-
-
Notifications
You must be signed in to change notification settings - Fork 665
/
nextcloud_install_production.sh
1120 lines (980 loc) · 33.2 KB
/
nextcloud_install_production.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# T&M Hansson IT AB © - 2024, https://www.hanssonit.se/
# GNU General Public License v3.0
# https://github.com/nextcloud/vm/blob/main/LICENSE
# Prefer IPv4 for apt
echo 'Acquire::ForceIPv4 "true";' >> /etc/apt/apt.conf.d/99force-ipv4
# Fix fancy progress bar for apt-get
# https://askubuntu.com/a/754653
if [ -d /etc/apt/apt.conf.d ]
then
if ! [ -f /etc/apt/apt.conf.d/99progressbar ]
then
echo 'Dpkg::Progress-Fancy "1";' > /etc/apt/apt.conf.d/99progressbar
echo 'APT::Color "1";' >> /etc/apt/apt.conf.d/99progressbar
chmod 644 /etc/apt/apt.conf.d/99progressbar
fi
fi
# Install curl if not existing
if [ "$(dpkg-query -W -f='${Status}' "curl" 2>/dev/null | grep -c "ok installed")" = "1" ]
then
echo "curl OK"
else
apt-get update -q4
apt-get install curl -y
fi
# Install whiptail if not existing
if [ "$(dpkg-query -W -f='${Status}' "whiptail" 2>/dev/null | grep -c "ok installed")" = "1" ]
then
echo "whiptail OK"
else
apt-get install whiptail -y
fi
true
SCRIPT_NAME="Nextcloud Install Script"
SCRIPT_EXPLAINER="This script is installing all requirements that are needed for Nextcloud to run.
It's the first of two parts that are necessary to finish your customized Nextcloud installation."
# shellcheck source=lib.sh
source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/main/lib.sh)
# Check for errors + debug code and abort if something isn't right
# 1 = ON
# 0 = OFF
DEBUG=0
debug_mode
# Check if root
root_check
# Test RAM size (2GB min) + CPUs (min 1)
ram_check 2 Nextcloud
cpu_check 1 Nextcloud
# Check if dpkg or apt is running
is_process_running apt
is_process_running dpkg
# Check distribution and version
if ! version 24.04 "$DISTRO" 24.04.10
then
msg_box "This script can only be run on Ubuntu 24.04 (server)."
exit 1
fi
# Automatically restart services
# Restart mode: (l)ist only, (i)nteractive or (a)utomatically.
sed -i "s|#\$nrconf{restart} = .*|\$nrconf{restart} = 'a';|g" /etc/needrestart/needrestart.conf
# Check for flags
if [ "$1" = "" ]
then
print_text_in_color "$ICyan" "Running in normal mode..."
sleep 1
elif [ "$1" = "--provisioning" ] || [ "$1" = "-p" ]
then
print_text_in_color "$ICyan" "Running in provisioning mode..."
export PROVISIONING=1
sleep 1
elif [ "$1" = "--not-latest" ]
then
NOT_LATEST=1
print_text_in_color "$ICyan" "Running in not-latest mode..."
sleep 1
else
msg_box "Failed to get the correct flag. Did you enter it correctly?"
exit 1
fi
# Show explainer
if [ -z "$PROVISIONING" ]
then
msg_box "$SCRIPT_EXPLAINER"
fi
# Create a placeholder volume before modifying anything
if [ -z "$PROVISIONING" ]
then
if ! does_snapshot_exist "NcVM-installation" && yesno_box_no "Do you want to use LVM snapshots to be able to restore your root partition during upgrades and such?
Please note: this feature will not be used by this script but by other scripts later on.
For now we will only create a placeholder volume that will be used to let some space for snapshot volumes.
Be aware that you will not be able to use the built-in backup solution if you choose 'No'!
