version: '3.8'

services:
  db:
    image: mariadb:10.11
    container_name: nextcloud-db
    restart: always
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    volumes:
      - db_data:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=${NC_DB_PASS}
      - MYSQL_PASSWORD=${NC_DB_PASS}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: always
    volumes:
      - redis_data:/data

  app:
    image: nextcloud:stable
    container_name: nextcloud-app
    restart: always
    ports:
      - "8080:80"
    volumes:
      - nc_data:/var/www/html
    environment:
      - MYSQL_HOST=db
      - MYSQL_PASSWORD=${NC_DB_PASS}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - REDIS_HOST=redis
      - NEXTCLOUD_ADMIN_USER=${NC_ADMIN_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NC_ADMIN_PASS}
      - NEXTCLOUD_TRUSTED_PROXIES=127.0.0.1
      - PHP_MEMORY_LIMIT=512M
      - APACHE_BACKEND_WORKERS=8
    depends_on:
      - db
      - redis

  ai-worker:
    build: ./ai-worker
    container_name: nextcloud-ai
    restart: unless-stopped
    volumes:
      - nc_data:/data
      - ai_models:/models
    environment:
      - NEXTCLOUD_URL=http://app
      - OLLAMA_URL=http://ollama:11434
    depends_on:
      - app

  ollama:
    image: ollama/ollama:latest
    container_name: nextcloud-ollama
    restart: always
    ports:
      - "11434:11434"
    volumes:
      - ollama_data:/root/.ollama
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]

volumes:
  db_data:
  redis_data:
  nc_data:
  ollama_data:
  ai_models:

NC_DB_PASS=your_secure_password_here
NC_ADMIN_USER=admin
NC_ADMIN_PASS=your_admin_password_here

docker compose up -d

# Enable via OCC command line
docker exec nextcloud-app php occ app:enable aialab
docker exec nextcloud-app php occ app:enable office
docker exec nextcloud-app php occ app:enable activity

# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh

# Download models suitable for your VPS
# CPU-only recommendation: llama3.2:3b (lightweight & fast)
ollama pull llama3.2:3b

# If you have a GPU, recommend: llama3.2-vision:11b (supports image understanding)
# ollama pull llama3.2-vision:11b

# Install embedding model
ollama pull nomic-embed-text

# Verify the model works
curl http://localhost:11434/api/embeddings -d '{
  "model": "nomic-embed-text",
  "input": "Test vector retrieval"
}'

# analyzer.py
import json
import hashlib
import requests
import os
import mimetypes
from datetime import datetime
from pathlib import Path
from typing import Optional
import logging
import re

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class FileAnalyzer:
    """AI File Analysis Engine"""

    def __init__(self, nc_url: str, nc_user: str, nc_app_password: str,
                 ollama_url: str = "http://ollama:11434"):
        self.nc_url = nc_url.rstrip('/')
        self.nc_auth = (nc_user, nc_app_password)
        self.ollama_url = ollama_url
        self.categories = {
            'documents': ['document', 'report', 'contract', 'agreement', 'proposal'],
            'images': ['photo', 'screenshot', 'image', 'chart', 'design'],
            'videos': ['video', 'tutorial', 'meeting', 'presentation'],
            'audio': ['music', 'podcast', 'recording', 'voice memo'],
            'code': ['code', 'script', 'program', 'project', 'source'],
            'data': ['data', 'spreadsheet', 'CSV', 'Excel', 'database'],
            'finance': ['invoice', 'bill', 'receipt', 'tax', 'financial'],
            'personal': ['personal', 'note', 'diary', 'contact'],
        }

    def analyze_file(self, file_path: str, file_type: str) -> dict:
        """Analyze a single file and return AI-generated tags"""
        result = {
            'path': file_path,
            'analyzed_at': datetime.now().isoformat(),
            'ai_tags': [],
            'ai_category': 'uncategorized',
            'confidence': 0.0,
            'summary': '',
        }

        try:
            if file_type.startswith('image/'):
                result = self._analyze_image(file_path, result)
            elif file_type.startswith('text/') or file_type in [
                'application/pdf', 'application/msword',
                'application/vnd.openxmlformats-officedocument'
            ]:
                result = self._analyze_text(file_path, result)
            else:
                result = self._classify_generic(file_path, result)

            logger.info(f"Analyzed {file_path}: {result['ai_tags']}")
        except Exception as e:
            logger.error(f"Failed to analyze {file_path}: {e}")

        return result

    def _analyze_image(self, file_path: str, result: dict) -> dict:
        """Analyze images using vision models"""
        try:
            with open(file_path, 'rb') as f:
                img_hash = hashlib.sha256(f.read()).hexdigest()[:16]

