小白搭建nextcloud

环境说明

这次搭建 nextcloud 使用的是 centos7.6(1810) 服务器，使用最小化安装

使用的 LNMP 环境搭建

本次操作全程使用的root权限，普通用户注意使用sudo

安装 Nginx

为了大家都能安装成功，同时避免麻烦，所以使用 yum 安装。

配置 epel 源

yum install -y epel-release

安装

yum install -y nginx

安装PHP

添加php的源

rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

安装PHP及必要扩展

yum install -y php70w-devel php70w-pear php70w-pecl php70w-gd php70w-opcache php70w-cli php70w-pdo php70w-process php70w-pecl-apcu php70w-mcrypt php70w-mysql php70w-fpm php70w-pecl-memcached php70w-common php70w-xml php70w-mbstring php70w-pecl-igbinary php70w-json php70w-pecl-apcu-devel  php70w-intl

配置php-fpm

php-fpm默认的使用用户是apache

vim /etc/php-fpm.d/www.conf 

user = nginx                                   //将用户和组都改为nginx
group = nginx
listen = 127.0.0.1:9000
env[HOSTNAME] = $HOSTNAME //将以下几行，去掉注释
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp

为php创建目录

mkdir -p /var/lib/php/session
chown -R nginx:nginx /var/lib/php/session/

安装数据库

其实可以不用安装数据库，但是为了显得我会使用数据库所以还是弄一下

注意数据库版本

5.7以上mysql的数据库初始密码要到log里面找

安装mariadb

我没有使用mysql，centos7以后yum默认使用mariadb作为数据库

yum install -y mariadb mariadb-server mariadb-devel

配置mariadb

默认安装mariadb是没有密码

配置mariadb首先要启动服务

systemctl start mariadb

接下来进入数据库修改root密码，两种方法任选一种

初始化数据库（方法一）

mysql_secure_installation

除了root password 要设置两次密码其他的可以全部回车

直接改密码懒得初始化（方法二）

mysql -u root -p

没有密码直接回车

进入服务器后直接修改密码

set password for root@'localhost' = password('123456');

注意后面的123456就是修改的密码，为了安全请设置八位以上带大小写和特殊的密码。

为服务创建数据库和授权用户

注意：以下所有操作经需进入数据库操作

创建数据库

为nextcloud创建一个数据库

create database nextcloud_db;

创建授权用户

create user nextcloud@'localhost' identified by '123456';
grant all on nextcloud_db.* to nextcloud@'localhost';

也可以用下面的命令一部到位

grant all privileges on nextcloud_db.* to nextclou@localhost identified by 'n123456';

配置SSL证书

我的证书是在阿里云申请的免费证书，你们也可以用下面的方法。

创建整数目录

mkdir /etc/nginx/cert/

不管是自己生成的SSL证书，还是运营商申请的证书，全放在这个目录，方便配置。

自己生成证书

openssl req -new -x509 -days 365 -nodes -out /etc/nginx/cert/nextcloud.crt -keyout /etc/nginx/cert/nextcloud.key

这个证书只能使用一年，要续订可以删掉之前生成的证书，然后再次生成。（这是我猜的）

# 会出现下面的选项需要填写，可以随便填。 

Country Name (2 letter code) [XX]:cn                                           //国家

State or Province Name (full name) []:yunnan                                  //省份

Locality Name (eg, city) [Default City]:yuxi                               //地区名字

Organization Name (eg, company) [Default Company Ltd]:XPSL                     //公司名

Organizational Unit Name (eg, section) []:Technology                           //部门

Common Name (eg, your name or your server's hostname) []:xpsl                 //CA主机名

Email Address []:[email protected]                                                        //Email地址

下载安装nextcloud

下载原文件

官网地址为: https://nextcloud.com/install/

yum install -y wget unzip
wget https://download.nextcloud.com/server/releases/nextcloud-13.0.2.zip
unzip nextcloud-13.0.2.zip

配置网站空间

nextcloud本质是一个php网站，既然这样就等为它配置一个目录。

我的目录设置在 /usr/share/nginx/html 下

mv nextcloud /usr/share/nginx/html
cd !$
mkdir nextcloud/data
chown -R nginx:nginx nextcloud

配置网站nginx虚拟环境

进入nginx配置目录

cd /etc/nginx/conf.d/

添加新网站配置文件

vim nextcloud.conf          # 注意必须以".conf"结尾

复制粘贴下面是内容

upstream php-handler {
    server 127.0.0.1:9000;
    #server unix:/var/run/php5-fpm.sock;
}


server {
    listen 80;
    server_name www.houziyu.topt;       # 这是网站的url
    # enforce https
rewrite ^(.*)$ https://$host$1 permanent;
}


server {
    listen 443 ssl;
    server_name www.houziyu.topt;       # 这是网站的url
    
    # 注意，这里填写的是ssl证书公玥与私玥
    ssl_certificate /etc/nginx/cert/nextcloud.crt;      
    ssl_certificate_key /etc/nginx/cert/nextcloud.key;

    # 这个文件是直接摘抄别人的，具体可以自己看注释。
    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    add_header Strict-Transport-Security "max-age=15768000;
    includeSubDomains; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /usr/share/nginx/html/nextcloud/;


    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }


    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;


    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }


    # set max upload size
    client_max_body_size 10240M; # 上传文件最大限制，php.ini中也要修改，最后优化时会提及。
    fastcgi_buffers 64 4K;

    # Disable gzip to avoid the removal of the ETag header
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;


    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;


    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;


    location / {
        rewrite ^ /index.php$uri;
    }


    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
        include fastcgi_params;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }


    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }


    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        add_header Strict-Transport-Security "max-age=15768000;includeSubDomains; preload;";
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

修改ngnix默认配置

vim /etc/nginx/nginx.conf 

注释 默认server

#   server {
#       listen       80 default_server;
#       listen       [::]:80 default_server;
#       server_name  _;
#       root         /usr/share/nginx/html;

#       # Load configuration files for the default server block.
#       include /etc/nginx/default.d/*.conf;

#       location / {
#       }

#       error_page 404 /404.html;
#           location = /40x.html {
#       }

#       error_page 500 502 503 504 /50x.html;
#           location = /50x.html {
#       }
#   }

nginx配置检查

nginx -t

如果出现

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

那就可以进行下一步

启动服务并开启开机自启

systemctl start nginx
systemctl enable nginx
systemctl start php-fpm
systemctl enable php-fpm
systemctl start mariadb
systemctl enable mariadb

打开服务端口防火墙

检查是否启动firewall服务

systemctl status firewalld

打开80和443端口，数据库使用的是本地数据库可以不用设置防火墙。

firewall-cmd --add-port=80/tcp --permanent
firewall-cmd --add-port=443/tcp --permanent
firewall-cmd --reload

关闭selinux

因为不会用还是关了算了

vim /etc/selinux/config

SELINUX=disabled    (添加这句话写在中间)

网页设置nextcloud

看视频，有道云笔记不能上传图片，我也没有办法。