Enabling this will also force an automatic reboot after running the update script!"
then
check_free_space
if [ "$FREE_SPACE" -ge 50 ]
then
print_text_in_color "$ICyan" "Creating volume..."
sleep 1
# Create a placeholder snapshot
check_command lvcreate --size 5G --name "NcVM-installation" ubuntu-vg
else
print_text_in_color "$IRed" "Could not create volume because of insufficient space..."
sleep 2
fi
fi
fi
# Fix LVM on BASE image
if grep -q "LVM" /etc/fstab
then
if [ -n "$PROVISIONING" ] || yesno_box_yes "Do you want to make all free space available to your root partition?"
then
# Resize LVM (live installer is &%¤%/!
# VM
print_text_in_color "$ICyan" "Extending LVM, this may take a long time..."
lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
# Run it again manually just to be sure it's done
while :
do
lvdisplay | grep "Size" | awk '{print $3}'
if ! lvextend -L +10G /dev/ubuntu-vg/ubuntu-lv >/dev/null 2>&1
then
if ! lvextend -L +1G /dev/ubuntu-vg/ubuntu-lv >/dev/null 2>&1
then
if ! lvextend -L +100M /dev/ubuntu-vg/ubuntu-lv >/dev/null 2>&1
then
if ! lvextend -L +1M /dev/ubuntu-vg/ubuntu-lv >/dev/null 2>&1
then
resize2fs /dev/ubuntu-vg/ubuntu-lv
break
fi
fi
fi
fi
done
fi
fi
# Install needed dependencies
install_if_not lshw
install_if_not net-tools
install_if_not whiptail
install_if_not apt-utils
install_if_not keyboard-configuration
# Nice to have dependencies
install_if_not bash-completion
install_if_not htop
install_if_not iputils-ping
# Download needed libraries before execution of the first script
mkdir -p "$SCRIPTS"
download_script GITHUB_REPO lib
download_script STATIC fetch_lib
# Set locales
run_script ADDONS locales
# Create new current user
download_script STATIC adduser
bash "$SCRIPTS"/adduser.sh "nextcloud_install_production.sh"
rm -f "$SCRIPTS"/adduser.sh
check_universe
check_multiverse
# Check if key is available
if ! site_200 "$NCREPO"
then
msg_box "Nextcloud repo is not available, exiting..."
exit 1
fi
# Test Home/SME function
if home_sme_server
then
msg_box "This is the Home/SME server, function works!"
else
print_text_in_color "$ICyan" "Home/SME Server not detected. No worries, just testing the function."
sleep 3
fi
# Check if it's a clean server
stop_if_installed postgresql
stop_if_installed apache2
stop_if_installed nginx
stop_if_installed php
stop_if_installed php-fpm
stop_if_installed php-common
stop_if_installed php"$PHPVER"-fpm
stop_if_installed php7.0-fpm
stop_if_installed php7.1-fpm
stop_if_installed php7.2-fpm
stop_if_installed php7.3-fpm
stop_if_installed php8.0-fpm
stop_if_installed php8.1-fpm
stop_if_installed php8.2-fpm
stop_if_installed mysql-common
stop_if_installed mariadb-server
# We don't want automatic updates since they might fail (we use our own script)
if is_this_installed unattended-upgrades
then
apt-get purge unattended-upgrades -y
apt-get autoremove -y
rm -rf /var/log/unattended-upgrades
fi
# Create $SCRIPTS dir
if [ ! -d "$SCRIPTS" ]
then
mkdir -p "$SCRIPTS"
fi
# Create $VMLOGS dir
if [ ! -d "$VMLOGS" ]
then
mkdir -p "$VMLOGS"
fi
# Install needed network
install_if_not netplan.io
# APT over HTTPS
install_if_not apt-transport-https
# Install build-essentials to get make
install_if_not build-essential
# Install a decent text editor
install_if_not nano
# Install package for crontab
install_if_not cron
# Make sure sudo exists (needed in adduser.sh)
install_if_not sudo
# Make sure add-apt-repository exists (needed in lib.sh)
install_if_not software-properties-common
# Set dual or single drive setup
if [ -n "$PROVISIONING" ]
then
choice="2 Disks Auto"
else
msg_box "This server is designed to run with two disks, one for OS and one for DATA. \
This will get you the best performance since the second disk is using ZFS which is a superior filesystem.
Though not recommended, you can still choose to only run on one disk, \
if for example it's your only option on the hypervisor you're running.
You will now get the option to decide which disk you want to use for DATA, \
or run the automatic script that will choose the available disk automatically."
choice=$(whiptail --title "$TITLE - Choose disk format" --nocancel --menu \
"How would you like to configure your disks?
