时间戳

首页 > 技术文章 > nextcloud with nginx install on Archlinux

nextcloud with nginx install on Archlinux

nicephil 2017-03-12 09:55 原文

nextcloud with nginx install on Archlinux

Archlinux

Modules Install

$ yaourt -S nginx-mainline php-fpm php-gd php-intl php-mcrypt php-apcu nextcloud mariadb syslog-ng

Modules Setup

SYSLOG

$ systemctl enable syslog-ng
$ systemctl restart syslog-ng

PHP

/etc/php/php.ini

date.timezone = Asia/Shanghai
display_errors=On
extension=gd.so
extension=iconv.so
extension=intl.so
extension=mcrypt.so
extension=mysqli.so
zend_extension=opcache.so
extension=pdo_mysql.so
extension=zip.so
[opcache]
opcache.enable=1
opcache.enable_cli=1

/etc/php/conf.d/apcu.ini

extension=apcu.so
[apc]
apc.enable=1
apc.shm_size=32M
apc.ttl=7200
apc.enable_cli=1

MariaDB

$ mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql
$ systemctl enable mariadb
$ systemctl restart mariadb
$ mysql_secure_installation

Nginx

TLS/SSL

$ mkdir /etc/nginx/ssl
$ cd /etc/nginx/ssl
$ openssl req -new -x509 -nodes -newkey rsa:4096 $ -keyout server.key -out server.crt -days 1095
$ chmod 400 server.key
$ chmod 444 server.crt

PHP-FPM

/etc/php/php-fpm.d/www.conf

env[PATH] = /usr/local/bin:/usr/bin:/bin

$ systemctl enable php-fpm
$ systemctl restart php-fpm

NextCloud

Init DB

  1. $ mysql -u root -p 
  2. mysql> CREATE DATABASE `nextcloud` DEFAULT CHARACTER SET `utf8` COLLATE `utf8_unicode_ci`; 
  3. mysql> CREATE USER `nextcloud`@'localhost' IDENTIFIED BY 'xxxxx'; 
  4. mysql> GRANT ALL PRIVILEGES ON `nextcloud`.* TO `nextcloud`@`localhost`; 
  5. mysql> \q 

