CentOS7 安装Nextcloud17

快来打我* 2023-06-02 09:29 14阅读 0赞

# CentOS7 安装Nextcloud17 #

> nextcloud是继承owncloud后的开源项目，并且跨各大平台，提供安卓、Mac、window、IOS等平台应用。  
> 安装参考：[docs.nextcloud.com][]  
> 安装参考

# 0.搭建环境说明 #

> 因为计划在CentOS系统下运行多个应用，所以方案选择会有一点不同。  
> 详细组成：
> 
>  *  Nginx 1.16.1
>  *  MySql 5.7.27
>  *  Redis 5.0.6
>  *  PHP 7.2.23 (fpm-fcgi)  
>     还有就是，赋予部署用户是pi，需要自行创建该用户。

# 1.安装基础环境 #

> 安装基础依赖和工具。

yum install -y epel-release yum-utils unzip curl wget \
    bash-completion policycoreutils-python mlocate bzip2

## 1.1安装MySql ##

> 安装教程：[CentOS 7 安装MySql][CentOS 7 _MySql]  
> 下面建一个`nextcloud`数据库。

# 进入myql
    mysql -u root -p
    
    create database nextcloud;          
    
    # 设置超强密码！！
    create user nextcloud@'%' identified by '****************';
    
    grant all privileges on nextcloud.* to nextcloud@'%' identified by '****************';
    
    flush privileges;
    quit;

## 1.2安装Redis ##

> 安装教程：[CentOS7 安装 redis][CentOS7 _ redis]

## 1.3安装PHP ##

> PHP需要集成较多的依赖，安装会比较繁琐。

#yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
    yum-config-manager --enable remi-php72
    
    yum -y install php php-common php-opcache php-mcrypt php-cli php-gd php-curl php-mysql php-mbstring php-intl php-pecl-apcu php-mysqlnd php-pecl-redis php-imagick  php-fpm php-zip php-xml php-process php-pear php-pdo php-json php-devel php-xmlrpc php-soap php-ldap
    
    
    # 配置PHP-FPM
    vi /etc/php-fpm.d/www.conf
    
    # 将用户和组都改为pi
    user = pi                         
    group = pi
    
    # 注意：php-fpm所监听的端口为9000
    listen = 127.0.0.1:9000
    
    # 去掉下面几行注释
    env[HOSTNAME] = $HOSTNAME
    env[PATH] = /usr/local/bin:/usr/bin:/bin
    env[TMP] = /tmp
    env[TMPDIR] = /tmp
    env[TEMP] = /tmp
    
    
    # 增加php内存
    vi /etc/php.ini
    # 每个脚本可以消耗的时间，单位也是秒
    max_input_time = 60
    
    # 脚本运行最大消耗的内存
    memory_limit = 4096M
    
    # 上载文件的最大许可大小
    upload_max_filesize = 4096M
    
    
    # 进入缓存设置
    vi /etc/php.d/10-opcache.ini
    opcache.enable=1
    opcache.interned_strings_buffer=8
    opcache.max_accelerated_files=10000
    opcache.memory_consumption=128
    opcache.save_comments=1
    opcache.revalidate_freq=1
    # -------END--------
    
    # 在/var/lib目录下为session路径创建一个新的文件夹，并将用户名和组设为nginx
    mkdir -p /var/lib/php/session
    chown pi:pi -R /var/lib/php/session/

> 重启：`systemctl restart php-fpm`  
> 开机自启：`systemctl enable php-fpm`

## 1.4安装Nginx ##

> 安装教程：[CentOS7 安装Nginx][CentOS7 _Nginx]  
> 配置参考：[Nginx configuration][]

> 安装完nginx后，首先为`Nextcloud`生成自签名SSL证书，如果有就不需要自己生成，拷贝到对应目录下就好。

# 创建证书目录
    mkdir -p /etc/nginx/cert
    
    openssl req -new -x509 -days 365 -nodes -out /etc/nginx/cert/1_nextcloud.kioye.cn_bundle.crt -keyout /etc/nginx/cert/2_nextcloud.kioye.cn.key
    # 修改权限
    chmod 700 /etc/nginx/cert
    chmod 600 /etc/nginx/cert/*