            resp = requests.post(
                f"{self.ollama_url}/api/chat",
                json={
                    'model': 'llama3.2-vision',
                    'messages': [{
                        'role': 'user',
                        'content': 'Describe the content of this image and provide 3-5 English tags. Return only JSON: {"tags": ["tag1", "tag2"], "summary": "brief description"}',
                        'images': [img_hash]
                    }],
                    'stream': False
                }
            )

            if resp.status_code == 200:
                ai_response = resp.json()['message']['content']
                json_match = re.search(r'\{.*\}', ai_response, re.DOTALL)
                if json_match:
                    ai_data = json.loads(json_match.group())
                    result['ai_tags'] = ai_data.get('tags', [])
                    result['summary'] = ai_data.get('summary', '')
                    result['confidence'] = 0.85

        except Exception as e:
            logger.warning(f"Image analysis failed: {e}")
            result['ai_tags'] = ['image']

        return result

    def _analyze_text(self, file_path: str, result: dict) -> dict:
        """Analyze text content using LLM"""
        try:
            text_content = ''
            if file_path.endswith(('.txt', '.md')):
                with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
                    text_content = f.read(10000)
            elif file_path.endswith('.pdf'):
                text_content = self._extract_pdf_text(file_path)

            if text_content:
                resp = requests.post(
                    f"{self.ollama_url}/api/generate",
                    json={
                        'model': 'llama3.2:3b',
                        'prompt': f'''Analyze the following text content and return JSON:
{{"tags": ["tag1", "tag2", "tag3"], "category": "classification", "summary": "summary within 100 words"}}

Text content:
{text_content[:5000]}''',
                        'stream': False,
                        'options': {
                            'temperature': 0.3,
                            'num_predict': 200
                        }
                    }
                )

                if resp.status_code == 200:
                    ai_response = resp.json()['response']
                    json_match = re.search(r'\{.*\}', ai_response, re.DOTALL)
                    if json_match:
                        ai_data = json.loads(json_match.group())
                        result['ai_tags'] = ai_data.get('tags', [])
                        result['category'] = ai_data.get('category', 'uncategorized')
                        result['summary'] = ai_data.get('summary', '')
                        result['confidence'] = 0.80

        except Exception as e:
            logger.warning(f"Text analysis failed: {e}")

        return result

    def _classify_generic(self, file_path: str, result: dict) -> dict:
        """Generic file classification (based on filename and extension)"""
        ext = Path(file_path).suffix.lower()
        filename = Path(file_path).stem.lower()

        ext_to_cat = {
            '.jpg': 'images', '.jpeg': 'images', '.png': 'images',
            '.gif': 'images', '.webp': 'images',
            '.mp4': 'videos', '.avi': 'videos', '.mkv': 'videos',
            '.mp3': 'audio', '.wav': 'audio', '.flac': 'audio',
            '.py': 'code', '.js': 'code', '.sh': 'code',
            '.java': 'code', '.go': 'code', '.rs': 'code',
            '.csv': 'data', '.xlsx': 'data', '.xls': 'data',
            '.doc': 'documents', '.docx': 'documents',
            '.pdf': 'documents', '.odt': 'documents',
            '.pptx': 'documents', '.ppt': 'documents',
        }

        if ext in ext_to_cat:
            result['ai_category'] = ext_to_cat[ext]
            result['ai_tags'] = [ext.lstrip('.')]
            result['confidence'] = 0.60

        for keyword, category in self.categories.items():
            for kw in category:
                if kw in filename:
                    result['ai_tags'].append(kw)
                    result['confidence'] = max(result['confidence'], 0.70)

        return result

    def _extract_pdf_text(self, file_path: str) -> str:
        """Extract text from PDF files"""
        try:
            import subprocess
            result = subprocess.run(
                ['pdftotext', '-layout', file_path, '-'],
                capture_output=True, text=True, timeout=30
            )
            return result.stdout
        except Exception:
            return ''

    def batch_analyze_directory(self, directory: str) -> list:
        """Batch analyze files in a directory"""
        results = []
        for root, dirs, files in os.walk(directory):
            for fname in files:
                fpath = os.path.join(root, fname)
                stat = os.stat(fpath)
                if stat.st_size < 1024:
                    continue
                if stat.st_size > 50 * 1024 * 1024:
                    continue

                mime = mimetypes.guess_type(fname)[0] or 'application/octet-stream'
                analysis = self.analyze_file(fpath, mime)
                results.append(analysis)

        return results

# nextcloud_api.py
import requests
import hashlib

class NextCloudAPI:
    """Nextcloud API Wrapper"""

