378 lines
11 KiB
Bash
378 lines
11 KiB
Bash
#!/usr/bin/env bash
|
|
# Nextcloud + Apache + PHP 8.3 (php-legacy) + MariaDB + Redis on Arch Linux
|
|
# Production-oriented, reverse-proxy aware
|
|
#
|
|
# Run as root:
|
|
# sudo ./arch_install.sh
|
|
|
|
set -euo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
# =========================
|
|
# EDIT THESE VARIABLES
|
|
# =========================
|
|
DOMAIN="domain.com"
|
|
|
|
NC_DIR="/srv/http/nextcloud"
|
|
NC_DATA_DIR="/srv/nextcloud-data"
|
|
|
|
DB_NAME="nextcloud"
|
|
DB_USER="nextcloud"
|
|
DB_PASS="changeMe"
|
|
|
|
ADMIN_USER="admin"
|
|
ADMIN_PASS="changeMe"
|
|
|
|
TRUST_LOCAL_PROXY="true"
|
|
REAL_IP_HEADER="CF-Connecting-IP" # use X-Forwarded-For if not Cloudflare
|
|
|
|
NC_VERSION="33.0.0"
|
|
NC_TARBALL_URL="https://download.nextcloud.com/server/releases/nextcloud-${NC_VERSION}.tar.bz2"
|
|
NC_SHA512_URL="https://download.nextcloud.com/server/releases/nextcloud-${NC_VERSION}.tar.bz2.sha512"
|
|
|
|
PHP_BIN="/usr/bin/php-legacy"
|
|
PHP_INI="/etc/php-legacy/php.ini"
|
|
PHP_FPM_WWW_CONF="/etc/php-legacy/php-fpm.d/www.conf"
|
|
PHP_FPM_SERVICE="php-fpm-legacy"
|
|
|
|
REDIS_SOCK="/run/redis/redis.sock"
|
|
|
|
log() {
|
|
printf '\n==== %s ====\n' "$1"
|
|
}
|
|
|
|
require_root() {
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "Run this script as root."
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
check_vars() {
|
|
local vars=(
|
|
DOMAIN NC_DIR NC_DATA_DIR
|
|
DB_NAME DB_USER DB_PASS
|
|
ADMIN_USER ADMIN_PASS
|
|
NC_VERSION NC_TARBALL_URL NC_SHA512_URL
|
|
)
|
|
for v in "${vars[@]}"; do
|
|
if [[ -z "${!v}" ]]; then
|
|
echo "Variable $v is empty. Edit the script first."
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
enable_php_ext() {
|
|
local ext="$1"
|
|
if ! grep -Eq "^[[:space:]]*extension=${ext}\.so" "$PHP_INI"; then
|
|
sed -i "/^;extension=${ext}\.so/s/^;//" "$PHP_INI" || true
|
|
if ! grep -Eq "^[[:space:]]*extension=${ext}\.so" "$PHP_INI"; then
|
|
printf "\nextension=%s.so\n" "$ext" >> "$PHP_INI"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
set_ini_value() {
|
|
local key="$1"
|
|
local value="$2"
|
|
if grep -Eq "^[;[:space:]]*${key}[[:space:]]*=" "$PHP_INI"; then
|
|
sed -ri "s|^[;[:space:]]*${key}[[:space:]]*=.*|${key} = ${value}|" "$PHP_INI"
|
|
else
|
|
printf "\n%s = %s\n" "$key" "$value" >> "$PHP_INI"
|
|
fi
|
|
}
|
|
|
|
set_fpm_value() {
|
|
local key="$1"
|
|
local value="$2"
|
|
if grep -Eq "^[;[:space:]]*${key}[[:space:]]*=" "$PHP_FPM_WWW_CONF"; then
|
|
sed -ri "s|^[;[:space:]]*${key}[[:space:]]*=.*|${key} = ${value}|" "$PHP_FPM_WWW_CONF"
|
|
else
|
|
printf "\n%s = %s\n" "$key" "$value" >> "$PHP_FPM_WWW_CONF"
|
|
fi
|
|
}
|
|
|
|
detect_redis_conf() {
|
|
if [[ -f /etc/redis/redis.conf ]]; then
|
|
echo "/etc/redis/redis.conf"
|
|
elif [[ -f /etc/redis.conf ]]; then
|
|
echo "/etc/redis.conf"
|
|
else
|
|
echo ""
|
|
fi
|
|
}
|
|
|
|
require_cmd() {
|
|
command -v "$1" >/dev/null 2>&1 || {
|
|
