协同办公是目前比较流行的办公方式。Web office就是一种很好的选择,通过Web office 你可以选择在
任何时间任何地点与团队进行协作。本教程介绍如何使用Nextcloud和ONLYOFFICE构建一个私有的web
Office办公环境,实现文档的实时管理、编辑和协作。这种基于开源和自托管的工具都提供了极高的安全
特性来保持文档的私密性,并同时拥有云盘的功能。
实现Nextcloud与ONLYOFFICE的组合有以下三种形式:
1,安装独立的Nextcloud服务器和独立的ONLYOFFICE服务器,再将二者进行融合。
2,使用Docker compose安装Nextcloud并与ONLYOFFICE集成在一起。
3,使用Univention app appliance来部署包含Univention Server、Nextcloud和ONLYOFFICE的VM。
这里我们独立安装nectcloud,onlyoffice.(在不同的服务器上安装)域名都要https的而且必须是机构加密的证书。
首先安装nectcloud,我用的环境是lnmp安装的nectcloud-16.0.3(PHP版本必须7.1以上)
LNMP安装我就不说了,直接贴nginx的配置
upstream php-handler {
#server 127.0.0.1:9000;
server unix:/dev/shm/php-cgi.sock;
}
server {
listen 80;
listen [::]:80;
server_name nexcloud.test.com;
enforce https
#return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name nexcloud.test.com;
Use Mozilla’s guidelines for SSL/TLS settings
https://mozilla.github.io/server-side-tls/ssl-config-generator/
NOTE: some settings below might be redundant
ssl_certificate /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.key;
Add headers to serve security related headers
Before enabling Strict-Transport-Security headers please read into this
topic first.
add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;
#
WARNING: Only add the preload option once you read about
the consequences in https://hstspreload.org/. This option
will add the domain to a hardcoded list that is shipped
in all major browsers and getting removed from this list
could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
Path to the root of your installation
root /data/wwwroot/nexcloud.test.com;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
The following 2 rules are only needed for the user_webfinger app.
Uncomment it if you’re planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
set max upload size
client_max_body_size 512M;
fastcgi_buffers 64 4K;
Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
Uncomment if your server is build with the ngx_pagespeed module
This module is currently not supported.
#pagespeed off;
location / {
rewrite ^ /index.php$request_uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+).php(?:$|/) {
fastcgi_split_path_info ^(.+?.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
Adding the cache control header for js and css files
Make sure it is BELOW the PHP block
location ~ .(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control “public, max-age=15778463”;
Add headers to serve security related headers (It is intended to
have those duplicated to the ones above)
Before enabling Strict-Transport-Security headers please read into
this topic first.
add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;
#
WARNING: Only add the preload option once you read about
the consequences in https://hstspreload.org/. This option
will add the domain to a hardcoded list that is shipped
in all major browsers and getting removed from this list
could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
Optional: Don’t log access to assets
access_log off;
}
location ~ .(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;
Optional: Don’t log access to other assets
access_log off;
}
}
这里nectcloud就安装完成了。
第二步安装onlyoffice
/etc/selinux/config
禁止SELINUX=disabled
systemctl stop firewalld
systemctl disable firewalld
curl -sL https://rpm.nodesource.com/setup_6.x | sudo bash –
yum -y install gcc-c++ make
yum -y install nodejs
/etc/yum.repos.d/nginx.repo添加nginx源
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1
yum install -y epel-release
yum install postgresql postgresql-server -y
postgresql-setup initdb
systemctl enable postgresql
/var/lib/pgsql/data/pg_hba.conf 修改
host all all 127.0.0.1/32 trust
host all all ::1/128 trust
systemctl start postgresql
sudo -u postgres psql -c “CREATE DATABASE onlyoffice;”
sudo -u postgres psql -c “CREATE USER onlyoffice WITH password ‘onlyoffice’;”
sudo -u postgres psql -c “GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;”
yum -y install redis
systemctl start redis
systemctl enable redis
yum -y install rabbitmq-server
systemctl start rabbitmq-server
systemctl enable rabbitmq-server
yum -y install https://downloads.sourceforge.net/project/mscorefonts2/rpms/msttcore-fonts-installer-2.6-1.noarch.rpm
rpm –import “http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x8320CA65CB2DE8E5”
[onlyoffice]
name=onlyoffice repo
baseurl=http://download.onlyoffice.com/repo/centos/main/noarch/
gpgcheck=0
enabled=1
yum -y install onlyoffice-documentserver
systemctl start supervisord
systemctl enable supervisord
systemctl start nginx
systemctl enable nginx
bash documentserver-configure.sh
For Postgresql
Host: localhost
Database: onlyoffice
User: onlyoffice
Password: onlyoffice
For Redis
Host: localhost
For RabbitMQ
Host: localhost
User: guest
Password: guest
http://localhost or http://
修改nginx支持https
vim /etc/onlyoffice/documentserver/nginx/ds.conf
贴出我的nginx配置
include /etc/nginx/includes/http-common.conf;
server {
listen 0.0.0.0:80;
listen [::]:80 default_server;
server_name onlyoffice.test.com;
server_tokens off;
include /etc/nginx/includes/ds-*.conf;
location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}
}
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ssl default_server;
server_name onlyoffice.test.com;
server_tokens off;
#root /var/www/onlyoffice/documentserver;
Strong SSL Security
https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
#ssl on;
ssl_certificate /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.key;
ssl_verify_client off;
ssl_ciphers “EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH”;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security max-age=31536000;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}
include /etc/nginx/includes/ds-*.conf;
}
https://域名,如图说明安装成功