> 配置nginx。

# 进入nextcloud.conf编辑状态
    vi /etc/nginx/conf.d/nextcloud.conf
    
    upstream php-handler { 
        server 127.0.0.1:9000;
        #server unix:/var/run/php/php7.2-fpm.sock;
    }
    
    server { 
        listen 80;
        listen [::]:80;
        server_name nextcloud.kioye.cn;
        # enforce https
        return 301 https://$server_name:443$request_uri;
    }
    
    server { 
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name nextcloud.kioye.cn;
    
        # Use Mozilla's guidelines for SSL/TLS settings
        # https://mozilla.github.io/server-side-tls/ssl-config-generator/
        # NOTE: some settings below might be redundant
        ssl_certificate /etc/nginx/cert/1_nextcloud.kioye.cn_bundle.crt;
        ssl_certificate_key /etc/nginx/cert/2_nextcloud.kioye.cn.key;
    
        # Add headers to serve security related headers
        # Before enabling Strict-Transport-Security headers please read into this
        # topic first.
        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;" always;
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header Referrer-Policy "no-referrer" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Download-Options "noopen" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Permitted-Cross-Domain-Policies "none" always;
        add_header X-Robots-Tag "none" always;
        add_header X-XSS-Protection "1; mode=block" always;
    
        # Remove X-Powered-By, which is an information leak
        fastcgi_hide_header X-Powered-By;
    
        # Path to the root of your installation
        root /var/www/nextcloud/;
    
        location = /robots.txt { 
            allow all;
            log_not_found off;
            access_log off;
        }
    
        # The following 2 rules are only needed for the user_webfinger app.
        # Uncomment it if you're planning to use this app.
        #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
    
        # The following rule is only needed for the Social app.
        # Uncomment it if you're planning to use this app.
        #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
    
        location = /.well-known/carddav { 
          return 301 $scheme://$host:$server_port/remote.php/dav;
        }
        location = /.well-known/caldav { 
          return 301 $scheme://$host:$server_port/remote.php/dav;
        }
    
        # set max upload size
        client_max_body_size 512M;
        fastcgi_buffers 64 4K;
    
        # Enable gzip but do not remove ETag headers
        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
    
        # Uncomment if your server is build with the ngx_pagespeed module
        # This module is currently not supported.
        #pagespeed off;
    
        location / { 
            rewrite ^ /index.php$request_uri;
        }
    
        location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { 
            deny all;
        }
        location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { 
            deny all;
        }
    
        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { 
            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param HTTPS on;
            # Avoid sending the security headers twice
            fastcgi_param modHeadersAvailable true;
            # Enable pretty urls
            fastcgi_param front_controller_active true;
            fastcgi_pass php-handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
        }
    
        location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { 
            try_files $uri/ =404;
            index index.php;
        }
    
        # Adding the cache control header for js, css and map files
        # Make sure it is BELOW the PHP block
        location ~ \.(?:css|js|woff2?|svg|gif|map)$ { 
            try_files $uri /index.php$request_uri;
            add_header Cache-Control "public, max-age=15778463";
            # Add headers to serve security related headers (It is intended to
            # have those duplicated to the ones above)
            # Before enabling Strict-Transport-Security headers please read into
            # this topic first.
            #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
            #
            # WARNING: Only add the preload option once you read about
            # the consequences in https://hstspreload.org/. This option
            # will add the domain to a hardcoded list that is shipped
            # in all major browsers and getting removed from this list
            # could take several months.
            add_header Referrer-Policy "no-referrer" always;
            add_header X-Content-Type-Options "nosniff" always;
            add_header X-Download-Options "noopen" always;
            add_header X-Frame-Options "SAMEORIGIN" always;
            add_header X-Permitted-Cross-Domain-Policies "none" always;
            add_header X-Robots-Tag "none" always;
            add_header X-XSS-Protection "1; mode=block" always;
    
            # Optional: Don't log access to assets
            access_log off;
        }
    
        location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ { 
            try_files $uri /index.php$request_uri;
            # Optional: Don't log access to other assets
            access_log off;
        }
    }

