nextcloud私有云盘部署小计

考虑到项目组成员增加，工作内容和人物的加重，组内工作文档的统一管理提上日程。平台采用nextcloud开源平台，并通过成员分组的方式进行统一管理

版本信息

• 操作系统： centos7 x86-64
• mariadb: 5.5.56-MariaDB
• php: PHP 7.0.31
• nginx: nginx/1.12.2
• nextcloud: nextcloud-13.0.5

安装过程

nginx

yum的epel源

yum install -y epel-release
yum install nginx

启动

systemctl start nginx
systemctl enable nginx

mariadb

随着mysql被甲骨文收购，越来越多的人开始投向了mariadb，一来是完全开源命令通用，还有就是centos7仓库中预置了5.5版本的mariadb~

更换国内yum仓库：

cd /etc/yum.repos.d
mv CentOS-Base.repo CentOS-Base.repo.bak
wget -O CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
yum clean all && yum makecache

安装db（检查是否已安装）:

yum install mariadb-server mariadb
systemctl start mariadb
systemctl enable mariadb

设置密码：

echo 'skip-grant-tables' >> /etc/my.cnf
systemctl restart mariadb
mysql -u root

MariaDB [(none)]> use mysql;
MariaDB [mysql]> select user, password, host from user;
MariaDB [mysql]> update user set password=password('your_pswd') where User="root" and Host="localhost";
MariaDB [mysql]> flush privileges;
MariaDB [mysql]> exit

注释/etc/my.cnf最后一行，重启db：

systemctl restart mariadb
systemctl enable mariadb

php及其依赖插件

安装epel和remi源

yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm

安装php

yum install yum-utils
yum-config-manager --enable remi-php70   [Install PHP 7.0]
yum-config-manager --enable remi-php71   [Install PHP 7.1]
yum-config-manager --enable remi-php72   [Install PHP 7.2]

安装扩展

yum install php php-mcrypt php-cli php-gd php-curl php-mysql php-ldap php-zip php-fileinfo \
php-devel php-pear php-gd php-opcache php-cli php-pdo php-process php-pecl-apcu php-mcrypt \
php-mysql php-fpm php-pecl-memcached php-common php-xml php-mbstring php-pecl-igbinary-devel

启动&&自启动

systemctl start php-fpm
systemctl status php-fpm
systemctl enable php-fpm

自签名ssl证书

mkdir /etc/nginx/cert/
cd /etc/nginx/cert/
openssl req -new -x509 -days 365 -nodes -out /etc/nginx/cert/nextcloud.crt \
        -keyout /etc/nginx/cert/nextcloud.key

给权限

chmod 600 /etc/nginx/cert/*
chmod 700 /etc/nginx/cert

下载Nextcloud

13.0.2版本

cd /opt
wget https://download.nextcloud.com/server/releases/nextcloud-13.0.5.zip
unzip nextcloud-13.0.5.zip
cd /usr/share/nginx/html
# 这步操作比较骚气，谨慎操作
rm -rf *
cp -R /opt/nextcloud/* .
chown -R nginx:nginx /usr/share/nginx/html/

配置php和nginx

php-fpm

vim /etc/php-fpm.d/www.conf
-------------------------------------
user = nginx                                   //将用户和组都改为nginx
group = nginx
listen = 127.0.0.1:9000
env[HOSTNAME] = $HOSTNAME                     //将以下几行，去掉注释
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp
-------------------------------------

# 创建session文件夹
mkdir -p /var/lib/php/session
chown nginx:nginx -R /var/lib/php/session/

nginx

cd /etc/nginx/conf.d/
vim nextcloud.conf
-------------------------------------
upstream php-handler {
    server 127.0.0.1:9000;
    #server unix:/var/run/php5-fpm.sock;
}
 
 
server {
    listen 80;
    server_name localhost;
    # enforce https
    rewrite ^(.*)$ https://$host$1 permanent;
}
 
 
server {
    listen 443 ssl;
    server_name localhost;
 
    ssl_certificate /etc/nginx/cert/nextcloud.crt;
    ssl_certificate_key /etc/nginx/cert/nextcloud.key;
 
    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    add_header Strict-Transport-Security "max-age=15768000;
    includeSubDomains; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
 
    # Path to the root of your installation
    root /usr/share/nginx/html/nextcloud/;
 
 
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
 
 
    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;
 