$MENU_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
"2 Disks Auto" "(Automatically configured)" \
"2 Disks Manual" "(Choose by yourself)" \
"1 Disk" "(Only use one disk /mnt/ncdata - NO ZFS!)" 3>&1 1>&2 2>&3)
fi
case "$choice" in
"2 Disks Auto")
run_script DISK format-sdb
# Change to zfs-mount-generator
run_script DISK change-to-zfs-mount-generator
# Create daily zfs prune script
run_script DISK create-daily-zfs-prune
;;
"2 Disks Manual")
run_script DISK format-chosen
# Change to zfs-mount-generator
run_script DISK change-to-zfs-mount-generator
# Create daily zfs prune script
run_script DISK create-daily-zfs-prune
;;
"1 Disk")
print_text_in_color "$IRed" "1 Disk setup chosen."
sleep 2
;;
*)
;;
esac
# Set DNS resolver
# https://unix.stackexchange.com/questions/442598/how-to-configure-systemd-resolved-and-systemd-networkd-to-use-local-dns-server-f
while :
do
if [ -n "$PROVISIONING" ]
then
choice="Quad9"
else
choice=$(whiptail --title "$TITLE - Set DNS Resolver" --menu \
"Which DNS provider should this Nextcloud box use?
$MENU_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
"Quad9" "(https://www.quad9.net/)" \
"Cloudflare" "(https://www.cloudflare.com/dns/)" \
"Local" "($GATEWAY) - DNS on gateway" \
"Expert" "If you really know what you're doing!" 3>&1 1>&2 2>&3)
fi
case "$choice" in
"Quad9")
sed -i "s|^#\?DNS=.*$|DNS=9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9|g" /etc/systemd/resolved.conf
;;
"Cloudflare")
sed -i "s|^#\?DNS=.*$|DNS=1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001|g" /etc/systemd/resolved.conf
;;
"Local")
sed -i "s|^#\?DNS=.*$|DNS=$GATEWAY|g" /etc/systemd/resolved.conf
systemctl restart systemd-resolved.service
if network_ok
then
break
else
msg_box "Could not validate the local DNS server. Pick an Internet DNS server and try again."
continue
fi
;;
"Expert")
OWNDNS=$(input_box_flow "Please choose your own DNS server(s) with a space in between, e.g: $GATEWAY 9.9.9.9 (NS1 NS2)")
sed -i "s|^#\?DNS=.*$|DNS=$OWNDNS|g" /etc/systemd/resolved.conf
systemctl restart systemd-resolved.service
if network_ok
then
break
unset OWNDNS
else
msg_box "Could not validate the local DNS server. Pick an Internet DNS server and try again."
continue
fi
;;
*)
;;
esac
if test_connection
then
break
else
msg_box "Could not validate the DNS server. Please try again."
fi
done
# Install PostgreSQL
apt-get update -q4 & spinner_loading
install_if_not postgresql
# Create DB
cd /tmp
sudo -u postgres psql <<END
CREATE USER $PGDB_USER WITH PASSWORD '$PGDB_PASS';
CREATE DATABASE nextcloud_db WITH OWNER $PGDB_USER TEMPLATE template0 ENCODING 'UTF8';
END
print_text_in_color "$ICyan" "PostgreSQL password: $PGDB_PASS"
systemctl restart postgresql.service
# Install Apache
check_command install_if_not apache2
a2enmod rewrite \
headers \
proxy \
proxy_fcgi \
setenvif \
env \
mime \
dir \
authz_core \
alias \
mpm_event \
ssl
# We don't use Apache PHP (just to be sure)
a2dismod mpm_prefork
# Disable server tokens in Apache
if ! grep -q 'ServerSignature' /etc/apache2/apache2.conf
then
{
echo "# Turn off ServerTokens for both Apache and PHP"
echo "ServerSignature Off"
echo "ServerTokens Prod"
} >> /etc/apache2/apache2.conf
check_command systemctl restart apache2.service
fi
# Install PHP "$PHPVER"
install_if_not php"$PHPVER"-fpm
install_if_not php"$PHPVER"-intl
install_if_not php"$PHPVER"-ldap
install_if_not php"$PHPVER"-imap
install_if_not php"$PHPVER"-gd
install_if_not php"$PHPVER"-pgsql
install_if_not php"$PHPVER"-curl
install_if_not php"$PHPVER"-xml
install_if_not php"$PHPVER"-zip
install_if_not php"$PHPVER"-mbstring
install_if_not php"$PHPVER"-soap
install_if_not php"$PHPVER"-gmp
install_if_not php"$PHPVER"-bz2
install_if_not php"$PHPVER"-bcmath
install_if_not php-pear
# Enable php-fpm
a2enconf php"$PHPVER"-fpm
# Enable HTTP/2 server wide
print_text_in_color "$ICyan" "Enabling HTTP/2 server wide..."
