545 lines
12 KiB
Markdown
545 lines
12 KiB
Markdown
# NextCloud installieren
|
|
|
|
Ordner erstellen
|
|
|
|
```
|
|
mkdir -p /opt/nextcloud/{database,app,daten}
|
|
```
|
|
|
|
Docker-Datei anlegen (`/opt/nextcloud/Dockerfile`)
|
|
|
|
```
|
|
FROM nextcloud
|
|
USER root
|
|
RUN apt update && apt install -y libmagickcore-6.q16-6-extra
|
|
```
|
|
|
|
Docker-Compose-Datei anlegen
|
|
|
|
`/opt/nextcloud/docker-compose.yml`
|
|
|
|
```
|
|
version: '3.3'
|
|
|
|
services:
|
|
nextcloud-db:
|
|
image: mariadb
|
|
container_name: nextcloud-db
|
|
command: --transaction-isolation=READ-COMMITTED --log-bin=ROW
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /opt/nextcloud/database:/var/lib/mysql
|
|
environment:
|
|
- MYSQL_ROOT_PASSWORD=<SQL_root_Passwort>
|
|
- MYSQL_PASSWORD=<SQL_Benutzer_Passwort>
|
|
- MYSQL_DATABASE=nextcloud #Datenbank Name
|
|
- MYSQL_USER=nextcloud #SQL Nutzername
|
|
- MYSQL_INITDB_SKIP_TZINFO=1
|
|
networks:
|
|
- default
|
|
|
|
nextcloud-redis:
|
|
image: redis:alpine
|
|
container_name: nextcloud-redis
|
|
hostname: nextcloud-redis
|
|
networks:
|
|
- default
|
|
restart: unless-stopped
|
|
command: redis-server --requirepass <Redis_Passwort>
|
|
|
|
nextcloud-app:
|
|
build: .
|
|
container_name: nextcloud-app
|
|
ports:
|
|
- 127.0.0.1:8080:80
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- nextcloud-db
|
|
- nextcloud-redis
|
|
environment:
|
|
REDIS_HOST: nextcloud-redis
|
|
REDIS_HOST_PASSWORD: <Redis_Passwort>
|
|
volumes:
|
|
- /opt/nextcloud/app:/var/www/html
|
|
- /opt/nextcloud/daten:/var/www/html/data
|
|
|
|
networks:
|
|
- default
|
|
|
|
collabora:
|
|
image: collabora/code
|
|
container_name: nextcloud-collabora
|
|
restart: unless-stopped
|
|
networks:
|
|
- default
|
|
ports:
|
|
- 127.0.0.1:9980:9980
|
|
environment:
|
|
- "domain=cloud\\.domain\\.tld"
|
|
- "dictionaries=de en"
|
|
- "username=<benutzername>"
|
|
- "password=<passwort>"
|
|
```
|
|
|
|
NC starten
|
|
|
|
```
|
|
cd /opt/nextcloud
|
|
docker-compose up -d
|
|
```
|
|
|
|
Seite aufrufen `<ip-adresse>:8080` und Setup abschließen.
|
|
|
|
## reverse Proxy anlegen
|
|
|
|
Zertifikat erstellen
|
|
|
|
```
|
|
certbot certonly --agree-tos --email admin@domain.tld --webroot -w /var/lib/letsencrypt/ -d cloud.domain.tld
|
|
```
|
|
|
|
Datei `/etc/apache2/sites-available/cloud.domain.tld.conf`
|
|
|
|
```
|
|
<VirtualHost *:80>
|
|
|
|
ServerName cloud.domain.tld
|
|
|
|
SSLEngine off
|
|
|
|
DocumentRoot /var/www/html/
|
|
|
|
RewriteEngine on
|
|
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
|
|
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
|
|
ServerName cloud.domain.tld
|
|
|
|
DocumentRoot /var/www/html/
|
|
|
|
SSLEngine on
|
|
SSLCertificateFile /etc/letsencrypt/live/cloud.domain.tld/fullchain.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/cloud.domain.tld/privkey.pem
|
|
|
|
Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
|
|
|
|
RewriteEngine On
|
|
RewriteRule ^/\.well-known/carddav https://cloud.domain.tld/remote.php/dav/ [R=301,L]
|
|
RewriteRule ^/\.well-known/caldav https://cloud.domain.tld/remote.php/dav/ [R=301,L]
|
|
|
|
ProxyRequests Off
|
|
ProxyPreserveHost On
|
|
|
|
SSLProxyCheckPeerCN off
|
|
SSLProxyCheckPeerName off
|
|
|
|
<Location "/">
|
|
|
|
ProxyPass http://127.0.0.1:8080/
|
|
ProxyPassReverse http://127.0.0.1:8080/
|
|
|
|
</Location>
|
|
|
|
<Location "/.well-known/acme-challenge">
|
|
ProxyPass "!"