 
    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }
 
 
    # set max upload size
    client_max_body_size 10240M;    # 上传文件最大限制，php.ini中也要修改，最后优化时会提及。
    fastcgi_buffers 64 4K;
 
    # Disable gzip to avoid the removal of the ETag header
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 
 
    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;
 
 
    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;
 
 
    location / {
        rewrite ^ /index.php$uri;
    }
 
 
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }
 
    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
        include fastcgi_params;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }
 
 
    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }
 
 
    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        add_header Strict-Transport-Security "max-age=15768000;includeSubDomains; preload;";
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }
 
    location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}
-------------------------------------

# 注释掉默认配置文件里的80端口模块
vim /etc/nginx/nginx.conf
-------------------------------------
    #server {
    #    listen       80 default_server;
    #    listen       [::]:80 default_server;
    #    server_name  _;
    #    root         /usr/share/nginx/html;

    #    # Load configuration files for the default server block.
    #    include /etc/nginx/default.d/*.conf;

    #    location / {
    #    }

    #    error_page 404 /404.html;
    #        location = /40x.html {
    #    }

    #    error_page 500 502 503 504 /50x.html;
    #        location = /50x.html {
    #    }
    #}
-------------------------------------

关掉selinux

setenforce 0
sed -i "s/=enforcing/=disabled/g" /etc/selinux/config

web访问&&安装

默认80，访问10.10.2.187
一切顺利的话成功进入登陆页面（不顺利应该是php扩展的原因，再调试）：

性能调整

admin用户登陆后页面上方会有警告提示，根据提示进行更改就好...

php

php.ini

vim /etc/php.ini
---------------------------------------------
[PHP]
# 添加如下配置
opcache.enable=1
opcache.enable_cli=1
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

upload_max_filesize = 10240M  #上传大小限制
---------------------------------------------

缓存后端--memcache

yum install -y memcache
vim /etc/sysconfig/memcached
---------------------------------------------
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="2048"
OPTIONS=""
---------------------------------------------

nextcloud添加memcache缓存配置

vim /usr/share/nginx/html/config/config.php
---------------------------------------------
'memcache.local' => '\OC\Memcache\APCu',
  'memcache.distributed' => '\OC\Memcache\Memcached',
  'memcached_servers' => array(
   array('localhost', 11211),
    ),
---------------------------------------------

重启

systemctl restart memcached
systemctl enable memcached

权限管理

按不同成员不同组和设置组文件夹的方式来提供共享空间。

=======================================================

1、更改数据目录

原来使用根目录，大小只有40G，不够用了，目前重新分区100G，并修改

• 旧目录：Nextcloud_data（可能已经被删掉）
• 新目录：Nextcloud

由于使用人数不多，不必激活维护模式（后来发现是扯淡，最好激活维护模式），直接停止服务，copy数据目录即可，而后重启nginx
注意：数据目录下有两个隐藏文件，也要一并复制过去，否则报错

• .htaccess
• .ocdata

=========================================================

2、更新版本

13.. --- 15.0.7

出现了一系列问题，在此先说一下升级一定要注意的事情：

• 备份数据目录
• 备份配置文件 config.php
• 备份mysql数据库
• 备份前一定要转换为维护模式
• 养成定期备份的习惯

这次是2019/04/20这几天升级了15.0.7版本出现的一系列问题，做一下记录：

这次出现的问题：升级之后，所有组文件夹、public目录文件和部分个人目录下的文件无法显示；查看数据目录，发现很多文件都在files_versions里，而files目录里大都是空的。

整个过程脑子有点懵：

• 显示怀疑15版本源码问题，导致了数据不显示
• 而后想到由于mysql数据库没有做备份，会不会是数据索引都在mysql里，从而导致文件索引不到？
• 最后怀疑文件丢失，然后开始了漫长的手动补救，，，

很重要的两点：

• 首先数据做了备份，数据肯定不会丢失
• 其次大都是组文件夹不显示，八成是组文件夹应用的问题

最后证明，mysql一切正常，数据不显示是组问价夹没有启用导致的；因为再数据备份过程中查看回显，一切数据都在；中途发现文件都在files_versions里，而files目录中为空，怀疑是文件丢失，事实证明这就是nextcloud的存储逻辑，都是正常的，不过是因为应用没有启用，导致文件不显示而已，，，

15.0.7版本性能优化

Enabling MySQL 4-byte support

启用MySQL四字节支持