cat << HTTP2_ENABLE > "$HTTP2_CONF"
<IfModule http2_module>
Protocols h2 http/1.1
</IfModule>
HTTP2_ENABLE
print_text_in_color "$IGreen" "$HTTP2_CONF was successfully created"
a2enmod http2
restart_webserver
# Set up a php-fpm pool with a unixsocket
cat << POOL_CONF > "$PHP_POOL_DIR"/nextcloud.conf
[Nextcloud]
user = www-data
group = www-data
listen = /run/php/php"$PHPVER"-fpm.nextcloud.sock
listen.owner = www-data
listen.group = www-data
pm = dynamic
; max_children is set dynamically with calculate_php_fpm()
pm.max_children = 8
pm.start_servers = 3
pm.min_spare_servers = 2
pm.max_spare_servers = 3
env[HOSTNAME] = $(hostname -f)
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp
security.limit_extensions = .php
php_admin_value [cgi.fix_pathinfo] = 1
; Optional
; pm.max_requests = 2000
POOL_CONF
# Disable the idling example pool.
mv "$PHP_POOL_DIR"/www.conf "$PHP_POOL_DIR"/www.conf.backup
# Enable the new php-fpm config
restart_webserver
# Calculate the values of PHP-FPM based on the amount of RAM available (it's done in the startup script as well)
calculate_php_fpm
# Install VM-tools
if [ "$SYSVENDOR" == "VMware, Inc." ];
then
install_if_not open-vm-tools
elif [[ "$SYSVENDOR" == "QEMU" || "$SYSVENDOR" == "Red Hat" ]];
then
install_if_not qemu-guest-agent
systemctl enable qemu-guest-agent
systemctl start qemu-guest-agent
fi
# Get not-latest Nextcloud version
if [ -n "$NOT_LATEST" ]
then
while [ -z "$NCVERSION" ]
do
print_text_in_color "$ICyan" "Fetching the not-latest Nextcloud version..."
NCVERSION=$(curl -s -m 900 "$NCREPO"/ | sed --silent 's/.*href="nextcloud-\([^"]\+\).zip.asc".*/\1/p' \
| sort --version-sort | grep -v "\.0$\|\.1$\|\.2$" | tail -1)
STABLEVERSION="nextcloud-$NCVERSION"
print_text_in_color "$IGreen" "$NCVERSION"
done
fi
# Download and validate Nextcloud package
check_command download_verify_nextcloud_stable
if [ ! -f "$HTML/$STABLEVERSION.tar.bz2" ]
then
msg_box "Aborting,something went wrong with the download of $STABLEVERSION.tar.bz2"
exit 1
fi
# Extract package
tar -xjf "$HTML/$STABLEVERSION.tar.bz2" -C "$HTML" & spinner_loading
rm "$HTML/$STABLEVERSION.tar.bz2"
# Secure permissions
download_script STATIC setup_secure_permissions_nextcloud
bash "$SECURE" & spinner_loading
# Ask to set a custom username
if [ -z "$PROVISIONING" ]
then
if yesno_box_no "Nextcloud is about to be installed.\nDo you want to change the standard GUI user '$GUIUSER' to something else?"
then
while :
do
GUIUSER=$(input_box_flow "Please type in the name of the Web Admin in Nextcloud.
\nThe only allowed characters for the username are:
'a-z', 'A-Z', '0-9', and '_.@-'")
if [[ "$GUIUSER" == *" "* ]]
then
msg_box "Please don't use spaces."
