Май 2020 - Информационный портал GUWi.ru

Установка Nextcloud на CentOS 8 используя скрипт. Nginx.

Для автоматической установки Nextcloud на CentOS 8 необходимо создать скрипт

nano avto_nextcloud_v01.sh

1	nano avto_nextcloud_v01.sh

#!/bin/sh
# You MUST set the SERVERNAME here:
SERVERNAME=nextcloud.example.com

# These values are used to generate a ssl certificate.  You can/should replace with LetsEncrypt after the build
COUNTRY=RU
STATE=-
CITY=Kolomna
ORG="Test ORG"
ORG_UNIT=Nextcloud

# This is the name of the database that will get created for nextcloud
DBNAME=nextcloud
# This is the username that is needed for the nextcloud database.  NOTE: This is not a nextcloud user account
USER=nextclouduser
# This is the name of the nextcloud Admin user
ADMIN=administrator

# These values increase the limits for nextcloud:
# BODY sets the client_max_body_size in the nginx nextcloud.conf file
BODY=40960M
# FILESIZE sets the upload_max_filesize in /etc/php.ini
FILESIZE=102400M

# This generates a random password for the root account of mariadb.  You can change it if you wish
MARIADBPASSWORD=`date +%s | sha256sum | base64 | head -c 16`
sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash
# This generates a random password for the nextcloud user account in mariadb.  You can change it if you wish
APPPASSWORD=`date +%s | sha256sum | base64 | head -c 16`
sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash
# This generates a random password for the admin user account password:
ADMINPASS=`date +%s | sha256sum | base64 | head -c 16`

# This will save the values that are needed for setup and accessing mariadb in /root/mariadb.txt
echo -e "MariaDB root password is $MARIADBPASSWORD" >> /root/mariadb.txt
echo -e "App DB is $DBNAME, the Username is $USER and the password is $APPPASSWORD" >> /root/mariadb.txt
# This will save the admin username and password for nextcloud
echo -e "The admin username is $ADMIN and the password is $ADMINPASS" >> /root/nextcloud_admin.txt

##########################################################################
############## NO CHANGES FROM HERE DOWN SHOULD BE REQUIRED ##############
##########################################################################

sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
dnf -y install nginx mariadb-server mariadb php php-mysqlnd php-fpm php-opcache php-gd php-xml php-mbstring wget unzip php-common php-gd php-json php-curl php-zip php-xml php-mbstring php-bz2 php-intl php-process apcu-panel php-pecl-apcu
sed -i 's/user\ =\ apache/user\ =\ nginx/g' /etc/php-fpm.d/www.conf
sed -i 's/group\ =\ apache/group\ =\ nginx/g' /etc/php-fpm.d/www.conf
sed -i "s/upload_max_filesize = 2M/upload_max_filesize = $FILESIZE/g" /etc/php.ini
sed -i 's/opcache.max_accelerated_files=4000/opcache.max_accelerated_files=10000/g' /etc/php.d/10-opcache.ini
echo "opcache.revalidate_freq=1" >> /etc/php.d/10-opcache.ini
sed -i 's/memory_limit\ =\ 128M/memory_limit\ =\ 512M/g' /etc/php.ini

echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php-fpm.d/www.conf
systemctl enable nginx --now
systemctl enable mariadb --now
systemctl enable php-fpm --now
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
chown nginx:nginx /usr/share/nginx/html -R
mkdir /etc/nginx/ssl
openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout /etc/nginx/ssl/nextcloud.key -out /etc/nginx/ssl/nextcloud.crt -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORG/OU=$ORG_UNIT/CN=$SERVERNAME"
cat << EOF >> /tmp/setup.sql
SET PASSWORD FOR 'root'@'localhost' = PASSWORD('$MARIADBPASSWORD');
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
CREATE DATABASE $DBNAME DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER $USER@localhost IDENTIFIED BY '$APPPASSWORD';
GRANT ALL PRIVILEGES ON $DBNAME.* TO $USER@localhost;
FLUSH PRIVILEGES;
quit
EOF
mysql -u root < /tmp/setup.sql
wget https://download.nextcloud.com/server/releases/latest-18.zip
unzip latest-18.zip -d /usr/share/nginx/
chown nginx:nginx /usr/share/nginx/nextcloud/ -R
cat << EOF >> /etc/nginx/conf.d/nextcloud.conf
server {
    #listen 80;
    listen 443 ssl;

    server_name $SERVERNAME;
    ssl_certificate /etc/nginx/ssl/nextcloud.crt;
    ssl_certificate_key /etc/nginx/ssl/nextcloud.key;