echo "Required command not found: $1"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
require_root
|
|
check_vars
|
|
|
|
log "Updating system and installing packages"
|
|
pacman -Syu --noconfirm
|
|
|
|
pacman -S --needed --noconfirm \
|
|
apache mariadb redis cronie \
|
|
php-legacy php-legacy-fpm php-legacy-gd php-legacy-intl php-legacy-sodium \
|
|
php-legacy-apcu php-legacy-redis php-legacy-imagick \
|
|
curl wget tar bzip2 unzip sudo
|
|
|
|
require_cmd mariadb
|
|
require_cmd httpd
|
|
require_cmd redis-server
|
|
require_cmd "${PHP_BIN}"
|
|
|
|
log "Creating base directories"
|
|
install -d -m 0755 /srv/http
|
|
install -d -m 0750 "${NC_DATA_DIR}"
|
|
|
|
log "Initializing and configuring MariaDB"
|
|
if [[ ! -d /var/lib/mysql/mysql ]]; then
|
|
mariadb-install-db --user=mysql --basedir=/usr --datadir=/var/lib/mysql
|
|
fi
|
|
|
|
systemctl enable --now mariadb
|
|
|
|
mariadb <<'SQL'
|
|
DELETE FROM mysql.user WHERE User='';
|
|
DROP DATABASE IF EXISTS test;
|
|
DELETE FROM mysql.db WHERE Db='test' OR Db LIKE 'test\_%';
|
|
FLUSH PRIVILEGES;
|
|
SQL
|
|
|
|
mariadb <<SQL
|
|
CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\`
|
|
CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
|
|
CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';
|
|
GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';
|
|
FLUSH PRIVILEGES;
|
|
SQL
|
|
|
|
log "Configuring PHP 8.3 legacy stack"
|
|
for ext in gd intl mysqli pdo_mysql sodium zip apcu redis imagick; do
|
|
enable_php_ext "$ext"
|
|
done
|
|
|
|
set_ini_value "memory_limit" "512M"
|
|
set_ini_value "upload_max_filesize" "1024M"
|
|
set_ini_value "post_max_size" "1024M"
|
|
set_ini_value "max_execution_time" "360"
|
|
set_ini_value "max_input_time" "360"
|
|
set_ini_value "output_buffering" "Off"
|
|
set_ini_value "date.timezone" "UTC"
|
|
|
|
# opcache
|
|
if ! grep -Eq '^[[:space:]]*zend_extension[[:space:]]*=.*opcache' "$PHP_INI"; then
|
|
printf "\nzend_extension=opcache\n" >> "$PHP_INI"
|
|
fi
|
|
set_ini_value "opcache.enable" "1"
|
|
set_ini_value "opcache.enable_cli" "0"
|
|
set_ini_value "opcache.interned_strings_buffer" "16"
|
|
set_ini_value "opcache.max_accelerated_files" "10000"
|
|
set_ini_value "opcache.memory_consumption" "256"
|
|
set_ini_value "opcache.save_comments" "1"
|
|
set_ini_value "opcache.revalidate_freq" "60"
|
|
|
|
set_fpm_value "user" "http"
|
|
set_fpm_value "group" "http"
|
|
set_fpm_value "listen" "/run/php-fpm-legacy/php-fpm.sock"
|
|
set_fpm_value "listen.owner" "http"
|
|
set_fpm_value "listen.group" "http"
|
|
set_fpm_value "listen.mode" "0660"
|
|
set_fpm_value "pm" "dynamic"
|
|
set_fpm_value "pm.max_children" "64"
|
|
set_fpm_value "pm.start_servers" "8"
|
|
set_fpm_value "pm.min_spare_servers" "4"
|
|
set_fpm_value "pm.max_spare_servers" "16"
|
|
|
|
systemctl enable --now "${PHP_FPM_SERVICE}"
|
|
systemctl restart "${PHP_FPM_SERVICE}"
|
|
|
|
log "Configuring Redis"
|
|
REDIS_CONF="$(detect_redis_conf)"
|
|
if [[ -z "${REDIS_CONF}" ]]; then
|
|
echo "Could not find Redis config file."
