '/certs/redis.crt',
+            'local_pk' => '/certs/redis.key',
+            'cafile' => '/certs/ca.crt'
+        ]
+    ],
+
+    /**
+     * Connection details for a Redis Cluster.
+     *
+     * Redis Cluster support requires the PHP module phpredis in version 3.0.0 or
+     * higher.
+     *
+     * Available failover modes:
+     *  - ``\RedisCluster::FAILOVER_NONE`` - only send commands to master nodes (default)
+     *  - ``\RedisCluster::FAILOVER_ERROR`` - failover to slaves for read commands if master is unavailable (recommended)
+     *  - ``\RedisCluster::FAILOVER_DISTRIBUTE`` - randomly distribute read commands across master and slaves
+     *
+     * WARNING: ``\RedisCluster::FAILOVER_DISTRIBUTE`` is a not recommended setting, and we strongly
+     * suggest to not use it if you use Redis for file locking. Due to the way Redis
+     * is synchronized, it could happen that the read for an existing lock is
+     * scheduled to a slave that is not fully synchronized with the connected master
+     * which then causes a FileLocked exception.
+     *
+     * See https://redis.io/topics/cluster-spec for details about the Redis cluster
+     *
+     * Authentication works with phpredis version 4.2.1+. See
+     * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1
+     */
+    'redis.cluster' => [
+        'seeds' => [ // provide some or all of the cluster servers to bootstrap discovery, port required
+            'localhost:7000',
+            'localhost:7001',
+        ],
+        'timeout' => 0.0,
+        'read_timeout' => 0.0,
+        'failover_mode' => \RedisCluster::FAILOVER_ERROR,
+        'user' => '', // Optional: if not defined, no password will be used.
+        'password' => '', // Optional: if not defined, no password will be used.
+        // If Redis in-transit encryption is enabled, provide certificates
+        // SSL context https://www.php.net/manual/en/context.ssl.php
+        'ssl_context' => [
+            'local_cert' => '/certs/redis.crt',
+            'local_pk' => '/certs/redis.key',
+            'cafile' => '/certs/ca.crt'
+        ]
+    ],
+
+
+    /**
+     * Server details for one or more Memcached servers to use for memory caching.
+     */
+    'memcached_servers' => [
+        // hostname, port and optional weight
+        // or path and port 0 for Unix socket. Also see:
+        // https://www.php.net/manual/en/memcached.addservers.php
+        // https://www.php.net/manual/en/memcached.addserver.php
+        ['localhost', 11211],
+        //array('other.host.local', 11211),
+    ],
+
+    /**
+     * Connection options for Memcached
+     */
+    'memcached_options' => [
+        // Set timeouts to 50ms
+        \Memcached::OPT_CONNECT_TIMEOUT => 50,
+        \Memcached::OPT_RETRY_TIMEOUT => 50,
+        \Memcached::OPT_SEND_TIMEOUT => 50,
+        \Memcached::OPT_RECV_TIMEOUT => 50,
+        \Memcached::OPT_POLL_TIMEOUT => 50,
+
+        // Enable compression
+        \Memcached::OPT_COMPRESSION => true,
+
+        // Turn on consistent hashing
+        \Memcached::OPT_LIBKETAMA_COMPATIBLE => true,
+
+        // Enable Binary Protocol
+        \Memcached::OPT_BINARY_PROTOCOL => true,
+
+        // Binary serializer will be enabled if the igbinary PECL module is available
+        //\Memcached::OPT_SERIALIZER => \Memcached::SERIALIZER_IGBINARY,
+    ],
+
+
+    /**
+     * Location of the cache folder, defaults to ``data/$user/cache`` where
+     * ``$user`` is the current user. When specified, the format will change to
+     * ``$cache_path/$user`` where ``$cache_path`` is the configured cache directory
+     * and ``$user`` is the user.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'cache_path' => '',
+
+    /**
+     * TTL of chunks located in the cache folder before they're removed by
+     * garbage collection (in seconds). Increase this value if users have
+     * issues uploading very large files via the Nextcloud Client as upload isn't
+     * completed within one day.
+     *
+     * Defaults to ``60*60*24`` (1 day)
+     */
+    'cache_chunk_gc_ttl' => 60 * 60 * 24,
+
+    /**
+     * Enable caching of the app config values.
+     * If enabled the app config will be cached locally for a short TTL,
+     * reducing database load significantly on larger setups.
+     *
+     * Defaults to ``true``
+     */
+    'cache_app_config' => true,
+
+    /**
+     * Using Object Store with Nextcloud
+     */
+
+    /**
+     * This example shows how to configure Nextcloud to store all files in a
+     * Swift object storage.
+     *
+     * It is important to note that Nextcloud in object store mode will expect
+     * exclusive access to the object store container because it only stores the
+     * binary data for each file. The metadata is currently kept in the local
+     * database for performance reasons.
+     *
+     * WARNING: The current implementation is incompatible with any app that uses
+     * direct file I/O and circumvents our virtual filesystem. That includes
+     * Encryption and Gallery. Gallery will store thumbnails directly in the
+     * filesystem, and encryption will cause severe overhead because key files need
+     * to be fetched in addition to any requested file.
+     *
+     */
+    'objectstore' => [
+        'class' => 'OC\\Files\\ObjectStore\\Swift',
+        'arguments' => [
+            // trystack will use your Facebook ID as the username
+            'username' => 'facebook100000123456789',
+            // in the trystack dashboard, go to user -> settings -> API Password to
+            // generate a password
+            'password' => 'Secr3tPaSSWoRdt7',
+            // must already exist in the objectstore, name can be different
+            'container' => 'nextcloud',
+            // prefix to prepend to the fileid, default is 'oid:urn:'
+            'objectPrefix' => 'oid:urn:',
+            // create the container if it does not exist. default is false
+            'autocreate' => true,
+            // required, dev-/trystack defaults to 'RegionOne'
+            'region' => 'RegionOne',
+            // The Identity / Keystone endpoint
+            'url' => 'http://8.21.28.222:5000/v2.0',
+            // uploadPartSize: size of the uploaded chunks, defaults to 524288000
+            'uploadPartSize' => 524288000,
+            // required on dev-/trystack
+            'tenantName' => 'facebook100000123456789',
+            // dev-/trystack uses swift by default, the lib defaults to 'cloudFiles'
+            // if omitted
+            'serviceName' => 'swift',
+            // The Interface / URL Type, optional
+            'urlType' => 'internal',
+            // Maximum amount of data that can be uploaded
+            'totalSizeLimit' => 1024 * 1024 * 1024,
+        ],
+    ],
+
+    /**
+     * To use Swift V3
+     */
+    'objectstore' => [
+        'class' => 'OC\\Files\\ObjectStore\\Swift',
+        'arguments' => [
+            'autocreate' => true,
+            'user' => [
+                'name' => 'swift',
+                'password' => 'swift',
+                'domain' => [
+                    'name' => 'default',
+                ],
+            ],
+            'scope' => [
+                'project' => [
+                    'name' => 'service',
+                    'domain' => [
+                        'name' => 'default',
+                    ],
+                ],
+            ],
+            'tenantName' => 'service',
+            'serviceName' => 'swift',
+            'region' => 'regionOne',
+            'url' => 'http://yourswifthost:5000/v3',
+            'bucket' => 'nextcloud',
+        ],
+    ],
+
+    /**
+     * To use S3 object storage
+     */
+    'objectstore' => [
+        'class' => 'OC\\Files\\ObjectStore\\S3',
+        'arguments' => [
+            'bucket' => 'nextcloud',
+            'key' => 'your-access-key',
+            'secret' => 'your-secret-key',
+            'hostname' => 's3.example.com',
+            'port' => 443,
+            'use_ssl' => true,
+            'region' => 'us-east-1',
+            // optional: Maximum number of retry attempts for failed S3 requests
+            // Default: 5
+            'retriesMaxAttempts' => 5,
+        ],
+    ],
+
+    /**
+     * If this is set to true and a multibucket object store is configured, then
+     * newly created previews are put into 256 dedicated buckets.
+     *
+     * Those buckets are named like the multibucket version but with the postfix
+     * ``-preview-NUMBER`` where NUMBER is between 0 and 255.
+     *
+     * Keep in mind that only previews of files are put in there that don't have
+     * some already. Otherwise, the old bucket will be used.
+     *
+     * To migrate existing previews to this new multibucket distribution of previews,
+     * use the occ command ``preview:repair``. For now, this will only migrate
+     * previews that were generated before Nextcloud 19 in the flat
+     * ``appdata_INSTANCEID/previews/FILEID`` folder structure.
+     */
+    'objectstore.multibucket.preview-distribution' => false,
+
+
+    /**
+     * Sharing
+     *
+     * Global settings for Sharing
+     */
+
+    /**
+     * Replaces the default Share Provider Factory. This can be utilized if
+     * own or 3rd-party Share Providers are used that – for instance – use the
+     * filesystem instead of the database to keep the share information.
+     *
+     * Defaults to ``\OC\Share20\ProviderFactory``
+     */
+    'sharing.managerFactory' => '\OC\Share20\ProviderFactory',
+
+    /**
+     * Enables expiration for link share passwords sent by email (sharebymail).
+     * The passwords will expire after the configured interval; the users can
+     * still request a new one on the public link page.
+     */
+    'sharing.enable_mail_link_password_expiration' => false,
+
+    /**
+     * Expiration interval for passwords, in seconds.