# - has to be escaped otherwise it won't work.
# Inspired by: https://unix.stackexchange.com/a/498731/433213
elif [ "${GUIUSER//[A-Za-z0-9_.\-@]}" ]
then
msg_box "Allowed characters for the username are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again."
else
break
fi
done
while :
do
GUIPASS=$(input_box_flow "Please type in the new password for the new Web Admin ($GUIUSER) in Nextcloud.")
if [[ "$GUIPASS" == *" "* ]]
then
msg_box "Please don't use spaces."
fi
if [ "${GUIPASS//[A-Za-z0-9_.\-@]}" ]
then
msg_box "Allowed characters for the password are:\na-z', 'A-Z', '0-9', and '_.@-'\n\nPlease try again."
else
msg_box "The new Web Admin in Nextcloud is now: $GUIUSER\nThe password is set to: $GUIPASS
This is used when you login to Nextcloud itself, i.e. on the web."
break
fi
done
fi
fi
# Install Nextcloud
# NC 29 fix ## TODO: is this needed in coming versions?
chown www-data:www-data "$NCPATH"/data
# Normal install
print_text_in_color "$ICyan" "Installing Nextcloud, it might take a while..."
cd "$NCPATH"
# Don't use nextcloud_occ here as it takes alooong time.
# https://github.com/nextcloud/vm/issues/2542#issuecomment-1700406020
check_command sudo -u www-data php "$NCPATH"/occ maintenance:install \
--data-dir="$NCDATA" \
--database=pgsql \
--database-name=nextcloud_db \
--database-user="$PGDB_USER" \
--database-pass="$PGDB_PASS" \
--admin-user="$GUIUSER" \
--admin-pass="$GUIPASS"
print_text_in_color "$ICyan" "Nextcloud version:"
nextcloud_occ status
sleep 3
# Install PECL dependencies
install_if_not php"$PHPVER"-dev
# Install Redis (distributed cache)
run_script ADDONS redis-server-ubuntu
# Install smbclient
# php"$PHPVER"-smbclient does not yet work in PHP 7.4
install_if_not libsmbclient-dev
yes no | pecl install smbclient
if [ ! -f "$PHP_MODS_DIR"/smbclient.ini ]
then
touch "$PHP_MODS_DIR"/smbclient.ini
fi
if ! grep -qFx extension=smbclient.so "$PHP_MODS_DIR"/smbclient.ini
then
echo "# PECL smbclient" > "$PHP_MODS_DIR"/smbclient.ini
echo "extension=smbclient.so" >> "$PHP_MODS_DIR"/smbclient.ini
check_command phpenmod -v ALL smbclient
fi
# Enable igbinary for PHP
# https://github.com/igbinary/igbinary
if is_this_installed "php$PHPVER"-dev
then
if ! yes no | pecl install -Z igbinary
then
msg_box "igbinary PHP module installation failed"
exit
else
print_text_in_color "$IGreen" "igbinary PHP module installation OK!"
fi
{
echo "# igbinary for PHP"
echo "session.serialize_handler=igbinary"
echo "igbinary.compact_strings=On"
} >> "$PHP_INI"
if [ ! -f "$PHP_MODS_DIR"/igbinary.ini ]
then
touch "$PHP_MODS_DIR"/igbinary.ini
fi
if ! grep -qFx extension=igbinary.so "$PHP_MODS_DIR"/igbinary.ini
then
echo "# PECL igbinary" > "$PHP_MODS_DIR"/igbinary.ini
echo "extension=igbinary.so" >> "$PHP_MODS_DIR"/igbinary.ini
check_command phpenmod -v ALL igbinary
fi
restart_webserver
fi
# Prepare cron.php to be run every 5 minutes
crontab -u www-data -l | { cat; echo "*/5 * * * * php -f $NCPATH/cron.php > /dev/null 2>&1"; } | crontab -u www-data -
# Run the updatenotification on a schedule
nextcloud_occ config:system:set upgrade.disable-web --type=bool --value=true
nextcloud_occ config:app:set updatenotification notify_groups --value="[]"
print_text_in_color "$ICyan" "Configuring update notifications specific for this server..."