    # Add headers to serve security related headers
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header Referrer-Policy no-referrer;

    #I found this header is needed on Debian/Ubuntu/CentOS/RHEL, but not on Arch Linux.
    add_header X-Frame-Options "SAMEORIGIN";

    # Path to the root of your installation
    root /usr/share/nginx/nextcloud/;

    access_log /var/log/nginx/nextcloud.access;
    error_log /var/log/nginx/nextcloud.error;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
        return 301 \$scheme://\$host/remote.php/dav;
    }
    location = /.well-known/caldav {
       return 301 \$scheme://\$host/remote.php/dav;
    }

    location ~ /.well-known/acme-challenge {
      allow all;
    }

    # set max upload size
    client_max_body_size $BODY;
    fastcgi_buffers 64 4K;

    # Disable gzip to avoid the removal of the ETag header
    gzip off;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;

    location / {
       rewrite ^ /index.php\$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
       deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
       deny all;
     }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
       include fastcgi_params;
       fastcgi_split_path_info ^(.+\.php)(/.*)$;
       fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
       fastcgi_param PATH_INFO \$fastcgi_path_info;
       #Avoid sending the security headers twice
       fastcgi_param modHeadersAvailable true;
       fastcgi_param front_controller_active true;
       fastcgi_pass unix:/run/php-fpm/www.sock;
       fastcgi_intercept_errors on;
       fastcgi_request_buffering off;
       fastcgi_send_timeout 3600;
       fastcgi_read_timeout 3600;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
       try_files \$uri/ =404;
       index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
        try_files \$uri /index.php\$uri\$is_args\$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
   }

   location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
        try_files \$uri /index.php\$uri\$is_args\$args;
        # Optional: Don't log access to other assets
        access_log off;
   }
}
EOF
systemctl reload nginx
setsebool -P httpd_execmem 1
systemctl reload php-fpm
chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud/ -R
setsebool -P httpd_can_network_connect 1
setfacl -R -m u:nginx:rwx /var/lib/php/opcache/
setfacl -R -m u:nginx:rwx /var/lib/php/session/
setfacl -R -m u:nginx:rwx /var/lib/php/wsdlcache/
mkdir /usr/share/nginx/nextcloud-data
chown nginx:nginx /usr/share/nginx/nextcloud-data -R
chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud-data/ -R
cd /usr/share/nginx/nextcloud/
sudo -u nginx php occ  maintenance:install --database "mysql" --database-name "$DBNAME"  --database-user "$USER" --database-pass "$APPPASSWORD" --admin-user "$ADMIN" --admin-pass "$ADMINPASS" --data-dir "/usr/share/nginx/nextcloud-data"
sed -i '$d' /usr/share/nginx/nextcloud/config/config.php
# I put three \\\ in the below echo file because \ needs to be escaped out.  The result is two \\
echo "  'memcache.local' => '\\\OC\\\Memcache\\\APCu'," >> /usr/share/nginx/nextcloud/config/config.php
echo ");" >> /usr/share/nginx/nextcloud/config/config.php
# For some reason, when you configure nextcloud from the command line, you need to modify trusted_domains
sed -i "s/0 => 'localhost/0 => '*/g" /usr/share/nginx/nextcloud/config/config.php
cat /root/nextcloud_admin.txt

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

#!/bin/sh

# You MUST set the SERVERNAME here:

SERVERNAME=nextcloud.example.com

# These values are used to generate a ssl certificate. You can/should replace with LetsEncrypt after the build

COUNTRY=RU

STATE=-

CITY=Kolomna

ORG="Test ORG"