|
|
echo "Looked for /etc/redis/redis.conf and /etc/redis.conf"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Using Redis config: ${REDIS_CONF}"
|
|
|
|
sed -ri 's|^port .*|port 0|' "${REDIS_CONF}"
|
|
|
|
if grep -Eq '^[[:space:]]*unixsocket[[:space:]]+' "${REDIS_CONF}"; then
|
|
sed -ri "s|^[[:space:]]*unixsocket[[:space:]]+.*|unixsocket ${REDIS_SOCK}|" "${REDIS_CONF}"
|
|
else
|
|
printf "\nunixsocket %s\n" "${REDIS_SOCK}" >> "${REDIS_CONF}"
|
|
fi
|
|
|
|
if grep -Eq '^[[:space:]]*unixsocketperm[[:space:]]+' "${REDIS_CONF}"; then
|
|
sed -ri 's|^[[:space:]]*unixsocketperm[[:space:]]+.*|unixsocketperm 770|' "${REDIS_CONF}"
|
|
else
|
|
printf "unixsocketperm 770\n" >> "${REDIS_CONF}"
|
|
fi
|
|
|
|
usermod -aG redis http || true
|
|
systemctl enable --now redis
|
|
systemctl restart redis
|
|
|
|
log "Configuring Apache"
|
|
HTTPD_CONF="/etc/httpd/conf/httpd.conf"
|
|
|
|
sed -ri 's|^#(LoadModule proxy_module modules/mod_proxy.so)|\1|' "${HTTPD_CONF}"
|
|
sed -ri 's|^#(LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so)|\1|' "${HTTPD_CONF}"
|
|
sed -ri 's|^#(LoadModule rewrite_module modules/mod_rewrite.so)|\1|' "${HTTPD_CONF}"
|
|
sed -ri 's|^#(LoadModule headers_module modules/mod_headers.so)|\1|' "${HTTPD_CONF}"
|
|
sed -ri 's|^#(LoadModule remoteip_module modules/mod_remoteip.so)|\1|' "${HTTPD_CONF}" || true
|
|
sed -ri 's|^#(LoadModule env_module modules/mod_env.so)|\1|' "${HTTPD_CONF}" || true
|
|
sed -ri 's|^#(LoadModule mime_module modules/mod_mime.so)|\1|' "${HTTPD_CONF}" || true
|
|
sed -ri 's|^#(LoadModule dir_module modules/mod_dir.so)|\1|' "${HTTPD_CONF}" || true
|
|
sed -ri 's|^#(LoadModule setenvif_module modules/mod_setenvif.so)|\1|' "${HTTPD_CONF}" || true
|
|
|
|
if ! grep -Eq '^[[:space:]]*ServerName[[:space:]]+' "${HTTPD_CONF}"; then
|
|
printf "\nServerName %s\n" "${DOMAIN}" >> "${HTTPD_CONF}"
|
|
fi
|
|
|
|
install -d -m 0755 /etc/httpd/conf/extra
|
|
|
|
if ! grep -Fq "IncludeOptional conf/extra/*.conf" "${HTTPD_CONF}"; then
|
|
printf "\nIncludeOptional conf/extra/*.conf\n" >> "${HTTPD_CONF}"
|
|
fi
|
|
|
|
cat > /etc/httpd/conf/extra/remoteip-nextcloud.conf <<EOF
|
|
RemoteIPHeader ${REAL_IP_HEADER}
|
|
RemoteIPTrustedProxy 127.0.0.1
|
|
RemoteIPTrustedProxy ::1
|
|
EOF
|
|
|
|
cat > /etc/httpd/conf/extra/nextcloud.conf <<EOF
|
|
<VirtualHost *:80>
|
|
ServerName ${DOMAIN}
|
|
DocumentRoot ${NC_DIR}
|
|
|
|
<Directory ${NC_DIR}>
|
|
Require all granted
|
|
AllowOverride All
|
|
Options FollowSymLinks MultiViews
|
|
|
|
<IfModule mod_dav.c>
|
|
Dav off
|
|
</IfModule>
|
|
|
|
<IfModule mod_headers.c>
|
|
Header always set Referrer-Policy "no-referrer"
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "SAMEORIGIN"
|
|
Header always set X-XSS-Protection "1; mode=block"
|
|
</IfModule>
|
|
</Directory>
|
|
|
|
DirectoryIndex index.php index.html
|
|
LimitRequestBody 0
|
|
SetEnv HOME ${NC_DIR}
|
|
SetEnv HTTP_HOME ${NC_DIR}
|
|
|
|
<FilesMatch "\.php$">
|
|
SetHandler "proxy:unix:/run/php-fpm-legacy/php-fpm.sock|fcgi://localhost/"
|
|
</FilesMatch>
|
|
|
|
ErrorLog "/var/log/httpd/nextcloud_error.log"
|
|
CustomLog "/var/log/httpd/nextcloud_access.log" combined
|
|
</VirtualHost>
|
|
EOF
|
|
|
|
httpd -t
|
|
systemctl enable --now httpd
|
|
systemctl reload httpd
|
|
|
|
log "Downloading official Nextcloud release"
|
|
TMPDIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