    def __init__(self, url: str, username: str, app_password: str):
        self.base_url = url.rstrip('/')
        self.auth = (username, app_password)

    def get_files(self, path: str = '/', recursive: bool = False) -> list:
        """Get file listing for a given path"""
        files = []
        params = {'path': path}
        resp = requests.get(
            f"{self.base_url}/ocs/apps/files_sharing/api/v1/shares",
            auth=self.auth, params=params
        )
        if resp.status_code == 200:
            data = resp.json()
            for item in data.get('ocs', {}).get('data', []):
                files.append({
                    'path': item.get('path', ''),
                    'name': item.get('name', ''),
                    'size': item.get('size', 0),
                    'mime': item.get('mimetype', ''),
                    'mtime': item.get('mtime', 0),
                })
        return files

    def add_tag_to_file(self, file_path: str, tag: str):
        """Add AI-generated tag to a file"""
        props = f'''<?xml version="1.0"?>
<D:set>
  <D:prop>
    <ai:tags xmlns:ai="http://nextcloud.com/ai">{tag}</ai:tags>
  </D:prop>
</D:set>'''
        resp = requests.request(
            'PROPFIND',
            f"{self.base_url}/remote.php/dav/files/",
            auth=self.auth,
            data=props
        )
        return resp.status_code == 207

    def search_by_tag(self, tag: str) -> list:
        """Search files by tag"""
        files = []
        resp = requests.get(
            f"{self.base_url}/ocs/apps/files_sharing/api/v1/search",
            auth=self.auth,
            params={'tag': tag}
        )
        if resp.status_code == 200:
            files = resp.json().get('ocs', {}).get('data', [])
        return files

# semantic_search.py
import numpy as np
from sentence_transformers import SentenceTransformer

class SemanticSearchIndex:
    """Semantic Search Index"""

    def __init__(self, model_name='paraphrase-multilingual-MiniLM-L12-v2'):
        self.model = SentenceTransformer(model_name)
        self.index = {}
        self.embeddings = []

    def add_document(self, file_path: str, text: str, metadata: dict = None):
        """Add a document to the index"""
        embedding = self.model.encode(text)
        self.index[file_path] = {
            'embedding': embedding,
            'metadata': metadata or {},
            'text_preview': text[:200]
        }
        self.embeddings.append(embedding)

    def search(self, query: str, top_k: int = 10) -> list:
        """Semantic search"""
        query_embedding = self.model.encode(query)

        if not self.embeddings:
            return []

        similarities = np.dot(self.embeddings, query_embedding)
        top_indices = np.argsort(similarities)[::-1][:top_k]

        results = []
        for idx in top_indices:
            file_path = list(self.index.keys())[idx]
            doc = self.index[file_path]
            results.append({
                'path': file_path,
                'score': float(similarities[idx]),
                'metadata': doc['metadata'],
                'preview': doc['text_preview']
            })

        return results

    def save_index(self, filepath: str):
        """Persist the index"""
        import pickle
        with open(filepath, 'wb') as f:
            pickle.dump({
                'index': self.index,
                'embeddings': np.array(self.embeddings),
            }, f)

    def load_index(self, filepath: str):
        """Load an existing index"""
        import pickle
        with open(filepath, 'rb') as f:
            data = pickle.load(f)
            self.index = data['index']
            self.embeddings = data['embeddings'].tolist()

// Frontend search enhancement example (Nextcloud plugin)
async function enhancedSearch(query) {
    // 1. Semantic search
    const semanticResults = await fetch('/apps/ai-search/semantic', {
        method: 'POST',
        body: JSON.stringify({ query }),
    });

    // 2. Traditional keyword search
    const keywordResults = await fetch(`/ocs/apps/files_sharing/api/v1/search?q=${query}`);

    // 3. Merge and rank
    const combined = mergeAndRank(semanticResults, keywordResults);
    return combined;
}

# anomaly_detector.py
import numpy as np
from collections import defaultdict
from datetime import datetime, timedelta

class AccessAnomalyDetector:
    """Access Anomaly Detector"""

    def __init__(self, window_hours=24):
        self.window_hours = window_hours
        self.access_log = defaultdict(list)

    def record_access(self, user: str, action: str, path: str):
        """Record file access event"""
        self.access_log[user].append({
            'timestamp': datetime.now(),
            'action': action,
            'path': path,
        })

    def detect_anomalies(self, user: str) -> list:
        """Detect anomalous behavior"""
        anomalies = []
        recent = self.access_log[user][-100:]

        if len(recent) < 10:
            return anomalies

        # Check 1: High-frequency access in short time
        time_span = (recent[-1]['timestamp'] - recent[0]['timestamp']).total_seconds()
        if time_span < 3600 and len(recent) > 50:
            anomalies.append({
                'type': 'high_frequency_access',
                'severity': 'warning',
                'detail': f'{user} accessed {len(recent)} files within {time_span/60:.1f} minutes',
            })

