NGINX) на свой сервер + приятный бонус

Дек 15, 2018 | By Вячеслав Ш.

Для тех, кому паранойя не дает спокойно спать и повсюду кажутся коварные агенты спец.служб, желающие завладеть вашими фотками, ниже будет представлен гайд по развертыванию своего собственного сервера Nextcloud (в данном случае, совсем свежего релиза под номером 15).

Исходные данные:

У вас уже есть где развернуть сервер, если нет, самое время арендовать.
Установленный дистрибутив Debian 9.x 64Bit / Ubuntu 18.04 TLS 64Bit
Проброшенные на этот сервер порты 80 и 443
Сеть в приведенном примере 192.168.0.0/24
Домен в приведенном примере mydomain.com

Процесс:

Первым делом

apt update &amp;&amp; apt upgrade -y

1	apt update && apt upgrade -y

Так, как мне удобнее пользоваться mcedit, ставим MC, везде, где требуется править конфиг, я буду использовать mcedit, если вы предпочитаете что-то другое, не забудьте поменять mcedit на предпочитаемый редактор

apt install mc -y

1	apt install mc -y

Устанавливаем NGINX

Debian

cd /usr/local/src/
apt install apt-transport-https lsb-release ca-certificates software-properties-common zip unzip dirmngr screen curl ffmpeg libfile-fcntllock-perl ssl-cert -y
apt remove nginx nginx-common nginx-full -y --allow-change-held-packages
sed -i '$adeb [arch=amd64] http://nginx.org/packages/mainline/debian/ stretch nginx' /etc/apt/sources.list
sed -i '$adeb [arch=amd64] http://mirror2.hs-esslingen.de/mariadb/repo/10.3/debian stretch main' /etc/apt/sources.list
sed -i '$adeb https://packages.sury.org/php/ stretch main' /etc/apt/sources.list
wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
wget http://nginx.org/keys/nginx_signing.key &amp;&amp; apt-key add nginx_signing.key
apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xF1656F24C74CD1D8
apt update &amp;&amp; apt install nginx -y

cd /usr/local/src/

apt install apt-transport-https lsb-release ca-certificates software-properties-common zip unzip dirmngr screen curl ffmpeg libfile-fcntllock-perl ssl-cert -y

apt remove nginx nginx-common nginx-full -y --allow-change-held-packages

sed -i '$adeb [arch=amd64] http://nginx.org/packages/mainline/debian/ stretch nginx' /etc/apt/sources.list

sed -i '$adeb [arch=amd64] http://mirror2.hs-esslingen.de/mariadb/repo/10.3/debian stretch main' /etc/apt/sources.list

sed -i '$adeb https://packages.sury.org/php/ stretch main' /etc/apt/sources.list

wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg

wget http://nginx.org/keys/nginx_signing.key && apt-key add nginx_signing.key

apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xF1656F24C74CD1D8

apt update && apt install nginx -y

Ubuntu

sudo -s
cd /usr/local/src
mv /etc/apt/sources.list /etc/apt/sources.list.bak &amp;&amp; touch /etc/apt/sources.list
cat &lt;&lt;EOF &gt;&gt;/etc/apt/sources.list
deb http://archive.ubuntu.com/ubuntu bionic main multiverse restricted universe
deb http://archive.ubuntu.com/ubuntu bionic-security main multiverse restricted universe
deb http://archive.ubuntu.com/ubuntu bionic-updates main multiverse restricted universe
deb [arch=amd64] http://nginx.org/packages/mainline/ubuntu/ bionic nginx
deb [arch=amd64] http://mirror2.hs-esslingen.de/mariadb/repo/10.3/ubuntu bionic main
EOF
wget http://nginx.org/keys/nginx_signing.key &amp;&amp; apt-key add nginx_signing.key
apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0xF1656F24C74CD1D8
apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install software-properties-common zip unzip screen curl ffmpeg libfile-fcntllock-perl -y
add-apt-repository ppa:certbot/certbot -y &amp;&amp; apt update &amp;&amp; apt upgrade -y &amp;&amp; apt install letsencrypt ssl-cert -y
apt remove nginx nginx-common nginx-full -y --allow-change-held-packages
apt install nginx -y

sudo -s

cd /usr/local/src

mv /etc/apt/sources.list /etc/apt/sources.list.bak && touch /etc/apt/sources.list

cat <<EOF >>/etc/apt/sources.list

deb http://archive.ubuntu.com/ubuntu bionic main multiverse restricted universe

deb http://archive.ubuntu.com/ubuntu bionic-security main multiverse restricted universe

deb http://archive.ubuntu.com/ubuntu bionic-updates main multiverse restricted universe

deb [arch=amd64] http://nginx.org/packages/mainline/ubuntu/ bionic nginx

deb [arch=amd64] http://mirror2.hs-esslingen.de/mariadb/repo/10.3/ubuntu bionic main

EOF

wget http://nginx.org/keys/nginx_signing.key && apt-key add nginx_signing.key

apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0xF1656F24C74CD1D8

apt update && apt upgrade -y && apt install software-properties-common zip unzip screen curl ffmpeg libfile-fcntllock-perl -y

add-apt-repository ppa:certbot/certbot -y && apt update && apt upgrade -y && apt install letsencrypt ssl-cert -y

apt remove nginx nginx-common nginx-full -y --allow-change-held-packages

apt install nginx -y

Debian/Ubuntu

systemctl enable nginx.service &amp;&amp; apt-mark hold nginx

1	systemctl enable nginx.service && apt-mark hold nginx

Если позже потребуется обновить NGINX, достаточно выполнить следующее:

apt-mark unhold nginx &amp;&amp; apt upgrade -y &amp;&amp; apt-mark hold nginx

1	apt-mark unhold nginx && apt upgrade -y && apt-mark hold nginx

Настройка конфигурации NGINX

сохраняем резервную копию стандартного конфига NGINX и создаем новый пустой конфиг:

mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak &amp;&amp; mcedit /etc/nginx/nginx.conf

1	mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak && mcedit /etc/nginx/nginx.conf

Вставляем в конфиг следующее содержимое, не забыв изменить сеть на свою, если требуется и сохраняем новый конфиг:

set_real_ip_from 192.168.0.0/24;

user www-data;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
multi_accept on;
use epoll;
}
http {
server_names_hash_bucket_size 64;
upstream php-handler {
server unix:/run/php/php7.2-fpm.sock;
}
set_real_ip_from 127.0.0.1;
set_real_ip_from 192.168.0.0/24;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
include /etc/nginx/mime.types;
#include /etc/nginx/proxy.conf;
#include /etc/nginx/ssl.conf;
#include /etc/nginx/header.conf;
#include /etc/nginx/optimization.conf;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" '
'"$host" sn="$server_name" '
'rt=$request_time '
'ua="$upstream_addr" us="$upstream_status" '
'ut="$upstream_response_time" ul="$upstream_response_length" '
'cs=$upstream_cache_status' ;
access_log /var/log/nginx/access.log main;
sendfile on;
send_timeout 3600;
tcp_nopush on;
tcp_nodelay on;
open_file_cache max=500 inactive=10m;
open_file_cache_errors on;
keepalive_timeout 65;
reset_timedout_connection on;
server_tokens off;
resolver 208.67.222.222 valid=30s;
resolver_timeout 5s;
include /etc/nginx/conf.d/*.conf;
}

user www-data;

worker_processes auto;

error_log /var/log/nginx/error.log warn;

pid /var/run/nginx.pid;

events {

worker_connections 1024;

multi_accept on;

use epoll;

}

http {

server_names_hash_bucket_size 64;

upstream php-handler {

server unix:/run/php/php7.2-fpm.sock;

}

set_real_ip_from 127.0.0.1;

set_real_ip_from 192.168.0.0/24;

real_ip_header X-Forwarded-For;

real_ip_recursive on;

include /etc/nginx/mime.types;

#include /etc/nginx/proxy.conf;

#include /etc/nginx/ssl.conf;

#include /etc/nginx/header.conf;

#include /etc/nginx/optimization.conf;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for" '

'"$host" sn="$server_name" '

'rt=$request_time '

'ua="$upstream_addr" us="$upstream_status" '

'ut="$upstream_response_time" ul="$upstream_response_length" '

'cs=$upstream_cache_status' ;

access_log /var/log/nginx/access.log main;

sendfile on;

send_timeout 3600;

tcp_nopush on;

tcp_nodelay on;

open_file_cache max=500 inactive=10m;

open_file_cache_errors on;

keepalive_timeout 65;

reset_timedout_connection on;

server_tokens off;

resolver 208.67.222.222 valid=30s;

resolver_timeout 5s;

include /etc/nginx/conf.d/*.conf;

}

Перезапускаем NGINX:

service nginx restart

1	service nginx restart

Создаем нужные папки и применяем права:

mkdir -p /var/nc_data /var/www/letsencrypt /usr/local/tmp/cache /usr/local/tmp/sessions /usr/local/tmp/apc /upload_tmp
chown -R www-data:www-data /upload_tmp /var/nc_data /var/www
chown -R www-data:root /usr/local/tmp/sessions /usr/local/tmp/cache /usr/local/tmp/apc

mkdir -p /var/nc_data /var/www/letsencrypt /usr/local/tmp/cache /usr/local/tmp/sessions /usr/local/tmp/apc /upload_tmp

chown -R www-data:www-data /upload_tmp /var/nc_data /var/www

chown -R www-data:root /usr/local/tmp/sessions /usr/local/tmp/cache /usr/local/tmp/apc

Устанавливаем PHP

Debian

apt install apt-transport-https lsb-release ca-certificates -y
apt install php7.2-fpm php7.2-gd php7.2-mysql php7.2-curl php7.2-xml php7.2-zip php7.2-intl php7.2-mbstring php7.2-json php7.2-bz2 php7.2-ldap php-apcu imagemagick php-imagick -y