+     */
+    'sharing.mail_link_password_expiration_interval' => 3600,
+
+    /**
+     * Define max number of results returned by the search for auto-completion of
+     * users, groups, etc. The value must not be lower than 0 (for unlimited).
+     *
+     * If more, different sources are requested (e.g., different user backends; or
+     * both users and groups), the value is applied per source and might not be
+     * truncated after collecting the results. I.e., more results can appear than
+     * configured here.
+     *
+     * Default is 25.
+     */
+    'sharing.maxAutocompleteResults' => 25,
+
+    /**
+     * Define the minimum length of the search string before we start auto-completion
+     * Default is no limit (value set to 0)
+     */
+    'sharing.minSearchStringLength' => 0,
+
+    /**
+     * Set to true to enable that internal shares need to be accepted by the users by default.
+     * Users can change this for their account in their personal sharing settings
+     */
+    'sharing.enable_share_accept' => false,
+
+    /**
+     * Set to ``true`` to enforce that internal shares need to be accepted
+     */
+    'sharing.force_share_accept' => false,
+
+    /**
+     * Set to ``false`` to prevent users from setting a custom share_folder
+     */
+    'sharing.allow_custom_share_folder' => true,
+
+    /**
+     * Define a default folder for shared files and folders other than root.
+     * Changes to this value will only have effect on new shares.
+     *
+     * Defaults to ``/``
+     */
+    'share_folder' => '/',
+
+    /**
+     * Set to ``false`` to stop sending a mail when users receive a share
+     */
+    'sharing.enable_share_mail' => true,
+
+    /**
+     * Set to true to enable the feature to add exceptions for share password enforcement
+     */
+    'sharing.allow_disabled_password_enforcement_groups' => false,
+
+    /**
+     * Set to true to always transfer incoming shares by default
+     * when running ``occ files:transfer-ownership``.
+     * Defaults to ``false``, so incoming shares are not transferred if not specifically requested
+     * by a command line argument.
+     */
+    'transferIncomingShares' => false,
+
+    /**
+     * Federated Cloud Sharing
+     */
+
+    /**
+     * Allow self-signed certificates for federated shares
+     */
+    'sharing.federation.allowSelfSignedCertificates' => false,
+
+    /**
+     * Hashing
+     */
+
+    /**
+     * By default, Nextcloud will use the Argon2 password hashing if available.
+     * However, if for whatever reason you want to stick with the PASSWORD_DEFAULT
+     * of your PHP version, then set the setting to true.
+     *
+     * Nextcloud uses the Argon2 algorithm (with PHP >= 7.2) to create hashes by its
+     * own and exposes its configuration options as following. More information can
+     * be found at: https://www.php.net/manual/en/function.password-hash.php
+     */
+    'hashing_default_password' => false,
+
+    /**
+     * The number of CPU threads to be used by the algorithm for computing a hash.
+     * The value must be an integer, and the minimum value is ``1``. Rationally, it does
+     * not help to provide a number higher than the available threads on the machine.
+     * Values that undershoot the minimum will be ignored in favor of the minimum.
+     */
+    'hashingThreads' => PASSWORD_ARGON2_DEFAULT_THREADS,
+
+    /**
+     * The memory in KiB to be used by the algorithm for computing a hash. The value
+     * must be an integer, and the minimum value is 8 times the number of CPU threads.
+     * Values that undershoot the minimum will be ignored in favor of the minimum.
+     */
+    'hashingMemoryCost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
+
+    /**
+     * The number of iterations that are used by the algorithm for computing a hash.
+     * The value must be an integer, and the minimum value is ``1``. Values that
+     * undershoot the minimum will be ignored in favor of the minimum.
+     */
+    'hashingTimeCost' => PASSWORD_ARGON2_DEFAULT_TIME_COST,
+
+    /**
+     * The hashing cost used by hashes generated by Nextcloud
+     * Using a higher value requires more time and CPU power to calculate the hashes
+     */
+    'hashingCost' => 10,
+
+    /**
+     * All other configuration options
+     */
+
+    /**
+     * Additional driver options for the database connection, e.g., to enable SSL
+     * encryption in MySQL or specify a custom wait timeout on a cheap hoster.
+     *
+     * When setting up TLS/SSL for encrypting the connections, you need to ensure that
+     * the passed keys and certificates are readable by the PHP process. In addition,
+     * ``PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT`` might need to be set to false, if the
+     * database server's certificate CN does not match with the hostname used to connect.
+     * The standard behavior here is different from the MySQL/MariaDB CLI client, which
+     * does not verify the server cert except ``--ssl-verify-server-cert`` is passed manually.
+     */
+    'dbdriveroptions' => [
+        PDO::MYSQL_ATTR_SSL_CA => '/file/path/to/ca_cert.pem',
+        PDO::MYSQL_ATTR_SSL_KEY => '/file/path/to/mysql-client-key.pem',
+        PDO::MYSQL_ATTR_SSL_CERT => '/file/path/to/mysql-client-cert.pem',
+        PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false,
+        PDO::MYSQL_ATTR_INIT_COMMAND => 'SET wait_timeout = 28800'
+    ],
+
+    /**
+     * SQLite3 journal mode can be specified using this configuration parameter -
+     * can be ``'WAL'`` or ``'DELETE'``. See https://www.sqlite.org/wal.html for more details.
+     */
+    'sqlite.journal_mode' => 'DELETE',
+
+    /**
+     * During setup, if requirements are met (see below), this setting is set to true
+     * to enable MySQL to handle 4-byte characters instead of 3-byte characters.
+     *
+     * To convert an existing 3-byte setup to a 4-byte setup, configure the MySQL
+     * parameters as described below and run the migration command:
+     * ``./occ db:convert-mysql-charset``
+     * This config setting will be automatically updated after a successful migration.
+     *
+     * Refer to the documentation for more details.
+     *
+     * MySQL requires specific settings for longer indexes (> 767 bytes), which are
+     * necessary for 4-byte character support::
+     *
+     *     [mysqld]
+     *     innodb_large_prefix=ON
+     *     innodb_file_format=Barracuda
+     *     innodb_file_per_table=ON
+     *
+     * Tables will be created with:
+     *  * character set: ``utf8mb4``
+     *  * collation:     ``utf8mb4_bin``
+     *  * row_format:    ``dynamic``
+     *
+     * See:
+     *  * https://dev.mysql.com/doc/refman/5.7/en/charset-unicode-utf8mb4.html
+     *  * https://dev.mysql.com/doc/refman/5.7/en/innodb-parameters.html#sysvar_innodb_large_prefix
+     *  * https://mariadb.com/kb/en/mariadb/xtradbinnodb-server-system-variables/#innodb_large_prefix
+     *  * http://www.tocker.ca/2013/10/31/benchmarking-innodb-page-compression-performance.html
+     *  * http://mechanics.flite.com/blog/2014/07/29/using-innodb-large-prefix-to-avoid-error-1071/
+     */
+    'mysql.utf8mb4' => false,
+
+    /**
+     * For search queries in the database, a default collation is chosen based on the
+     * character set. In some cases, a different collation is desired, such as for
+     * accent-sensitive searches.
+     *
+     * MariaDB and MySQL share some collations, but also have incompatible ones,
+     * depending on the database server version.
+     *
+     * This option allows overriding the automatic collation choice. Example::
+     *
+     *     'mysql.collation' => 'utf8mb4_0900_as_ci',
+     *
+     * This setting does not affect table creation or setup, where utf8[mb4]_bin is
+     * always used. It applies only to SQL queries using LIKE comparison operators.
+     */
+    'mysql.collation' => null,
+
+    /**
+     * PostgreSQL SSL connection
+     */
+    'pgsql_ssl' => [
+        'mode' => '',
+        'cert' => '',
+        'rootcert' => '',
+        'key' => '',
+        'crl' => '',
+    ],
+
+    /**
+     * Database types supported for installation.
+     *
+     * Available:
+     *  - sqlite (SQLite3)
+     *  - mysql (MySQL)
+     *  - pgsql (PostgreSQL)
+     *  - oci (Oracle)
+     *
+     * Defaults to:
+     *  - sqlite (SQLite3)
+     *  - mysql (MySQL)
+     *  - pgsql (PostgreSQL)
+     */
+    'supportedDatabases' => [
+        'sqlite',
+        'mysql',
+        'pgsql',
+        'oci',
+    ],
+
+    /**
+     * Override the location where Nextcloud stores temporary files. Useful in setups
+     * where the system temporary directory is on a limited-space ramdisk, restricted,
+     * or when using external storage that does not support streaming.
+     *
+     * The web server user/PHP must have write access to this directory. Ensure that
+     * PHP configuration recognizes this as a valid temporary directory by setting
+     * the TMP, TMPDIR, and TEMP environment variables accordingly. Additional
+     * permissions may be required for AppArmor or SELinux.
+     */
+    'tempdirectory' => '/tmp/nextcloudtemp',
+
+    /**
+     * Override the location where Nextcloud stores update files during updates.
+     * Useful when the default ``datadirectory`` is on a network disk like NFS or is
+     * otherwise restricted. Defaults to the value of ``datadirectory`` if unset.
+     *
+     * If set, the directory must be located outside the Nextcloud installation
+     * directory and writable by the web server user.
+     */
+    'updatedirectory' => '',
+
+    /**
+     * Block specific files or filenames, disallowing uploads or access (read and write).
+     * ``.htaccess`` is blocked by default.
+     *
+     * WARNING: Use this only if you understand the implications.
