CentOS 8 に Nextcloud 17 を Nginx / PHP-FPM 7.3 / MariaDB で構築する手順

sudo dnf install nginx

systemctl start nginx
systemctl enable nginx

systemctl status nginx

firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload

sudo dnf config-manager --set-enabled PowerTools
sudo dnf install epel-release
sudo dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm

dnf repolist

dnf module list php
dnf module enable php:remi-7.3

sudo dnf install php-fpm php-cli php-devel php-gd php-mysqlnd php-pear php-xml php-mbstring php-pdo php-json php-pecl-apcu php-pecl-apcu-devel php-pecl-imagick-devel php-intl php-opcache php-zip

vim /etc/php.ini

memory_limit = 512M
date.timezone = Asia/Jakarta
cgi.fixpathinfo = 0

vim /etc/php.d/10-opcache.ini

opcache.enable=1
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

vim /etc/php-fpm.d/www.conf

user = nginx
group = nginx
listen = /run/php-fpm/www.sock

env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp

php_value[opcache.file_cache] = /var/lib/php/opcache

mkdir -p /var/lib/php/{session,opcache}
chown -R nginx:nginx /var/lib/php/{session,opcache}

systemctl enable php-fpm
systemctl start php-fpm

netstat -pl | grep php
systemctl status php-fpm

sudo dnf install mariadb mariadb-server

systemctl start mariadb
systemctl enable mariadb

mysql_secure_installation

Set a root password? [Y/n] Y
Remove anonymous users? [Y/n] Y
Remove test database and access to it? [Y/n] Y
Reload privilege tables now? [Y/n] Y

mysql -u root -p
-- パスワード入力
create database nextcloud_db;
create user nextclouduser@localhost identified by 'nextcloudpassdb';
grant all privileges on nextcloud_db.* to nextclouduser@localhost identified by 'nextcloudpassdb';
flush privileges;
exit;

sudo dnf install certbot

certbot certonly --webroot --webroot-path /usr/share/nginx/html --agree-tos -m [email protected] -d cloud.hakase-labs.io

ls -lah /etc/letsencrypt/live/cloud.hakase-labs.io/

sudo dnf install unzip

cd /var/www/
wget https://download.nextcloud.com/server/releases/nextcloud-17.0.2.zip
unzip nextcloud-17.0.2.zip

mkdir -p /var/www/nextcloud/data/

sudo chown -R nginx:nginx /var/www/nextcloud

cd /etc/nginx/conf.d/
vim nextcloud.conf

upstream php-handler {
 #server 127.0.0.1:9000;
 server unix:/run/php-fpm/www.sock;
}

server {
 listen 80;
 listen [::]:80;
 server_name cloud.hakase-labs.io;
 # enforce https
 return 301 https://$server_name:443$request_uri;
}

server {
 listen 443 ssl http2;
 listen [::]:443 ssl http2;
 server_name cloud.hakase-labs.io;

 # Use Mozilla's guidelines for SSL/TLS settings
 # https://mozilla.github.io/server-side-tls/ssl-config-generator/
 # NOTE: some settings below might be redundant
 ssl_certificate /etc/ssl/nginx/fullchain.pem;
 ssl_certificate_key /etc/ssl/nginx/privkey.pem;

 # Add headers to serve security related headers
 add_header Referrer-Policy "no-referrer" always;
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-Download-Options "noopen" always;
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-Permitted-Cross-Domain-Policies "none" always;
 add_header X-Robots-Tag "none" always;
 add_header X-XSS-Protection "1; mode=block" always;

 fastcgi_hide_header X-Powered-By;

 root /var/www/nextcloud;

 location = /robots.txt {
 allow all;
 log_not_found off;
 access_log off;
 }

 location = /.well-known/carddav {
 return 301 $scheme://$host:$server_port/remote.php/dav;
 }
 location = /.well-known/caldav {
 return 301 $scheme://$host:$server_port/remote.php/dav;
 }

 client_max_body_size 512M;
 fastcgi_buffers 64 4K;

 gzip on;
 gzip_vary on;
 gzip_comp_level 4;
 gzip_min_length 256;
 gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
 gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

 location / {
 rewrite ^ /index.php;
 }

 location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
 deny all;
 }
 location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
 deny all;
 }

 location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
 fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
 set $path_info $fastcgi_path_info;
 try_files $fastcgi_script_name =404;
 include fastcgi_params;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 fastcgi_param PATH_INFO $path_info;
 fastcgi_param HTTPS on;
 fastcgi_param modHeadersAvailable true;
 fastcgi_param front_controller_active true;
 fastcgi_pass php-handler;
 fastcgi_intercept_errors on;
 fastcgi_request_buffering off;
 }

 location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
 try_files $uri/ =404;
 index index.php;
 }

 location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
 try_files $uri /index.php$request_uri;
 add_header Cache-Control "public, max-age=15778463";
 add_header Referrer-Policy "no-referrer" always;
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-Download-Options "noopen" always;
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-Permitted-Cross-Domain-Policies "none" always;
 add_header X-Robots-Tag "none" always;
 add_header X-XSS-Protection "1; mode=block" always;
 access_log off;
 }

 location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
 try_files $uri /index.php$request_uri;
 access_log off;
 }
}

nginx -t
systemctl restart nginx

netstat -plntu

sudo dnf install policycoreutils-python-utils

semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/data(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/apps(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/assets(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/.htaccess'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/nextcloud/.user.ini'

restorecon -Rv '/var/www/nextcloud/'

certbot renew --dry-run

# /etc/cron.d/certbot-reload の例
0 3,15 * * * root certbot renew --post-hook "systemctl reload nginx"

*/15 * * * * php -f /var/www/nextcloud/cron.php

mysqldump -u root -p nextcloud_db > nextcloud_db-$(date +%F).sql