> 重启：`systemctl restart nginx`  
> 开机自启：`systemctl enable nginx`

# 2.安装Nextcloud #

# 先下载
    wget https://download.nextcloud.com/server/releases/nextcloud-17.0.0.zip
    # 解压
    unzip nextcloud-*.zip
    # 移动到指定目录下
    mv nextcloud /var/www/
    # 修改权限
    chown -R pi:pi /var/www/nextcloud

> 关闭防火墙！

# 临时关闭
    setenforce 0
    # 进入编辑
    vi /etc/selinux/config
    # 设置为禁用状态
    SELINUX=disabled
    
    # 关闭并取消开机自启
    systemctl stop firewalld
    systemctl disable firewalld

> 自行修改一下hosts文件。  
> 访问网站：[https://nextcloud.kioye.cn][https_nextcloud.kioye.cn]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2t4d2lueHA_size_16_color_FFFFFF_t_70]

> 初始化完成，查看nextcloud环境状态。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2t4d2lueHA_size_16_color_FFFFFF_t_70 1]

> 初始化后，添加redis缓存。

# 进入编辑状态
    vi /var/www/nextcloud/config/config.php
    # 添加如下内容
      'memcache.distributed' => '\OC\Memcache\Redis',
      'memcache.locking' => '\OC\Memcache\Redis',
      'memcache.local' => '\OC\Memcache\APCu',
      'redis' => array(
        'host' => 'localhost',
        'port' => 6379,
        'password' => '1234',
        'database' => 15,
      ),

> 安装smbclient扩展模块

yum -y install libsmbclient libsmbclient-devel php-smbclient
    pecl install smbclient

# 3.集成onlyoffice #

> onlyOffice服务使用docker安装。所以需要提前安装好docker环境。  
> docker环境安装： [CentOS7下安装docker][CentOS7_docker]  
> nextcloud下的onlyoffice插件：[ONLYOFFICE][]  
> onlyoffice的GitHub：[onlyoffice docker][]

# 下载onlyffice插件
    wget https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v3.0.2/onlyoffice.tar.gz
    
    # 解压
    tar zxvf onlyoffice.tar.gz
    # 移动到apps下
    mv onlyoffice /var/www/nextcloud/apps/
    # 赋权
    chown -R pi:pi /var/www/nextcloud/apps/onlyoffice
    
    # 创建密钥
    mkdir -p /home/pi/onlyoffice/certs
    
    chown -R pi:pi /home/pi/onlyoffice
    chmod 700 /home/pi/onlyoffice
    chmod 600 /home/pi/onlyoffice/*
    
    # 后台运行
    #docker run -i -t -d -p 9300:80 onlyoffice/documentserver
    docker run -i -t -d -p 9300:443 -v /home/pi/onlyoffice/:/var/www/onlyoffice/Data  onlyoffice/documentserver
    
    # 启动正常后，设置开机自启容器
    
    docker update --restart=always xxx

[docs.nextcloud.com]: https://docs.nextcloud.com/server/17/admin_manual/installation/source_installation.html#example-installation-on-centos-7-server
[CentOS 7 _MySql]: https://blog.csdn.net/kxwinxp/article/details/90144508
[CentOS7 _ redis]: https://blog.csdn.net/kxwinxp/article/details/90144387
[CentOS7 _Nginx]: https://blog.csdn.net/kxwinxp/article/details/90698355
[Nginx configuration]: https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html
[https_nextcloud.kioye.cn]: https://nextcloud.com
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2t4d2lueHA_size_16_color_FFFFFF_t_70]: /images/20230601/71b449db798a4b4489543e46ee6bc794.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2t4d2lueHA_size_16_color_FFFFFF_t_70 1]: /images/20230601/7f5fe0a57e7749738c7b8f810c1cc2f4.png
[CentOS7_docker]: https://blog.csdn.net/kxwinxp/article/details/90638043
[ONLYOFFICE]: https://apps.nextcloud.com/apps/onlyoffice
[onlyoffice docker]: https://github.com/ONLYOFFICE/Docker-DocumentServer