+     *
+     * NOTE: This list is case-insensitive.
+     *
+     * Defaults to ``['.htaccess']``
+     */
+    'forbidden_filenames' => ['.htaccess'],
+
+    /**
+     * Disallow uploads of files with specific basenames. Matching existing files
+     * cannot be updated, and no new files can be created in matching folders.
+     *
+     * The basename is the filename without the extension, e.g., for "archive.tar.gz",
+     * the basename is "archive".
+     *
+     * NOTE: This list is case-insensitive.
+     *
+     * Defaults to ``[]`` (empty array)
+     */
+    'forbidden_filename_basenames' => [],
+
+    /**
+     * Block specific characters in filenames. Useful for filesystems or operating
+     * systems (e.g., Windows) that do not support certain characters. Matching
+     * existing files cannot be updated, and no new files can be created in matching
+     * folders.
+     *
+     * The ``/`` and ``\`` characters, as well as ASCII characters [0-31], are always
+     * forbidden.
+     *
+     * Example for Windows: ``['?', '<', '>', ':', '*', '|', '"']``
+     * See: https://en.wikipedia.org/wiki/Comparison_of_file_systems#Limits
+     *
+     * Defaults to ``[]`` (empty array)
+     */
+    'forbidden_filename_characters' => [],
+
+    /**
+     * Deny specific file extensions. Matching existing files cannot be updated, and
+     * no new files can be created in matching folders.
+     *
+     * The ``'.part'`` extension is always forbidden, as it is used internally by Nextcloud.
+     *
+     * Defaults to ``['.filepart', '.part']``
+     */
+    'forbidden_filename_extensions' => ['.part', '.filepart'],
+
+    /**
+     * Specify the name of a theme to apply to Nextcloud. Themes are located in
+     * ``nextcloud/themes/`` by default.
+     *
+     * Defaults to the theming app, included since Nextcloud 9.
+     */
+    'theme' => '',
+
+    /**
+     * Enforce a specific user theme, disabling user theming settings. Must be a
+     * valid ITheme ID, e.g., ``dark``, ``dark-highcontrast``, ``default``, ``light``,
+     * ``light-highcontrast``, ``opendyslexic``.
+     */
+    'enforce_theme' => '',
+
+    /**
+     * Enable or disable Progressive Web App (PWA) functionality, which allows
+     * browsers to open web applications in dedicated windows.
+     *
+     * Defaults to ``true``
+     */
+    'theming.standalone_window.enabled' => true,
+
+    /**
+     * Specify the default cipher for encrypting files. Supported ciphers:
+     *  - AES-256-CTR
+     *  - AES-128-CTR
+     *  - AES-256-CFB
+     *  - AES-128-CFB
+     *
+     * Defaults to ``AES-256-CTR``
+     */
+    'cipher' => 'AES-256-CTR',
+
+    /**
+     * Use the legacy base64 format for encrypted files instead of the more
+     * space-efficient binary format. This affects only newly written files; existing
+     * encrypted files remain readable regardless of the format.
+     *
+     * Defaults to ``false``
+     */
+    'encryption.use_legacy_base64_encoding' => false,
+
+    /**
+     * Specify the minimum Nextcloud desktop client version allowed to sync with this
+     * server. Connections from earlier clients will be denied. Defaults to the
+     * minimum officially supported version at the time of this server release.
+     *
+     * Changing this may cause older, unsupported clients to malfunction, potentially
+     * leading to data loss or unexpected behavior.
+     *
+     * Defaults to ``3.1.0``
+     */
+    'minimum.supported.desktop.version' => '3.1.0',
+
+    /**
+     * Specify the maximum Nextcloud desktop client version allowed to sync with this
+     * server. Connections from later clients will be denied.
+     *
+     * Defaults to ``99.99.99``
+     */
+    'maximum.supported.desktop.version' => '99.99.99',
+
+    /**
+     * Allow local storage to contain symlinks.
+     * WARNING: Not recommended, as this allows Nextcloud to access files outside the
+     * data directory, posing a potential security risk.
+     *
+     * Defaults to ``false``
+     */
+    'localstorage.allowsymlinks' => false,
+
+    /**
+     * Nextcloud overrides umask to ensure suitable access permissions regardless of
+     * web server or PHP-FPM configuration. Modifying this value has security
+     * implications and may cause issues with the installation.
+     *
+     * Most installations should not modify this value.
+     *
+     * Defaults to ``0022``
+     */
+    'localstorage.umask' => 0022,
+
+    /**
+     * Allow storage systems that do not support modifying existing files to overcome
+     * this limitation by removing files before overwriting.
+     *
+     * Defaults to ``false``
+     */
+    'localstorage.unlink_on_truncate' => false,
+
+    /**
+     * EXPERIMENTAL: Include external storage in quota calculations.
+     *
+     * Defaults to ``false``
+     */
+    'quota_include_external_storage' => false,
+
+    /**
+     * When an external storage is unavailable (e.g., due to failed authentication),
+     * it is flagged as such for a specified duration. For authentication failures,
+     * this delay can be customized to reduce the likelihood of account lockouts in
+     * systems like Active Directory.
+     *
+     * Defaults to ``1800`` seconds (30 minutes)
+     */
+    'external_storage.auth_availability_delay' => 1800,
+
+    /**
+     * Allow creation of external storages of type "Local" via the web interface and
+     * APIs. When disabled, local storages can still be created using the occ command::
+     *
+     *      occ files_external:create /mountpoint local null::null -c datadir=/path/to/data
+     *
+     * Defaults to ``true``
+     */
+    'files_external_allow_create_new_local' => true,
+
+    /**
+     * Specify how often the local filesystem (Nextcloud data/ directory and NFS
+     * mounts in data/) is checked for changes made outside Nextcloud. This does not
+     * apply to external storage.
+     *
+     * - ``0`` -> Never check the filesystem for outside changes, improving performance when no external changes are expected.
+     * - ``1`` -> Check each file or folder at most once per request, recommended for general use if outside changes are possible.
+     *
+     * Defaults to ``0``
+     */
+    'filesystem_check_changes' => 0,
+
+    /**
+     * Store part files created during upload in the same storage as the upload
+     * target. Setting this to false stores part files in the root of the user's
+     * folder, which may be necessary for external storage with limited rename
+     * capabilities.
+     *
+     * Defaults to ``true``
+     */
+    'part_file_in_storage' => true,
+
+    /**
+     * Specify the location of the ``mount.json`` file.
+     *
+     * Defaults to ``data/mount.json`` in the Nextcloud directory.
+     */
+    'mount_file' => '/var/www/nextcloud/data/mount.json',
+
+    /**
+     * Prevent Nextcloud from updating the cache due to filesystem changes for all
+     * storage.
+     *
+     * Defaults to ``false``
+     */
+    'filesystem_cache_readonly' => false,
+
+    /**
+     * List of trusted proxy servers. Supported formats:
+     *
+     * - IPv4 addresses, e.g., ``192.168.2.123``
+     * - IPv4 ranges in CIDR notation, e.g., ``192.168.2.0/24``
+     * - IPv6 addresses, e.g., ``fd9e:21a7:a92c:2323::1``
+     * - IPv6 ranges in CIDR notation, e.g., ``2001:db8:85a3:8d3:1319:8a20::/95``
+     *
+     * If a request's ``REMOTE_ADDR`` matches an address here, it is treated as a proxy,
+     * and the client IP is read from the HTTP header specified in
+     * ``forwarded_for_headers`` instead of ``REMOTE_ADDR``.
+     *
+     * Ensure ``forwarded_for_headers`` is configured if ``trusted_proxies`` is set.
+     *
+     * Defaults to ``[]`` (empty array)
+     */
+    'trusted_proxies' => ['203.0.113.45', '198.51.100.128', '192.168.2.0/24'],
+
+    /**
+     * Headers trusted as containing the client IP address when used with
+     * ``trusted_proxies``. For example, use ``HTTP_X_FORWARDED_FOR`` for the
+     * ``X-Forwarded-For`` header.
+     *
+     * Incorrect configuration allows clients to spoof their IP address, bypassing
+     * access controls and rendering logs unreliable.
+     *
+     * Defaults to ``['HTTP_X_FORWARDED_FOR']``
+     */
+    'forwarded_for_headers' => ['HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR'],
+
+    /**
+     * List of trusted IP ranges for admin actions. If non-empty, all admin actions
+     * must originate from IPs within these ranges.
+     *
+     * Supported formats:
+     * - IPv4 addresses or ranges, e.g., ``192.0.2.42/32``, ``233.252.0.0/24``
+     * - IPv6 addresses or ranges, e.g., ``2001:db8::13:37/64``
+     *
+     * Defaults to ``[]`` (empty array)
+     */
+    'allowed_admin_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'],
+
+    /**
+     * Maximum file size (in megabytes) for animating GIFs on public sharing pages.
+     * If a GIF exceeds this size, a static preview is shown.
+     *
+     * Set to ``-1`` for no limit.
+     *
+     * Defaults to ``10`` megabytes
+     */
+    'max_filesize_animated_gifs_public_sharing' => 10,
+
+    /**
+     * Set the lock's time-to-live (TTL) in seconds. Locks older than this are
+     * automatically cleaned up.
+     *
+     * Defaults to ``3600`` seconds (1 hour) or the PHP ``max_execution_time``,
+     * whichever is higher.
+     */
+    'filelocking.ttl' => 60 * 60,
+
+    /**
+     * Memory caching backend for file locking. Redis is highly recommended to avoid
+     * data loss, as many memcache backends may evict values unexpectedly.
+     *
+     * Defaults to ``none``
+     */
+    'memcache.locking' => '\\OC\\Memcache\\Redis',
+
+    /**
+     * Enable debug logging for file locking. This can generate a large volume of log
+     * entries, potentially causing performance degradation and large log files on
+     * busy instances.