download_script STATIC updatenotification
check_command chmod +x "$SCRIPTS"/updatenotification.sh
crontab -u root -l | { cat; echo "59 $AUT_UPDATES_TIME * * * $SCRIPTS/updatenotification.sh > /dev/null 2>&1"; } | crontab -u root -
# Change values in php.ini (increase max file size)
# max_execution_time
sed -i "s|max_execution_time =.*|max_execution_time = 3500|g" "$PHP_INI"
# max_input_time
sed -i "s|max_input_time =.*|max_input_time = 3600|g" "$PHP_INI"
# memory_limit
sed -i "s|memory_limit =.*|memory_limit = 512M|g" "$PHP_INI"
# post_max
sed -i "s|post_max_size =.*|post_max_size = 1100M|g" "$PHP_INI"
# upload_max
sed -i "s|upload_max_filesize =.*|upload_max_filesize = 1000M|g" "$PHP_INI"
# Set logging
nextcloud_occ config:system:set log_type --value=file
nextcloud_occ config:system:set logfile --value="$VMLOGS/nextcloud.log"
rm -f "$NCDATA/nextcloud.log"
rm -f "$NCPATH/data/nextcloud.log"
nextcloud_occ config:system:set loglevel --value=2
install_and_enable_app admin_audit
nextcloud_occ config:app:set admin_audit logfile --value="$VMLOGS/audit.log"
nextcloud_occ config:system:set log.condition apps 0 --value admin_audit
# Set maintenance window for cron
# https://docs.nextcloud.com/server/29/admin_manual/configuration_server/background_jobs_configuration.html#background-jobs
nextcloud_occ config:system:set maintenance_window_start --type=integer --value=2
# Set SMTP mail
nextcloud_occ config:system:set mail_smtpmode --value="smtp"
# Forget login/session after 30 minutes
nextcloud_occ config:system:set remember_login_cookie_lifetime --value="1800"
# Set logrotate (max 10 MB)
nextcloud_occ config:system:set log_rotate_size --value="10485760"
# Set trashbin retention obligation (save it in trashbin for 60 days or delete when space is needed)
nextcloud_occ config:system:set trashbin_retention_obligation --value="auto, 60"
# Set versions retention obligation (save versions for 180 days or delete when space is needed)
nextcloud_occ config:system:set versions_retention_obligation --value="auto, 180"
# Set activity retention obligation (save activity feed for 120 days, defaults to 365 days otherwise)
nextcloud_occ config:system:set activity_expire_days --value="120"
# Remove simple signup
nextcloud_occ config:system:set simpleSignUpLink.shown --type=bool --value=false
# Set chunk_size for files app to 100MB (defaults to 10MB)
nextcloud_occ config:app:set files max_chunk_size --value="104857600"
# Set product name
if home_sme_server
then
PRODUCTNAME="Nextcloud HanssonIT Server"
else
PRODUCTNAME="Nextcloud HanssonIT VM"
fi
if is_app_installed theming
then
if [ "$(nextcloud_occ config:app:get theming productName)" != "$PRODUCTNAME" ]
then
nextcloud_occ config:app:set theming productName --value "$PRODUCTNAME"
fi
fi
# Enable OPCache for PHP
# https://docs.nextcloud.com/server/14/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
phpenmod opcache
{
echo "# OPcache settings for Nextcloud"
echo "opcache.enable=1"
echo "opcache.enable_cli=1"
echo "opcache.interned_strings_buffer=$opcache_interned_strings_buffer_value"
echo "opcache.max_accelerated_files=10000"
echo "opcache.memory_consumption=256"
echo "opcache.save_comments=1"
echo "opcache.revalidate_freq=1"
echo "opcache.validate_timestamps=1"
} >> "$PHP_INI"
# PHP-FPM optimization
# https://geekflare.com/php-fpm-optimization/
sed -i "s|;emergency_restart_threshold.*|emergency_restart_threshold = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf
sed -i "s|;emergency_restart_interval.*|emergency_restart_interval = 1m|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf
sed -i "s|;process_control_timeout.*|process_control_timeout = 10|g" /etc/php/"$PHPVER"/fpm/php-fpm.conf
# PostgreSQL values for PHP (https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/linux_database_configuration.html#postgresql-database)
{
echo ""
echo "[PostgresSQL]"
echo "pgsql.allow_persistent = On"
echo "pgsql.auto_reset_persistent = Off"
echo "pgsql.max_persistent = -1"
echo "pgsql.max_links = -1"
echo "pgsql.ignore_notice = 0"
echo "pgsql.log_notice = 0"
} >> "$PHP_FPM_DIR"/conf.d/20-pdo_pgsql.ini
# Fix https://github.com/nextcloud/vm/issues/714
print_text_in_color "$ICyan" "Optimizing Nextcloud..."
