ownCloud 8 busted MOD_X_ACCEL_REDIRECT_ENABLED

see https://github.com/owncloud/core/issues/14976

We will need to update when ownCloud makes this better with MOD_X_ACCEL_REDIRECT_PREFIX.

See https://discourse.mailinabox.email/t/owncloud-can-not-read-uploaded-data/428.

CHANGELOG.md

@@ -11,6 +11,10 @@ Mail:
 * In order to guard against misconfiguration that can lead to domain control validation hijacking, email addresses that begin with admin, administrator, postmaster, hostmaster, and webmaster can no longer be used for (new) mail user accounts, and aliases for these addresses may direct mail only to the box's administrator(s).
 * Roundcube updated to version 1.1.1.
 
+ownCloud:
+
+* Downloading files you uploaded to ownCloud broke because of a change in ownCloud 8.
+
 System:
 
 * Backups now use duplicity's built-in gpg symmetric AES256 encryption rather than my home-brewed encryption. Old backups will be incorporated inside the first backup after this update but then deleted from disk (i.e. your backups from the previous few days will be backed up).

conf/nginx-primaryonly.conf

@@ -28,6 +28,7 @@
 		fastcgi_param SCRIPT_FILENAME /usr/local/lib/owncloud/$2;
 		fastcgi_param SCRIPT_NAME $1$2;
 		fastcgi_param PATH_INFO $3;
+		# TODO: see the dispreferred "method 2" for xaccel at https://doc.owncloud.org/server/8.1/admin_manual/configuration_files/serving_static_files_configuration.html
 		fastcgi_param MOD_X_ACCEL_REDIRECT_ENABLED on;
 		fastcgi_read_timeout 630;
 		fastcgi_pass php-fpm;
@@ -36,10 +37,13 @@
 		client_max_body_size 1G;
 		fastcgi_buffers 64 4K;
 	}
-	location ^~ /cloud/data {
-		# In order to support MOD_X_ACCEL_REDIRECT_ENABLED, we need to expose
-		# the data directory but only allow 'internal' redirects within nginx
-		# so that this is not exposed to the world.
+	location ^~ $STORAGE_ROOT/owncloud {
+		# This directory is for MOD_X_ACCEL_REDIRECT_ENABLED. It works a little weird.
+		# The full path on disk of the file is passed as the URL path. ownCloud 8 totally
+		# busted the sane way this worked in ownCloud 7. There's a pending change using
+		# a new parameter to make this make more sense.
+		# We need to only allow 'internal' redirects within nginx so that the filesystem
+		# is not exposed to the world.
 		internal;
 		alias $STORAGE_ROOT/owncloud;
 	}