+     *
+     * Use with ``log.condition`` to limit logging in production environments.
+     *
+     * Defaults to ``false``
+     */
+    'filelocking.debug' => false,
+
+    /**
+     * Disable the web-based updater.
+     *
+     * Defaults to ``false``
+     */
+    'upgrade.disable-web' => false,
+
+    /**
+     * Customize the CLI upgrade documentation link.
+     */
+    'upgrade.cli-upgrade-link' => '',
+
+    /**
+     * Additional line(s) (string or array of strings)
+     * that will be added to .user.ini on each update by the updater.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'user_ini_additional_lines' => '',
+
+    /**
+     * Customize the server logs documentation link for exception handling.
+     */
+    'documentation_url.server_logs' => '',
+
+    /**
+     * Enable debugging mode for Nextcloud. Only use for local development, not in
+     * production, as it disables minification and outputs additional debug
+     * information.
+     *
+     * Defaults to ``false``
+     */
+    'debug' => false,
+
+    /**
+     * Set the data fingerprint for the current data served. Used by clients to
+     * detect if a backup has been restored. Update this by running::
+     *
+     *      occ maintenance:data-fingerprint
+     *
+     * Changing or deleting this value may cause connected clients to stall until
+     * conflicts are resolved.
+     *
+     * Defaults to ``''`` (empty string)
+     */
+    'data-fingerprint' => '',
+
+    /**
+     * This entry serves as a warning if the sample configuration was copied.
+     * DO NOT ADD THIS TO YOUR CONFIGURATION!
+     *
+     * Ensure all settings are modified only after consulting the documentation.
+     */
+    'copied_sample_config' => true,
+
+    /**
+     * Use a custom lookup server to publish user data.
+     *
+     * Defaults to ``https://lookup.nextcloud.com``
+     */
+    'lookup_server' => 'https://lookup.nextcloud.com',
+
+    /**
+     * Enable Nextcloud's Global Scale architecture.
+     *
+     * Defaults to ``false``
+     */
+    'gs.enabled' => false,
+
+    /**
+     * Configure federation for Global Scale setups. Set to ``global`` to allow
+     * federation outside the environment.
+     *
+     * Defaults to ``internal``
+     */
+    'gs.federation' => 'internal',
+
+    /**
+     * List of user agents exempt from SameSite cookie protection due to non-standard
+     * HTTP behavior.
+     *
+     * WARNING: Use only if you understand the implications.
+     *
+     * Defaults to:
+     *
+     * - ``/^WebDAVFS/`` (OS X Finder)
+     * - ``/^Microsoft-WebDAV-MiniRedir/`` (Windows WebDAV drive)
+     */
+    'csrf.optout' => [
+        '/^WebDAVFS/', // OS X Finder
+        '/^Microsoft-WebDAV-MiniRedir/', // Windows WebDAV drive
+    ],
+
+    /**
+     * Specify allowed user agents for Login Flow V2 using regular expressions.
+     * User agents not matching this list are denied access to Login Flow V2.
+     *
+     * WARNING: Use only if you understand the implications.
+     *
+     * Example: Allow only the Nextcloud Android app::
+     *
+     *    'core.login_flow_v2.allowed_user_agents' => ['/Nextcloud-android/i'],
+     *
+     * Defaults to ``[]`` (empty array)
+     */
+    'core.login_flow_v2.allowed_user_agents' => [],
+
+    /**
+     * Show or hide the "simple sign up" link on public pages.
+     * See: https://nextcloud.com/signup/
+     *
+     * Defaults to ``true``
+     */
+    'simpleSignUpLink.shown' => true,
+
+    /**
+     * Enable or disable autocompletion for the login form. Disabling this prevents
+     * browsers from remembering login credentials, which may be required for
+     * compliance with certain security policies.
+     *
+     * Defaults to ``true``
+     */
+    'login_form_autocomplete' => true,
+
+    /**
+     * Set a timeout (in seconds) for the login form. After this period, the form is
+     * reset to prevent password leaks on public devices if the user forgets to clear
+     * it.
+     *
+     * A value of 0 disables the timeout.
+     *
+     * Defaults to ``300`` seconds (5 minutes)
+     */
+    'login_form_timeout' => 300,
+
+    /**
+     * Suppress warnings for outdated or unsupported browsers. When enabled, users
+     * can bypass the warning after reading it.
+     *
+     * Set to ``true`` to disable the warning.
+     *
+     * Defaults to ``false``
+     */
+    'no_unsupported_browser_warning' => false,
+
+    /**
+     * Disable background scanning of files. When enabled, a background job runs
+     * every 10 minutes to sync the filesystem and database for up to 500 users with
+     * unscanned files (size < 0 in filecache).
+     *
+     * Defaults to ``false``
+     */
+    'files_no_background_scan' => false,
+
+    /**
+     * Log all database queries to a file.
+     *
+     * WARNING: This significantly reduces server performance and is intended only
+     * for debugging or profiling query interactions. Sensitive data may be logged in
+     * plain text.
+     */
+    'query_log_file' => '',
+
+    /**
+     * Prefix all queries with the request ID when set to `yes`.
+     *
+     * Requires ``query_log_file`` to be set.
+     */
+    'query_log_file_requestid' => '',
+
+    /**
+     * Include all query parameters in the query log when set to `yes`.
+     *
+     * Requires ``query_log_file`` to be set.
+     * WARNING: This may log sensitive data in plain text.
+     */
+    'query_log_file_parameters' => '',
+
+    /**
+     * Include a backtrace in the query log when set to `yes`.
+     *
+     * Requires ``query_log_file`` to be set.
+     */
+    'query_log_file_backtrace' => '',
+
+    /**
+     * Log all Redis requests to a file.
+     *
+     * WARNING: This significantly reduces server performance and is intended only
+     * for debugging or profiling Redis interactions. Sensitive data may be logged in
+     * plain text.
+     */
+    'redis_log_file' => '',
+
+    /**
+     * Enable diagnostics event logging. Logs timings of common execution steps at
+     * debug level. Use with ``log.condition`` to enable conditionally in production.
+     *
+     * Defaults to ``true``
+     */
+    'diagnostics.logging' => true,
+
+    /**
+     * Limit diagnostics event logging to events longer than the specified threshold
+     * (in milliseconds). A value of 0 disables diagnostics event logging.
+     */
+    'diagnostics.logging.threshold' => 0,
+
+    /**
+     * Enable profiling globally.
+     *
+     * Defaults to ``true``
+     */
+    'profile.enabled' => true,
+
+    /**
+     * Override default scopes for account data. Valid properties and scopes are
+     * defined in ``OCP\Accounts\IAccountManager``. Values are merged with defaults
+     * from ``OC\Accounts\AccountManager``.
+     *
+     * Example: Set phone property to private scope:
+     * ``[\OCP\Accounts\IAccountManager::PROPERTY_PHONE => \OCP\Accounts\IAccountManager::SCOPE_PRIVATE]``
+     */
+    'account_manager.default_property_scope' => [],
+
+    /**
+     * Enable the deprecated Projects feature, superseded by Related Resources since
+     * Nextcloud 25.
+     *
+     * Defaults to ``false``
+     */
+    'projects.enabled' => false,
+
+    /**
+     * Enable the bulk upload feature.
+     *
+     * Defaults to ``true``
+     */
+    'bulkupload.enabled' => true,
+
+    /**
+     * Enable fetching Open Graph metadata from remote URLs.
+     *
+     * Defaults to ``true``
+     */
+    'reference_opengraph' => true,
+
+    /**
+     * Enable the legacy unified search.
+     *
+     * Defaults to ``false``
+     */
+    'unified_search.enabled' => false,
+
+    /**
+     * Enable features that do not yet comply with accessibility standards.
+     *
+     * Defaults to ``true``
+     */
+    'enable_non-accessible_features' => true,
+
+    /**
+     * Directories where Nextcloud searches for external binaries (e.g., LibreOffice,
+     * sendmail, ffmpeg).
+     *
+     * Defaults to:
+     * - /usr/local/sbin
+     * - /usr/local/bin
+     * - /usr/sbin
+     * - /usr/bin
+     * - /sbin
+     * - /bin
+     * - /opt/bin
+     */
+    'binary_search_paths' => [
+        '/usr/local/sbin',
+        '/usr/local/bin',
+        '/usr/sbin',
+        '/usr/bin',
+        '/sbin',
+        '/bin',
+        '/opt/bin',
+    ],
+
+    /**
+     * Maximum chunk size for chunked uploads (in bytes). Larger chunks increase
+     * throughput but yield diminishing returns above 100 MiB. Services like
+     * Cloudflare may limit to 100 MiB.
+     *
+     * Defaults to ``100 * 1024 * 1024`` (100 MiB)
+     */
+    'files.chunked_upload.max_size' => 100 * 1024 * 1024,
+
+    /**
+     * Maximum number of chunks uploaded in parallel during chunked uploads. Higher
+     * counts increase throughput but consume more server resources, with diminishing
+     * returns.
+     *
+     * Defaults to ``5``
+     */
+    'files.chunked_upload.max_parallel_count' => 5,
+
+    /**
+     * Allow users to manually delete files from their trashbin. Automated deletions
+     * (e.g., due to low quota) are unaffected.
+     *
+     * Defaults to ``true``
+     */
+    'files.trash.delete' => true,
+
+    /**
+     * Enable PHP 8.4 lazy objects for Dependency Injection to improve performance by
+     * avoiding instantiation of unused objects.
+     *
+     * Defaults to ``true``
+     */
+    'enable_lazy_objects' => true,
+
+    /**
+     * Change the default certificates bundle used for trusting certificates.
+     *
+     * Nextcloud ships its own up-to-date certificates bundle, but in certain cases admins may wish to specify a different bundle, for example the one shipped by their distro.
+     *
+     * Defaults to `\OC::$SERVERROOT . '/resources/config/ca-bundle.crt'`.
+     */
+    'default_certificates_bundle_path' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
 ];