1 2	apt install apt-transport-https lsb-release ca-certificates -y apt install php7.2-fpm php7.2-gd php7.2-mysql php7.2-curl php7.2-xml php7.2-zip php7.2-intl php7.2-mbstring php7.2-json php7.2-bz2 php7.2-ldap php-apcu imagemagick php-imagick -y

Ubuntu

apt install php7.2-fpm php7.2-gd php7.2-mysql php7.2-curl php7.2-xml php7.2-zip php7.2-intl php7.2-mbstring php7.2-json php7.2-bz2 php7.2-ldap php-apcu imagemagick php-imagick php-smbclient -y

1	apt install php7.2-fpm php7.2-gd php7.2-mysql php7.2-curl php7.2-xml php7.2-zip php7.2-intl php7.2-mbstring php7.2-json php7.2-bz2 php7.2-ldap php-apcu imagemagick php-imagick php-smbclient -y

На этом установка PHP 7.2 закончена, остается проверить системное время:

date

date

и если вы видите не то, что ожидали, исправить это, установив нужный часовой пояс, в моем случае это Новосибирск:

timedatectl set-timezone Asia/Novosibirsk

1	timedatectl set-timezone Asia/Novosibirsk

Настойка конфигурации PHP:

Debian/Ubuntu

cp /etc/php/7.2/fpm/pool.d/www.conf /etc/php/7.2/fpm/pool.d/www.conf.bak
cp /etc/php/7.2/cli/php.ini /etc/php/7.2/cli/php.ini.bak
cp /etc/php/7.2/fpm/php.ini /etc/php/7.2/fpm/php.ini.bak
cp /etc/php/7.2/fpm/php-fpm.conf /etc/php/7.2/fpm/php-fpm.conf.bak
sed -i "s/;env\[HOSTNAME\] = /env[HOSTNAME] = /" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/;env\[TMP\] = /env[TMP] = /" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/;env\[TMPDIR\] = /env[TMPDIR] = /" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/;env\[TEMP\] = /env[TEMP] = /" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/;env\[PATH\] = /env[PATH] = /" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/pm.max_children = .*/pm.max_children = 240/" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/pm.start_servers = .*/pm.start_servers = 20/" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/pm.min_spare_servers = .*/pm.min_spare_servers = 10/" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/pm.max_spare_servers = .*/pm.max_spare_servers = 20/" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/;pm.max_requests = 500/pm.max_requests = 500/" /etc/php/7.2/fpm/pool.d/www.conf
sed -i "s/output_buffering =.*/output_buffering = 'Off'/" /etc/php/7.2/cli/php.ini
sed -i "s/max_execution_time =.*/max_execution_time = 1800/" /etc/php/7.2/cli/php.ini
sed -i "s/max_input_time =.*/max_input_time = 3600/" /etc/php/7.2/cli/php.ini
sed -i "s/post_max_size =.*/post_max_size = 10240M/" /etc/php/7.2/cli/php.ini
sed -i "s/;upload_tmp_dir =.*/upload_tmp_dir = \/upload_tmp/" /etc/php/7.2/cli/php.ini
sed -i "s/upload_max_filesize =.*/upload_max_filesize = 10240M/" /etc/php/7.2/cli/php.ini
sed -i "s/max_file_uploads =.*/max_file_uploads = 100/" /etc/php/7.2/cli/php.ini
sed -i "s/;date.timezone.*/date.timezone = Europe\/\Berlin/" /etc/php/7.2/cli/php.ini
sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/7.2/cli/php.ini
sed -i "s/;session.save_path =.*/session.save_path = \"N;700;\/usr\/local\/tmp\/sessions\"/" /etc/php/7.2/cli/php.ini
sed -i '$aapc.enable_cli = 1' /etc/php/7.2/cli/php.ini
sed -i "s/memory_limit = 128M/memory_limit = 512M/" /etc/php/7.2/fpm/php.ini
sed -i "s/output_buffering =.*/output_buffering = 'Off'/" /etc/php/7.2/fpm/php.ini
sed -i "s/max_execution_time =.*/max_execution_time = 1800/" /etc/php/7.2/fpm/php.ini
sed -i "s/max_input_time =.*/max_input_time = 3600/" /etc/php/7.2/fpm/php.ini
sed -i "s/post_max_size =.*/post_max_size = 10240M/" /etc/php/7.2/fpm/php.ini
sed -i "s/;upload_tmp_dir =.*/upload_tmp_dir = \/upload_tmp/" /etc/php/7.2/fpm/php.ini
sed -i "s/upload_max_filesize =.*/upload_max_filesize = 10240M/" /etc/php/7.2/fpm/php.ini
sed -i "s/max_file_uploads =.*/max_file_uploads = 100/" /etc/php/7.2/fpm/php.ini
sed -i "s/;date.timezone.*/date.timezone = Europe\/\Berlin/" /etc/php/7.2/fpm/php.ini
sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.enable=.*/opcache.enable=1/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.enable_cli=.*/opcache.enable_cli=1/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=128/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=8/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=10000/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.revalidate_freq=.*/opcache.revalidate_freq=1/" /etc/php/7.2/fpm/php.ini
sed -i "s/;opcache.save_comments=.*/opcache.save_comments=1/" /etc/php/7.2/fpm/php.ini
sed -i "s/;session.save_path =.*/session.save_path = \"N;700;\/usr\/local\/tmp\/sessions\"/" /etc/php/7.2/fpm/php.ini
sed -i "s/;emergency_restart_threshold =.*/emergency_restart_threshold = 10/" /etc/php/7.2/fpm/php-fpm.conf
sed -i "s/;emergency_restart_interval =.*/emergency_restart_interval = 1m/" /etc/php/7.2/fpm/php-fpm.conf
sed -i "s/;process_control_timeout =.*/process_control_timeout = 10s/" /etc/php/7.2/fpm/php-fpm.conf
sed -i '$aapc.enabled=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.file_update_protection=2' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.optimization=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.shm_size=256M' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.include_once_override=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.shm_segments=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.ttl=7200' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.user_ttl=7200' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.gc_ttl=3600' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.num_files_hint=1024' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.enable_cli=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.max_file_size=5M' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.cache_by_default=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.use_request_time=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.slam_defense=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.mmap_file_mask=/usr/local/tmp/apc.XXXXXX' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.stat_ctime=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.canonicalize=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.write_lock=1' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.report_autofilter=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.rfc1867=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.rfc1867_prefix =upload_' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.rfc1867_name=APC_UPLOAD_PROGRESS' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.rfc1867_freq=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.rfc1867_ttl=3600' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.lazy_classes=0' /etc/php/7.2/fpm/php.ini
sed -i '$aapc.lazy_functions=0' /etc/php/7.2/fpm/php.ini
sed -i "s/09,39.*/# &amp;/" /etc/cron.d/php
(crontab -l ; echo "09,39 * * * * /usr/lib/php/sessionclean 2&gt;&amp;1") | crontab -u root -

cp /etc/php/7.2/fpm/pool.d/www.conf /etc/php/7.2/fpm/pool.d/www.conf.bak

cp /etc/php/7.2/cli/php.ini /etc/php/7.2/cli/php.ini.bak

cp /etc/php/7.2/fpm/php.ini /etc/php/7.2/fpm/php.ini.bak

cp /etc/php/7.2/fpm/php-fpm.conf /etc/php/7.2/fpm/php-fpm.conf.bak

sed -i "s/;env\[HOSTNAME\] = /env[HOSTNAME] = /" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/;env\[TMP\] = /env[TMP] = /" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/;env\[TMPDIR\] = /env[TMPDIR] = /" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/;env\[TEMP\] = /env[TEMP] = /" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/;env\[PATH\] = /env[PATH] = /" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/pm.max_children = .*/pm.max_children = 240/" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/pm.start_servers = .*/pm.start_servers = 20/" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/pm.min_spare_servers = .*/pm.min_spare_servers = 10/" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/pm.max_spare_servers = .*/pm.max_spare_servers = 20/" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/;pm.max_requests = 500/pm.max_requests = 500/" /etc/php/7.2/fpm/pool.d/www.conf

sed -i "s/output_buffering =.*/output_buffering = 'Off'/" /etc/php/7.2/cli/php.ini

sed -i "s/max_execution_time =.*/max_execution_time = 1800/" /etc/php/7.2/cli/php.ini

sed -i "s/max_input_time =.*/max_input_time = 3600/" /etc/php/7.2/cli/php.ini

sed -i "s/post_max_size =.*/post_max_size = 10240M/" /etc/php/7.2/cli/php.ini

sed -i "s/;upload_tmp_dir =.*/upload_tmp_dir = \/upload_tmp/" /etc/php/7.2/cli/php.ini

sed -i "s/upload_max_filesize =.*/upload_max_filesize = 10240M/" /etc/php/7.2/cli/php.ini

sed -i "s/max_file_uploads =.*/max_file_uploads = 100/" /etc/php/7.2/cli/php.ini

sed -i "s/;date.timezone.*/date.timezone = Europe\/\Berlin/" /etc/php/7.2/cli/php.ini

sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/7.2/cli/php.ini

sed -i "s/;session.save_path =.*/session.save_path = \"N;700;\/usr\/local\/tmp\/sessions\"/" /etc/php/7.2/cli/php.ini

sed -i '$aapc.enable_cli = 1' /etc/php/7.2/cli/php.ini

sed -i "s/memory_limit = 128M/memory_limit = 512M/" /etc/php/7.2/fpm/php.ini

sed -i "s/output_buffering =.*/output_buffering = 'Off'/" /etc/php/7.2/fpm/php.ini

sed -i "s/max_execution_time =.*/max_execution_time = 1800/" /etc/php/7.2/fpm/php.ini

sed -i "s/max_input_time =.*/max_input_time = 3600/" /etc/php/7.2/fpm/php.ini

sed -i "s/post_max_size =.*/post_max_size = 10240M/" /etc/php/7.2/fpm/php.ini

sed -i "s/;upload_tmp_dir =.*/upload_tmp_dir = \/upload_tmp/" /etc/php/7.2/fpm/php.ini