|
|
</Location>
|
|
|
|
CustomLog /var/log/apache2/cloud.domain.tld.log combined
|
|
ErrorLog /var/log/apache2/cloud.domain.tld.error.log
|
|
|
|
</VirtualHost>
|
|
```
|
|
|
|
Konfiguration aktivieren
|
|
|
|
```
|
|
a2ensite cloud.domain.tld.conf
|
|
systemctl reload apache2
|
|
```
|
|
|
|
## Konfiguration anpassen
|
|
|
|
Datei `/opt/nextcloud/app/config/config.php`
|
|
|
|
```
|
|
...
|
|
'trusted_domains' =>.
|
|
array (
|
|
0 => '10.4.0.1:8080',
|
|
1 => 'cloud.domain.tld',
|
|
),
|
|
...
|
|
'overwrite.cli.url' => 'https://cloud.domain.tld',
|
|
...
|
|
'trusted_proxies' => '<IP-Adresse des Servers>',
|
|
'overwriteprotocol' => 'https',
|
|
'overwritehost' => 'cloud.domain.tld',
|
|
'default_phone_region' => 'DE',
|
|
'app.mail.verify-tls-peer' => false,
|
|
...
|
|
```
|
|
|
|
Container neu starten
|
|
|
|
```
|
|
docker-compose restart
|
|
```
|
|
|
|
Wenn beim Sicherheitscheck angezeigt wird, dass der Header `X-Content-Type-Options` nicht konfiguriert ist, kann das daran liegen, dass er doppelt gesetzt ist und muss in der NC-Konfiguration entfernt werden.
|
|
|
|
Datei `/opt/nextcloud/app/.htaccess`
|
|
|
|
```
|
|
...
|
|
#Header onsuccess unset X-Content-Type-Options
|
|
#Header always set X-Content-Type-Options "nosniff"
|
|
...
|
|
```
|
|
|
|
## Cron Dienst anpassen
|
|
|
|
NC kennt mehrere Möglichkeiten, Hintergrund-Aufgaben zu erledigen. Da in einem Kontainer kein Dienst läuft, wird der cron-Dienst des Host-Servers verwendet.
|
|
|
|
In der ssh-Konsole als Benutzer root:
|
|
|
|
```
|
|
crontab -e
|
|
```
|
|
|
|
Befehl eintragen:
|
|
|
|
```
|
|
*/5 * * * * docker exec -t -u www-data nextcloud-app php -f /var/www/html/cron.php
|
|
```
|
|
|
|
NC-Einstellungen anpassen:
|
|
|
|
|
|
|
|
## Colabora Office
|
|
|
|
Eigene Domain in Apache als Reverse Proxy anlegen
|
|
|
|
```
|
|
certbot certonly --agree-tos --email admin@domain.tld --webroot -w /var/lib/letsencrypt/ -d office.domain.tld