Spacing +2 added lines, -2 removed lines

@@ -1797,7 +1797,7 @@ 
 	 * https://github.com/phpredis/phpredis/commit/c5994f2a42b8a348af92d3acb4edff1328ad8ce1
 	 */
 	'redis.cluster' => [
-		'seeds' => [ // provide some or all of the cluster servers to bootstrap discovery, port required
+		'seeds' => [// provide some or all of the cluster servers to bootstrap discovery, port required
 			'localhost:7000',
 			'localhost:7001',
 		],
@@ -2885,5 +2885,5 @@ 
 	 *
 	 * Defaults to `\OC::$SERVERROOT . '/resources/config/ca-bundle.crt'`.
 	 */
-	'default_certificates_bundle_path' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
+	'default_certificates_bundle_path' => \OC::$SERVERROOT.'/resources/config/ca-bundle.crt',
 ];

tests/lib/Http/Client/ClientTest.php

Indentation +584 added lines, -584 removed lines

@@ -26,588 +26,588 @@
  * Class ClientTest
  */
 class ClientTest extends \Test\TestCase {
-	/** @var \GuzzleHttp\Client|MockObject */
-	private $guzzleClient;
-	/** @var CertificateManager|MockObject */
-	private $certificateManager;
-	/** @var Client */
-	private $client;
-	/** @var IConfig|MockObject */
-	private $config;
-	/** @var IRemoteHostValidator|MockObject */
-	private IRemoteHostValidator $remoteHostValidator;
-	private LoggerInterface $logger;
-	private ServerVersion $serverVersion;
-	/** @var array */
-	private $defaultRequestOptions;
-
-	protected function setUp(): void {
-		parent::setUp();
-		$this->config = $this->createMock(IConfig::class);
-		$this->guzzleClient = $this->createMock(\GuzzleHttp\Client::class);
-		$this->certificateManager = $this->createMock(ICertificateManager::class);
-		$this->remoteHostValidator = $this->createMock(IRemoteHostValidator::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->serverVersion = $this->createMock(ServerVersion::class);
-
-		$this->client = new Client(
-			$this->config,
-			$this->certificateManager,
-			$this->guzzleClient,
-			$this->remoteHostValidator,
-			$this->logger,
-			$this->serverVersion,
-		);
-	}
-
-	public function testGetProxyUri(): void {
-		$this->config
-			->method('getSystemValueString')
-			->with('proxy', '')
-			->willReturn('');
-		$this->assertNull(self::invokePrivate($this->client, 'getProxyUri'));
-	}
-
-	public function testGetProxyUriProxyHostEmptyPassword(): void {
-		$this->config
-			->method('getSystemValue')
-			->willReturnMap([
-				['proxyexclude', [], []],
-			]);
-
-		$this->config
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', ''],
-			]);
-
-		$this->assertEquals([
-			'http' => 'foo',
-			'https' => 'foo'
-		], self::invokePrivate($this->client, 'getProxyUri'));
-	}
-
-	public function testGetProxyUriProxyHostWithPassword(): void {
-		$this->config
-			->expects($this->once())
-			->method('getSystemValue')
-			->with('proxyexclude', [])
-			->willReturn([]);
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', 'username:password'],
-			]);
-		$this->assertEquals([
-			'http' => 'username:password@foo',
-			'https' => 'username:password@foo'
-		], self::invokePrivate($this->client, 'getProxyUri'));
-	}
-
-	public function testGetProxyUriProxyHostWithPasswordAndExclude(): void {
-		$this->config
-			->expects($this->once())
-			->method('getSystemValue')
-			->with('proxyexclude', [])
-			->willReturn(['bar']);
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', 'username:password'],
-			]);
-		$this->assertEquals([
-			'http' => 'username:password@foo',
-			'https' => 'username:password@foo',
-			'no' => ['bar']
-		], self::invokePrivate($this->client, 'getProxyUri'));
-	}
-
-	public function testPreventLocalAddressThrowOnInvalidUri(): void {
-		$this->expectException(LocalServerException::class);
-		$this->expectExceptionMessage('Could not detect any host');
-
-		self::invokePrivate($this->client, 'preventLocalAddress', ['!@#$', []]);
-	}
-
-	public static function dataPreventLocalAddress(): array {
-		return [
-			['https://localhost/foo.bar'],
-			['https://localHost/foo.bar'],
-			['https://random-host/foo.bar'],
-			['https://[::1]/bla.blub'],
-			['https://[::]/bla.blub'],
-			['https://192.168.0.1'],
-			['https://172.16.42.1'],
-			['https://[fdf8:f53b:82e4::53]/secret.ics'],
-			['https://[fe80::200:5aee:feaa:20a2]/secret.ics'],
-			['https://[0:0:0:0:0:0:10.0.0.1]/secret.ics'],
-			['https://[0:0:0:0:0:ffff:127.0.0.0]/secret.ics'],
-			['https://10.0.0.1'],
-			['https://another-host.local'],
-			['https://service.localhost'],
-			['https://normal.host.com'],
-			['https://com.one-.nextcloud-one.com'],
-		];
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressDisabledByGlobalConfig(string $uri): void {
-		$this->config->expects($this->once())
-			->method('getSystemValueBool')
-			->with('allow_local_remote_servers', false)
-			->willReturn(true);
-
-		self::invokePrivate($this->client, 'preventLocalAddress', [$uri, []]);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressDisabledByOption(string $uri): void {
-		$this->config->expects($this->never())
-			->method('getSystemValueBool');
-
-		self::invokePrivate($this->client, 'preventLocalAddress', [$uri, [
-			'nextcloud' => ['allow_local_address' => true],
-		]]);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressOnGet(string $uri): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		$this->expectException(LocalServerException::class);
-		$this->remoteHostValidator
-			->method('isValid')
-			->with($host)
-			->willReturn(false);
-
-		$this->client->get($uri);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressOnHead(string $uri): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		$this->expectException(LocalServerException::class);
-		$this->remoteHostValidator
-			->method('isValid')
-			->with($host)
-			->willReturn(false);
-
-		$this->client->head($uri);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressOnPost(string $uri): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		$this->expectException(LocalServerException::class);
-		$this->remoteHostValidator
-			->method('isValid')
-			->with($host)
-			->willReturn(false);
-
-		$this->client->post($uri);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressOnPut(string $uri): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		$this->expectException(LocalServerException::class);
-		$this->remoteHostValidator
-			->method('isValid')
-			->with($host)
-			->willReturn(false);
-
-		$this->client->put($uri);
-	}
-
-	/**
-	 * @param string $uri
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
-	public function testPreventLocalAddressOnDelete(string $uri): void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		$this->expectException(LocalServerException::class);
-		$this->remoteHostValidator
-			->method('isValid')
-			->with($host)
-			->willReturn(false);
-
-		$this->client->delete($uri);
-	}
-
-	private function setUpDefaultRequestOptions(): void {
-		$this->config
-			->method('getSystemValue')
-			->willReturnMap([
-				['proxyexclude', [], []],
-			]);
-		$this->config
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', ''],
-			]);
-		$this->config
-			->method('getSystemValueBool')
-			->willReturnMap([
-				['installed', false, true],
-				['allow_local_remote_servers', false, true],
-			]);
-
-		$this->certificateManager
-			->expects($this->once())
-			->method('getAbsoluteBundlePath')
-			->with()
-			->willReturn('/my/path.crt');
-
-		$this->serverVersion->method('getVersionString')
-			->willReturn('123.45.6');
-
-		$this->defaultRequestOptions = [
-			'verify' => '/my/path.crt',
-			'proxy' => [
-				'http' => 'foo',
-				'https' => 'foo'
-			],
-			'headers' => [
-				'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
-				'Accept-Encoding' => 'gzip',
-			],
-			'timeout' => 30,
-			'nextcloud' => [
-				'allow_local_address' => true,
-			],
-		];
-	}
-
-	public function testGet(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('get', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->get('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testGetWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('get', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->get('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testPost(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('post', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->post('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testPostWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('post', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->post('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testPut(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('put', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->put('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testPutWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('put', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->put('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testDelete(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('delete', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->delete('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testDeleteWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('delete', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->delete('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('options', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->options('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testOptionsWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('options', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->options('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testHead(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$this->guzzleClient->method('request')
-			->with('head', 'http://localhost/', $this->defaultRequestOptions)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->head('http://localhost/', [])->getStatusCode());
-	}
-
-	public function testHeadWithOptions(): void {
-		$this->setUpDefaultRequestOptions();
-
-		$options = array_merge($this->defaultRequestOptions, [
-			'verify' => false,
-			'proxy' => [
-				'http' => 'bar',
-				'https' => 'bar'
-			],
-		]);
-
-		$this->guzzleClient->method('request')
-			->with('head', 'http://localhost/', $options)
-			->willReturn(new Response(418));
-		$this->assertEquals(418, $this->client->head('http://localhost/', $options)->getStatusCode());
-	}
-
-	public function testSetDefaultOptionsWithNotInstalled(): void {
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueBool')
-			->willReturnMap([
-				['installed', false, false],
-				['allow_local_remote_servers', false, false],
-			]);
-		$this->config
-			->expects($this->once())
-			->method('getSystemValueString')
-			->with('proxy', '')
-			->willReturn('');
-		$this->certificateManager
-			->expects($this->never())
-			->method('listCertificates');
-		$this->certificateManager
-			->expects($this->once())
-			->method('getDefaultCertificatesBundlePath')
-			->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-
-		$this->serverVersion->method('getVersionString')
-			->willReturn('123.45.6');
-
-		$this->assertEquals([
-			'verify' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
-			'headers' => [
-				'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
-				'Accept-Encoding' => 'gzip',
-			],
-			'timeout' => 30,
-			'nextcloud' => [
-				'allow_local_address' => false,
-			],
-			'allow_redirects' => [
-				'on_redirect' => function (
-					\Psr\Http\Message\RequestInterface $request,
-					\Psr\Http\Message\ResponseInterface $response,
-					\Psr\Http\Message\UriInterface $uri,
-				): void {
-				},
-			],
-		], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
-	}
-
-	public function testSetDefaultOptionsWithProxy(): void {
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueBool')
-			->willReturnMap([
-				['installed', false, true],
-				['allow_local_remote_servers', false, false],
-			]);
-		$this->config
-			->expects($this->once())
-			->method('getSystemValue')
-			->with('proxyexclude', [])
-			->willReturn([]);
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', ''],
-			]);
-		$this->certificateManager
-			->expects($this->once())
-			->method('getAbsoluteBundlePath')
-			->with()
-			->willReturn('/my/path.crt');
-
-		$this->serverVersion->method('getVersionString')
-			->willReturn('123.45.6');
-
-		$this->assertEquals([
-			'verify' => '/my/path.crt',
-			'proxy' => [
-				'http' => 'foo',
-				'https' => 'foo'
-			],
-			'headers' => [
-				'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
-				'Accept-Encoding' => 'gzip',
-			],
-			'timeout' => 30,
-			'nextcloud' => [
-				'allow_local_address' => false,
-			],
-			'allow_redirects' => [
-				'on_redirect' => function (
-					\Psr\Http\Message\RequestInterface $request,
-					\Psr\Http\Message\ResponseInterface $response,
-					\Psr\Http\Message\UriInterface $uri,
-				): void {
-				},
-			],
-		], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
-	}
-
-	public function testSetDefaultOptionsWithProxyAndExclude(): void {
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueBool')
-			->willReturnMap([
-				['installed', false, true],
-				['allow_local_remote_servers', false, false],
-			]);
-		$this->config
-			->expects($this->once())
-			->method('getSystemValue')
-			->with('proxyexclude', [])
-			->willReturn(['bar']);
-		$this->config
-			->expects($this->exactly(2))
-			->method('getSystemValueString')
-			->willReturnMap([
-				['proxy', '', 'foo'],
-				['proxyuserpwd', '', ''],
-			]);
-		$this->certificateManager
-			->expects($this->once())
-			->method('getAbsoluteBundlePath')
-			->with()
-			->willReturn('/my/path.crt');
-
-		$this->serverVersion->method('getVersionString')
-			->willReturn('123.45.6');
-
-		$this->assertEquals([
-			'verify' => '/my/path.crt',
-			'proxy' => [
-				'http' => 'foo',
-				'https' => 'foo',
-				'no' => ['bar']
-			],
-			'headers' => [
-				'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
-				'Accept-Encoding' => 'gzip',
-			],
-			'timeout' => 30,
-			'nextcloud' => [
-				'allow_local_address' => false,
-			],
-			'allow_redirects' => [
-				'on_redirect' => function (
-					\Psr\Http\Message\RequestInterface $request,
-					\Psr\Http\Message\ResponseInterface $response,
-					\Psr\Http\Message\UriInterface $uri,
-				): void {
-				},
-			],
-		], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
-	}
+    /** @var \GuzzleHttp\Client|MockObject */
+    private $guzzleClient;
+    /** @var CertificateManager|MockObject */
+    private $certificateManager;
+    /** @var Client */
+    private $client;
+    /** @var IConfig|MockObject */
+    private $config;
+    /** @var IRemoteHostValidator|MockObject */
+    private IRemoteHostValidator $remoteHostValidator;
+    private LoggerInterface $logger;
+    private ServerVersion $serverVersion;
+    /** @var array */
+    private $defaultRequestOptions;
+
+    protected function setUp(): void {
+        parent::setUp();
+        $this->config = $this->createMock(IConfig::class);
+        $this->guzzleClient = $this->createMock(\GuzzleHttp\Client::class);
+        $this->certificateManager = $this->createMock(ICertificateManager::class);
