nextcloud with nginx install on Archlinux

Archlinux

Modules Install

$ yaourt -S nginx-mainline php-fpm php-gd php-intl php-mcrypt php-apcu nextcloud mariadb syslog-ng

Modules Setup

SYSLOG

$ systemctl enable syslog-ng

$ systemctl restart syslog-ng

PHP

/etc/php/php.ini

date.timezone = Asia/Shanghai

display_errors=On

extension=gd.so

extension=iconv.so

extension=intl.so

extension=mcrypt.so

extension=mysqli.so

zend_extension=opcache.so

extension=pdo_mysql.so

extension=zip.so

[opcache]

opcache.enable=1

opcache.enable_cli=1

/etc/php/conf.d/apcu.ini

extension=apcu.so

[apc]

apc.enable=1

apc.shm_size=32M

apc.ttl=7200

apc.enable_cli=1

MariaDB

$ mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql

$ systemctl enable mariadb

$ systemctl restart mariadb

$ mysql_secure_installation

Nginx

TLS/SSL

$ mkdir /etc/nginx/ssl

$ cd /etc/nginx/ssl

$ openssl req -new -x509 -nodes -newkey rsa:4096 $ -keyout server.key -out server.crt -days 1095

$ chmod 400 server.key

$ chmod 444 server.crt

PHP-FPM

/etc/php/php-fpm.d/www.conf

env[PATH] = /usr/local/bin:/usr/bin:/bin

$ systemctl enable php-fpm

$ systemctl restart php-fpm

NextCloud

Init DB

1. $ mysql -u root -p

   ---

2. mysql> CREATE DATABASE `nextcloud` DEFAULT CHARACTER SET `utf8` COLLATE `utf8_unicode_ci`;

   ---

3. mysql> CREATE USER `nextcloud`@'localhost' IDENTIFIED BY 'xxxxx';

   ---

4. mysql> GRANT ALL PRIVILEGES ON `nextcloud`.* TO `nextcloud`@`localhost`;

   ---

5. mysql> \q

   ---

Nginx

$ mkdir /etc/nginx/conf.d/

$ touch /etc/nginx/conf.d/nextcloud.conf

/etc/nginx/nginx.conf

1. http {

   ---

2. include conf.d/*.conf

   ---

3. ...

   ---

4. }

   ---

/etc/nginx/conf.d/nextcloud.conf

1. upstream php-handler {

   ---

2. #server 127.0.0.1:9000;

   ---

3. server unix:/var/run/php-fpm/php-fpm.sock;

   ---

4. }

   ---

5. ---

6. #server {

   ---

7. # listen 80;

   ---

8. # server_name 45.63.49.131;

   ---

9. # # enforce https

   ---

10. # return 301 https://$server_name$request_uri;

    ---

11. #}

    ---

12. ---

13. server {

    ---

14. listen 8080;

    ---

15. listen 443 ssl http2;

    ---

16. ssl on;

    ---

17. server_name 45.63.49.131;

    ---

18. ---

19. ssl_certificate ssl/server.crt;

    ---

20. ssl_certificate_key ssl/server.key;

    ---

21. ---

22. # Add headers to serve security related headers

    ---

23. # Before enabling Strict-Transport-Security headers please read into this

    ---

24. # topic first.

    ---

25. add_header Strict-Transport-Security "max-age=15768000;

    ---

26. includeSubDomains; preload;";

    ---

27. add_header X-Content-Type-Options nosniff;

    ---

28. add_header X-Frame-Options "SAMEORIGIN";

    ---

29. add_header X-XSS-Protection "1; mode=block";

    ---

30. add_header X-Robots-Tag none;

    ---

31. add_header X-Download-Options noopen;

    ---

32. add_header X-Permitted-Cross-Domain-Policies none;

    ---

33. ---

34. # Path to the root of your installation

    ---

35. root /usr/share/webapps/nextcloud/;

    ---

36. ---

37. location = /robots.txt {

    ---

38. allow all;

    ---

39. log_not_found off;

    ---

40. access_log off;

    ---

41. }

    ---

42. ---

43. # The following 2 rules are only needed for the user_webfinger app.

