Merge pull request #11831 from nextcloud/Rello-server-hardening

Add details about outgoing connections

admin_manual/installation/harden_server.rst

@@ -236,20 +236,43 @@ security headers are shipped.
 Connections to remote servers
 -----------------------------
 
-Some Nextcloud functionalites require connecting to remote servers. Depending on 
-your server setup, these are the possible connections:
+Some functionalites require the Nextcloud server to be able to connect remote systems via https/443.
+This pragraph also includes the data which is being transmitted to the Nextcloud GmbH.
+Depending on your server setup, these are the possible connections:
 
-- www.nextcloud.com, www.startpage.com, www.eff.org, www.edri.org for checking the internet connection
-- cloud.nextcloud.com (https) for validating the enterprise subscription
-- updates.nextcloud.com (https) for Nextcloud server updates
-- push-notifications.nextcloud.com (https) for sending push notifications to mobile clients
-- pushfeed.nextcloud.com (https) for the Nextcloud announcements app
-- lookup.nextcloud.com (https) for updating and lookups to the federated sharing addressbook
-- surveyserver.nextcloud.com (https) if the admin has agreed to share anonymized data
-- apps.nextcloud.com (https) for available apps and their updates 
-- github.com (https) for downloading Nextcloud standard apps
+- nextcloud.com, startpage.com, eff.org, edri.org
+	- `optional (config)`_
+	- for checking the internet connection
+- cloud.nextcloud.com
+	- used for enterprise license monitoring
+	- submitted data: subscription key, user count
+- updates.nextcloud.com
+	- to check for available Nextcloud server updates
+	- submitted data: server version, subscription key, install time, instance id, instance size
+- apps.nextcloud.com
+	- to check for available apps and their updates 
+	- submitted data: subscription key
+- github.com
+	- to download Nextcloud standard apps
+- push-notifications.nextcloud.com
+	- sending push notifications to mobile clients
+	- submitted data: unique device identifier, public key, push token
+- pushfeed.nextcloud.com
+	- optional
+	- checking for updates to be shown in the Nextcloud Announcements app
+- lookup.nextcloud.com
+	- optional
+	- for updating and lookups to the federated sharing addressbook
+	- submitted data: *pending*
+- surveyserver.nextcloud.com
+	- optional
+	- if the admin has agreed to share anonymized server data
+	- submitted data: instance id, server versions (incl. php & db), installed apps
 - Any remote Nextcloud server that is connected with federated sharing
 
+.. _optional (config): https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#has-internet-connection
+
+
 Setup fail2ban
 --------------