Installation de Nextcloud: votre propre service de cloud chez vous

Cela fait quelques temps que j’utilise une instance Nextcloud sur le serveur. Cela vous permet de créer votre propre service de cloud: vous gérez vous-mêmes vos données (images, documents, fichiers…) sans passer par un service tiers.

Vous gardez donc entièrement la main sur vos données : plus besoin de Google Drive ou Dropbox (ou autre), c’est vous qui gérez. Nextcloud possède même ses applications mobiles pour pouvoir accéder à vos données à tout moment, sur tous supports.

Ce tutoriel est réalisé sous Ubuntu Server mais il est facilement transposable à votre système d’exploitation sous Linux.

Installation de Nextcloud

Voici les paquets PHP nécessaires pour installer Nextcloud:

• PHP (7.2, 7.3 or 7.4)
• PHP module ctype
• PHP module curl
• PHP module dom
• PHP module GD
• PHP module hash (only on FreeBSD)
• PHP module iconv
• PHP module JSON
• PHP module libxml (Linux package libxml2 must be >=2.7.0)
• PHP module mbstring
• PHP module openssl
• PHP module posix
• PHP module session
• PHP module SimpleXML
• PHP module XMLReader
• PHP module XMLWriter
• PHP module zip
• PHP module zlib

Nextcloud est maintenant capable de tourner sous PHP 7.4 donc vous pouvez installer les paquets PHP qui lui sont nécessaires:

apt install php7.4 php7.4-cli php7.4-gd php7.4-imap php7.4-mysql php7.4-soap php7.4-apcu php7.4-common php7.4-gmp  php7.4-intl php7.4-opcache php7.4-xml php7.4-apcu-bc php7.4-curl php7.4-igbinary php7.4-json php7.4-readline  php7.4-zip php7.4-bcmath php7.4-fpm php7.4-imagick php7.4-mbstring php7.4-redisCode language: CSS (css)

On télécharge Nextcloud, depuis la page Téléchargement ou via la ligne de commande:

wget https://download.nextcloud.com/server/releases/nextcloud-22.0.0.zipCode language: JavaScript (javascript)

On décompresse l’archive:

unzip nextcloud-22.0.0.zipCode language: CSS (css)

Et on déplace ensuite le répertoire dans un dossier public lisible par le serveur de fichiers:

mv nextcloud /var/www/html/Code language: JavaScript (javascript)

et on lui donne ensuite les bonnes permissions:

chown -R www-data:www-data /var/www/html/nextcloudCode language: JavaScript (javascript)

Création de la base de données

Une fois dans l’interface mysql:

CREATE USER 'nextcloud_user'@'localhost' IDENTIFIED BY 'password';
CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci; 
GRANT ALL PRIVILEGES on nextcloud.* to 'nextcloud_user'@'localhost'; 
FLUSH privileges;
quit;Code language: JavaScript (javascript)

Server block NginX pour Nextcloud

Notre serveur utilise NginX donc nous allons créer un nouveau server block:

nano /etc/nginx/sites-available/nextcloud.conf

et on y ajoute:

upstream php-handler {
   #server 127.0.0.1:9000;
   server unix:/run/php/php7.4-fpm.sock;
 }
 server {
   listen 80;
   listen [::]:80;
   server_name XXXXXX.EXAMPLE.COM;
   # enforce https
   return 301 https://$server_name$request_uri;
 }
 server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
   server_name XXXXXX.EXAMPLE.COM;
   ssl_certificate   /etc/nginx/ssl/skyminds.net/fullchain.pem;
   ssl_certificate_key   /etc/nginx/ssl/skyminds.net/privkey.pem;

Add headers to serve security-related headers
   # Before enabling Strict-Transport-Security headers please read into this
   # topic first.
   # add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;";
   #
   # WARNING: Only add the preload option once you read about
   # the consequences in https://hstspreload.org/. This option
   # will add the domain to a hardcoded list that is shipped
   # in all major browsers and getting removed from this list
   # could take several months.
   add_header X-Frame-Options SAMEORIGIN;
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";
   add_header X-Robots-Tag none;
   add_header X-Download-Options noopen;
   add_header X-Permitted-Cross-Domain-Policies none;
   add_header Referrer-Policy "strict-origin-when-cross-origin";

# Remove X-Powered-By, which is an information leak
   fastcgi_hide_header X-Powered-By;
 # Path to the root of your installation
   root /home/www/nextcloud/;
 error_log /var/log/nginx/nextcloud.log;
 location = /robots.txt {
   allow all;
   log_not_found off;
   access_log off;
   }

