nextcloud with nginx install on Archlinux

nextcloud with nginx install on Archlinux

Archlinux

Modules Install

$ yaourt -S nginx-mainline php-fpm php-gd php-intl php-mcrypt php-apcu nextcloud mariadb syslog-ng

Modules Setup

SYSLOG

$ systemctl enable syslog-ng
$ systemctl restart syslog-ng

PHP

/etc/php/php.ini

date.timezone = Asia/Shanghai
display_errors=On
extension=gd.so
extension=iconv.so
extension=intl.so
extension=mcrypt.so
extension=mysqli.so
zend_extension=opcache.so
extension=pdo_mysql.so
extension=zip.so
[opcache]
opcache.enable=1
opcache.enable_cli=1

/etc/php/conf.d/apcu.ini

extension=apcu.so
[apc]
apc.enable=1
apc.shm_size=32M
apc.ttl=7200
apc.enable_cli=1

MariaDB

$ mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql
$ systemctl enable mariadb
$ systemctl restart mariadb
$ mysql_secure_installation

Nginx

TLS/SSL

$ mkdir /etc/nginx/ssl
$ cd /etc/nginx/ssl
$ openssl req -new -x509 -nodes -newkey rsa:4096 $ -keyout server.key -out server.crt -days 1095
$ chmod 400 server.key
$ chmod 444 server.crt

PHP-FPM

/etc/php/php-fpm.d/www.conf

env[PATH] = /usr/local/bin:/usr/bin:/bin

$ systemctl enable php-fpm
$ systemctl restart php-fpm

NextCloud

Init DB

1. $ mysql -u root -p 

   ---

2. mysql> CREATE DATABASE `nextcloud` DEFAULT CHARACTER SET `utf8` COLLATE `utf8_unicode_ci`; 

   ---

3. mysql> CREATE USER `nextcloud`@'localhost' IDENTIFIED BY 'xxxxx'; 

   ---

4. mysql> GRANT ALL PRIVILEGES ON `nextcloud`.* TO `nextcloud`@`localhost`; 

   ---

5. mysql> \q 

   ---

Nginx

$ mkdir /etc/nginx/conf.d/
$ touch /etc/nginx/conf.d/nextcloud.conf

/etc/nginx/nginx.conf

1. http { 

   ---

2. include conf.d/*.conf 

   ---

3. ... 

   ---

4. } 

   ---

/etc/nginx/conf.d/nextcloud.conf

1. upstream php-handler { 

   ---

2. #server 127.0.0.1:9000; 

   ---

3. server unix:/var/run/php-fpm/php-fpm.sock; 

   ---

4. } 

   ---

5.  

   ---

6. #server { 

   ---

7. # listen 80; 

   ---

8. # server_name 45.63.49.131; 

   ---

9. # # enforce https 

   ---

10. # return 301 https://$server_name$request_uri; 

    ---

11. #} 

    ---

12.  

    ---

13. server { 

    ---

14. listen 8080; 

    ---

15. listen 443 ssl http2; 

    ---

16. ssl on; 

    ---

17. server_name 45.63.49.131; 

    ---

18.  

    ---

19. ssl_certificate ssl/server.crt; 

    ---

20. ssl_certificate_key ssl/server.key; 

    ---

21.  

    ---

22. # Add headers to serve security related headers 

    ---

23. # Before enabling Strict-Transport-Security headers please read into this 

    ---

24. # topic first. 

    ---

25. add_header Strict-Transport-Security "max-age=15768000; 

    ---

26. includeSubDomains; preload;"; 

    ---

27. add_header X-Content-Type-Options nosniff; 

    ---

28. add_header X-Frame-Options "SAMEORIGIN"; 

    ---

29. add_header X-XSS-Protection "1; mode=block"; 

    ---

30. add_header X-Robots-Tag none; 

    ---

31. add_header X-Download-Options noopen; 

    ---

32. add_header X-Permitted-Cross-Domain-Policies none; 

    ---

33.  

    ---

34. # Path to the root of your installation 

    ---

35. root /usr/share/webapps/nextcloud/; 

    ---

36.  

    ---

37. location = /robots.txt { 

    ---

38. allow all; 

    ---

39. log_not_found off; 

    ---

40. access_log off; 

    ---

41. } 

    ---

42.  

    ---

43. # The following 2 rules are only needed for the user_webfinger app. 

    ---

44. # Uncomment it if you're planning to use this app. 