sed -i "s/upload_max_filesize =.*/upload_max_filesize = 10240M/" /etc/php/7.2/fpm/php.ini

sed -i "s/max_file_uploads =.*/max_file_uploads = 100/" /etc/php/7.2/fpm/php.ini

sed -i "s/;date.timezone.*/date.timezone = Europe\/\Berlin/" /etc/php/7.2/fpm/php.ini

sed -i "s/;session.cookie_secure.*/session.cookie_secure = True/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.enable=.*/opcache.enable=1/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.enable_cli=.*/opcache.enable_cli=1/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=128/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=8/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=10000/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.revalidate_freq=.*/opcache.revalidate_freq=1/" /etc/php/7.2/fpm/php.ini

sed -i "s/;opcache.save_comments=.*/opcache.save_comments=1/" /etc/php/7.2/fpm/php.ini

sed -i "s/;session.save_path =.*/session.save_path = \"N;700;\/usr\/local\/tmp\/sessions\"/" /etc/php/7.2/fpm/php.ini

sed -i "s/;emergency_restart_threshold =.*/emergency_restart_threshold = 10/" /etc/php/7.2/fpm/php-fpm.conf

sed -i "s/;emergency_restart_interval =.*/emergency_restart_interval = 1m/" /etc/php/7.2/fpm/php-fpm.conf

sed -i "s/;process_control_timeout =.*/process_control_timeout = 10s/" /etc/php/7.2/fpm/php-fpm.conf

sed -i '$aapc.enabled=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.file_update_protection=2' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.optimization=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.shm_size=256M' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.include_once_override=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.shm_segments=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.ttl=7200' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.user_ttl=7200' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.gc_ttl=3600' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.num_files_hint=1024' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.enable_cli=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.max_file_size=5M' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.cache_by_default=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.use_request_time=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.slam_defense=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.mmap_file_mask=/usr/local/tmp/apc.XXXXXX' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.stat_ctime=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.canonicalize=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.write_lock=1' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.report_autofilter=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.rfc1867=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.rfc1867_prefix =upload_' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.rfc1867_name=APC_UPLOAD_PROGRESS' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.rfc1867_freq=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.rfc1867_ttl=3600' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.lazy_classes=0' /etc/php/7.2/fpm/php.ini

sed -i '$aapc.lazy_functions=0' /etc/php/7.2/fpm/php.ini

sed -i "s/09,39.*/# &/" /etc/cron.d/php

(crontab -l ; echo "09,39 * * * * /usr/lib/php/sessionclean 2>&1") | crontab -u root -

Изменяем /etc/fstab

Проверяем uid пользователя www-data

id www-data

1	id www-data

если вы видите что-то. отличное от uid=33(www-data), в следующих строках меняем uid=33 на свое и выполняем их в терминале:

sed -i '$atmpfs /usr/local/tmp/apc tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab
sed -i '$atmpfs /usr/local/tmp/cache tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab
sed -i '$atmpfs /usr/local/tmp/sessions tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

sed -i '$atmpfs /usr/local/tmp/apc tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

sed -i '$atmpfs /usr/local/tmp/cache tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

sed -i '$atmpfs /usr/local/tmp/sessions tmpfs defaults,uid=33,size=300M,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

Дополнительно:

sed -i '$atmpfs /tmp tmpfs defaults,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab
sed -i '$atmpfs /var/tmp tmpfs defaults,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

1 2	sed -i '$atmpfs /tmp tmpfs defaults,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab sed -i '$atmpfs /var/tmp tmpfs defaults,noatime,nosuid,nodev,noexec,mode=1777 0 0' /etc/fstab

Подключаем tmpfs и перезапускаем PHP и NGINX:

mount -a &amp;&amp; service php7.2-fpm restart &amp;&amp; service nginx restart

1	mount -a && service php7.2-fpm restart && service nginx restart

Устанавливаем MariaDB

apt update &amp;&amp; apt install mariadb-server -y

1	apt update && apt install mariadb-server -y

Проверяем версию DB сервера:

mysql --version

1	mysql --version

Должно быть что-то такое: 10.3.10-MariaDB или выше

Настраиваем MariaDB:

mysql_secure_installation

1	mysql_secure_installation

Enter current password for root (enter for none): <ENTER> or type the password

Set root password? [Y/n] Y

Если пароль был установлен во время установки MariaDB, то будет предложено изменить его, далее последует ряд вопросов, на которые требуется ответить утвердительно (Y):

Remove anonymous users? [Y/n] Y

Disallow root login remotely? [Y/n] Y

Remove test database and access to it? [Y/n] Y

Reload privilege tables now? [Y/n] Y

Настройка конфигурации MariaDB:

сохраняем резервную копию стандартного конфига MariaDB и создаем новый пустой конфиг:

service mysql stop
mv /etc/mysql/my.cnf /etc/mysql/my.cnf.bak &amp;&amp; mcedit /etc/mysql/my.cnf

1 2	service mysql stop mv /etc/mysql/my.cnf /etc/mysql/my.cnf.bak && mcedit /etc/mysql/my.cnf

Вставляем в пустой конфиг следующее содержимое:

[client]
port = 3306
socket = /var/run/mysqld/mysqld.sock
default-character-set = utf8mb4
[mysqld_safe]
log_error=/var/log/mysql/mysql_error.log
socket = /var/run/mysqld/mysqld.sock
nice = 0
[mysqld]
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
log_error=/var/log/mysql/mysql_error.log
general_log_file = /var/log/mysql/mysql.log
general_log = 0
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
lc_messages_dir = /usr/share/mysql
lc_messages = en_US
skip-external-locking
skip-name-resolve
bind-address = 127.0.0.1
max_connections = 200
connect_timeout = 5
wait_timeout = 600
max_allowed_packet = 16M
thread_cache_size = 128
sort_buffer_size = 4M
bulk_insert_buffer_size = 16M
tmp_table_size = 64M
max_heap_table_size = 64M
myisam_recover_options = BACKUP
key_buffer_size = 128M
#open-files-limit = 2000
table_open_cache = 400
myisam_sort_buffer_size = 512M
concurrent_insert = 2
read_buffer_size = 2M
read_rnd_buffer_size = 1M
query_cache_limit = 2M
query_cache_size = 64M
query_cache_type = 1
query_cache_min_res_unit = 2k
log_warnings = 2
slow_query_log_file = /var/log/mysql/mariadb-slow.log
long_query_time = 1
log_slow_verbosity = query_plan
slow-query-log = 1
slow-query-log-file = /var/log/mysql/slow.log
log_bin = /var/log/mysql/mariadb-bin
log_bin_index = /var/log/mysql/mariadb-bin.index
expire_logs_days = 10
max_binlog_size = 100M
default_storage_engine = InnoDB
innodb_buffer_pool_size = 256M
innodb_buffer_pool_instances = 1
innodb_flush_log_at_trx_commit = 2
innodb_log_buffer_size = 32M
innodb_max_dirty_pages_pct = 90
innodb_file_per_table = 1
innodb_open_files = 400
innodb_io_capacity = 400
innodb_flush_method = O_DIRECT
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
transaction_isolation = READ-COMMITTED
binlog_format = ROW
[mysqldump]
quick
quote-names
max_allowed_packet = 16M
[mysql]
#no-auto-rehash    # faster start of mysql but no tab completion
[isamchk]
key_buffer = 16M
!include /etc/mysql/mariadb.cnf
!includedir /etc/mysql/conf.d/

[client]

port = 3306

socket = /var/run/mysqld/mysqld.sock

default-character-set = utf8mb4

[mysqld_safe]

log_error=/var/log/mysql/mysql_error.log

socket = /var/run/mysqld/mysqld.sock

nice = 0

[mysqld]

user = mysql

pid-file = /var/run/mysqld/mysqld.pid

log_error=/var/log/mysql/mysql_error.log

general_log_file = /var/log/mysql/mysql.log

general_log = 0

socket = /var/run/mysqld/mysqld.sock

port = 3306

basedir = /usr

datadir = /var/lib/mysql

tmpdir = /tmp

lc_messages_dir = /usr/share/mysql

lc_messages = en_US

skip-external-locking

skip-name-resolve

bind-address = 127.0.0.1

max_connections = 200

connect_timeout = 5

wait_timeout = 600

max_allowed_packet = 16M

thread_cache_size = 128

sort_buffer_size = 4M

bulk_insert_buffer_size = 16M

tmp_table_size = 64M

max_heap_table_size = 64M

myisam_recover_options = BACKUP

key_buffer_size = 128M

#open-files-limit = 2000

table_open_cache = 400

myisam_sort_buffer_size = 512M

concurrent_insert = 2

read_buffer_size = 2M

read_rnd_buffer_size = 1M

query_cache_limit = 2M

query_cache_size = 64M

query_cache_type = 1

query_cache_min_res_unit = 2k

log_warnings = 2

slow_query_log_file = /var/log/mysql/mariadb-slow.log

long_query_time = 1

log_slow_verbosity = query_plan

slow-query-log = 1

slow-query-log-file = /var/log/mysql/slow.log

log_bin = /var/log/mysql/mariadb-bin

log_bin_index = /var/log/mysql/mariadb-bin.index

expire_logs_days = 10

max_binlog_size = 100M

default_storage_engine = InnoDB

innodb_buffer_pool_size = 256M

innodb_buffer_pool_instances = 1

innodb_flush_log_at_trx_commit = 2

innodb_log_buffer_size = 32M

innodb_max_dirty_pages_pct = 90

innodb_file_per_table = 1

innodb_open_files = 400

innodb_io_capacity = 400

innodb_flush_method = O_DIRECT

character-set-server = utf8mb4

collation-server = utf8mb4_general_ci

transaction_isolation = READ-COMMITTED

binlog_format = ROW

[mysqldump]

quick

quote-names

max_allowed_packet = 16M

[mysql]

