Nextcloud

MariaDB

Installation

apk add --update nextcloud-mysql mariadb mariadb-client

Configuration

mysql_install_db --user=mysql --datadir=/var/lib/mysql
rc-service mariadb start
rc-update add mariadb
mysql_secure_installation

Base de données Nextcloud

mysql -u root -p

CHANGER LE MOT DE PASSE CI-DESSOUS

CREATE USER 'nextclouddb'@'localhost' IDENTIFIED BY '';
CREATE DATABASE IF NOT EXISTS nextclouddb CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;
GRANT ALL PRIVILEGES ON nextclouddb.* TO 'nextclouddb'@'localhost';
FLUSH PRIVILEGES;
QUIT;

Retirer les paquets inutiles

apk del mariadb-client

Nextcloud

Installation

apk add --update nextcloud-initscript nextcloud-files_pdfviewer nextcloud-text nextcloud-notifications nextcloud-files_videoplayer nextcloud-files_external nextcloud-default-apps

Configuration

nano /usr/share/webapps/nextcloud/config/config.php

'overwrite.cli.url' => 'https://cloud.exemple.fr',
'htaccess.RewriteBase' => '/',
'default_phone_region' => 'FR',

Si reverse proxy :

'trusted_domains' =>
   [
    'cloud.exemple.fr'
  ],

PHP

Installation

apk add --update php82 php82-gd php82-curl php82-zip php82-dom php82-xml php82-simplexml php82-mbstring php82-intl php82-pecl-imagick php82-fpm php82-sysvsem php82-exif

Configuration

date.timezone

sed -i.bak 's/;date.timezone =/date.timezone = Europe\/Paris/g' /etc/php82/php.ini

memory_limit

sed -i.bak 's/memory_limit = 128M/memory_limit = 2048M /g' /etc/php82/php.ini

upload_max_filesize

sed -i.bak 's/upload_max_filesize = 2M/upload_max_filesize = 1000G /g' /etc/php82/php.ini

serverinfo

nano /etc/php82/php-fpm.d/nextcloud.conf

Chercher cette ligne et y retirer shell_exec

; Disable certain functions for security reasons.
; http://php.net/disable-functions
php_admin_value[disable_functions] = exec,passthru,shell_exec,system,curl_multi_exec,show_source

opcache

apk add --update php82-opcache

sed -i.bak 's/;opcache.enable=1/opcache.enable=1/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.enable_cli=0/opcache.enable_cli=1/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.interned_strings_buffer=8/opcache.interned_strings_buffer=8/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.max_accelerated_files=10000/opcache.max_accelerated_files=10000/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.memory_consumption=128/opcache.memory_consumption=128/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.save_comments=1/opcache.save_comments=1/g' /etc/php82/php.ini
sed -i.bak 's/;opcache.revalidate_freq=2/opcache.revalidate_freq=1/g' /etc/php82/php.ini

Nginx

Installation

apk add --update nginx

Configuration

nginx.conf

mv /etc/nginx/nginx.conf /etc/nginx/[old]-nginx.conf
nano /etc/nginx/nginx.conf

user nginx;
worker_processes auto;

# Configures default error logger.
error_log /var/log/nginx/error.log warn; # Log warn, error, crit, alert, emerg

events {
    # The maximum number of simultaneous connections that can be opened by a worker process.
    worker_connections 1024; # increase if you need more connections
}

http {
    # server_names_hash_bucket_size controls the maximum length
    # of a virtual host entry (ie the length of the domain name).
    server_names_hash_bucket_size   64; # controls the maximum length of a virtual host entry (ie domain name)
    server_tokens                   off; # hide who we are, don't show nginx version to clients
    sendfile                        on; # can cause issues

    # Specifies the maximum accepted body size of a client request, as
    # indicated by the request header Content-Length. If the stated content
    # length is greater than this size, then the client receives the HTTP
    # error code 413. Set to 0 to disable. Default is '1m'.
    client_max_body_size 0;

    # nginx will find this file in the config directory set at nginx build time
    # Includes mapping of file name extensions to MIME types of responses
    include mime.types;

    # fallback in case we can't determine a type
    default_type application/octet-stream;

    # buffering causes issues, disable it
    # increase buffer size. still useful even when buffering is off
    proxy_buffering off;
    proxy_buffer_size 4k;

    # allow the server to close the connection after a client stops responding. Frees up socket-associated memory.
    reset_timedout_connection on;

    # Specifies the main log format.
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
            '$status $body_bytes_sent "$http_referer" '
            '"$http_user_agent" "$http_x_forwarded_for"';

    # Sets the path, format, and configuration for a buffered log write.
    # Buffer log writes to speed up IO, or disable them altogether
    access_log /var/log/nginx/access.log main buffer=16k;
    #access_log off;

    # Include files with config snippets into the root context.
    include conf.d/*.conf;

    # Includes virtual hosts configs.
    include http.d/*.conf;
}

Configuration SSL

mkdir /etc/nginx/conf.d
nano /etc/nginx/conf.d/ssl-params.inc

Puis copier ce contenu :

# secure nginx, see https://cipherli.st/

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver_timeout 5s;

# https://hstspreload.org
# By default, HSTS header is not added to subdomain requests. If you have subdomains and want
# HSTS to apply to all of them, you should add the includeSubDomains variable like this:
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

add_header Referrer-Policy                   "no-referrer"       always;
add_header X-Content-Type-Options            "nosniff"           always;
add_header X-Frame-Options                   "SAMEORIGIN"        always;
add_header X-Permitted-Cross-Domain-Policies "none"              always;
add_header X-Robots-Tag                      "noindex, nofollow" always;
add_header X-XSS-Protection                  "1; mode=block"     always;