+        $this->remoteHostValidator = $this->createMock(IRemoteHostValidator::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+        $this->serverVersion = $this->createMock(ServerVersion::class);
+
+        $this->client = new Client(
+            $this->config,
+            $this->certificateManager,
+            $this->guzzleClient,
+            $this->remoteHostValidator,
+            $this->logger,
+            $this->serverVersion,
+        );
+    }
+
+    public function testGetProxyUri(): void {
+        $this->config
+            ->method('getSystemValueString')
+            ->with('proxy', '')
+            ->willReturn('');
+        $this->assertNull(self::invokePrivate($this->client, 'getProxyUri'));
+    }
+
+    public function testGetProxyUriProxyHostEmptyPassword(): void {
+        $this->config
+            ->method('getSystemValue')
+            ->willReturnMap([
+                ['proxyexclude', [], []],
+            ]);
+
+        $this->config
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', ''],
+            ]);
+
+        $this->assertEquals([
+            'http' => 'foo',
+            'https' => 'foo'
+        ], self::invokePrivate($this->client, 'getProxyUri'));
+    }
+
+    public function testGetProxyUriProxyHostWithPassword(): void {
+        $this->config
+            ->expects($this->once())
+            ->method('getSystemValue')
+            ->with('proxyexclude', [])
+            ->willReturn([]);
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', 'username:password'],
+            ]);
+        $this->assertEquals([
+            'http' => 'username:password@foo',
+            'https' => 'username:password@foo'
+        ], self::invokePrivate($this->client, 'getProxyUri'));
+    }
+
+    public function testGetProxyUriProxyHostWithPasswordAndExclude(): void {
+        $this->config
+            ->expects($this->once())
+            ->method('getSystemValue')
+            ->with('proxyexclude', [])
+            ->willReturn(['bar']);
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', 'username:password'],
+            ]);
+        $this->assertEquals([
+            'http' => 'username:password@foo',
+            'https' => 'username:password@foo',
+            'no' => ['bar']
+        ], self::invokePrivate($this->client, 'getProxyUri'));
+    }
+
+    public function testPreventLocalAddressThrowOnInvalidUri(): void {
+        $this->expectException(LocalServerException::class);
+        $this->expectExceptionMessage('Could not detect any host');
+
+        self::invokePrivate($this->client, 'preventLocalAddress', ['!@#$', []]);
+    }
+
+    public static function dataPreventLocalAddress(): array {
+        return [
+            ['https://localhost/foo.bar'],
+            ['https://localHost/foo.bar'],
+            ['https://random-host/foo.bar'],
+            ['https://[::1]/bla.blub'],
+            ['https://[::]/bla.blub'],
+            ['https://192.168.0.1'],
+            ['https://172.16.42.1'],
+            ['https://[fdf8:f53b:82e4::53]/secret.ics'],
+            ['https://[fe80::200:5aee:feaa:20a2]/secret.ics'],
+            ['https://[0:0:0:0:0:0:10.0.0.1]/secret.ics'],
+            ['https://[0:0:0:0:0:ffff:127.0.0.0]/secret.ics'],
+            ['https://10.0.0.1'],
+            ['https://another-host.local'],
+            ['https://service.localhost'],
+            ['https://normal.host.com'],
+            ['https://com.one-.nextcloud-one.com'],
+        ];
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressDisabledByGlobalConfig(string $uri): void {
+        $this->config->expects($this->once())
+            ->method('getSystemValueBool')
+            ->with('allow_local_remote_servers', false)
+            ->willReturn(true);
+
+        self::invokePrivate($this->client, 'preventLocalAddress', [$uri, []]);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressDisabledByOption(string $uri): void {
+        $this->config->expects($this->never())
+            ->method('getSystemValueBool');
+
+        self::invokePrivate($this->client, 'preventLocalAddress', [$uri, [
+            'nextcloud' => ['allow_local_address' => true],
+        ]]);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressOnGet(string $uri): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        $this->expectException(LocalServerException::class);
+        $this->remoteHostValidator
+            ->method('isValid')
+            ->with($host)
+            ->willReturn(false);
+
+        $this->client->get($uri);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressOnHead(string $uri): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        $this->expectException(LocalServerException::class);
+        $this->remoteHostValidator
+            ->method('isValid')
+            ->with($host)
+            ->willReturn(false);
+
+        $this->client->head($uri);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressOnPost(string $uri): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        $this->expectException(LocalServerException::class);
+        $this->remoteHostValidator
+            ->method('isValid')
+            ->with($host)
+            ->willReturn(false);
+
+        $this->client->post($uri);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressOnPut(string $uri): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        $this->expectException(LocalServerException::class);
+        $this->remoteHostValidator
+            ->method('isValid')
+            ->with($host)
+            ->willReturn(false);
+
+        $this->client->put($uri);
+    }
+
+    /**
+     * @param string $uri
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPreventLocalAddress')]
+    public function testPreventLocalAddressOnDelete(string $uri): void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        $this->expectException(LocalServerException::class);
+        $this->remoteHostValidator
+            ->method('isValid')
+            ->with($host)
+            ->willReturn(false);
+
+        $this->client->delete($uri);
+    }
+
+    private function setUpDefaultRequestOptions(): void {
+        $this->config
+            ->method('getSystemValue')
+            ->willReturnMap([
+                ['proxyexclude', [], []],
+            ]);
+        $this->config
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', ''],
+            ]);
+        $this->config
+            ->method('getSystemValueBool')
+            ->willReturnMap([
+                ['installed', false, true],
+                ['allow_local_remote_servers', false, true],
+            ]);
+
+        $this->certificateManager
+            ->expects($this->once())
+            ->method('getAbsoluteBundlePath')
+            ->with()
+            ->willReturn('/my/path.crt');
+
+        $this->serverVersion->method('getVersionString')
+            ->willReturn('123.45.6');
+
+        $this->defaultRequestOptions = [
+            'verify' => '/my/path.crt',
+            'proxy' => [
+                'http' => 'foo',
+                'https' => 'foo'
+            ],
+            'headers' => [
+                'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
+                'Accept-Encoding' => 'gzip',
+            ],
+            'timeout' => 30,
+            'nextcloud' => [
+                'allow_local_address' => true,
+            ],
+        ];
+    }
+
+    public function testGet(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('get', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->get('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testGetWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('get', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->get('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testPost(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('post', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->post('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testPostWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('post', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->post('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testPut(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('put', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->put('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testPutWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('put', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->put('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testDelete(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('delete', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->delete('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testDeleteWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('delete', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->delete('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('options', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->options('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testOptionsWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('options', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->options('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testHead(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $this->guzzleClient->method('request')
+            ->with('head', 'http://localhost/', $this->defaultRequestOptions)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->head('http://localhost/', [])->getStatusCode());
+    }
+
+    public function testHeadWithOptions(): void {
+        $this->setUpDefaultRequestOptions();
+
+        $options = array_merge($this->defaultRequestOptions, [
+            'verify' => false,
+            'proxy' => [
+                'http' => 'bar',
+                'https' => 'bar'
+            ],
+        ]);
+
+        $this->guzzleClient->method('request')
+            ->with('head', 'http://localhost/', $options)
+            ->willReturn(new Response(418));
+        $this->assertEquals(418, $this->client->head('http://localhost/', $options)->getStatusCode());
+    }
+
+    public function testSetDefaultOptionsWithNotInstalled(): void {
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueBool')
+            ->willReturnMap([
+                ['installed', false, false],
+                ['allow_local_remote_servers', false, false],
+            ]);
+        $this->config
+            ->expects($this->once())
+            ->method('getSystemValueString')
+            ->with('proxy', '')
+            ->willReturn('');
+        $this->certificateManager
+            ->expects($this->never())
+            ->method('listCertificates');
+        $this->certificateManager
+            ->expects($this->once())
+            ->method('getDefaultCertificatesBundlePath')
+            ->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+
+        $this->serverVersion->method('getVersionString')
+            ->willReturn('123.45.6');
+
+        $this->assertEquals([
+            'verify' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
+            'headers' => [
+                'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
+                'Accept-Encoding' => 'gzip',
+            ],
+            'timeout' => 30,
+            'nextcloud' => [
+                'allow_local_address' => false,
+            ],
+            'allow_redirects' => [
+                'on_redirect' => function (
+                    \Psr\Http\Message\RequestInterface $request,
+                    \Psr\Http\Message\ResponseInterface $response,
+                    \Psr\Http\Message\UriInterface $uri,
+                ): void {
+                },
+            ],
+        ], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
+    }
+
+    public function testSetDefaultOptionsWithProxy(): void {
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueBool')
+            ->willReturnMap([
+                ['installed', false, true],
+                ['allow_local_remote_servers', false, false],
+            ]);
+        $this->config
+            ->expects($this->once())
+            ->method('getSystemValue')
+            ->with('proxyexclude', [])
+            ->willReturn([]);
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', ''],
+            ]);
+        $this->certificateManager
+            ->expects($this->once())
+            ->method('getAbsoluteBundlePath')
+            ->with()
+            ->willReturn('/my/path.crt');
+
+        $this->serverVersion->method('getVersionString')
+            ->willReturn('123.45.6');
+
+        $this->assertEquals([
+            'verify' => '/my/path.crt',
+            'proxy' => [
+                'http' => 'foo',
+                'https' => 'foo'
+            ],
+            'headers' => [
+                'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
+                'Accept-Encoding' => 'gzip',
+            ],
+            'timeout' => 30,
+            'nextcloud' => [
+                'allow_local_address' => false,
+            ],
+            'allow_redirects' => [
+                'on_redirect' => function (
+                    \Psr\Http\Message\RequestInterface $request,
+                    \Psr\Http\Message\ResponseInterface $response,
+                    \Psr\Http\Message\UriInterface $uri,
+                ): void {
+                },
+            ],
+        ], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
+    }
+
+    public function testSetDefaultOptionsWithProxyAndExclude(): void {
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueBool')
+            ->willReturnMap([
+                ['installed', false, true],
+                ['allow_local_remote_servers', false, false],
+            ]);
+        $this->config
+            ->expects($this->once())
+            ->method('getSystemValue')
+            ->with('proxyexclude', [])
+            ->willReturn(['bar']);
+        $this->config
+            ->expects($this->exactly(2))
+            ->method('getSystemValueString')
+            ->willReturnMap([
+                ['proxy', '', 'foo'],
+                ['proxyuserpwd', '', ''],
+            ]);
+        $this->certificateManager
+            ->expects($this->once())
+            ->method('getAbsoluteBundlePath')
+            ->with()
+            ->willReturn('/my/path.crt');
+
+        $this->serverVersion->method('getVersionString')
+            ->willReturn('123.45.6');
+
+        $this->assertEquals([
+            'verify' => '/my/path.crt',
+            'proxy' => [
+                'http' => 'foo',
+                'https' => 'foo',
+                'no' => ['bar']
+            ],
+            'headers' => [
+                'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
+                'Accept-Encoding' => 'gzip',
+            ],
+            'timeout' => 30,
+            'nextcloud' => [
+                'allow_local_address' => false,
+            ],
+            'allow_redirects' => [
+                'on_redirect' => function (
+                    \Psr\Http\Message\RequestInterface $request,
+                    \Psr\Http\Message\ResponseInterface $response,
+                    \Psr\Http\Message\UriInterface $uri,
+                ): void {
+                },
+            ],
+        ], self::invokePrivate($this->client, 'buildRequestOptions', [[]]));
+    }
 }