#no-auto-rehash # faster start of mysql but no tab completion

[isamchk]

key_buffer = 16M

!include /etc/mysql/mariadb.cnf

!includedir /etc/mysql/conf.d/

Debian

Перезапускаем и подключаем MariaDB:

service mysql restart &amp;&amp; mysql -uroot -p

1	service mysql restart && mysql -uroot -p

Ubuntu

Перезапускаем MariaDB:

service mysql restart

1	service mysql restart

Debian/Ubuntu

Создаем базу данных и пользователя БД:

БД: nextcloud

Пользователь: nextcloud@localhost

Пароль: nextcloud

CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci; CREATE USER nextcloud@localhost identified by 'nextcloud'; GRANT ALL PRIVILEGES on nextcloud.* to nextcloud@localhost; FLUSH privileges; quit;

Проверяем уровень изоляции транзакций, должен быть READ_Commit и кодировку UTF8MB4

mysql -h localhost -uroot -p -e "SELECT @@TX_ISOLATION; SELECT SCHEMA_NAME 'database', default_character_set_name 'charset', DEFAULT_COLLATION_NAME 'collation' FROM information_schema.SCHEMATA WHERE SCHEMA_NAME='nextcloud'"

1	mysql -h localhost -uroot -p -e "SELECT @@TX_ISOLATION; SELECT SCHEMA_NAME 'database', default_character_set_name 'charset', DEFAULT_COLLATION_NAME 'collation' FROM information_schema.SCHEMATA WHERE SCHEMA_NAME='nextcloud'"

должны получить следующий результат:

Если у вас результат соответствует ожидаемому, с настройкой MariaDB закончили.

Устанавливаем Redis

apt update &amp;&amp; apt install redis-server php-redis -y

1	apt update && apt install redis-server php-redis -y

Изменяем конфиг и членство в группах:

cp /etc/redis/redis.conf /etc/redis/redis.conf.bak
sed -i "s/port 6379/port 0/" /etc/redis/redis.conf
sed -i s/\#\ unixsocket/\unixsocket/g /etc/redis/redis.conf
sed -i "s/unixsocketperm 700/unixsocketperm 770/" /etc/redis/redis.conf
sed -i "s/# maxclients 10000/maxclients 512/" /etc/redis/redis.conf
usermod -a -G redis www-data
cp /etc/sysctl.conf /etc/sysctl.conf.bak &amp;&amp; sed -i '$avm.overcommit_memory = 1' /etc/sysctl.conf

cp /etc/redis/redis.conf /etc/redis/redis.conf.bak

sed -i "s/port 6379/port 0/" /etc/redis/redis.conf

sed -i s/\#\ unixsocket/\unixsocket/g /etc/redis/redis.conf

sed -i "s/unixsocketperm 700/unixsocketperm 770/" /etc/redis/redis.conf

sed -i "s/# maxclients 10000/maxclients 512/" /etc/redis/redis.conf

usermod -a -G redis www-data

cp /etc/sysctl.conf /etc/sysctl.conf.bak && sed -i '$avm.overcommit_memory = 1' /etc/sysctl.conf

Перезагружаем сервер!

shutdown -r now

1	shutdown -r now

или

reboot now

1	reboot now

После перезагрузки приступаем к настройке и установке Nextcloud

Nextcloud

Cохраняем резервную копию стандартного конфига и создаем новый nextcloud.conf:

Debian

su -
mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak &amp;&amp; mcedit /etc/nginx/conf.d/nextcloud.conf

1 2	su - mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak && mcedit /etc/nginx/conf.d/nextcloud.conf

Ubuntu

sudo -s
mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak &amp;&amp; touch /etc/nginx/conf.d/default.conf &amp;&amp; mcedit /etc/nginx/conf.d/nextcloud.conf

1 2	sudo -s mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak && touch /etc/nginx/conf.d/default.conf && mcedit /etc/nginx/conf.d/nextcloud.conf

Debian/Ubuntu

ОБЯЗАТЕЛЬНО меняем mydomain.com на свой домен

server {
server_name mydomain.com;
listen 80 default_server;
location ^~ /.well-known/acme-challenge {
proxy_pass http://127.0.0.1:81;
proxy_set_header Host $host;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
server_name mydomain.com;
listen 443 ssl http2 default_server;
root /var/www/nextcloud/;
access_log /var/log/nginx/nextcloud.access.log main;
error_log /var/log/nginx/nextcloud.error.log warn;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
#SOCIAL app enabled? Please uncomment the following three rows
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
client_max_body_size 10240M;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ \.(?:flv|mp4|mov|m4a)$ {
mp4;
mp4_buffer_size 100m;
mp4_max_buffer_size 1024m;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
include php_optimization.conf;
fastcgi_pass php-handler;
fastcgi_param HTTPS on;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
include php_optimization.conf;
fastcgi_pass php-handler;
fastcgi_param HTTPS on;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
location ~ \.(?:css|js|woff|svg|gif|png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
access_log off;
expires 360d;
}
}

server {

server_name mydomain.com;

listen 80 default_server;

location ^~ /.well-known/acme-challenge {

proxy_pass http://127.0.0.1:81;

proxy_set_header Host $host;

}

location / {

return 301 https://$host$request_uri;

}

server {

server_name mydomain.com;

listen 443 ssl http2 default_server;

root /var/www/nextcloud/;

access_log /var/log/nginx/nextcloud.access.log main;

error_log /var/log/nginx/nextcloud.error.log warn;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

location = /.well-known/carddav {

return 301 $scheme://$host/remote.php/dav;

}

location = /.well-known/caldav {

return 301 $scheme://$host/remote.php/dav;

}

#SOCIAL app enabled? Please uncomment the following three rows

#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

client_max_body_size 10240M;

location / {

rewrite ^ /index.php$uri;

}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {

deny all;

}

location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {

deny all;

}

location ~ \.(?:flv|mp4|mov|m4a)$ {

mp4;

mp4_buffer_size 100m;

mp4_max_buffer_size 1024m;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

include php_optimization.conf;

fastcgi_pass php-handler;

fastcgi_param HTTPS on;

}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

include php_optimization.conf;

fastcgi_pass php-handler;

fastcgi_param HTTPS on;

}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {

try_files $uri/ =404;

index index.php;

}

location ~ \.(?:css|js|woff|svg|gif|png|html|ttf|ico|jpg|jpeg)$ {

try_files $uri /index.php$uri$is_args$args;

access_log off;

expires 360d;

}

Если требуется функционал социальной сети (появился в Nextcloud 15), нужно раскомментировать строки после #SOCIAL app enabled? Please uncomment the following three rows

#SOCIAL app enabled? Please uncomment the following three rows 
#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

#SOCIAL app enabled? Please uncomment the following three rows

#rewrite ^/.well-known/webfinger /public.php?service=webfinger last;

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

Если планируется запускать Nextcloud как раздел сайта (подкаталог) mydomain.com/nextcloud, используйте этот вариант nextcloud.conf:

Не забывайте заменить mydomain.com на свой домен

server {
server_name mydomain.com;
listen 80 default_server;
location ^~ /.well-known/acme-challenge {
proxy_pass http://127.0.0.1:81;
proxy_set_header Host $host;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
server_name mydomain.com;
listen 443 ssl http2 default_server;
root /var/www/;
access_log /var/log/nginx/nextcloud.access.log main;
error_log /var/log/nginx/nextcloud.error.log warn;
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location = /.well-known/carddav {
return 301 $scheme://$host/nextcloud/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/nextcloud/remote.php/dav;
}
#SOCIAL app enabled? Please uncomment the following three rows
#rewrite ^/.well-known/webfinger /nextcloud/public.php?service=webfinger last;
#rewrite ^/.well-known/host-meta /nextcloud/public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /nextcloud/public.php?service=host-meta-json last;
client_max_body_size 10240M;
location ^~ /nextcloud {
location /nextcloud {
rewrite ^ /nextcloud/index.php$uri;
}
location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ \.(?:flv|mp4|mov|m4a)$ {
mp4;
mp4_buffer_size 100m;
mp4_max_buffer_size 1024m;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
include php_optimization.conf;
fastcgi_pass php-handler;
fastcgi_param HTTPS on;
}
location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
include php_optimization.conf;
fastcgi_pass php-handler;
fastcgi_param HTTPS on;
}
location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg|css|js|woff|svg|gif)$ {
try_files $uri /nextcloud/index.php$uri$is_args$args;
access_log off;
expires 360d;
}
}
}

server {

server_name mydomain.com;

listen 80 default_server;

location ^~ /.well-known/acme-challenge {

proxy_pass http://127.0.0.1:81;

proxy_set_header Host $host;

}

location / {

return 301 https://$host$request_uri;

}

server {

server_name mydomain.com;

listen 443 ssl http2 default_server;

root /var/www/;

access_log /var/log/nginx/nextcloud.access.log main;

error_log /var/log/nginx/nextcloud.error.log warn;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

location = /.well-known/carddav {

return 301 $scheme://$host/nextcloud/remote.php/dav;

}

location = /.well-known/caldav {

return 301 $scheme://$host/nextcloud/remote.php/dav;

}

#SOCIAL app enabled? Please uncomment the following three rows

#rewrite ^/.well-known/webfinger /nextcloud/public.php?service=webfinger last;

#rewrite ^/.well-known/host-meta /nextcloud/public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /nextcloud/public.php?service=host-meta-json last;

client_max_body_size 10240M;

location ^~ /nextcloud {

location /nextcloud {

rewrite ^ /nextcloud/index.php$uri;

}

location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {

deny all;

}

location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) {

deny all;

}

location ~ \.(?:flv|mp4|mov|m4a)$ {

mp4;

mp4_buffer_size 100m;

mp4_max_buffer_size 1024m;

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

include php_optimization.conf;

fastcgi_pass php-handler;

fastcgi_param HTTPS on;

