As the title states. This solution is without the use of docker. It is just a straight forward installation of Nextcloud 18.0.3 on OMV 5 using Nginx (php-fpm) with PHP 7.3 that is already installed and MariaDB as our database server. In order to work on port 80 or port 443, we will have to change the OMV web ports to 8080 and 8443. You can achieve this via “General settings” on the OMV web interface. This guide asumes that Nextcloud will user ports TCP/80 and TCP/443. Everything that is marked RED, needs your attention.
Let’s start with some packages.
apt install mariadb-server php-xml php-cli php-cgi php-mysql php-mbstring php-gd php-curl php-zip wget unzip php-imagick php-intl -y
Download nextcloud and place it on folder /var/www
cd /usr/src wget https://download.nextcloud.com/server/releases/nextcloud-18.0.4.zip unzip nextcloud-18.0.4.zip mv nextcloud /var/www/ chown -R www-data:www-data /var/www/nextcloud/ chmod -R 755 /var/www/nextcloud/
Now, we have to create a new pool on the fpm, in order to adjust php settings for nextcloud and not mess up the OMV web part.
nano /etc/php/7.3/fpm/pool.d/nextcloud.conf
[nextcloud]
user = www-data
group = www-data
listen = /run/php/php7.3-fpm-nextcloud.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0600
pm = dynamic
pm.max_children = 120
pm.start_servers = 12
pm.min_spare_servers = 6
pm.max_spare_servers = 18
chdir = /
php_value[include_path] = ".:/usr/share/php:/var/www/nextcloud"
php_value[upload_max_filesize] = 512M
php_value[post_max_size] = 512M
php_value[max_execution_time] = 300
php_value[date.timezone] = Europe/Athens
php_value[expose_php] = Off
php_value[memory_limit] = 512M
env[PATH] = /usr/local/bin:/usr/bin:/bin
To improve performance we have to enable opcache and use redis
nano /etc/php/7.3/fpm/conf.d/10-opcache.ini configuration for php opcache module ; priority=10 zend_extension=opcache.so opcache.enable=1 opcache.enable_cli=1 opcache.interned_strings_buffer=8 opcache.max_accelerated_files=10000 opcache.memory_consumption=128 opcache.save_comments=1 opcache.revalidate_freq=1
Install redis and make changes to config.php.
apt-get install redis-server php-redis systemctl start redis-server systemctl enable redis-server
nano /var/www/nextcloud/config/config.php 'memcache.local' => '\\OC\\Memcache\\Redis', 'memcache.locking' => '\\OC\\Memcache\\Redis', 'redis' => array( 'host' => 'localhost', 'port' => '6379', ),
Set up our database.
systemctl enable mariadb
mysql_secure_installation
mysql -u root -p
CREATE DATABASE nextclouddb;
CREATE USER 'nextclouduser'@'localhost' IDENTIFIED BY 'changeme';
GRANT ALL ON nextclouddb.* TO 'nextclouduser'@'localhost';
FLUSH PRIVILEGES;
EXIT;
Then we have to create a server block from Nginx. This block has SSL enabled so prior to that, you should have SSL certificates created. I point out in bold where changes must be made and also where the SSL certificates should be declared.
nano /etc/nginx/sites-available/nextcloud
server {
server_name myserver.mydomain.com;
root /var/www/nextcloud;
index index.php;
autoindex off;
server_tokens off;
sendfile on;
error_log /var/log/nginx/nextcloud_error.log error;
access_log /var/log/nginx/nextcloud_access.log combined;
error_page 404 = /404.php;
location /404.html {
internal;
}
# Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this
# topic first.
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
add_header X-Frame-Options SAMEORIGIN;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
# The following rule is only needed for the Social app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
# The following 2 rules are only needed for the user_webfinger app.
location = /.well-known/carddav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host:$server_port/remote.php/dav;
}
# set max upload size
client_max_body_size 512M;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
location / {
rewrite ^ /index.php;
}
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all;
}
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on;
fastcgi_read_timeout 300s;
# Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
# Enable pretty urls
fastcgi_param front_controller_active true;
fastcgi_pass unix:/run/php/php7.3-fpm-nextcloud.sock;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js, css and map files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
add_header X-Frame-Options SAMEORIGIN;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
try_files $uri /index.php$request_uri;
# Optional: Don't log access to other assets
access_log off;
}
listen [::]:80 default_server ipv6only=off;
if ($scheme = http) {
# Force redirection to HTTPS.
return 301 https://$host:443$request_uri;
}
listen [::]:443 default_server ipv6only=off ssl deferred;
ssl_certificate /etc/ssl/certs/nextcloud.crt;
ssl_certificate_key /etc/ssl/private/nextcloud.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
ssl_ecdh_curve "X25519:secp384r1:prime256v1";
}
Let’s enable the above block.
cd /etc/nginx/sites-enabled ln -s ../sites-available/nextcloud nextcloud
For the Nextcloud storage location, I used a folder on my RAID storage. The installation of Nextcloud, asks for data storage path. By default, it places data files inside /var/www/nextcloud. You can skip this step, if you don’t want to change the default storage path.
mkdir /srv/dev-disk-by-id-md-name/cloud chown www-data:www-data /srv/dev-disk-by-id-md-name/cloud
Restart some services
systemctl restart nginx systemctl restart php7.3-fpm
Begin the installation on https://yourserveripaddress
For any additions or suggestions, please leave a comment below
(No Ratings Yet)
Loading...