Spacing +5 added lines, -5 removed lines

@@ -476,13 +476,13 @@ 
 		$this->certificateManager
 			->expects($this->once())
 			->method('getDefaultCertificatesBundlePath')
-			->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+			->willReturn(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 
 		$this->serverVersion->method('getVersionString')
 			->willReturn('123.45.6');
 
 		$this->assertEquals([
-			'verify' => \OC::$SERVERROOT . '/resources/config/ca-bundle.crt',
+			'verify' => \OC::$SERVERROOT.'/resources/config/ca-bundle.crt',
 			'headers' => [
 				'User-Agent' => 'Nextcloud-Server-Crawler/123.45.6',
 				'Accept-Encoding' => 'gzip',
@@ -492,7 +492,7 @@ 
 				'allow_local_address' => false,
 			],
 			'allow_redirects' => [
-				'on_redirect' => function (
+				'on_redirect' => function(
 					\Psr\Http\Message\RequestInterface $request,
 					\Psr\Http\Message\ResponseInterface $response,
 					\Psr\Http\Message\UriInterface $uri,
@@ -546,7 +546,7 @@ 
 				'allow_local_address' => false,
 			],
 			'allow_redirects' => [
-				'on_redirect' => function (
+				'on_redirect' => function(
 					\Psr\Http\Message\RequestInterface $request,
 					\Psr\Http\Message\ResponseInterface $response,
 					\Psr\Http\Message\UriInterface $uri,
@@ -601,7 +601,7 @@ 
 				'allow_local_address' => false,
 			],
 			'allow_redirects' => [
-				'on_redirect' => function (
+				'on_redirect' => function(
 					\Psr\Http\Message\RequestInterface $request,
 					\Psr\Http\Message\ResponseInterface $response,
 					\Psr\Http\Message\UriInterface $uri,