}

location ~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

include php_optimization.conf;

fastcgi_pass php-handler;

fastcgi_param HTTPS on;

}

location ~ ^/nextcloud/(?:updater|ocs-provider)(?:$|/) {

try_files $uri/ =404;

index index.php;

}

location ~ \.(?:png|html|ttf|ico|jpg|jpeg|css|js|woff|svg|gif)$ {

try_files $uri /nextcloud/index.php$uri$is_args$args;

access_log off;

expires 360d;

}

На этом подготовка конфига закончена, переходим к letsencrypt

КОНФИГИ

Создаем конфиг letsencrypt.conf:

mcedit /etc/nginx/conf.d/letsencrypt.conf

1	mcedit /etc/nginx/conf.d/letsencrypt.conf

и вставляем в него следующее содержимое:

server {
server_name 127.0.0.1;
listen 127.0.0.1:81 default_server;
charset utf-8;
access_log /var/log/nginx/le.access.log main;
error_log /var/log/nginx/le.error.log warn;
location ^~ /.well-known/acme-challenge {
default_type text/plain;
root /var/www/letsencrypt;
}
}

server {

server_name 127.0.0.1;

listen 127.0.0.1:81 default_server;

charset utf-8;

access_log /var/log/nginx/le.access.log main;

error_log /var/log/nginx/le.error.log warn;

location ^~ /.well-known/acme-challenge {

default_type text/plain;

root /var/www/letsencrypt;

}

Создаем конфиг ssl.conf:

mcedit /etc/nginx/ssl.conf

1	mcedit /etc/nginx/ssl.conf

и вставляем следующее содержимое, не забыв поменять домен mydomain.com на свой:

ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
ssl_trusted_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
#ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
#ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
#ssl_trusted_certificate /etc/letsencrypt/live/mydomain.com/chain.pem;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384';
ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;

ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;

ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

ssl_trusted_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;

#ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;

#ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;

#ssl_trusted_certificate /etc/letsencrypt/live/mydomain.com/chain.pem;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

ssl_session_timeout 1d;

ssl_session_cache shared:SSL:50m;

ssl_session_tickets off;

ssl_protocols TLSv1.2;

ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384';

ssl_ecdh_curve secp521r1:secp384r1:prime256v1;

ssl_prefer_server_ciphers on;

ssl_stapling on;

ssl_stapling_verify on;

Создаем конфиг header.conf:

mcedit /etc/nginx/header.conf

1	mcedit /etc/nginx/header.conf

и вставляем следующее содержимое:

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
<span class="pl-s">add_header Referrer-Policy "no-referrer" always;
add_header Feature-Policy "geolocation 'self'";

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

add_header X-Content-Type-Options "nosniff" always;

add_header X-XSS-Protection "1; mode=block" always;

add_header Referrer-Policy "no-referrer" always;

add_header Feature-Policy "geolocation 'self'";

Создаем конфиг optimization.conf:

mcedit /etc/nginx/optimization.conf

1	mcedit /etc/nginx/optimization.conf

и вставляем следующее содержимое:

fastcgi_read_timeout 3600;
fastcgi_buffers 64 64K;
fastcgi_buffer_size 256k;
fastcgi_busy_buffers_size 3840K;
fastcgi_cache_key $http_cookie$request_method$host$request_uri;
fastcgi_cache_use_stale error timeout invalid_header http_500;
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
gzip_disable "MSIE [1-6]\.";

fastcgi_read_timeout 3600;

fastcgi_buffers 64 64K;

fastcgi_buffer_size 256k;

fastcgi_busy_buffers_size 3840K;

fastcgi_cache_key $http_cookie$request_method$host$request_uri;

fastcgi_cache_use_stale error timeout invalid_header http_500;

fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

gzip on;

gzip_vary on;

gzip_comp_level 4;

gzip_min_length 256;

gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;

gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

gzip_disable "MSIE [1-6]\.";

Создаем конфиг php_optimization.conf:

mcedit /etc/nginx/php_optimization.conf

1	mcedit /etc/nginx/php_optimization.conf

и вставляем следующее содержимое:

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
fastcgi_cache_valid 404 1m;
fastcgi_cache_valid any 1h;
fastcgi_cache_methods GET HEAD;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param PATH_INFO $fastcgi_path_info;

fastcgi_param modHeadersAvailable true;

fastcgi_param front_controller_active true;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

fastcgi_cache_valid 404 1m;

fastcgi_cache_valid any 1h;

fastcgi_cache_methods GET HEAD;

Повышаем безопасность:

screen -S dhparam
openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

1 2	screen -S dhparam openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096

процесс не быстрый, поэтому наберитесь терпения и дождитесь окончания процесса генерации, после завершения процесса, перезапустите NGINX

sed -i s/\#\include/\include/g /etc/nginx/nginx.conf &amp;&amp; service nginx restart

1	sed -i s/\#\include/\include/g /etc/nginx/nginx.conf && service nginx restart

Загрузка, распаковка и установка прав для каталогов Nextcloud

wget https://download.nextcloud.com/server/releases/latest.tar.bz2
tar -xjf latest.tar.bz2 -C /var/www &amp;&amp; chown -R www-data:www-data /var/www/ &amp;&amp; rm latest.tar.bz2

1 2	wget https://download.nextcloud.com/server/releases/latest.tar.bz2 tar -xjf latest.tar.bz2 -C /var/www && chown -R www-data:www-data /var/www/ && rm latest.tar.bz2

Запрос SSL сертификата

не забываем поменять домен mydomain.com на свой:

apt update &amp;&amp; apt install letsencrypt -y
letsencrypt certonly -a webroot --webroot-path=/var/www/letsencrypt --rsa-key-size 4096 -d mydomain.com

1 2	apt update && apt install letsencrypt -y letsencrypt certonly -a webroot --webroot-path=/var/www/letsencrypt --rsa-key-size 4096 -d mydomain.com

Применяем разрешения с помощью скрипта permissions.sh

Создаем скрипт permissions.sh:

mcedit /root/permissions.sh

1	mcedit /root/permissions.sh

и вставляем следующее содержимое, не забыв поменять домен mydomain.com на свой:

#!/bin/bash
find /var/www/ -type f -print0 | xargs -0 chmod 0640
find /var/www/ -type d -print0 | xargs -0 chmod 0750
chown -R www-data:www-data /var/www/
chown -R www-data:www-data /upload_tmp/
chown -R www-data:www-data /var/nc_data/
chmod 0644 /var/www/nextcloud/.htaccess
chmod 0644 /var/www/nextcloud/.user.ini
chmod 600 /etc/letsencrypt/live/mydomain.com/fullchain.pem
chmod 600 /etc/letsencrypt/live/mydomain.com/privkey.pem
chmod 600 /etc/letsencrypt/live/mydomain.com/chain.pem
chmod 600 /etc/letsencrypt/live/mydomain.com/cert.pem
chmod 600 /etc/ssl/certs/dhparam.pem
exit 0

#!/bin/bash

find /var/www/ -type f -print0 | xargs -0 chmod 0640

find /var/www/ -type d -print0 | xargs -0 chmod 0750

chown -R www-data:www-data /var/www/

chown -R www-data:www-data /upload_tmp/

chown -R www-data:www-data /var/nc_data/

chmod 0644 /var/www/nextcloud/.htaccess

chmod 0644 /var/www/nextcloud/.user.ini

chmod 600 /etc/letsencrypt/live/mydomain.com/fullchain.pem

chmod 600 /etc/letsencrypt/live/mydomain.com/privkey.pem

chmod 600 /etc/letsencrypt/live/mydomain.com/chain.pem

chmod 600 /etc/letsencrypt/live/mydomain.com/cert.pem

chmod 600 /etc/ssl/certs/dhparam.pem

exit 0

даем скрипту права на запуск и запускаем:

chmod +x /root/permissions.sh &amp;&amp; /root/permissions.sh

1	chmod +x /root/permissions.sh && /root/permissions.sh

Вносим изменения в ssl.conf и в очередной раз перезапускаем NGINX:

sed -i '/ssl-cert-snakeoil/d' /etc/nginx/ssl.conf
sed -i s/\#\ssl/\ssl/g /etc/nginx/ssl.conf
service nginx restart

sed -i '/ssl-cert-snakeoil/d' /etc/nginx/ssl.conf

sed -i s/\#\ssl/\ssl/g /etc/nginx/ssl.conf

service nginx restart

ВНИМАНИЕ! Если сервис NGINX не перезапустился и вывалился с ошибкой, значит в предыдущих шагах, при настройке конфигов, вы сделали что-то не так и сейчас вам придется вернуться к их настройке.

