From c540751ef67ee136e2f40108a1ca28f216001022 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Mon, 11 May 2026 12:58:57 +0100
Subject: [PATCH] Limit request body size

---
 ansible/roles/pve_docker/files/nextcloud/docker-compose.yml | 3 ++-
 ansible/roles/traefik/files/file-provider-main.yml          | 5 +++++
 ansible/roles/traefik/files/traefik.yml                     | 1 +
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml b/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml
index a61c5a9..b2887ef 100644
--- a/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml
+++ b/ansible/roles/pve_docker/files/nextcloud/docker-compose.yml
@@ -23,7 +23,8 @@ services:
       - traefik.http.services.nextcloud-nextcloud.loadbalancer.server.port=443
       - traefik.http.services.nextcloud-nextcloud.loadbalancer.server.scheme=https
       - traefik.http.middlewares.nextcloud-hsts.headers.stsseconds=15552000
-      - traefik.http.routers.nextcloud.middlewares=nextcloud-hsts@docker
+      - traefik.http.middlewares.nextcloud-limit.buffering.maxRequestBodyBytes=0
+      - traefik.http.routers.nextcloud.middlewares=nextcloud-hsts@docker,nextcloud-limit@docker
     networks:
       - default
       - traefik
diff --git a/ansible/roles/traefik/files/file-provider-main.yml b/ansible/roles/traefik/files/file-provider-main.yml
index 2dfda78..52d7b15 100644
--- a/ansible/roles/traefik/files/file-provider-main.yml
+++ b/ansible/roles/traefik/files/file-provider-main.yml
@@ -17,6 +17,11 @@ http:
         customResponseHeaders:
           Permissions-Policy: interest-cohort=()
 
+    request-limit:
+      buffering:
+        maxRequestBodyBytes: 2000000
+        memResponseBodyBytes: 10000000
+
     tailscale-only:
       ipAllowList:
         sourceRange:
diff --git a/ansible/roles/traefik/files/traefik.yml b/ansible/roles/traefik/files/traefik.yml
index aa7efbf..3f67e4d 100644
--- a/ansible/roles/traefik/files/traefik.yml
+++ b/ansible/roles/traefik/files/traefik.yml
@@ -18,6 +18,7 @@ entryPoints:
         - floc-block@file
         - compress@file
         - secure-headers@file
+        - request-limit@file
       tls:
         certResolver: "{{ 'acme-tls' if traefik_tls_challenge else 'acme-http' }}"
         {% if traefik_tls_challenge %}