add trusted proxy, post-install/upgrade hooks, occ docs and admin review

- Add TRUSTED_PROXIES=caddy to fix reverse proxy header warning
- Add post-installation hook: maintenance window, phone region, DB indices, MIME migrations
- Add post-upgrade hook: DB indices and MIME migrations
- Add occ commands section to README
- Add nextcloud-review.md with admin warning fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nextcloud/docker-compose.yml

@@ -13,9 +13,12 @@ services:
       - POSTGRES_HOST=postgres
       - REDIS_HOST=redis
       - REDIS_HOST_PASSWORD=${REDIS_PASSWORD}
+      - TRUSTED_PROXIES=caddy
     volumes:
       - ${DATA_ROOT}/nextcloud/html:/var/www/html
       - ${DATA_ROOT}/nextcloud/data:/var/www/html/data
+      - ./hooks/post-installation.sh:/docker-entrypoint-hooks.d/post-installation/post-installation.sh:ro
+      - ./hooks/post-upgrade.sh:/docker-entrypoint-hooks.d/post-upgrade/post-upgrade.sh:ro
     networks:
       - proxy
       - nextcloud-internal

nextcloud/hooks/post-installation.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -eu
+
+echo "==> Post-installation: setting maintenance window start to 01:00 UTC..."
+php occ config:system:set maintenance_window_start --type=integer --value=1
+
+echo "==> Post-installation: setting default phone region to DE..."
+php occ config:system:set default_phone_region --value="DE"
+
+echo "==> Post-installation: adding missing DB indices..."
+php occ db:add-missing-indices
+
+echo "==> Post-installation: running MIME type migrations..."
+php occ maintenance:repair --include-expensive
+
+echo "==> Post-installation: done."

nextcloud/hooks/post-upgrade.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eu
+
+echo "==> Post-upgrade: adding missing DB indices..."
+php occ db:add-missing-indices
+
+echo "==> Post-upgrade: running MIME type migrations..."
+php occ maintenance:repair --include-expensive
+
+echo "==> Post-upgrade: done."