Создаем запись в CRON для автоматического переиздания вашего SSL сертификата:

sed -i "s/SHELL=*/# &amp;/" /etc/cron.d/certbot
sed -i "s/PATH=*/# &amp;/" /etc/cron.d/certbot
sed -i "s/0 =*/# &amp;/" /etc/cron.d/certbot

sed -i "s/SHELL=*/# &/" /etc/cron.d/certbot

sed -i "s/PATH=*/# &/" /etc/cron.d/certbot

sed -i "s/0 =*/# &/" /etc/cron.d/certbot

Создаем скрипт renewal.sh:

mcedit /root/renewal.sh

1	mcedit /root/renewal.sh

и вставляем следующее содержимое:

#!/bin/bash
cd /etc/letsencrypt
letsencrypt renew
result=$(find /etc/letsencrypt/live/ -type l -mtime -1 )
if [ -n "$result" ]; then
/usr/sbin/service nginx stop
/usr/sbin/service mysql restart
/usr/sbin/service redis-server restart
/usr/sbin/service php7.2-fpm restart
/usr/sbin/service nginx restart
fi
exit 0

#!/bin/bash

cd /etc/letsencrypt

letsencrypt renew

result=$(find /etc/letsencrypt/live/ -type l -mtime -1 )

if [ -n "$result" ]; then

/usr/sbin/service nginx stop

/usr/sbin/service mysql restart

/usr/sbin/service redis-server restart

/usr/sbin/service php7.2-fpm restart

/usr/sbin/service nginx restart

exit 0

Даем права на запуск скрипта и добавляем в CRON:

chmod +x /root/renewal.sh &amp;&amp; crontab -e

1	chmod +x /root/renewal.sh && crontab -e

вставляем строку. выделенную красным:

09,39 * * * * /usr/lib/php/sessionclean 2&gt;&amp;1
@monthly /root/renewal.sh 2&gt;&amp;1

1 2	09,39 * * * * /usr/lib/php/sessionclean 2>&1 @monthly /root/renewal.sh 2>&1

Установка Nextcloud в фоновом режиме с предустановленными параметрами

–database-user “nextcloud” : Данный пользователь был указан ранее, при создании БД

–database-pass “nextcloud” : Данный пароль был указан ранее, при создании БД

–admin-user “YourNextcloudAdmin” : Измените имя пользователя на свое, данный пользователь будет администратором вашего облака Nextcloud

–admin-pass “YourNextcloudAdminPasssword” : установите свой пароль для администратора

Debian

Не забываем про mydomain.com

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ maintenance:install --database "mysql" --database-name "<span style="color: #000000">nextcloud</span>" --database-user "<span style="color: #000000">nextcloud</span>" --database-pass "nextcloud" --admin-user "YourNextcloudAdmin" --admin-pass "YourNextcloudAdminPasssword" --data-dir "/var/nc_data"'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ maintenance:install --database "mysql" --database-name "nextcloud" --database-user "nextcloud" --database-pass "nextcloud" --admin-user "YourNextcloudAdmin" --admin-pass "YourNextcloudAdminPasssword" --data-dir "/var/nc_data"'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ config:system:set trusted_domains 1 --value=mydomain.com'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://mydomain.com'
cp /var/www/nextcloud/config/config.php /var/www/nextcloud/config/config.php.bak

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ config:system:set trusted_domains 1 --value=mydomain.com'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://mydomain.com'

cp /var/www/nextcloud/config/config.php /var/www/nextcloud/config/config.php.bak

sed -i 's/^[ ]*//' /var/www/nextcloud/config/config.php
sed -i '/);/d' /var/www/nextcloud/config/config.php

1 2	sed -i 's/^[ ]*//' /var/www/nextcloud/config/config.php sed -i '/);/d' /var/www/nextcloud/config/config.php

cat &lt;&lt;EOF &gt;&gt;/var/www/nextcloud/config/config.php
'activity_expire_days' =&gt; 14,
'auth.bruteforce.protection.enabled' =&gt; true,
'blacklisted_files' =&gt; 
array (
0 =&gt; '.htaccess',
1 =&gt; 'Thumbs.db',
2 =&gt; 'thumbs.db',
),
'cron_log' =&gt; true,
'enable_previews' =&gt; true,
'enabledPreviewProviders' =&gt; 
array (
0 =&gt; 'OC\\Preview\\PNG',
1 =&gt; 'OC\\Preview\\JPEG',
2 =&gt; 'OC\\Preview\\GIF',
3 =&gt; 'OC\\Preview\\BMP',
4 =&gt; 'OC\\Preview\\XBitmap',
5 =&gt; 'OC\\Preview\\Movie',
6 =&gt; 'OC\\Preview\\PDF',
7 =&gt; 'OC\\Preview\\MP3',
8 =&gt; 'OC\\Preview\\TXT',
9 =&gt; 'OC\\Preview\\MarkDown',
),
'filesystem_check_changes' =&gt; 0,
'filelocking.enabled' =&gt; 'true',
'htaccess.RewriteBase' =&gt; '/',
'integrity.check.disabled' =&gt; false,
'knowledgebaseenabled' =&gt; false,
'logfile' =&gt; '/var/nc_data/nextcloud.log',
'loglevel' =&gt; 2,
'logtimezone' =&gt; 'Europe/Berlin',
'log_rotate_size' =&gt; 104857600,
'maintenance' =&gt; false,
'memcache.local' =&gt; '\\OC\\Memcache\\APCu',
'memcache.locking' =&gt; '\\OC\\Memcache\\Redis',
'overwriteprotocol' =&gt; 'https',
'preview_max_x' =&gt; 1024,
'preview_max_y' =&gt; 768,
'preview_max_scale_factor' =&gt; 1,
'redis' =&gt; 
array (
'host' =&gt; '/var/run/redis/redis.sock',
'port' =&gt; 0,
'timeout' =&gt; 0.0,
),
'quota_include_external_storage' =&gt; false,
'share_folder' =&gt; '/Shares',
'skeletondirectory' =&gt; '',
'theme' =&gt; '',
'trashbin_retention_obligation' =&gt; 'auto, 7',
'updater.release.channel' =&gt; 'stable',
);
EOF

cat <<EOF >>/var/www/nextcloud/config/config.php

'activity_expire_days' => 14,

'auth.bruteforce.protection.enabled' => true,

'blacklisted_files' =>

array (

0 => '.htaccess',

1 => 'Thumbs.db',

2 => 'thumbs.db',

'cron_log' => true,

'enable_previews' => true,

'enabledPreviewProviders' =>

array (

0 => 'OC\\Preview\\PNG',

1 => 'OC\\Preview\\JPEG',

2 => 'OC\\Preview\\GIF',

3 => 'OC\\Preview\\BMP',

4 => 'OC\\Preview\\XBitmap',

5 => 'OC\\Preview\\Movie',

6 => 'OC\\Preview\\PDF',

7 => 'OC\\Preview\\MP3',

8 => 'OC\\Preview\\TXT',

9 => 'OC\\Preview\\MarkDown',

'filesystem_check_changes' => 0,

'filelocking.enabled' => 'true',

'htaccess.RewriteBase' => '/',

'integrity.check.disabled' => false,

'knowledgebaseenabled' => false,

'logfile' => '/var/nc_data/nextcloud.log',

'loglevel' => 2,

'logtimezone' => 'Europe/Berlin',

'log_rotate_size' => 104857600,

'maintenance' => false,

'memcache.local' => '\\OC\\Memcache\\APCu',

'memcache.locking' => '\\OC\\Memcache\\Redis',

'overwriteprotocol' => 'https',

'preview_max_x' => 1024,

'preview_max_y' => 768,

'preview_max_scale_factor' => 1,

'redis' =>

array (

'host' => '/var/run/redis/redis.sock',

'port' => 0,

'timeout' => 0.0,

'quota_include_external_storage' => false,

'share_folder' => '/Shares',

'skeletondirectory' => '',

'theme' => '',

'trashbin_retention_obligation' => 'auto, 7',

'updater.release.channel' => 'stable',

);

EOF

Отредактируем .user.ini

sed -i "s/upload_max_filesize=.*/upload_max_filesize=10240M/" /var/www/nextcloud/.user.ini
sed -i "s/post_max_size=.*/post_max_size=10240M/" /var/www/nextcloud/.user.ini
sed -i "s/output_buffering=.*/output_buffering='Off'/" /var/www/nextcloud/.user.ini
service php7.2-fpm restart &amp;&amp; service redis-server restart &amp;&amp; service nginx restart

sed -i "s/upload_max_filesize=.*/upload_max_filesize=10240M/" /var/www/nextcloud/.user.ini

sed -i "s/post_max_size=.*/post_max_size=10240M/" /var/www/nextcloud/.user.ini

sed -i "s/output_buffering=.*/output_buffering='Off'/" /var/www/nextcloud/.user.ini

service php7.2-fpm restart && service redis-server restart && service nginx restart

Настроим Nextcloud Apps:

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:disable survey_client'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:disable firstrunwizard'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:enable admin_audit'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:enable files_pdfviewer'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:disable survey_client'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:disable firstrunwizard'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:enable admin_audit'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ app:enable files_pdfviewer'

Ubuntu

sudo -u www-data php /var/www/nextcloud/occ maintenance:install --database "mysql" --database-name "nextcloud" --database-user "nextcloud" --database-pass "<span style="color: #ff0000">nextcloud</span>" --admin-user "<span style="color: #ff0000">YourNextcloudAdmin</span>" --admin-pass "<span style="color: #ff0000">YourNextcloudAdminPasssword</span>" --data-dir "/var/nc_data"

sudo -u www-data php /var/www/nextcloud/occ maintenance:install --database "mysql" --database-name "nextcloud" --database-user "nextcloud" --database-pass "nextcloud" --admin-user "YourNextcloudAdmin" --admin-pass "YourNextcloudAdminPasssword" --data-dir "/var/nc_data"

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 1 --value=<span style="color: #ff0000"><strong>mydomain.com</strong></span>
sudo -u www-data php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://<span style="color: #ff0000"><strong>mydomain.com</strong></span>
sudo -u www-data cp /var/www/nextcloud/config/config.php /var/www/nextcloud/config/config.php.bak

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 1 --value=mydomain.com

sudo -u www-data php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://mydomain.com

sudo -u www-data cp /var/www/nextcloud/config/config.php /var/www/nextcloud/config/config.php.bak

sudo -u www-data sed -i 's/^[ ]*//' /var/www/nextcloud/config/config.php
sudo -u www-data sed -i '/);/d' /var/www/nextcloud/config/config.php