# Make a regex exception for `/.well-known` so that clients can still     
# access it despite the existence of the regex rule     
# `location ~ /(\.|autotest|...)` which would otherwise handle requests     
# for `/.well-known`.     
location ^~ /.well-known {         
# The following 6 rules are borrowed from `.htaccess`         
location = /.well-known/carddav     { return 301 /remote.php/dav/; }         location = /.well-known/caldav      { return 301 /remote.php/dav/; }         
# Anything else is dynamically handled by Nextcloud         
location ^~ /.well-known            { return 301 /index.php$uri; }         try_files $uri $uri/ =404;     
}

 # set max upload size
   client_max_body_size 512M;
   fastcgi_buffers 64 4K;
 # Enable gzip but do not remove ETag headers
   gzip on;
   gzip_vary on;
   gzip_comp_level 4;
   gzip_min_length 256;
   gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
   gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 # Uncomment if your server is built with the ngx_pagespeed module
   # This module is currently not supported.
   #pagespeed off;

 location / {
   rewrite ^ /index.php$uri;
   }
 location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
   deny all;
   }
   location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) {
   deny all;
   }
 location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+).php(?:$|/) {
   try_files $fastcgi_script_name =404;
   fastcgi_split_path_info ^(.+.php)(/.*)$;
   set $path_info $fastcgi_path_info;
   try_files $fastcgi_script_name =404;
   include fastcgi_params;
   fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
   fastcgi_param PATH_INFO $fastcgi_path_info;
   fastcgi_param HTTPS on;
   #Avoid sending the security headers twice
   fastcgi_param modHeadersAvailable true;
   fastcgi_param front_controller_active true;
   fastcgi_pass php-handler;
   fastcgi_intercept_errors on;
   fastcgi_request_buffering off;
   }
 location ~ ^/(?:updater|ocs-provider)(?:$|/) {
   try_files $uri/ =404;
   index index.php;
   }
 # Adding the cache control header for js and css files
   # Make sure it is BELOW the PHP block
   location ~ .(?:css|js|woff|svg|gif)$ {
   try_files $uri /index.php$uri$is_args$args;
   add_header Cache-Control "public, max-age=15778463";
   # Add headers to serve security related headers (It is intended to
   # have those duplicated to the ones above)
   # Before enabling Strict-Transport-Security headers please read into
   # this topic first.
   #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
   #
   # WARNING: Only add the preload option once you read about
   # the consequences in https://hstspreload.org/. This option
   # will add the domain to a hardcoded list that is shipped
   # in all major browsers and getting removed from this list
   # could take several months.
   add_header X-Content-Type-Options nosniff always;
   add_header X-XSS-Protection "1; mode=block" always;
   add_header X-Robots-Tag none always;
   add_header X-Download-Options noopen always;
   add_header X-Permitted-Cross-Domain-Policies none always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   # Optional: Don't log access to assets
   access_log off;
   }
 location ~ .(?:png|html|ttf|ico|jpg|jpeg)$ {
   try_files $uri /index.php$uri$is_args$args;
   # Optional: Don't log access to other assets
   access_log off;
   }
 }Code language: PHP (php)

N’oubliez pas de modifier:

• le chemin du root
• le chemin vers le socket PHP s’il diffère
• le nom de votre server_name
• le chemin de vos certificats TLS

On teste notre server block:

nginx -t

et on redémarre NginX:

service nginx restart

Ajout du serveur redis

Nextcloud – ainsi que tous nos autres sites sur le serveur – fonctionne bien mieux avec le serveur Redis installé:

apt install redis-server

Ensuite, éditez la configuration de Nextcloud:

nano /home/www/nextcloud/config/config.php

et ajoutez/modifiez les lignes suivantes:

'filelocking.enabled' => true,
'memcache.local' => '\\OC\\Memcache\\APCu',
'memcache.distributed' => '\\OC\\Memcache\\Redis',
'redis' =>
  array (
    'host' => '127.0.0.1',
    'port' => 6379,
    'timeout' => 0.0,
  ),Code language: PHP (php)

Enregistrez le fichier puis relancez les services:

service redis-server php7.4-fpm nginx restartCode language: CSS (css)

Certificat TLS

J’utilise un sous-domaine qui est automatique pris en charge par un certificat wildcard mais si vous avez besoin d’un certificat TLS pour votre Nextcloud, il suffit d’utiliser acme.sh:

DOMAIN="XXXXX.example.com"

acme.sh --issue -d $DOMAIN --keylength ec-384 --dns dns_cf
Code language: PHP (php)

et ensuite on copie les nouveaux fichiers vers notre répertoire nginx:

acme.sh --install-cert --ecc -d $DOMAIN --key-file /etc/nginx/ssl/$DOMAIN/privkey.pem --fullchain-file /etc/nginx/ssl/$DOMAIN/fullchain.pem --reloadcmd "service nginx force-reload"Code language: PHP (php)

Une fois le certificat installé, modifiez la configuration du server block NginX pour actualiser l’adresse des certificats, activer la redirection HTTP/HTTPS et activer HSTS.

Il ne vous reste plus qu’à lancer l’installation en ligne depuis le site que vous venez de créer.