|
|
```
|
|
|
|
Datei `/etc/apache2/sites-available/office.domain.tld.conf`
|
|
|
|
```
|
|
<VirtualHost *:80>
|
|
|
|
ServerName office.domain.tld
|
|
|
|
SSLEngine off
|
|
|
|
DocumentRoot /var/www/html/
|
|
|
|
RewriteEngine on
|
|
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
|
|
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:443>
|
|
|
|
ServerName office.domain.tld
|
|
|
|
# SSL configuration, you may want to take the easy route instead and use Lets Encrypt!
|
|
SSLEngine on
|
|
SSLCertificateFile /etc/letsencrypt/live/srv3.domain.tld/fullchain.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/srv3.domain.tld/privkey.pem
|
|
SSLProtocol all -SSLv2 -SSLv3
|
|
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
|
|
SSLHonorCipherOrder on
|
|
|
|
# Encoded slashes need to be allowed
|
|
AllowEncodedSlashes NoDecode
|
|
|
|
# Container uses a unique non-signed certificate
|
|
SSLProxyEngine On
|
|
SSLProxyVerify None
|
|
SSLProxyCheckPeerCN Off
|
|
SSLProxyCheckPeerName Off
|
|
|
|
# keep the host
|
|
ProxyPreserveHost On
|
|
|
|
# static html, js, images, etc. served from loolwsd
|
|
# loleaflet is the client part of LibreOffice Online
|
|
ProxyPass /loleaflet https://127.0.0.1:9980/loleaflet retry=0
|
|
ProxyPassReverse /loleaflet https://127.0.0.1:9980/loleaflet
|
|
|
|
# WOPI discovery URL
|
|
ProxyPass /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
|
|
ProxyPassReverse /hosting/discovery https://127.0.0.1:9980/hosting/discovery
|
|
|
|
# Main websocket
|
|
ProxyPassMatch "/lool/(.*)/ws$" wss://127.0.0.1:9980/lool/$1/ws nocanon
|
|
|
|
# Admin Console websocket
|
|
ProxyPass /lool/adminws wss://127.0.0.1:9980/lool/adminws
|
|
|
|
# Download as, Fullscreen presentation and Image upload operations
|
|
ProxyPass /lool https://127.0.0.1:9980/lool
|
|
ProxyPassReverse /lool https://127.0.0.1:9980/lool
|
|
|
|
# Endpoint with information about availability of various features
|
|
ProxyPass /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
|
|
ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities
|
|
|
|
CustomLog /var/log/apache2/office.domain.tld.log combined
|
|
ErrorLog /var/log/apache2/office.domain.tld.error.log
|
|
|
|
</VirtualHost>
|
|
```
|
|
|
|
Konfiguration aktivieren
|
|
|
|
```
|
|
a2ensite office.domain.tld.conf
|
|
a2enmod ssl proxy proxy_http proxy_wstunnel rewrite headers
|
|
systemctl restart apache2
|
|
```
|
|
|
|
In NC den eigenen Server eintragen:
|
|
|
|
|
|
|
|
## NextCloud Talk mit Signaling-Server
|
|
|
|
### Turn-Server installieren
|
|
|
|
```
|
|
apt install coturn
|
|
```
|
|
|
|
In `/etc/default/coturn` aktivieren
|
|
|
|
```
|
|
TURNSERVER_ENABLED=1
|
|
```
|
|
|
|
Datei `/etc/turnserver.conf` anpassen
|
|
|
|
```
|
|
listening-port=3478
|
|
listening-ip=<IPv4-Adresse des Servers>
|
|
listening-ip=<IPv6-Adresse des Servers>
|
|
fingerprint
|
|
lt-cred-mech
|
|
use-auth-secret
|
|
static-auth-secret=<Secret>
|
|
realm=<FQDN des Servers>
|
|
total-quota=0
|
|
bps-capacity=0
|
|
no-tls
|
|
no-dtls
|
|
stale-nonce
|
|
no-loopback-peers
|
|
no-multicast-peers
|
|
proc-user=turnserver
|
|
proc-group=turnserver
|
|
```
|
|
|
|
Coturn-Server (neu) starten:
|
|
|
|
```
|
|
service coturn restart
|
|
```
|
|
|
|
Firewall anpassen
|
|
|
|
```
|
|
iptables -A INPUT -p tcp -m tcp --dport 3478 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
iptables -A INPUT -p udp -m udp --dport 3478 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
ip6tables -A INPUT -p tcp -m tcp --dport 3478 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
ip6tables -A INPUT -p udp -m udp --dport 3478 -m state --state NEW,ESTABLISHED -j ACCEPT
|
|
netfilter-persistent save
|
|
```
|
|
|
|
NC-Einstellungen anpassen
|
|
|
|
|
|
|
|
### Janus installieren
|
|
|
|
```
|
|
add-apt-repository ppa:fancycode/janus
|
|
apt update
|
|
apt install janus
|
|
```
|
|
|
|
Konfiguration anpassen:
|
|
|
|
Datei `/etc/janus/janus.jcfg`
|
|
|
|
```
|
|
nat: {
|
|
stun_server = "<server>"
|
|
stun_port = 3478
|
|
nice_debug = false
|
|
full_trickle = true
|
|
# ...
|
|
turn_rest_api_key = "<key>"
|
|
# ...
|
|
}
|
|
```
|
|
|
|
Mit dem Befehl `openssl rand -hex 16` kann der `<key>` erzeugt werden.
