阿里云centos7 LNMP环境搭建nextcloud个人网盘

NextCloud是开源网盘，具有丰富的文件管理分享功能，支持修改LOGO，可以作为自己的私人网盘使用。

准备工作

阿里云ECS服务器(CentOS7.2 64bit 1核/1G/1M)，比较卡顿，推荐升级到1核/2G/3M

开始配置

1：阿里云服务器添加安全组，允许访问22(ssh协议端口)和80(http协议端口)，443(ssl协议)端口
控制台->云服务器ECS->安全组->配置规则，允许访问以下端口

2：服务器防火墙允许访问22，80，443端口，并且重新启用(或者直接关闭防火墙,不建议)

sudo firewall-cmd --zone=public --add-port=443/tcp --permanent
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
如果防火墙没有启用，则出现如下打印，此时可以直接进行第三步。

重启防火墙
sudo systemctl restart firewalld

3: 安装nginx并设置开机启动

安装
sudo yum update
sudo yum install nginx

设置开机启动
sudo systemctl start nginx
sudo systemctl enable nginx

验证安装是否成功
浏览器输入:IP地址后回车，看到Nginx页面说明安装成功。

4：安装php7.2

添加php7.2的yum源
sudo rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
sudo rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

安装php相关运行时库
sudo yum install -y php72w php72w-devel php72w-pear php72w-pecl php72w-gd php72w-opcache php72w-cli php72w-pdo php72w-process php72w-pecl-apcu php72w-mcrypt php72w-mysql php72w-fpm php72w-pecl-redis php72w-common php72w-xml php72w-mbstring php72w-pecl-igbinary php72w-intl php72w-pecl-imagick

验证安装是否成功：
sudo php -v

设置php开机启动
sudo systemctl start php-fpm
sudo systemctl enable php-fpm

5: 安装配置mysql(mariaDB)

(1)安装mariadb
sudo yum install mariadb mariadb-server mariadb-devel -y

(2)设置开机启动
sudo systemctl start mariadb
sudo systemctl enable mariadb

(3)配置mariadb，为nextcloud添加数据库用户名和数据表
A: 初始化数据库
输入mysql_secure_installation，按回车键设置密码并配置数据库


B: 为nextcloud添加数据库
第一，先输入登录数据库命令
mysql -uroot -p

第二，然后输入密码

第三，接下来新建next_cloud数据库nextcloud_db(数据库名字随便起，但是需要记住这个名字，后面需要)
Create database nextcloud_db default charset=utf8;

第四，然后为nextcloud创建数据库用户(名字随便起，但是需要记住这个名字，后面需要)
Create user nextcloud_user@localhost identified by ‘password’;

第五，允许nextcloud_user用户访问数据库nextcloud_db
Grant all privileges on nextcloud_db.* to nextcloud_user@localhost identified by ‘password’;

第六，刷新授权表，使立即生效

第七(用来确认建好了数据库和响应的数据表)，查看数据库下的用户表：

查看数据库：

第八，使用新建的用户登录，并查看数据库，说明设置正确

6: 将nextcloud放入到nginx的网站目录下

(1)下载nextcloud，（这里使用迅雷下载），然后通过filezilla上传到服务器
第一，在服务器上安装filezilla
sudo yum -y install filezilla

第二，Windows下下载nextcloud14 https://nextcloud.com/changelog/#latest14

第三，将文件上传到服务器之后
通过ftp上传文件到usr/share/nginx/html目录(安装nginx之后，nginx建立的网站目录)下

(2)校验文件后，解压缩到usr/share/nginx/html目录下
第一，校验文件
sha256sum -c nextcloud-14.0.4.zip.sha256 < nextcloud-14.0.4.zip

第二，安装unzip，然后将nextcloud解压到usr/share/nginx/html文件夹下

7，为nextcloud生成证书,记住生成证书的路径(nextcloud的nginx配置文件需要这个路径和名字)
我这里直接参考别人的配置，在/etc/nginx目录下创建了cert文件夹用于防止证书文件

(1)为nginx生成365天的证书：
sudo openssl req -new -x509 -days 1460 -nodes -out /etc/nginx/cert/nextcloud.crt -keyout /etc/nginx/cert/nextcloud.key

8: 配置nginx支持php-fpm

(1)官网上面复制一下nginx的配置文件，另存为nextcloud.conf
nextcloud.conf
https://docs.nextcloud.com/server/16/admin_manual/installation/nginx.html