Génération du fichier ssl_dhparam

Cela peut être un peu long.

openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096

nextcloud.conf

mv /etc/nginx/http.d/default.conf /etc/nginx/http.d/default.conf.old
nano /etc/nginx/http.d/nextcloud.conf

# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
    "" "";
    default ", immutable";
}

server {
        #listen       [::]:80; #uncomment for IPv6 support
        listen       80;
        return 301 https://$host$request_uri;
        server_name cloud.exemple.fr;
}

server {
        #listen       [::]:443 ssl http2; #uncomment for IPv6 support
        listen       443 ssl http2;
        server_name  cloud.exemple.fr;
    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
        ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

    # Path to the root of your installation
        root /usr/share/webapps/nextcloud;

    include /etc/nginx/conf.d/ssl-params.inc; # SSL parameters

    # set max upload size and increase upload timeout:
    client_max_body_size 512M;
    client_body_timeout 300s;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # The settings allows you to optimize the HTTP2 bandwidth.
    # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
    # for tuning hints
    client_body_buffer_size 512k;

    # Remove X-Powered-By, which is an information leak
    fastcgi_hide_header X-Powered-By;

    # Set .mjs and .wasm MIME types
    # Either include it in the default mime.types list
    # and include that list explicitly or add the file extension
    # only for Nextcloud like below:
    include mime.types;
    types {
        text/javascript mjs;
        application/wasm;
    }
    # Specify how to handle directories -- specifying `/index.php$request_uri`
        # here as the fallback means that Nginx always exhibits the desired behaviour
        # when a client requests a path that corresponds to a directory that exists
        # on the server. In particular, if that directory contains an index.php file,
        # that file is correctly served; if it doesn't, then the request is passed to
        # the front-end controller. This consistent behaviour means that we don't need
        # to specify custom rules for certain paths (e.g. images and other assets,
        # `/updater`, `/ocs-provider`), and thus
        # `try_files $uri $uri/ /index.php$request_uri`
        # always provides the desired behaviour.
        index index.php index.html /index.php$request_uri;

        # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
        location = / {
                if ( $http_user_agent ~ ^DavClnt ) {
                        return 302 /remote.php/webdav/$is_args$args;
                }
        }

        location = /robots.txt {
                allow all;
                log_not_found off;
                access_log off;
        }

        # Make a regex exception for `/.well-known` so that clients can still
        # access it despite the existence of the regex rule
        # `location ~ /(\.|autotest|...)` which would otherwise handle requests
        # for `/.well-known`.
        location ^~ /.well-known {
                # The rules in this block are an adaptation of the rules
                # in `.htaccess` that concern `/.well-known`.

                location = /.well-known/carddav { return 301 /remote.php/dav/; }
                location = /.well-known/caldav  { return 301 /remote.php/dav/; }

                location /.well-known/acme-challenge        { try_files $uri $uri/ =404; }
                location /.well-known/pki-validation        { try_files $uri $uri/ =404; }

                # Let Nextcloud's API for `/.well-known` URIs handle all other
                # requests by passing them to the front-end controller.
                return 301 /index.php$request_uri;
        }

        # Rules borrowed from `.htaccess` to hide certain paths from clients
        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                                { return 404; }

        # Ensure this block, which passes PHP files to the PHP process, is above the blocks
        # which handle static assets (as seen below). If this block is not declared first,
        # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
        # to the URI, resulting in a HTTP 500 error response.
        location ~ \.php(?:$|/) {
                # Required for legacy support
                rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;

                fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                set $path_info $fastcgi_path_info;

                try_files $fastcgi_script_name =404;

                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_param PATH_INFO $path_info;
                fastcgi_param HTTPS on;

                fastcgi_param modHeadersAvailable true;                 # Avoid sending the security headers twice
                fastcgi_param front_controller_active true;         # Enable pretty urls
                fastcgi_pass unix:/run/nextcloud/fastcgi.sock; # From the nextcloud-initscript package

                fastcgi_intercept_errors on;
                fastcgi_request_buffering off;

                fastcgi_max_temp_file_size 0;
        }

        # Serve static files
        location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
                try_files $uri /index.php$request_uri;
                # HTTP response headers borrowed from Nextcloud `.htaccess`
                add_header Cache-Control                                         "public, max-age=15778463$asset_immutable";
                add_header Referrer-Policy                                   "no-referrer"           always;
                add_header X-Content-Type-Options                        "nosniff"                   always;
                add_header X-Frame-Options                                   "SAMEORIGIN"                always;
                add_header X-Permitted-Cross-Domain-Policies "none"                          always;
                add_header X-Robots-Tag                                          "noindex, nofollow" always;
                add_header X-XSS-Protection                                  "1; mode=block"         always;
                access_log off;         # Optional: Don't log access to assets
        }

        location ~ \.woff2?$ {
                try_files $uri /index.php$request_uri;
                expires 7d;                 # Cache-Control policy borrowed from `.htaccess`
                access_log off;         # Optional: Don't log access to assets
        }

        # Rule borrowed from `.htaccess`
        location /remote {
                return 301 /remote.php$request_uri;
        }

        location / {
                try_files $uri $uri/ /index.php$request_uri;
        }
}

Démarrer les services

rc-service nginx start
rc-service nextcloud start
rc-service php-fpm82 start

rc-update add nginx
rc-update add nextcloud
rc-update add php-fpm82

Crontab

crontab -u nextcloud -e

Puis ajouter

*/5  *  *  *  * php -f /usr/share/webapps/nextcloud/cron.php