Patch, upgrade, fix

Got notified by mail that a FreeBSD user was unable to use PHP 8.5 with the Nextcloud port and apps.

Always great to hear that people are using the ports! Then, figure out what's going on.

Summarizing:

Nextcloud recommends using PHP 8.5
PHP 8.5 removed some constants for PDO MySQL causing TLS errors
Nextcloud does not know the latest MariaDB LTS version 12.3

No PHP 8.5 flavor packages for Nextcloud ports

Bit of digging, the Nextcloud "USES" framework had not been updated to align with latest Nextcloud docs.

For every major version update of Nextcloud, I need to check for changes in the System Requirements.

On 2026-04-27, the system requirements added Ubuntu 26.04, and made PHP 8.5 the recommended version.

The Nextcloud apps in FreeBSD ports all have a USES line for nextcloud

USES=               nextcloud

This triggers the FreeBSD ports infrastructure to pull in the Mk/Uses/nextcloud.mk file. The error is right there, it was still set to ignore the PHP 8.5 flavor of the port. So binary packages were available for PHP 8.2 through 8.4. The Nextcloud package itself (www/nextcloud) was available in PHP 8.5 flavor.

# /usr/ports/Mk/Uses/nextcloud.mk
IGNORE_WITH_PHP=    85

Easy enough fix to align with the Admin manual. Let's deprecate PHP 8.2 while we're here.

# /usr/ports/Mk/Uses/nextcloud.mk
IGNORE_WITH_PHP=    82

Deprecation of PHP MySQL PDO constants

The occ command failed after upgrading from PHP 8.4 to PHP 8.5 (no other changes, Nextcloud 33.0.5).

An unhandled exception has been thrown:
Doctrine\DBAL\Exception: Failed to connect to the database: An exception \
occurred in the driver: SQLSTATE[HY000] [2002] Cannot connect to MySQL using\
SSL in /usr/local/www/nextcloud/lib/private/DB/Connection.php:238

Weird, I know the database can be connected, and it does have a valid LetsEncrypt cert. SSL is mandatory for the account Nextcloud uses to connect to the database. The nextcloud logs shows us what's wrong:

"message":"Constant PDO::MYSQL_ATTR_SSL_CAPATH is deprecated since 8.5, use \
Pdo\\Mysql::ATTR_SSL_CAPATH instead at /usr/local/etc/nextcloud/config.php#34"

So what's in that file?

  'dbdriveroptions' => array (
    1014 => true,
    1010 => '/etc/ssl/certs',
  ),

Weirdly, numbers. Probably dug that up somewhere when I started enforcing SSL. (It's all jails on localhost, SSL should not be needed. An attacker that can dump the traffic has root privileges already)

So this is about deprecation of constants in PHP PDO for MySQL, let's fix this

  'dbdriveroptions' => array [
    \PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true,
    \PDO::MYSQL_ATTR_SSL_CAPATH => '/etc/ssl/certs',
  ],

and the occ command operates as expected. Note the literal \ in \PDO! Bonus, we now have a more descriptive configuration.

MariaDB 12.3

Recently, I added the MariaDB 12.3 client and server ports to FreeBSD.

Dogfooding is important to me, so the database jail gets an upgraded MariaDB.

$ mariadb-dump --all-databases | zstd -9 > ~/backup/mariadb-before-12.3.sql.zstd
$ service mariadb stop
$ pkg install mariadb123-server
...
Conflicts with the existing packages have been found.
One more solver iteration is needed to resolve them.
The following 4 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        mariadb123-client: 12.3.2_1 [FreeBSD-ports]
        mariadb123-server: 12.3.2_1 [FreeBSD-ports]

Installed packages to be REMOVED:
        mariadb118-client: 11.8.8
        mariadb118-server: 11.8.8
...
$ service mariadb start
$ mariadb-upgrade
...

Back in business!

Had I read the Nextcloud Admin guide Installation Requirements properly, I could have prevented this in the Admin overview.

Database version
MariaDB version "12.3.2-MariaDB-log" detected. MariaDB >=10.6 and <=11.8 is suggested for best performance, stability and functionality with this version of Nextcloud.

Ah well, all seems to function fine with Nextcloud 33, PHP 8.5 and MariaDB 12.3.