(2)修改部分内容：
第一：修改主机域名，我这里没有域名，用的是IP地址

第二：修改证书路径

第三：修改root目录为nextcloud目录

第四，将配置文件放入/etc/nginx/conf.d/目录下

9: 修改php-fpm配置文件

(1)修改用户和组为nginx
vim /etc/php-fpm.d/www.conf
修改user和group为nginx

(2)打开环境变量
将这几个环境变量取消注释(默认是被’;'注释掉了)

10: 创建nextcloud的数据目录，并添加权限(php-fpm访问)

sudo mkdir /usr/share/nginx/html/nextcloud/data
chown nginx:nginx -R /usr/share/nginx/html/nextcloud/

11: 其他配置(遇到问题的时候在网上找了很多方式，操作了几次，最后是成功了，但是暂时还不清楚是哪一步骤起作用了)

Nextcloud页面配置完成后，无限重复在登录界面
(1)修改权限（(图片显示的是修改之前的)）
sudo chown nginx:nginx -R /var/lib/php/session/

(2)修改php配置文件的762行，取消注释

12: 最后一步：

重启php-fpm和nginx
sudo systemctl restart php-fpm
sudo systemctl restart nginx

13: 打开浏览器，输入ip地址/nextcloud(例如:192.168.1.10/nextcloud)开始配置网盘

参考配置文件

/etc/nginx/nginx.conf

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  _;
        root         /usr/share/nginx/html;
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        return 404;        

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }

# Settings for a TLS enabled server.
#
#    server {
#        listen       443 ssl http2 default_server;
#        listen       [::]:443 ssl http2 default_server;
#        server_name  _;
#        root         /usr/share/nginx/html;
#
#        ssl_certificate "/etc/pki/nginx/server.crt";
#        ssl_certificate_key "/etc/pki/nginx/private/server.key";
#        ssl_session_cache shared:SSL:1m;
#        ssl_session_timeout  10m;
#        ssl_ciphers HIGH:!aNULL:!MD5;
#        ssl_prefer_server_ciphers on;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#
#        location / {
#        }
#
#        error_page 404 /404.html;
#            location = /40x.html {
#        }
#
#        error_page 500 502 503 504 /50x.html;
#            location = /50x.html {
#        }
#    }

}

/etc/nginx/conf.d/nextcloud.conf

upstream php-handler {
    server 127.0.0.1:9000;
    #server unix:/var/run/php/php7.2-fpm.sock;
}

server {
    listen 80;
    listen [::]:80;
    server_name www.baidu.com;
    location / {
    root /usr/share/nginx/html;
    index index.html;
    }

    location /nextcloud {
        return 301 https://$server_name:443$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name 192.168.1.10;   

    location = / {
        #root /usr/share/nginx/html;
        proxy_pass http://www.baidu.com;
        #return 502;
    }

    # Use Mozilla's guidelines for SSL/TLS settings
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
    # NOTE: some settings below might be redundant
    ssl_certificate /etc/nginx/cert/nextcloud.crt;
    ssl_certificate_key /etc/nginx/cert/nextcloud.key;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    #
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Remove X-Powered-By, which is an information leak
    fastcgi_hide_header X-Powered-By;

    # Path to the root of your installation
    root /usr/share/nginx/html/nextcloud;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

    # The following rule is only needed for the Social app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/webfinger /public.php?service=webfinger last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$request_uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        # Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        # Enable pretty urls
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$request_uri;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

其它问题(有问题就看LOG文件)

在调试过程中查看nginx的log文件，发现很多错误(别人的域名解析到了我们的主机，找不到对应页面)，这是由于自己的主机被别人恶意解析了。

处理方式：用站长之家，查看IP是否被别人的域名指向，如果是，那么修改Nginx配置页面，添加return 404那一行，防止别人恶意解析，然后重新导入nginx配置文件

sudo nginx -s reload

参考资料

主要参考

环境： nextcloud 安装系统要求

mariadb配置部分，以及php安装部分: CentOS7下NextCloud搭建

php-fpm配置(很详细): Nextcloud私有云部署

参考了nextcloud下载配置，目录权限修改等: CentOS 7 安装 NextCloud

其它

CentOS7安装Nextcloud13 使用（Nginx+MariaDB+PHP）
nextcloud 登陆不了，无限循环
CentOS 7终端命令行方式安装FileZilla（★firecat亲测有效★）

centos添加用户并赋予管理员权限
Nginx 配置文件, 配置代理，配置跳转，重定向

nginx配置location总结及简单案例

nginx配置文件http、server、location指的是什么？

Nginx配置try_files实践二

Nextcloud上的一些常见报错及解决方案

暂时未修改

[PHP] - 性能加速 - 开启opcache
nginx access.log清空
Nginx 防止被域名恶意解析的方法
nginx限制恶意IP处理方法