    ---

45. #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; 

    ---

46. #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json 

    ---

47. # last; 

    ---

48.  

    ---

49. location = /.well-known/carddav { 

    ---

50. return 301 $scheme://$host/remote.php/dav; 

    ---

51. } 

    ---

52. location = /.well-known/caldav { 

    ---

53. return 301 $scheme://$host/remote.php/dav; 

    ---

54. } 

    ---

55.  

    ---

56. # set max upload size 

    ---

57. client_max_body_size 512M; 

    ---

58. fastcgi_buffers 64 4K; 

    ---

59.  

    ---

60. # Disable gzip to avoid the removal of the ETag header 

    ---

61. gzip off; 

    ---

62.  

    ---

63. # Uncomment if your server is build with the ngx_pagespeed module 

    ---

64. # This module is currently not supported. 

    ---

65. #pagespeed off; 

    ---

66.  

    ---

67. error_page 403 /core/templates/403.php; 

    ---

68. error_page 404 /core/templates/404.php; 

    ---

69.  

    ---

70. location / { 

    ---

71. rewrite ^ /index.php$uri; 

    ---

72. } 

    ---

73.  

    ---

74. location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { 

    ---

75. deny all; 

    ---

76. } 

    ---

77. location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { 

    ---

78. deny all; 

    ---

79. } 

    ---

80.  

    ---

81. location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) { 

    ---

82. fastcgi_split_path_info ^(.+\.php)(/.*)$; 

    ---

83. include fastcgi_params; 

    ---

84. fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; 

    ---

85. fastcgi_param PATH_INFO $fastcgi_path_info; 

    ---

86. fastcgi_param HTTPS on; 

    ---

87. #Avoid sending the security headers twice 

    ---

88. fastcgi_param modHeadersAvailable true; 

    ---

89. fastcgi_param front_controller_active true; 

    ---

90. fastcgi_pass php-handler; 

    ---

91. fastcgi_intercept_errors on; 

    ---

92. fastcgi_request_buffering off; 

    ---

93. } 

    ---

94.  

    ---

95. location ~ ^/(?:updater|ocs-provider)(?:$|/) { 

    ---

96. try_files $uri/ =404; 

    ---

97. index index.php; 

    ---

98. } 

    ---

99.  

    ---

100. # Adding the cache control header for js and css files 

     ---

101. # Make sure it is BELOW the PHP block 

     ---

102. location ~* \.(?:css|js|woff|svg|gif)$ { 

     ---

103. try_files $uri /index.php$uri$is_args$args; 

     ---

104. add_header Cache-Control "public, max-age=7200"; 

     ---

105. # Add headers to serve security related headers (It is intended to 

     ---

106. # have those duplicated to the ones above) 

     ---

107. # Before enabling Strict-Transport-Security headers please read into 

     ---

108. # this topic first. 

     ---

109. # add_header Strict-Transport-Security "max-age=15768000; 

     ---

110. # includeSubDomains; preload;"; 

     ---

111. add_header X-Content-Type-Options nosniff; 

     ---

112. add_header X-Frame-Options "SAMEORIGIN"; 

     ---

113. add_header X-XSS-Protection "1; mode=block"; 

     ---

114. add_header X-Robots-Tag none; 

     ---

115. add_header X-Download-Options noopen; 

     ---

116. add_header X-Permitted-Cross-Domain-Policies none; 

     ---

117. # Optional: Don't log access to assets 

     ---

118. access_log off; 

     ---

119. } 

     ---

120.  

     ---

121. location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ { 

     ---

122. try_files $uri /index.php$uri$is_args$args; 

     ---

123. # Optional: Don't log access to other assets 

     ---

124. access_log off; 

     ---

125. } 

     ---

126. } 

     ---

Set ownership on /usr/share/webapps/nextcloud

$ sudo chown http:http -R /usr/share/webapps/nextcloud

Generate /etc/webapps/nextcloud/config/php.config

$ cd /usr/share/webapps/nextcloud
$ sudo -u http php occ maintenance:install --database
"mysql" --database-host “localhost:/var/run/mysqld/mysqld.sock” --database-name “nextcloud” --database-user “nextcloud” --database-pass
"xxxx" --admin-user “llwang” --admin-pass “xxxx”

Import server.crt in ‘opera or chrome’

1. 选项-->高级设置-->管理证书-->导入 

   ---

$ opera “https://xxx.com:8080”

---

nicephil@gmail.com