|
|
|
|
Datei `/etc/janus/janus.transport.http.jcfg`
|
|
|
|
```
|
|
general: {
|
|
# ...
|
|
base_path = "/janus"
|
|
http = true
|
|
port = 8088
|
|
ip = 127.0.0.1
|
|
https = false
|
|
# ...
|
|
}
|
|
```
|
|
|
|
Datei `/etc/janus/janus.transport.websockets.jcfg`
|
|
|
|
```
|
|
general: {
|
|
# ...
|
|
ws = true
|
|
ws_port = 8188
|
|
ws_ip = 127.0.0.1
|
|
wss = false
|
|
# ...
|
|
}
|
|
```
|
|
|
|
Dienst (neu) starten:
|
|
|
|
```
|
|
systemctl restart janus
|
|
```
|
|
|
|
### NATS einrichten
|
|
|
|
```
|
|
docker pull nats:latest
|
|
docker run --name=natsserver -d -p 127.0.0.1:4222:4222 -ti --restart=always nats:latest
|
|
```
|
|
|
|
### Signaling-Server einrichten
|
|
|
|
```
|
|
apt install golang-go
|
|
cd /etc/
|
|
git clone https://github.com/strukturag/nextcloud-spreed-signaling.git
|
|
cd /etc/nextcloud-spreed-signaling
|
|
make build
|
|
```
|
|
|
|
Lokale Konfiguration erzeugen:
|
|
|
|
```
|
|
cd /etc/nextcloud-spreed-signaling
|
|
cp server.conf.in server.conf
|
|
```
|
|
|
|
Datei `/etc/nextcloud-spreed-signaling/server.conf`:
|
|
|
|
```
|
|
[http]
|
|
listen = 127.0.0.1:8086
|
|
|
|
[sessions]
|
|
hashkey = <session-hashkey>
|
|
blockkey = <session-blockkey>
|
|
|
|
[backend]
|
|
backends = backend1
|
|
|
|
[backend1]
|
|
url = <URL des Nextcloud-Servers>
|
|
secret = <Nextcloud-Secret>
|
|
|
|
[nats]
|
|
url = nats://localhost:4222
|
|
|
|
[mcu]
|
|
type = janus
|
|
url = ws://127.0.0.1:8188
|
|
|
|
[turn]
|
|
apikey = <API-Key von Janus (turn_rest_api_key)>
|
|
secret = <Secret von Coturn (static-auth-secret)>
|
|
```
|
|
|
|
Für `<session-hashkey>` kann `openssl rand -hex 32` verwendet werden, `<session-blockkey>` darf nur 32 bytes haben und kann mit `openssl rand -hex 16` gebildet werden.
|
|
|
|
Der Schlüssel `<Nextcloud-Secret>` kann ebenfalls mit `openssl rand -hex 32` erzeugt werden und wird dann in NC eingetragen.
|
|
|
|
Benutzer und Dienst anlegen:
|
|
|
|
```
|
|
groupadd signaling
|
|
useradd --system --gid signaling --shell /bin/false --comment "Nextcloud Signaling" signaling
|
|
```
|
|
|
|
Datei `/etc/systemd/system/nextcloud-signaling.service` anlegen
|
|
|
|
```
|
|
[Unit]
|
|
Description=Nextcloud Talk signaling server
|
|
|
|
[Service]
|
|
ExecStart=/etc/nextcloud-spreed-signaling/bin/signaling --config /etc/nextcloud-spreed-signaling/server.conf
|
|
User=signaling
|
|
Group=signaling
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
Dienst aktivieren und starten:
|
|
|
|
```
|
|
systemctl daemon-reload
|
|
systemctl enable nextcloud-signaling
|
|
systemctl start nextcloud-signaling
|
|
```
|
|
|
|
Dienste überprüfen:
|
|
|
|
Janus:
|
|
|
|
```
|
|
journalctl -u janus
|
|
```
|
|
|
|
Signaling-Server:
|
|
|
|
```
|
|
journalctl -u nextcloud-signaling
|
|
```
|
|
|
|
### Apache-Proxy konfigurieren
|
|
|
|
Entweder als eigene Subdomain, oder in die NC-Konfiguration integrieren:
|
|
|
|
```
|
|
RewriteEngine On
|
|
RewriteRule ^/standalone-signaling/spreed$ - [L]
|
|
RewriteRule ^/standalone-signaling/api/(.*) http://127.0.0.1:8086/api/$1 [L,P]
|
|
ProxyPass "/standalone-signaling/" "ws://127.0.0.1:8086/"
|
|
```
|
|
|
|
NC-Konfiguration anpassen:
|
|
|
|
Die URL wird mit `https://<servername>/standalone-signaling` angegeben, als "Gemeinsames Geheimnis" trägt man `<Nextcloud-Secret>` aus der Konfiguration des Signaling-Servers ein.
|
|
|
|
 |