Nginx

$ mkdir /etc/nginx/conf.d/
$ touch /etc/nginx/conf.d/nextcloud.conf

/etc/nginx/nginx.conf

  1. http { 
  2. include conf.d/*.conf 
  3. ... 
  4. } 

/etc/nginx/conf.d/nextcloud.conf

  1. upstream php-handler { 
  2. #server 127.0.0.1:9000; 
  3. server unix:/var/run/php-fpm/php-fpm.sock; 
  4. } 
  5.  
  6. #server { 
  7. # listen 80; 
  8. # server_name 45.63.49.131; 
  9. # # enforce https 
  10. # return 301 https://$server_name$request_uri; 
  11. #} 
  12.  
  13. server { 
  14. listen 8080; 
  15. listen 443 ssl http2; 
  16. ssl on; 
  17. server_name 45.63.49.131; 
  18.  
  19. ssl_certificate ssl/server.crt; 
  20. ssl_certificate_key ssl/server.key; 
  21.  
  22. # Add headers to serve security related headers 
  23. # Before enabling Strict-Transport-Security headers please read into this 
  24. # topic first. 
  25. add_header Strict-Transport-Security "max-age=15768000; 
  26. includeSubDomains; preload;"; 
  27. add_header X-Content-Type-Options nosniff; 
  28. add_header X-Frame-Options "SAMEORIGIN"; 
  29. add_header X-XSS-Protection "1; mode=block"; 
  30. add_header X-Robots-Tag none; 
  31. add_header X-Download-Options noopen; 
  32. add_header X-Permitted-Cross-Domain-Policies none; 
  33.  
  34. # Path to the root of your installation 
  35. root /usr/share/webapps/nextcloud/; 
  36.  
  37. location = /robots.txt { 
  38. allow all; 
  39. log_not_found off; 
  40. access_log off; 
  41. } 
  42.  
  43. # The following 2 rules are only needed for the user_webfinger app. 
  44. # Uncomment it if you're planning to use this app. 
  45. #rewrite ^/.well-known/host-meta /public.php?service=host-meta last; 
  46. #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json 
  47. # last; 
  48.  
  49. location = /.well-known/carddav { 
  50. return 301 $scheme://$host/remote.php/dav; 
  51. } 
  52. location = /.well-known/caldav { 
  53. return 301 $scheme://$host/remote.php/dav; 
  54. } 
  55.  
  56. # set max upload size 
  57. client_max_body_size 512M; 
  58. fastcgi_buffers 64 4K; 
  59.  
  60. # Disable gzip to avoid the removal of the ETag header 
  61. gzip off; 
  62.  
  63. # Uncomment if your server is build with the ngx_pagespeed module 
  64. # This module is currently not supported. 
  65. #pagespeed off; 
  66.  
  67. error_page 403 /core/templates/403.php; 
  68. error_page 404 /core/templates/404.php; 
  69.  
  70. location / { 
  71. rewrite ^ /index.php$uri; 
  72. } 
  73.  
  74. location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { 
  75. deny all; 
  76. } 
  77. location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { 
  78. deny all; 
  79. } 
  80.  
  81. location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) { 
  82. fastcgi_split_path_info ^(.+\.php)(/.*)$; 
  83. include fastcgi_params; 
  84. fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; 
  85. fastcgi_param PATH_INFO $fastcgi_path_info; 
  86. fastcgi_param HTTPS on; 
  87. #Avoid sending the security headers twice 
  88. fastcgi_param modHeadersAvailable true; 
  89. fastcgi_param front_controller_active true; 
  90. fastcgi_pass php-handler; 
  91. fastcgi_intercept_errors on; 
  92. fastcgi_request_buffering off; 
  93. } 
  94.  
  95. location ~ ^/(?:updater|ocs-provider)(?:$|/) { 
  96. try_files $uri/ =404; 
  97. index index.php; 
  98. } 
  99.  
  100. # Adding the cache control header for js and css files 
  101. # Make sure it is BELOW the PHP block 
  102. location ~* \.(?:css|js|woff|svg|gif)$ { 
  103. try_files $uri /index.php$uri$is_args$args; 
  104. add_header Cache-Control "public, max-age=7200"; 
  105. # Add headers to serve security related headers (It is intended to 
  106. # have those duplicated to the ones above) 
  107. # Before enabling Strict-Transport-Security headers please read into 
  108. # this topic first. 
  109. # add_header Strict-Transport-Security "max-age=15768000; 
  110. # includeSubDomains; preload;"; 
  111. add_header X-Content-Type-Options nosniff; 
  112. add_header X-Frame-Options "SAMEORIGIN"; 
  113. add_header X-XSS-Protection "1; mode=block"; 
  114. add_header X-Robots-Tag none; 
  115. add_header X-Download-Options noopen; 
  116. add_header X-Permitted-Cross-Domain-Policies none; 
  117. # Optional: Don't log access to assets 
  118. access_log off; 
  119. } 
  120.  
  121. location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ { 
  122. try_files $uri /index.php$uri$is_args$args; 
  123. # Optional: Don't log access to other assets 
  124. access_log off; 
  125. } 
  126. } 

Set ownership on /usr/share/webapps/nextcloud

$ sudo chown http:http -R /usr/share/webapps/nextcloud

Generate /etc/webapps/nextcloud/config/php.config

$ cd /usr/share/webapps/nextcloud
$ sudo -u http php occ maintenance:install --database
"mysql" --database-host “localhost:/var/run/mysqld/mysqld.sock” --database-name “nextcloud” --database-user “nextcloud” --database-pass
"xxxx" --admin-user “llwang” --admin-pass “xxxx”

Import server.crt in ‘opera or chrome’

  1. 选项-->高级设置-->管理证书-->导入 

$ opera “https://xxx.com:8080”

nicephil@gmail.com

推荐阅读