1 2	sudo -u www-data sed -i 's/^[ ]*//' /var/www/nextcloud/config/config.php sudo -u www-data sed -i '/);/d' /var/www/nextcloud/config/config.php

sudo -u www-data cat &lt;&lt;EOF &gt;&gt;/var/www/nextcloud/config/config.php
'activity_expire_days' =&gt; 14,
'auth.bruteforce.protection.enabled' =&gt; true,
'blacklisted_files' =&gt; 
array (
0 =&gt; '.htaccess',
1 =&gt; 'Thumbs.db',
2 =&gt; 'thumbs.db',
),
'cron_log' =&gt; true,
'enable_previews' =&gt; true,
'enabledPreviewProviders' =&gt; 
array (
0 =&gt; 'OC\\Preview\\PNG',
1 =&gt; 'OC\\Preview\\JPEG',
2 =&gt; 'OC\\Preview\\GIF',
3 =&gt; 'OC\\Preview\\BMP',
4 =&gt; 'OC\\Preview\\XBitmap',
5 =&gt; 'OC\\Preview\\Movie',
6 =&gt; 'OC\\Preview\\PDF',
7 =&gt; 'OC\\Preview\\MP3',
8 =&gt; 'OC\\Preview\\TXT',
9 =&gt; 'OC\\Preview\\MarkDown',
),
'filesystem_check_changes' =&gt; 0,
'filelocking.enabled' =&gt; 'true',
'htaccess.RewriteBase' =&gt; '/',
'integrity.check.disabled' =&gt; false,
'knowledgebaseenabled' =&gt; false,
'logfile' =&gt; '/var/nc_data/nextcloud.log',
'loglevel' =&gt; 2,
'logtimezone' =&gt; 'Europe/Berlin',
'log_rotate_size' =&gt; 104857600,
'maintenance' =&gt; false,
'memcache.local' =&gt; '\\OC\\Memcache\\APCu',
'memcache.locking' =&gt; '\\OC\\Memcache\\Redis',
'overwriteprotocol' =&gt; 'https',
'preview_max_x' =&gt; 1024,
'preview_max_y' =&gt; 768,
'preview_max_scale_factor' =&gt; 1,
'redis' =&gt; 
array (
'host' =&gt; '/var/run/redis/redis-server.sock',
'port' =&gt; 0,
'timeout' =&gt; 0.0,
),
'quota_include_external_storage' =&gt; false,
'share_folder' =&gt; '/Shares',
'skeletondirectory' =&gt; '',
'theme' =&gt; '',
'trashbin_retention_obligation' =&gt; 'auto, 7',
'updater.release.channel' =&gt; 'stable',
);
EOF

sudo -u www-data cat <<EOF >>/var/www/nextcloud/config/config.php

'activity_expire_days' => 14,

'auth.bruteforce.protection.enabled' => true,

'blacklisted_files' =>

array (

0 => '.htaccess',

1 => 'Thumbs.db',

2 => 'thumbs.db',

'cron_log' => true,

'enable_previews' => true,

'enabledPreviewProviders' =>

array (

0 => 'OC\\Preview\\PNG',

1 => 'OC\\Preview\\JPEG',

2 => 'OC\\Preview\\GIF',

3 => 'OC\\Preview\\BMP',

4 => 'OC\\Preview\\XBitmap',

5 => 'OC\\Preview\\Movie',

6 => 'OC\\Preview\\PDF',

7 => 'OC\\Preview\\MP3',

8 => 'OC\\Preview\\TXT',

9 => 'OC\\Preview\\MarkDown',

'filesystem_check_changes' => 0,

'filelocking.enabled' => 'true',

'htaccess.RewriteBase' => '/',

'integrity.check.disabled' => false,

'knowledgebaseenabled' => false,

'logfile' => '/var/nc_data/nextcloud.log',

'loglevel' => 2,

'logtimezone' => 'Europe/Berlin',

'log_rotate_size' => 104857600,

'maintenance' => false,

'memcache.local' => '\\OC\\Memcache\\APCu',

'memcache.locking' => '\\OC\\Memcache\\Redis',

'overwriteprotocol' => 'https',

'preview_max_x' => 1024,

'preview_max_y' => 768,

'preview_max_scale_factor' => 1,

'redis' =>

array (

'host' => '/var/run/redis/redis-server.sock',

'port' => 0,

'timeout' => 0.0,

'quota_include_external_storage' => false,

'share_folder' => '/Shares',

'skeletondirectory' => '',

'theme' => '',

'trashbin_retention_obligation' => 'auto, 7',

'updater.release.channel' => 'stable',

);

EOF

Отредактируем .user.ini

sudo -u www-data sed -i "s/upload_max_filesize=.*/upload_max_filesize=10240M/" /var/www/nextcloud/.user.ini
sudo -u www-data sed -i "s/post_max_size=.*/post_max_size=10240M/" /var/www/nextcloud/.user.ini
sudo -u www-data sed -i "s/output_buffering=.*/output_buffering='Off'/" /var/www/nextcloud/.user.ini
service php7.2-fpm restart &amp;&amp; service redis-server restart &amp;&amp; service nginx restart

sudo -u www-data sed -i "s/upload_max_filesize=.*/upload_max_filesize=10240M/" /var/www/nextcloud/.user.ini

sudo -u www-data sed -i "s/post_max_size=.*/post_max_size=10240M/" /var/www/nextcloud/.user.ini

sudo -u www-data sed -i "s/output_buffering=.*/output_buffering='Off'/" /var/www/nextcloud/.user.ini

service php7.2-fpm restart && service redis-server restart && service nginx restart

Настроим Nextcloud Apps:

sudo -u www-data php /var/www/nextcloud/occ config:system:set 'auth.bruteforce.protection.enabled' --value=false
sudo -u www-data php /var/www/nextcloud/occ app:disable survey_client
sudo -u www-data php /var/www/nextcloud/occ app:disable firstrunwizard
sudo -u www-data php /var/www/nextcloud/occ app:enable admin_audit
sudo -u www-data php /var/www/nextcloud/occ app:enable files_pdfviewer

sudo -u www-data php /var/www/nextcloud/occ config:system:set 'auth.bruteforce.protection.enabled' --value=false

sudo -u www-data php /var/www/nextcloud/occ app:disable survey_client

sudo -u www-data php /var/www/nextcloud/occ app:disable firstrunwizard

sudo -u www-data php /var/www/nextcloud/occ app:enable admin_audit

sudo -u www-data php /var/www/nextcloud/occ app:enable files_pdfviewer

На этом установка и настройка Nextcloud завершена, можно открыть браузер и перейти по адресу https://mydomain.com

Для Ubuntu

Если проверка целостности в Nextcloud не удалась, попробуйте изменить config.php

sudo -u www-data mcedit /var/www/nextcloud/config/config.php

1	sudo -u www-data mcedit /var/www/nextcloud/config/config.php

и установить:

'integrity.check.disabled' =&gt; <span style="color: #ff0000">true</span>,

1	'integrity.check.disabled' => <span style="color: #ff0000">true</span>,

перезапустите все службы:

service php7.2-fpm restart &amp;&amp; service redis-server restart &amp;&amp; service nginx restart

1	service php7.2-fpm restart && service redis-server restart && service nginx restart

Перезапустите проверку целостности и установите значение обратно в «false»:

sudo -u www-data mcedit /var/www/nextcloud/config/config.php

1	sudo -u www-data mcedit /var/www/nextcloud/config/config.php

'integrity.check.disabled' =&gt; <span style="color: #ff0000">false</span>,

1	'integrity.check.disabled' => <span style="color: #ff0000">false</span>,

и опять перезапустите все службы:

service php7.2-fpm restart &amp;&amp; service redis-server restart &amp;&amp; service nginx restart

1	service php7.2-fpm restart && service redis-server restart && service nginx restart

проблема должна решиться

ОПТИМИЗАЦИЯ

Debian

/usr/sbin/service nginx stop
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ db:add-missing-indices'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ db:convert-filecache-bigint'
/usr/sbin/service nginx start

/usr/sbin/service nginx stop

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ db:add-missing-indices'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ db:convert-filecache-bigint'

/usr/sbin/service nginx start

Ubuntu

/usr/sbin/service nginx stop
sudo -u www-data php /var/www/nextcloud/occ db:add-missing-indices
sudo -u www-data php /var/www/nextcloud/occ db:convert-filecache-bigint
/usr/sbin/service nginx start

/usr/sbin/service nginx stop

sudo -u www-data php /var/www/nextcloud/occ db:add-missing-indices

sudo -u www-data php /var/www/nextcloud/occ db:convert-filecache-bigint

/usr/sbin/service nginx start

Debian/Ubuntu

создаем скрипт optimize.sh:

mcedit /root/optimize.sh

1	mcedit /root/optimize.sh

и вставляем следующее содержимое:

#!/bin/bash
redis-cli -s /var/run/redis/redis.sock &lt;&lt;EOF
FLUSHALL
quit
EOF
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ files:scan --all'
su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ files:scan-app-data'
exit 0

#!/bin/bash

redis-cli -s /var/run/redis/redis.sock <<EOF

FLUSHALL

quit

EOF

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ files:scan --all'

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ files:scan-app-data'

exit 0

сохраняем и даем права на запуск:

chmod +x /root/optimize.sh

1	chmod +x /root/optimize.sh

запускаем:

/root/optimize.sh

1	/root/optimize.sh

Добавляем в CRON задачи для www-data и root:

www-data:

crontab -u www-data -e

1	crontab -u www-data -e

и вставляем следующее:

*/15 * * * * php -f /var/www/nextcloud/cron.php &gt; /dev/null 2&gt;&amp;1

1	/15 * * * php -f /var/www/nextcloud/cron.php > /dev/null 2>&1

root:

crontab -e

1	crontab -e

и вставляем следующее:

5 1 * * * /root/optimize.sh 2&gt;&amp;1

1	5 1 * * * /root/optimize.sh 2>&1

Переключаем Nextcloud на использование cron:

Debian

su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ background:cron'

1	su - www-data -s /bin/bash -c 'php /var/www/nextcloud/occ background:cron'

Перезапускаем все сервисы:

service mysql restart &amp;&amp; service php7.2-fpm restart &amp;&amp; service redis-server restart &amp;&amp; service nginx restart

1	service mysql restart && service php7.2-fpm restart && service redis-server restart && service nginx restart

