协同办公是目前比较流行的办公方式。Web office就是一种很好的选择,通过Web office 你可以选择在
任何时间任何地点与团队进行协作。本教程介绍如何使用Nextcloud和ONLYOFFICE构建一个私有的web
Office办公环境,实现文档的实时管理、编辑和协作。这种基于开源和自托管的工具都提供了极高的安全
特性来保持文档的私密性,并同时拥有云盘的功能。

实现Nextcloud与ONLYOFFICE的组合有以下三种形式:
1,安装独立的Nextcloud服务器和独立的ONLYOFFICE服务器,再将二者进行融合。
2,使用Docker compose安装Nextcloud并与ONLYOFFICE集成在一起。
3,使用Univention app appliance来部署包含Univention Server、Nextcloud和ONLYOFFICE的VM。

这里我们独立安装nectcloud,onlyoffice.(在不同的服务器上安装)域名都要https的而且必须是机构加密的证书。
首先安装nectcloud,我用的环境是lnmp安装的nectcloud-16.0.3(PHP版本必须7.1以上)
LNMP安装我就不说了,直接贴nginx的配置
upstream php-handler {
#server 127.0.0.1:9000;
server unix:/dev/shm/php-cgi.sock;
}

server {
listen 80;
listen [::]:80;
server_name nexcloud.test.com;

enforce https

#return 301 https://$server_name$request_uri;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name nexcloud.test.com;

Use Mozilla’s guidelines for SSL/TLS settings

https://mozilla.github.io/server-side-tls/ssl-config-generator/

NOTE: some settings below might be redundant

ssl_certificate /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.key;

Add headers to serve security related headers

Before enabling Strict-Transport-Security headers please read into this

topic first.

add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;

#

WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option

will add the domain to a hardcoded list that is shipped

in all major browsers and getting removed from this list

could take several months.

add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;

Remove X-Powered-By, which is an information leak

fastcgi_hide_header X-Powered-By;

Path to the root of your installation

root /data/wwwroot/nexcloud.test.com;

location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

The following 2 rules are only needed for the user_webfinger app.

Uncomment it if you’re planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}

set max upload size

client_max_body_size 512M;
fastcgi_buffers 64 4K;

Enable gzip but do not remove ETag headers

gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

Uncomment if your server is build with the ngx_pagespeed module

This module is currently not supported.

#pagespeed off;

location / {
rewrite ^ /index.php$request_uri;
}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) {
deny all;
}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+).php(?:$|/) {
fastcgi_split_path_info ^(.+?.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}

Adding the cache control header for js and css files

Make sure it is BELOW the PHP block

location ~ .(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control “public, max-age=15778463”;

Add headers to serve security related headers (It is intended to

have those duplicated to the ones above)

Before enabling Strict-Transport-Security headers please read into

this topic first.

add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;

#

WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option

will add the domain to a hardcoded list that is shipped

in all major browsers and getting removed from this list

could take several months.

add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;

Optional: Don’t log access to assets

access_log off;
}

location ~ .(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;

Optional: Don’t log access to other assets

access_log off;
}
}
这里nectcloud就安装完成了。
第二步安装onlyoffice
/etc/selinux/config
禁止SELINUX=disabled
systemctl stop firewalld
systemctl disable firewalld
curl -sL https://rpm.nodesource.com/setup_6.x | sudo bash –
yum -y install gcc-c++ make
yum -y install nodejs

/etc/yum.repos.d/nginx.repo添加nginx源

[nginx]

name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

yum install -y epel-release
yum install postgresql postgresql-server -y
postgresql-setup initdb

systemctl enable postgresql
/var/lib/pgsql/data/pg_hba.conf 修改
host all all 127.0.0.1/32 trust

host all all ::1/128 trust

systemctl start postgresql

sudo -u postgres psql -c “CREATE DATABASE onlyoffice;”
sudo -u postgres psql -c “CREATE USER onlyoffice WITH password ‘onlyoffice’;”
sudo -u postgres psql -c “GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;”

yum -y install redis
systemctl start redis
systemctl enable redis

yum -y install rabbitmq-server
systemctl start rabbitmq-server
systemctl enable rabbitmq-server

yum -y install https://downloads.sourceforge.net/project/mscorefonts2/rpms/msttcore-fonts-installer-2.6-1.noarch.rpm

rpm –import “http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x8320CA65CB2DE8E5”

[onlyoffice]
name=onlyoffice repo
baseurl=http://download.onlyoffice.com/repo/centos/main/noarch/
gpgcheck=0
enabled=1

yum -y install onlyoffice-documentserver

systemctl start supervisord
systemctl enable supervisord
systemctl start nginx
systemctl enable nginx

bash documentserver-configure.sh

For Postgresql
Host: localhost
Database: onlyoffice
User: onlyoffice
Password: onlyoffice
For Redis
Host: localhost
For RabbitMQ
Host: localhost
User: guest
Password: guest

http://localhost or http://;
修改nginx支持https
vim /etc/onlyoffice/documentserver/nginx/ds.conf

贴出我的nginx配置

include /etc/nginx/includes/http-common.conf;
server {
listen 0.0.0.0:80;
listen [::]:80 default_server;
server_name onlyoffice.test.com;
server_tokens off;
include /etc/nginx/includes/ds-*.conf;
location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}
}
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ssl default_server;
server_name onlyoffice.test.com;
server_tokens off;
#root /var/www/onlyoffice/documentserver;

Strong SSL Security

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

#ssl on;
ssl_certificate /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.key;
ssl_verify_client off;

ssl_ciphers “EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH”;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache builtin:1000 shared:SSL:10m;

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=31536000;

add_header X-Frame-Options SAMEORIGIN;

add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}

include /etc/nginx/includes/ds-*.conf;
}
https://域名,如图说明安装成功

onlyoffice+nectcloud在线协同作业_第1张图片
onlyoffice+nectcloud在线协同作业_第2张图片

onlyoffice+nectcloud在线协同作业_第3张图片

onlyoffice+nectcloud在线协同作业_第4张图片
上传个文件测试在线打开

可以打开编辑 而且,可以同时几个编辑一个文件,协同作业很好用.
onlyoffice+nectcloud在线协同作业_第5张图片