|
|
cd "$TMPDIR"
|
|
curl -fsSLo nextcloud.tar.bz2 "${NC_TARBALL_URL}"
|
|
curl -fsSLo nextcloud.tar.bz2.sha512 "${NC_SHA512_URL}"
|
|
sha512sum -c nextcloud.tar.bz2.sha512
|
|
tar -xjf nextcloud.tar.bz2
|
|
|
|
log "Deploying Nextcloud"
|
|
rm -rf "${NC_DIR}"
|
|
mv nextcloud "${NC_DIR}"
|
|
|
|
chown -R http:http "${NC_DIR}" "${NC_DATA_DIR}"
|
|
find "${NC_DIR}" -type d -exec chmod 0750 {} \;
|
|
find "${NC_DIR}" -type f -exec chmod 0640 {} \;
|
|
chmod 0750 "${NC_DATA_DIR}"
|
|
|
|
install -d -o http -g http -m 0750 "${NC_DIR}/config"
|
|
install -d -o http -g http -m 0750 "${NC_DIR}/apps"
|
|
|
|
log "Running Nextcloud installer"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" maintenance:install \
|
|
--database "mysql" \
|
|
--database-name "${DB_NAME}" \
|
|
--database-user "${DB_USER}" \
|
|
--database-pass "${DB_PASS}" \
|
|
--admin-user "${ADMIN_USER}" \
|
|
--admin-pass "${ADMIN_PASS}" \
|
|
--data-dir "${NC_DATA_DIR}"
|
|
|
|
log "Applying reverse-proxy and HTTPS settings"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set overwrite.cli.url --value="https://${DOMAIN}"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set overwriteprotocol --value="https"
|
|
|
|
if [[ "${TRUST_LOCAL_PROXY}" == "true" ]]; then
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set trusted_proxies 0 --value="127.0.0.1"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set trusted_proxies 1 --value="::1"
|
|
|
|
if [[ "${REAL_IP_HEADER}" == "CF-Connecting-IP" ]]; then
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set forwarded_for_headers 0 --value="HTTP_CF_CONNECTING_IP"
|
|
else
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set forwarded_for_headers 0 --value="HTTP_X_FORWARDED_FOR"
|
|
fi
|
|
fi
|
|
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set trusted_domains 1 --value="${DOMAIN}"
|
|
|
|
log "Configuring APCu and Redis"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set memcache.local --value='\OC\Memcache\APCu'
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set memcache.locking --value='\OC\Memcache\Redis'
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" config:system:set redis --type=json --value="{\"host\":\"${REDIS_SOCK}\",\"port\":0,\"timeout\":1.5}"
|
|
|
|
log "Configuring cron background jobs"
|
|
systemctl enable --now cronie
|
|
|
|
cat > /etc/cron.d/nextcloud <<EOF
|
|
*/5 * * * * http ${PHP_BIN} -f ${NC_DIR}/cron.php
|
|
EOF
|
|
|
|
chmod 0644 /etc/cron.d/nextcloud
|
|
systemctl restart cronie
|
|
|
|
log "Finalizing"
|
|
sudo -u http "${PHP_BIN}" "${NC_DIR}/occ" maintenance:update:htaccess || true
|
|
|
|
echo
|
|
echo "================================================================="
|
|
echo " Nextcloud installed successfully"
|
|
echo " URL: https://${DOMAIN}"
|
|
echo " Admin user: ${ADMIN_USER}"
|
|
echo " Admin pass: ${ADMIN_PASS}"
|
|
echo " Web root: ${NC_DIR}"
|
|
echo " Data dir: ${NC_DATA_DIR}"
|
|
echo " PHP: ${PHP_BIN}"
|
|
echo " FPM svc: ${PHP_FPM_SERVICE}"
|
|
echo " Redis conf: ${REDIS_CONF}"
|
|
echo "-----------------------------------------------------------------"
|
|
echo " Services enabled:"
|
|
echo " - httpd"
|
|
echo " - ${PHP_FPM_SERVICE}"
|
|
echo " - mariadb"
|
|
echo " - redis"
|
|
echo " - cronie"
|
|
echo "=================================================================" |