        # Check 2: Off-hours access
        work_hours = set(range(8, 22))
        off_hours_access = [a for a in recent if a['timestamp'].hour not in work_hours]
        if len(off_hours_access) > 10:
            anomalies.append({
                'type': 'off_hours_access',
                'severity': 'info',
                'detail': f'{user} had {len(off_hours_access)} accesses outside working hours',
            })

        # Check 3: Sensitive file access
        sensitive_keywords = ['password', 'secret', 'key', 'token', 'financial', 'contract']
        sensitive_access = [
            a for a in recent
            if any(kw in a['path'].lower() for kw in sensitive_keywords)
        ]
        if sensitive_access:
            anomalies.append({
                'type': 'sensitive_file_access',
                'severity': 'high',
                'detail': f'Detected {len(sensitive_access)} accesses to sensitive files',
            })

        return anomalies

# alert_sender.py
import smtplib
import requests
from email.mime.text import MIMEText
from datetime import datetime

def send_alert_webhook(anomaly: dict, webhook_url: str):
    """Send alert to Webhook (Telegram, Slack, etc.)"""
    payload = {
        'text': f"🚨 AI Security Alert\n"
                f"Type: {anomaly['type']}\n"
                f"Severity: {anomaly['severity']}\n"
                f"Detail: {anomaly['detail']}\n"
                f"Time: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}"
    }
    requests.post(webhook_url, json=payload)

def send_alert_email(anomaly: dict, smtp_config: dict):
    """Send email alert"""
    msg = MIMEText(anomaly['detail'], 'plain', 'utf-8')
    msg['Subject'] = f"[AI Security Alert] {anomaly['type']}"
    msg['From'] = smtp_config['sender']
    msg['To'] = smtp_config['recipient']

    with smtplib.SMTP(smtp_config['host'], smtp_config['port']) as server:
        server.starttls()
        server.login(smtp_config['user'], smtp_config['password'])
        server.send_message(msg)

# Edit crontab
crontab -e

# Analyze newly uploaded files every hour
0 * * * * /usr/bin/docker exec nextcloud-ai python3 /app/schedule_analyze.py >> /var/log/ai-analyzer.log 2>&1

# Rebuild semantic index daily at 3 AM
0 3 * * * /usr/bin/docker exec nextcloud-ai python3 /app/rebuild_index.py >> /var/log/ai-index.log 2>&1

# Check anomaly patterns weekly on Sunday
0 4 * * 0 /usr/bin/docker exec nextcloud-ai python3 /app/check_anomalies.py >> /var/log/ai-alerts.log 2>&1

# schedule_analyze.py
#!/usr/bin/env python3
"""Scheduled script to analyze newly uploaded files"""
import os
import sys
import json
import hashlib
from pathlib import Path
from datetime import datetime

sys.path.insert(0, '/app')
from analyzer import FileAnalyzer
from nextcloud_api import NextCloudAPI

def main():
    NC_URL = os.environ.get('NEXTCLOUD_URL', 'http://app:80')
    NC_USER = os.environ.get('NC_USER', 'admin')
    NC_PASS = os.environ.get('NC_APP_PASS', '')
    OLLAMA_URL = os.environ.get('OLLAMA_URL', 'http://ollama:11434')

    analyzer = FileAnalyzer(NC_URL, NC_USER, NC_PASS, OLLAMA_URL)
    api = NextCloudAPI(NC_URL, NC_USER, NC_PASS)

    files = api.get_files('/Documents')

    analyzed_count = 0
    for file_info in files:
        file_path = file_info['path']
        marker_file = f"/tmp/ai_analyzed_{hashlib.md5(file_path.encode()).hexdigest()}.done"
        if os.path.exists(marker_file):
            continue

        result = analyzer.analyze_file(
            os.path.join('/data', file_path),
            file_info['mime']
        )

        result_file = f"/data/.ai_metadata/{file_path}.json"
        os.makedirs(os.path.dirname(result_file), exist_ok=True)
        with open(result_file, 'w') as f:
            json.dump(result, f, indent=2, ensure_ascii=False)

        os.makedirs(os.path.dirname(marker_file), exist_ok=True)
        Path(marker_file).touch()
        analyzed_count += 1

    print(f"[{datetime.now()}] Analyzed {analyzed_count} new files")

if __name__ == '__main__':
    main()