ORG_UNIT=Nextcloud

# This is the name of the database that will get created for nextcloud

DBNAME=nextcloud

# This is the username that is needed for the nextcloud database. NOTE: This is not a nextcloud user account

USER=nextclouduser

# This is the name of the nextcloud Admin user

ADMIN=administrator

# These values increase the limits for nextcloud:

# BODY sets the client_max_body_size in the nginx nextcloud.conf file

BODY=40960M

# FILESIZE sets the upload_max_filesize in /etc/php.ini

FILESIZE=102400M

# This generates a random password for the root account of mariadb. You can change it if you wish

MARIADBPASSWORD=`date +%s | sha256sum | base64 | head -c 16`

sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash

# This generates a random password for the nextcloud user account in mariadb. You can change it if you wish

APPPASSWORD=`date +%s | sha256sum | base64 | head -c 16`

sleep 1 # We need to sleep 1 to change the password, otherwise we end up with the same hash

# This generates a random password for the admin user account password:

ADMINPASS=`date +%s | sha256sum | base64 | head -c 16`

# This will save the values that are needed for setup and accessing mariadb in /root/mariadb.txt

echo -e "MariaDB root password is $MARIADBPASSWORD" >> /root/mariadb.txt

echo -e "App DB is $DBNAME, the Username is $USER and the password is $APPPASSWORD" >> /root/mariadb.txt

# This will save the admin username and password for nextcloud

echo -e "The admin username is $ADMIN and the password is $ADMINPASS" >> /root/nextcloud_admin.txt

##########################################################################

############## NO CHANGES FROM HERE DOWN SHOULD BE REQUIRED ##############

##########################################################################

sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

dnf -y install nginx mariadb-server mariadb php php-mysqlnd php-fpm php-opcache php-gd php-xml php-mbstring wget unzip php-common php-gd php-json php-curl php-zip php-xml php-mbstring php-bz2 php-intl php-process apcu-panel php-pecl-apcu

sed -i 's/user\ =\ apache/user\ =\ nginx/g' /etc/php-fpm.d/www.conf

sed -i 's/group\ =\ apache/group\ =\ nginx/g' /etc/php-fpm.d/www.conf

sed -i "s/upload_max_filesize = 2M/upload_max_filesize = $FILESIZE/g" /etc/php.ini

sed -i 's/opcache.max_accelerated_files=4000/opcache.max_accelerated_files=10000/g' /etc/php.d/10-opcache.ini

echo "opcache.revalidate_freq=1" >> /etc/php.d/10-opcache.ini

sed -i 's/memory_limit\ =\ 128M/memory_limit\ =\ 512M/g' /etc/php.ini

echo "env[PATH] = /usr/local/bin:/usr/bin:/bin" >> /etc/php-fpm.d/www.conf

systemctl enable nginx --now

systemctl enable mariadb --now

systemctl enable php-fpm --now

firewall-cmd --permanent --add-service=https

firewall-cmd --reload

chown nginx:nginx /usr/share/nginx/html -R

mkdir /etc/nginx/ssl

openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout /etc/nginx/ssl/nextcloud.key -out /etc/nginx/ssl/nextcloud.crt -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORG/OU=$ORG_UNIT/CN=$SERVERNAME"

cat << EOF >> /tmp/setup.sql

SET PASSWORD FOR 'root'@'localhost' = PASSWORD('$MARIADBPASSWORD');

DELETE FROM mysql.user WHERE User='';

DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');

DROP DATABASE IF EXISTS test;

DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';

CREATE DATABASE $DBNAME DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

CREATE USER $USER@localhost IDENTIFIED BY '$APPPASSWORD';

GRANT ALL PRIVILEGES ON $DBNAME.* TO $USER@localhost;

FLUSH PRIVILEGES;

quit

EOF

mysql -u root < /tmp/setup.sql

wget https://download.nextcloud.com/server/releases/latest-18.zip

unzip latest-18.zip -d /usr/share/nginx/

chown nginx:nginx /usr/share/nginx/nextcloud/ -R

cat << EOF >> /etc/nginx/conf.d/nextcloud.conf

server {

#listen 80;

listen 443 ssl;

server_name $SERVERNAME;

ssl_certificate /etc/nginx/ssl/nextcloud.crt;

ssl_certificate_key /etc/nginx/ssl/nextcloud.key;

