Initial commit: Nextcloud bare/Hansson → AIO migration toolkit

Scripts 01-05 voor sequentiële migratie: transfer, staging, upgrade-keten,
AIO-install en DB-import. PostgreSQL + MySQL/MariaDB bronnen ondersteund.
Proxmox/OPNSense VM-builder optioneel in proxmox/. README met 12 gotchas.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

04-install-aio.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# 04-install-aio.sh — AIO mastercontainer installeren op de doelserver.
+#
+# Gebruik:
+#   ./04-install-aio.sh test         → NC_STAGING_DOMAIN, poort 11000, skip LE
+#   ./04-install-aio.sh production   → NC_DOMAIN, poort 443, Let's Encrypt cert
+#
+# Na dit script: handmatige stappen in de AIO-wizard (zie output).
+# Wacht tot alle containers groen zijn → dan 05-import.sh draaien.
+#
+# BELANGRIJK: de mastercontainer bindt poort 443/80/3478 NIET zelf.
+# AIO's apache-subcontainer beheert die poorten. Als je die poorten wél aan de
+# mastercontainer geeft, faalt de domeincheck omdat beide containers op 443 luisteren.
+
+set -euo pipefail
+source "$(dirname "$0")/config.sh"
+MODE="${1:-test}"
+log() { echo "[$(date '+%H:%M:%S')] $*"; }
+
+if [[ "$MODE" == "production" ]]; then
+    DOMAIN="${NC_DOMAIN}"
+    APACHE_PORT=443
+    SKIP_VALIDATION=""
+else
+    DOMAIN="${NC_STAGING_DOMAIN}"
+    APACHE_PORT=11000
+    SKIP_VALIDATION="-e SKIP_DOMAIN_VALIDATION=true"
+fi
+
+log "Modus: ${MODE} — domein: ${DOMAIN} — apache-poort: ${APACHE_PORT}"
+
+# ── Snapshot vóór AIO ────────────────────────────────────────────────────────
+if [[ "${USE_PROXMOX}" == "true" ]]; then
+    SNAPSHOT="pre-aio-import-${MODE}"
+    log "Snapshot '${SNAPSHOT}' aanmaken..."
+    ssh "${PROXMOX_HOST}" \
+        "qm snapshot ${PROXMOX_VMID} '${SNAPSHOT}' \
+         --description 'Voor AIO start (${MODE})' 2>&1"
+    log "✓ Snapshot klaar."
+fi
+
+# ── Staging NC stoppen ───────────────────────────────────────────────────────
+log "Staging stack stoppen (indien actief)..."
+ssh "${TARGET_SSH}" "
+    sudo -u www-data php8.3 /var/www/nextcloud/occ maintenance:mode --on 2>/dev/null || true
+    systemctl stop apache2 php8.3-fpm nextcloud-cron.timer 2>/dev/null || true
+    echo 'Staging gestopt.'
+"
+
+# ── Docker installeren ───────────────────────────────────────────────────────
+log "Docker controleren / installeren..."
+ssh "${TARGET_SSH}" bash -s << 'REMOTE'
+if command -v docker &>/dev/null; then
+    echo "Docker al aanwezig: $(docker --version)"
+    exit 0
+fi
+apt-get update -qq
+apt-get install -y ca-certificates curl gnupg lsb-release 2>&1 | tail -1
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/debian/gpg \
+    -o /etc/apt/keyrings/docker.asc
+chmod a+r /etc/apt/keyrings/docker.asc
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
+    https://download.docker.com/linux/debian \
+    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+    > /etc/apt/sources.list.d/docker.list
+apt-get update -qq
+apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin 2>&1 | tail -3
+systemctl enable --now docker
+echo "Docker geïnstalleerd: $(docker --version)"
+REMOTE
+
+# ── AIO mastercontainer starten ──────────────────────────────────────────────
+log "AIO mastercontainer starten..."
+ssh "${TARGET_SSH}" bash -s << REMOTE
+set -e
+docker rm -f nextcloud-aio-mastercontainer 2>/dev/null || true
+
+docker run -d \
+  --name nextcloud-aio-mastercontainer \
+  --restart always \
+  -p 8080:8080 \
+  -e APACHE_PORT=${APACHE_PORT} \
+  -e APACHE_IP_BINDING=0.0.0.0 \
+  -e NEXTCLOUD_DATADIR=${TARGET_DATA_PATH} \
+  ${SKIP_VALIDATION} \
+  -v /var/run/docker.sock:/var/run/docker.sock:ro \
+  -v nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+  nextcloud/all-in-one:latest
+
+echo ""
+echo "Wachten op AIO start (~15s)..."
+sleep 15
+
+echo ""
+echo "══ AIO PASSPHRASE ══════════════════════════════"
+docker logs nextcloud-aio-mastercontainer 2>&1 \
+    | grep -i "passphrase\|initial passphrase" | tail -3 \
+    || docker logs nextcloud-aio-mastercontainer 2>&1 | tail -15
+echo "════════════════════════════════════════════════"
+REMOTE
+
+# ── App-rapport uit stap 03 printen ─────────────────────────────────────────
+log ""
+log "Apps die na AIO-import handmatig herinstalleerd moeten worden:"
+ssh "${TARGET_SSH}" "
+if [ -f /tmp/nc-apps-before.txt ] && [ -f /tmp/nc-apps-after.txt ]; then
+    AIO_REPLACES='fulltextsearch fulltextsearch_elasticsearch notify_push
+        spreed whiteboard recognize files_antivirus'
+    comm -23 \
+        <(sort /tmp/nc-apps-before.txt) \
+        <(sort /tmp/nc-apps-after.txt) | while read app; do
+        echo \"\$AIO_REPLACES\" | grep -qw \"\$app\" || echo \"  occ app:install \$app\"
+    done
+else
+    echo '  (voer eerst 03-upgrade.sh uit voor een volledige lijst)'
+fi
+" 2>/dev/null || true
+
+# ── Instructies ──────────────────────────────────────────────────────────────
+TARGET_IP=$(ssh "${TARGET_SSH}" "hostname -I | awk '{print \$1}'" 2>/dev/null || echo "<doel-ip>")
+
+echo ""
+log "══════════════════════════════════════════════════════════════"
+log "AIO mastercontainer draait. Handmatige stappen in de browser:"
+log ""
+log "  1. Open: https://${TARGET_IP}:8080"
+log "     (self-signed cert → klik door de waarschuwing)"
+log "  2. Voer de passphrase in (zie output hierboven)"
+log "  3. Stel domein in: ${DOMAIN}"
+if [[ "$MODE" == "test" ]]; then
+log "  4. 'Skip domain validation' is al geconfigureerd"
+fi
+log "  5. Selecteer optionele containers:"
+log "     Minimaal (test):    Imaginary"
+log "     Volledig (prod):    Talk, Imaginary, ClamAV, Fulltextsearch, Whiteboard"
+log "     Office-suite:       kies één — Collabora, OnlyOffice, Euro-Office, of geen"
+log "  6. Klik 'Save and start containers'"
+log "  7. Wacht tot ALLE containers groen zijn (~5-15 min)"
+log "     Let op: eerste start na import geeft zware CPU-piek door"
+log "     Elasticsearch-indexering + ClamAV DB-update + Recognize."
+log "     Plan dit buiten kantooruren."
+log ""
+log "  Daarna: ./05-import.sh"
+log "══════════════════════════════════════════════════════════════"