tests/lib/Security/CertificateManagerTest.php

Indentation +177 added lines, -177 removed lines

@@ -28,181 +28,181 @@
  */
 #[\PHPUnit\Framework\Attributes\Group('DB')]
 class CertificateManagerTest extends \Test\TestCase {
-	use \Test\Traits\UserTrait;
-	use \Test\Traits\MountProviderTrait;
-
-	private CertificateManager $certificateManager;
-	private string $username;
-	private ISecureRandom&MockObject $random;
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->username = $this->getUniqueID('', 20);
-		$this->createUser($this->username, '');
-
-		$storage = new Temporary();
-		$this->registerMount($this->username, $storage, '/' . $this->username . '/');
-
-		\OC_Util::tearDownFS();
-		\OC_User::setUserId($this->username);
-		Filesystem::tearDown();
-		\OC_Util::setupFS($this->username);
-
-		$config = $this->createMock(IConfig::class);
-		$config->expects($this->any())->method('getSystemValueBool')
-			->with('installed', false)->willReturn(true);
-		$config
-			->expects($this->any())
-			->method('getSystemValueString')
-			->with('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt')
-			->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-
-		$this->random = $this->createMock(ISecureRandom::class);
-		$this->random->method('generate')
-			->willReturn('random');
-
-		$this->certificateManager = new CertificateManager(
-			new View(),
-			$config,
-			$this->createMock(LoggerInterface::class),
-			$this->random
-		);
-	}
-
-	protected function tearDown(): void {
-		$user = Server::get(IUserManager::class)->get($this->username);
-		if ($user !== null) {
-			$user->delete();
-		}
-		parent::tearDown();
-	}
-
-	protected function assertEqualsArrays($expected, $actual) {
-		sort($expected);
-		sort($actual);
-
-		$this->assertEquals($expected, $actual);
-	}
-
-	public function testListCertificates(): void {
-		// Test empty certificate bundle
-		$this->assertSame([], $this->certificateManager->listCertificates());
-
-		// Add some certificates
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
-		$certificateStore = [];
-		$certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
-		$this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
-
-		// Add another certificates
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
-		$certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
-		$this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
-	}
-
-
-	public function testAddInvalidCertificate(): void {
-		$this->expectException(\Exception::class);
-		$this->expectExceptionMessage('Certificate could not get parsed.');
-
-		$this->certificateManager->addCertificate('InvalidCertificate', 'invalidCertificate');
-	}
-
-	public static function dangerousFileProvider(): array {
-		return [
-			['.htaccess'],
-			['../../foo.txt'],
-			['..\..\foo.txt'],
-		];
-	}
-
-	/**
-	 * @param string $filename
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dangerousFileProvider')]
-	public function testAddDangerousFile($filename): void {
-		$this->expectException(InvalidPathException::class);
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), $filename);
-	}
-
-	public function testRemoveDangerousFile(): void {
-		$this->assertFalse($this->certificateManager->removeCertificate('../../foo.txt'));
-	}
-
-	public function testRemoveExistingFile(): void {
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
-		$this->assertTrue($this->certificateManager->removeCertificate('GoodCertificate'));
-	}
-
-	public function testGetCertificateBundle(): void {
-		$this->assertSame('/files_external/rootcerts.crt', $this->certificateManager->getCertificateBundle());
-	}
-
-	/**
-	 *
-	 * @param int $CaBundleMtime
-	 * @param int $targetBundleMtime
-	 * @param int $targetBundleExists
-	 * @param bool $expected
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataTestNeedRebundling')]
-	public function testNeedRebundling($CaBundleMtime,
-		$targetBundleMtime,
-		$targetBundleExists,
-		$expected,
-	): void {
-		$view = $this->getMockBuilder(View::class)
-			->disableOriginalConstructor()->getMock();
-		$config = $this->createMock(IConfig::class);
-
-		/** @var CertificateManager | \PHPUnit\Framework\MockObject\MockObject $certificateManager */
-		$certificateManager = $this->getMockBuilder('OC\Security\CertificateManager')
-			->setConstructorArgs([$view, $config, $this->createMock(LoggerInterface::class), $this->random])
-			->onlyMethods(['getFilemtimeOfCaBundle', 'getCertificateBundle'])
-			->getMock();
-
-		$certificateManager->expects($this->any())->method('getFilemtimeOfCaBundle')
-			->willReturn($CaBundleMtime);
-
-		$certificateManager->expects($this->once())->method('getCertificateBundle')
-			->willReturn('targetBundlePath');
-
-		$view->expects($this->any())->method('file_exists')
-			->with('targetBundlePath')
-			->willReturn($targetBundleExists);
-
-
-		$view->expects($this->any())->method('filemtime')
-			->willReturnCallback(function ($path) use ($targetBundleMtime) {
-				if ($path === 'targetBundlePath') {
-					return $targetBundleMtime;
-				}
-				throw new \Exception('unexpected path');
-			});
-
-
-		$this->assertSame($expected,
-			$this->invokePrivate($certificateManager, 'needsRebundling')
-		);
-	}
-
-	public static function dataTestNeedRebundling(): array {
-		return [
-			//values: CaBundleMtime, targetBundleMtime, targetBundleExists, expected
-
-			[10, 30, true, false],
-			[10, 15, true, false],
-			[10, 8, true, true],
-			[10, 30, true, false],
-			[10, 8, true, true],
-
-			// if no target bundle exists we always build a new one
-			[10, 30, false, true],
-			[10, 15, false, true],
-			[10, 8, false, true],
-			[10, 30, false, true],
-			[10, 8, false, true],
-		];
-	}
+    use \Test\Traits\UserTrait;
+    use \Test\Traits\MountProviderTrait;
+
+    private CertificateManager $certificateManager;
+    private string $username;
+    private ISecureRandom&MockObject $random;
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->username = $this->getUniqueID('', 20);
+        $this->createUser($this->username, '');
+
+        $storage = new Temporary();
+        $this->registerMount($this->username, $storage, '/' . $this->username . '/');
+
+        \OC_Util::tearDownFS();
+        \OC_User::setUserId($this->username);
+        Filesystem::tearDown();
+        \OC_Util::setupFS($this->username);
+
+        $config = $this->createMock(IConfig::class);
+        $config->expects($this->any())->method('getSystemValueBool')
+            ->with('installed', false)->willReturn(true);
+        $config
+            ->expects($this->any())
+            ->method('getSystemValueString')
+            ->with('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt')
+            ->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+
+        $this->random = $this->createMock(ISecureRandom::class);
+        $this->random->method('generate')
+            ->willReturn('random');
+
+        $this->certificateManager = new CertificateManager(
+            new View(),
+            $config,
+            $this->createMock(LoggerInterface::class),
+            $this->random
+        );
+    }
+
+    protected function tearDown(): void {
+        $user = Server::get(IUserManager::class)->get($this->username);
+        if ($user !== null) {
+            $user->delete();
+        }
+        parent::tearDown();
+    }
+
+    protected function assertEqualsArrays($expected, $actual) {
+        sort($expected);
+        sort($actual);
+
+        $this->assertEquals($expected, $actual);
+    }
+
+    public function testListCertificates(): void {
+        // Test empty certificate bundle
+        $this->assertSame([], $this->certificateManager->listCertificates());
+
+        // Add some certificates
+        $this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+        $certificateStore = [];
+        $certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+        $this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
+
+        // Add another certificates
+        $this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
+        $certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
+        $this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
+    }
+
+
+    public function testAddInvalidCertificate(): void {
+        $this->expectException(\Exception::class);
+        $this->expectExceptionMessage('Certificate could not get parsed.');
+
+        $this->certificateManager->addCertificate('InvalidCertificate', 'invalidCertificate');
+    }
+
+    public static function dangerousFileProvider(): array {
+        return [
+            ['.htaccess'],
+            ['../../foo.txt'],
+            ['..\..\foo.txt'],
+        ];
+    }
+
+    /**
+     * @param string $filename
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dangerousFileProvider')]
+    public function testAddDangerousFile($filename): void {
+        $this->expectException(InvalidPathException::class);
+        $this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), $filename);
+    }
+
+    public function testRemoveDangerousFile(): void {
+        $this->assertFalse($this->certificateManager->removeCertificate('../../foo.txt'));
+    }
+
+    public function testRemoveExistingFile(): void {
+        $this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+        $this->assertTrue($this->certificateManager->removeCertificate('GoodCertificate'));
+    }
+
+    public function testGetCertificateBundle(): void {
+        $this->assertSame('/files_external/rootcerts.crt', $this->certificateManager->getCertificateBundle());
+    }
+
+    /**
+     *
+     * @param int $CaBundleMtime
+     * @param int $targetBundleMtime
+     * @param int $targetBundleExists
+     * @param bool $expected
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataTestNeedRebundling')]
+    public function testNeedRebundling($CaBundleMtime,
+        $targetBundleMtime,
+        $targetBundleExists,
+        $expected,
+    ): void {
+        $view = $this->getMockBuilder(View::class)
+            ->disableOriginalConstructor()->getMock();
+        $config = $this->createMock(IConfig::class);
+
+        /** @var CertificateManager | \PHPUnit\Framework\MockObject\MockObject $certificateManager */
+        $certificateManager = $this->getMockBuilder('OC\Security\CertificateManager')
+            ->setConstructorArgs([$view, $config, $this->createMock(LoggerInterface::class), $this->random])
+            ->onlyMethods(['getFilemtimeOfCaBundle', 'getCertificateBundle'])
+            ->getMock();
+
+        $certificateManager->expects($this->any())->method('getFilemtimeOfCaBundle')
+            ->willReturn($CaBundleMtime);
+
+        $certificateManager->expects($this->once())->method('getCertificateBundle')
+            ->willReturn('targetBundlePath');
+
+        $view->expects($this->any())->method('file_exists')
+            ->with('targetBundlePath')
+            ->willReturn($targetBundleExists);
+
+
+        $view->expects($this->any())->method('filemtime')
+            ->willReturnCallback(function ($path) use ($targetBundleMtime) {
+                if ($path === 'targetBundlePath') {
+                    return $targetBundleMtime;
+                }
+                throw new \Exception('unexpected path');
+            });
+
+
+        $this->assertSame($expected,
+            $this->invokePrivate($certificateManager, 'needsRebundling')
+        );
+    }
+
+    public static function dataTestNeedRebundling(): array {
+        return [
+            //values: CaBundleMtime, targetBundleMtime, targetBundleExists, expected
+
+            [10, 30, true, false],
+            [10, 15, true, false],
+            [10, 8, true, true],
+            [10, 30, true, false],
+            [10, 8, true, true],
+
+            // if no target bundle exists we always build a new one
+            [10, 30, false, true],
+            [10, 15, false, true],
+            [10, 8, false, true],
+            [10, 30, false, true],
+            [10, 8, false, true],
+        ];
+    }
 }

Spacing +10 added lines, -10 removed lines

@@ -42,7 +42,7 @@ 
 		$this->createUser($this->username, '');
 
 		$storage = new Temporary();
-		$this->registerMount($this->username, $storage, '/' . $this->username . '/');
+		$this->registerMount($this->username, $storage, '/'.$this->username.'/');
 
 		\OC_Util::tearDownFS();
 		\OC_User::setUserId($this->username);
@@ -55,8 +55,8 @@ 
 		$config
 			->expects($this->any())
 			->method('getSystemValueString')
-			->with('default_certificates_bundle_path', \OC::$SERVERROOT . '/resources/config/ca-bundle.crt')
-			->willReturn(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+			->with('default_certificates_bundle_path', \OC::$SERVERROOT.'/resources/config/ca-bundle.crt')
+			->willReturn(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 
 		$this->random = $this->createMock(ISecureRandom::class);
 		$this->random->method('generate')
@@ -90,14 +90,14 @@ 
 		$this->assertSame([], $this->certificateManager->listCertificates());
 
 		// Add some certificates
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+		$this->certificateManager->addCertificate(file_get_contents(__DIR__.'/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
 		$certificateStore = [];
-		$certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+		$certificateStore[] = new Certificate(file_get_contents(__DIR__.'/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
 		$this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
 
 		// Add another certificates
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
-		$certificateStore[] = new Certificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
+		$this->certificateManager->addCertificate(file_get_contents(__DIR__.'/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
+		$certificateStore[] = new Certificate(file_get_contents(__DIR__.'/../../data/certificates/expiredCertificate.crt'), 'ExpiredCertificate');
 		$this->assertEqualsArrays($certificateStore, $this->certificateManager->listCertificates());
 	}
 
@@ -123,7 +123,7 @@ 
 	#[\PHPUnit\Framework\Attributes\DataProvider('dangerousFileProvider')]
 	public function testAddDangerousFile($filename): void {
 		$this->expectException(InvalidPathException::class);
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/expiredCertificate.crt'), $filename);
+		$this->certificateManager->addCertificate(file_get_contents(__DIR__.'/../../data/certificates/expiredCertificate.crt'), $filename);
 	}
 
 	public function testRemoveDangerousFile(): void {
@@ -131,7 +131,7 @@ 
 	}
 
 	public function testRemoveExistingFile(): void {
-		$this->certificateManager->addCertificate(file_get_contents(__DIR__ . '/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
+		$this->certificateManager->addCertificate(file_get_contents(__DIR__.'/../../data/certificates/goodCertificate.crt'), 'GoodCertificate');
 		$this->assertTrue($this->certificateManager->removeCertificate('GoodCertificate'));
 	}
 
@@ -174,7 +174,7 @@ 
 
 
 		$view->expects($this->any())->method('filemtime')
-			->willReturnCallback(function ($path) use ($targetBundleMtime) {
+			->willReturnCallback(function($path) use ($targetBundleMtime) {
 				if ($path === 'targetBundlePath') {
 					return $targetBundleMtime;
 				}