# Add headers to serve security related headers

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

add_header Referrer-Policy no-referrer;

#I found this header is needed on Debian/Ubuntu/CentOS/RHEL, but not on Arch Linux.

add_header X-Frame-Options "SAMEORIGIN";

# Path to the root of your installation

root /usr/share/nginx/nextcloud/;

access_log /var/log/nginx/nextcloud.access;

error_log /var/log/nginx/nextcloud.error;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# The following 2 rules are only needed for the user_webfinger app.

# Uncomment it if you're planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json

# last;

location = /.well-known/carddav {

return 301 \$scheme://\$host/remote.php/dav;

}

location = /.well-known/caldav {

return 301 \$scheme://\$host/remote.php/dav;

}

location ~ /.well-known/acme-challenge {

allow all;

}

# set max upload size

client_max_body_size $BODY;

fastcgi_buffers 64 4K;

# Disable gzip to avoid the removal of the ETag header

gzip off;

# Uncomment if your server is build with the ngx_pagespeed module

# This module is currently not supported.

#pagespeed off;

error_page 403 /core/templates/403.php;

error_page 404 /core/templates/404.php;

location / {

rewrite ^ /index.php\$uri;

}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {

deny all;

}

location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {

deny all;

}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {

include fastcgi_params;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;

fastcgi_param PATH_INFO \$fastcgi_path_info;

#Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

fastcgi_param front_controller_active true;

fastcgi_pass unix:/run/php-fpm/www.sock;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

fastcgi_send_timeout 3600;

fastcgi_read_timeout 3600;

}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {

try_files \$uri/ =404;

index index.php;

}

# Adding the cache control header for js and css files

# Make sure it is BELOW the PHP block

location ~* \.(?:css|js)$ {

try_files \$uri /index.php\$uri\$is_args\$args;

add_header Cache-Control "public, max-age=7200";

# Add headers to serve security related headers (It is intended to

# have those duplicated to the ones above)

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

# Optional: Don't log access to assets

access_log off;

}

location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {

try_files \$uri /index.php\$uri\$is_args\$args;

# Optional: Don't log access to other assets

access_log off;

}

EOF

systemctl reload nginx

setsebool -P httpd_execmem 1

systemctl reload php-fpm

chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud/ -R

setsebool -P httpd_can_network_connect 1

setfacl -R -m u:nginx:rwx /var/lib/php/opcache/

setfacl -R -m u:nginx:rwx /var/lib/php/session/

setfacl -R -m u:nginx:rwx /var/lib/php/wsdlcache/

mkdir /usr/share/nginx/nextcloud-data

chown nginx:nginx /usr/share/nginx/nextcloud-data -R

chcon -t httpd_sys_rw_content_t /usr/share/nginx/nextcloud-data/ -R

cd /usr/share/nginx/nextcloud/

sudo -u nginx php occ maintenance:install --database "mysql" --database-name "$DBNAME" --database-user "$USER" --database-pass "$APPPASSWORD" --admin-user "$ADMIN" --admin-pass "$ADMINPASS" --data-dir "/usr/share/nginx/nextcloud-data"

sed -i '$d' /usr/share/nginx/nextcloud/config/config.php

# I put three \\\ in the below echo file because \ needs to be escaped out. The result is two \\

echo " 'memcache.local' => '\\\OC\\\Memcache\\\APCu'," >> /usr/share/nginx/nextcloud/config/config.php

echo ");" >> /usr/share/nginx/nextcloud/config/config.php

# For some reason, when you configure nextcloud from the command line, you need to modify trusted_domains

sed -i "s/0 => 'localhost/0 => '*/g" /usr/share/nginx/nextcloud/config/config.php

cat /root/nextcloud_admin.txt

и запустить скрипт командой

sh avto_nextcloud_v01.sh

1	sh avto_nextcloud_v01.sh