    ---

44. # Uncomment it if you're planning to use this app.

    ---

45. #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

    ---

46. #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json

    ---

47. # last;

    ---

48. ---

49. location = /.well-known/carddav {

    ---

50. return 301 $scheme://$host/remote.php/dav;

    ---

51. }

    ---

52. location = /.well-known/caldav {

    ---

53. return 301 $scheme://$host/remote.php/dav;

    ---

54. }

    ---

55. ---

56. # set max upload size

    ---

57. client_max_body_size 512M;

    ---

58. fastcgi_buffers 64 4K;

    ---

59. ---

60. # Disable gzip to avoid the removal of the ETag header

    ---

61. gzip off;

    ---

62. ---

63. # Uncomment if your server is build with the ngx_pagespeed module

    ---

64. # This module is currently not supported.

    ---

65. #pagespeed off;

    ---

66. ---

67. error_page 403 /core/templates/403.php;

    ---

68. error_page 404 /core/templates/404.php;

    ---

69. ---

70. location / {

    ---

71. rewrite ^ /index.php$uri;

    ---

72. }

    ---

73. ---

74. location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {

    ---

75. deny all;

    ---

76. }

    ---

77. location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {

    ---

78. deny all;

    ---

79. }

    ---

80. ---

81. location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {

    ---

82. fastcgi_split_path_info ^(.+\.php)(/.*)$;

    ---

83. include fastcgi_params;

    ---

84. fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    ---

85. fastcgi_param PATH_INFO $fastcgi_path_info;

    ---

86. fastcgi_param HTTPS on;

    ---

87. #Avoid sending the security headers twice

    ---

88. fastcgi_param modHeadersAvailable true;

    ---

89. fastcgi_param front_controller_active true;

    ---

90. fastcgi_pass php-handler;

    ---

91. fastcgi_intercept_errors on;

    ---

92. fastcgi_request_buffering off;

    ---

93. }

    ---

94. ---

95. location ~ ^/(?:updater|ocs-provider)(?:$|/) {

    ---

96. try_files $uri/ =404;

    ---

97. index index.php;

    ---

98. }

    ---

99. ---

100. # Adding the cache control header for js and css files

     ---

101. # Make sure it is BELOW the PHP block

     ---

102. location ~* \.(?:css|js|woff|svg|gif)$ {

     ---

103. try_files $uri /index.php$uri$is_args$args;

     ---

104. add_header Cache-Control "public, max-age=7200";

     ---

105. # Add headers to serve security related headers (It is intended to

     ---

106. # have those duplicated to the ones above)

     ---

107. # Before enabling Strict-Transport-Security headers please read into

     ---

108. # this topic first.

     ---

109. # add_header Strict-Transport-Security "max-age=15768000;

     ---

110. # includeSubDomains; preload;";

     ---

111. add_header X-Content-Type-Options nosniff;

     ---

112. add_header X-Frame-Options "SAMEORIGIN";

     ---

113. add_header X-XSS-Protection "1; mode=block";

     ---

114. add_header X-Robots-Tag none;

     ---

115. add_header X-Download-Options noopen;

     ---

116. add_header X-Permitted-Cross-Domain-Policies none;

     ---

117. # Optional: Don't log access to assets

     ---

118. access_log off;

     ---

119. }

     ---

120. ---

121. location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {

     ---

122. try_files $uri /index.php$uri$is_args$args;

     ---

123. # Optional: Don't log access to other assets

     ---

124. access_log off;

     ---

125. }

     ---

126. }

     ---

Set ownership on /usr/share/webapps/nextcloud

$ sudo chown http:http -R /usr/share/webapps/nextcloud

Generate /etc/webapps/nextcloud/config/php.config

$ cd /usr/share/webapps/nextcloud

$ sudo -u http php occ maintenance:install --database

"mysql" --database-host “localhost:/var/run/mysqld/mysqld.sock” --database-name “nextcloud” --database-user “nextcloud” --database-pass

"xxxx" --admin-user “llwang” --admin-pass “xxxx”

Import server.crt in ‘opera or chrome’

1. 选项-->高级设置-->管理证书-->导入

   ---

$ opera “https://xxx.com:8080”

nicephil@gmail.com