Ubuntu

sudo -u www-data php /var/www/nextcloud/occ background:cron

1	sudo -u www-data php /var/www/nextcloud/occ background:cron

на этом оптимизация завершена, можно пользоваться

Не забываем, что теперь на сервер может кто угодно постучаться. Если это друг, то ничего страшного, а если это вредитель, то защита не помешает. Поэтому ей и займемся в качестве завершающего этапа настройки

fail2ban

apt update &amp;&amp; apt install fail2ban -y

1	apt update && apt install fail2ban -y

создаем конфиг для правил фильтрации

mcedit /etc/fail2ban/filter.d/nextcloud.conf

1	mcedit /etc/fail2ban/filter.d/nextcloud.conf

и вставляем следующее содержимое:

[Definition]
failregex=^{"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '&lt;HOST&gt;'\)","level":2,"time":".*"}$
            ^{"reqId":".*","level":2,"time":".*","remoteAddr":".*","app":"core".*","message":"Login failed: '.*' \(Remote IP: '&lt;HOST&gt;'\)".*}$
            ^.*\"remoteAddr\":\"&lt;HOST&gt;\".*Trusted domain error.*$

[Definition]

failregex=^{"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' $Remote IP: '<HOST>'$","level":2,"time":".*"}$

^{"reqId":".*","level":2,"time":".*","remoteAddr":".*","app":"core".*","message":"Login failed: '.*' $Remote IP: '<HOST>'$".*}$

^.*\"remoteAddr\":\"<HOST>\".*Trusted domain error.*$

создаем fail2ban jail для Nextcloud

vi /etc/fail2ban/jail.d/nextcloud.local

1	vi /etc/fail2ban/jail.d/nextcloud.local

и вставляем следующее содержимое:

[nextcloud]
backend = auto
enabled = true
port = 80,443
protocol = tcp
filter = nextcloud
maxretry = 3
bantime = 36000
findtime = 36000
logpath = /var/nc_data/nextcloud.log

[nginx-http-auth]
enabled = true

[nextcloud]

backend = auto

enabled = true

port = 80,443

protocol = tcp

filter = nextcloud

maxretry = 3

bantime = 36000

findtime = 36000

logpath = /var/nc_data/nextcloud.log

[nginx-http-auth]

enabled = true

перезапускаем fail2ban

service fail2ban restart

1	service fail2ban restart

UFW

apt install ufw

1	apt install ufw

ufw allow from &lt;YOUR IP OR SUBNET HERE&gt; to any port <span class="highlight">22</span>

1	ufw allow from <YOUR IP OR SUBNET HERE> to any port <span class="highlight">22</span>

ufw allow 80/tcp &amp;&amp; ufw allow 443/tcp &amp;&amp; ufw logging medium ufw default deny incoming &amp;&amp; ufw enable &amp;&amp; service ufw restart

1	ufw allow 80/tcp && ufw allow 443/tcp && ufw logging medium ufw default deny incoming && ufw enable && service ufw restart

Spamhaus Project и UFW

Создаем скрипт

mcedit /root/ufw-spamhaus.sh

1	mcedit /root/ufw-spamhaus.sh

вставляем в него следующее содержимое:

#!/bin/bash
# Thanks to <a href="https://twitter.com/ank0m" target="_blank" rel="noopener">@ank0m</a>
EXEC_DATE=`date +%Y-%m-%d`
SPAMHAUS_DROP="/usr/local/src/drop.txt"
SPAMHAUS_eDROP="/usr/local/src/edrop.txt"
URL="https://www.spamhaus.org/drop/drop.txt"
eURL="https://www.spamhaus.org/drop/edrop.txt"
DROP_ADD_TO_UFW="/usr/local/src/DROP2.txt"
eDROP_ADD_TO_UFW="/usr/local/src/eDROP2.txt"
DROP_ARCHIVE_FILE="/usr/local/src/DROP_$EXEC_DATE"
eDROP_ARCHIVE_FILE="/usr/local/src/eDROP_$EXEC_DATE"
# All credits for the following BLACKLISTS goes to "<a href="https://www.spamhaus.org/" target="_blank" rel="noopener">The Spamhaus Project" - https://www.spamhaus.org</a>
echo "Start time: $(date)"
echo " "
echo "Download daily DROP file:"
wget -q -O - "$URL" &gt; $SPAMHAUS_DROP
grep -v '^;' $SPAMHAUS_DROP | cut -d ' ' -f 1 &gt; $DROP_ADD_TO_UFW
echo " "
echo "Extract DROP IP addresses and add to UFW:"
cat $DROP_ADD_TO_UFW | while read line
do
/usr/sbin/ufw insert 1 deny from "$line" comment 'DROP_Blacklisted_IPs'
done
echo " "
echo "Downloading eDROP list and import to UFW"
echo " "
echo "Download daily eDROP file:"
wget -q -O - "$eURL" &gt; $SPAMHAUS_eDROP
grep -v '^;' $SPAMHAUS_eDROP | cut -d ' ' -f 1 &gt; $eDROP_ADD_TO_UFW
echo " "
echo "Extract eDROP IP addresses and add to UFW:"
cat $eDROP_ADD_TO_UFW | while read line
do
/usr/sbin/ufw insert 1 deny from "$line" comment 'eDROP_Blacklisted_IPs'
done
echo " "
#####
## To remove or revert these rules, keep the list of IPs!
## Run a command like so to remove the rules:
# while read line; do ufw delete deny from $line; done &lt; $ARCHIVE_FILE
#####
echo "Backup DROP IP address list:"
mv $DROP_ADD_TO_UFW $DROP_ARCHIVE_FILE
echo " "
echo "Backup eDROP IP address list:"
mv $eDROP_ADD_TO_UFW $eDROP_ARCHIVE_FILE
echo " "
echo End time: $(date)

#!/bin/bash

# Thanks to <a href="https://twitter.com/ank0m" target="_blank" rel="noopener">@ank0m</a>

EXEC_DATE=`date +%Y-%m-%d`

SPAMHAUS_DROP="/usr/local/src/drop.txt"

SPAMHAUS_eDROP="/usr/local/src/edrop.txt"

URL="https://www.spamhaus.org/drop/drop.txt"

eURL="https://www.spamhaus.org/drop/edrop.txt"

DROP_ADD_TO_UFW="/usr/local/src/DROP2.txt"

eDROP_ADD_TO_UFW="/usr/local/src/eDROP2.txt"

DROP_ARCHIVE_FILE="/usr/local/src/DROP_$EXEC_DATE"

eDROP_ARCHIVE_FILE="/usr/local/src/eDROP_$EXEC_DATE"

# All credits for the following BLACKLISTS goes to "<a href="https://www.spamhaus.org/" target="_blank" rel="noopener">The Spamhaus Project" - https://www.spamhaus.org</a>

echo "Start time: $(date)"

echo " "

echo "Download daily DROP file:"

wget -q -O - "$URL" > $SPAMHAUS_DROP

grep -v '^;' $SPAMHAUS_DROP | cut -d ' ' -f 1 > $DROP_ADD_TO_UFW

echo " "

echo "Extract DROP IP addresses and add to UFW:"

cat $DROP_ADD_TO_UFW | while read line

/usr/sbin/ufw insert 1 deny from "$line" comment 'DROP_Blacklisted_IPs'

done

echo " "

echo "Downloading eDROP list and import to UFW"

echo " "

echo "Download daily eDROP file:"

wget -q -O - "$eURL" > $SPAMHAUS_eDROP

grep -v '^;' $SPAMHAUS_eDROP | cut -d ' ' -f 1 > $eDROP_ADD_TO_UFW

echo " "

echo "Extract eDROP IP addresses and add to UFW:"

cat $eDROP_ADD_TO_UFW | while read line

/usr/sbin/ufw insert 1 deny from "$line" comment 'eDROP_Blacklisted_IPs'

done

echo " "

#####

## To remove or revert these rules, keep the list of IPs!

## Run a command like so to remove the rules:

# while read line; do ufw delete deny from $line; done < $ARCHIVE_FILE

#####

echo "Backup DROP IP address list:"

mv $DROP_ADD_TO_UFW $DROP_ARCHIVE_FILE

echo " "

echo "Backup eDROP IP address list:"

mv $eDROP_ADD_TO_UFW $eDROP_ARCHIVE_FILE

echo " "

echo End time: $(date)

даем права на запуск:

chmod +x /root/ufw-spamhaus.sh

1	chmod +x /root/ufw-spamhaus.sh

и добавляем задачу в cron:

(crontab -l ; echo "10 2 * * * /root/ufw-spamhaus.sh 2&gt;&amp;1") | crontab -u root -

1	(crontab -l ; echo "10 2 * * * /root/ufw-spamhaus.sh 2>&1") \| crontab -u root -

запускаем скрипт:

/root/ufw-spamhaus.sh

1	/root/ufw-spamhaus.sh

скрипт будет некоторое время работать, добавляя правила для UFW

Ну и теперь самое интересное, приятный бонус, обещанный в заголовке!

Отправим наше облако на проверку безопасности параметров настройки

проверка SSL:

https://www.ssllabs.com/ssltest/analyze.html?d=https://mydomain.com

проверка службами Nextcloud:

https://scan.nextcloud.com

Проверка службами Mozilla:

https://observatory.mozilla.org/analyze/mydomain.com

Если вы все сделали правильно, оценка безопасности будет A+, что означает высшую оценку безопасности вашего сервера!

Блог Debian

Блог Debian

Установка Nextcloud 15 (Debian/Ubuntu/NGINX) на свой сервер + приятный бонус

Устанавливаем NGINX

Устанавливаем PHP

Изменяем /etc/fstab

Устанавливаем MariaDB

Устанавливаем Redis

Nextcloud

КОНФИГИ

Загрузка, распаковка и установка прав для каталогов Nextcloud

Запрос SSL сертификата

Применяем разрешения с помощью скрипта permissions.sh

Установка Nextcloud в фоновом режиме с предустановленными параметрами

ОПТИМИЗАЦИЯ

fail2ban

UFW

Spamhaus Project и UFW

Вячеслав Ш.