yes | nextcloud_occ db:convert-filecache-bigint
nextcloud_occ db:add-missing-indices
while [ -z "$CURRENTVERSION" ]
do
CURRENTVERSION=$(sudo -u www-data php "$NCPATH"/occ status | grep "versionstring" | awk '{print $3}')
done
if [ "${CURRENTVERSION%%.*}" -ge "19" ]
then
nextcloud_occ db:add-missing-columns
fi
if [ "${CURRENTVERSION%%.*}" -ge "20" ]
then
nextcloud_occ db:add-missing-primary-keys
fi
# Install Figlet
install_if_not figlet
# To be able to use snakeoil certs
install_if_not ssl-cert
# Generate $HTTP_CONF
if [ ! -f "$SITES_AVAILABLE"/"$HTTP_CONF" ]
then
touch "$SITES_AVAILABLE/$HTTP_CONF"
cat << HTTP_CREATE > "$SITES_AVAILABLE/$HTTP_CONF"
<VirtualHost *:80>
### YOUR SERVER ADDRESS ###
# ServerAdmin [email protected]
# ServerName cloud.example.com
### SETTINGS ###
<FilesMatch "\.php$">
SetHandler "proxy:unix:/run/php/php$PHPVER-fpm.nextcloud.sock|fcgi://localhost"
</FilesMatch>
# Logs
LogLevel warn
CustomLog \${APACHE_LOG_DIR}/access.log combined
ErrorLog \${APACHE_LOG_DIR}/error.log
# Document root folder
DocumentRoot $NCPATH
# The Nextcloud folder
<Directory $NCPATH>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
Satisfy Any
# This is to include all the Nextcloud rules due to that we use PHP-FPM and .htaccess aren't read
Include $NCPATH/.htaccess
</Directory>
# Deny access to your data directory
<Directory $NCDATA>
Require all denied
</Directory>
# Deny access to the Nextcloud config folder
<Directory $NCPATH/config/>
Require all denied
</Directory>
<IfModule mod_dav.c>
Dav off
</IfModule>
# The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients.
<Files ".ht*">
Require all denied
</Files>
SetEnv HOME $NCPATH
SetEnv HTTP_HOME $NCPATH
# Disable HTTP TRACE method.
TraceEnable off
# Disable HTTP TRACK method.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [R=405,L]
# Avoid "Sabre\DAV\Exception\BadRequest: expected filesize XXXX got XXXX"
<IfModule mod_reqtimeout.c>
RequestReadTimeout body=0
</IfModule>
</VirtualHost>
HTTP_CREATE
print_text_in_color "$IGreen" "$SITES_AVAILABLE/$HTTP_CONF was successfully created."
fi
# Generate $TLS_CONF
if [ ! -f "$SITES_AVAILABLE"/"$TLS_CONF" ]
then
touch "$SITES_AVAILABLE/$TLS_CONF"
cat << TLS_CREATE > "$SITES_AVAILABLE/$TLS_CONF"
# <VirtualHost *:80>
# RewriteEngine On
# RewriteRule ^(.*)$ https://%{HTTP_HOST}\$1 [END,NE,R=permanent]
# </VirtualHost>
<VirtualHost *:443>
Header add Strict-Transport-Security: "max-age=15552000;includeSubdomains"
### YOUR SERVER ADDRESS ###
# ServerAdmin [email protected]
# ServerName cloud.example.com
### SETTINGS ###
<FilesMatch "\.php$">
SetHandler "proxy:unix:/run/php/php$PHPVER-fpm.nextcloud.sock|fcgi://localhost"
</FilesMatch>
# Intermediate configuration
SSLEngine on
SSLCompression off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
ServerSignature off
# Logs
LogLevel warn
CustomLog \${APACHE_LOG_DIR}/access.log combined
ErrorLog \${APACHE_LOG_DIR}/error.log
# Document root folder
DocumentRoot $NCPATH
# The Nextcloud folder
<Directory $NCPATH>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
Satisfy Any
# This is to include all the Nextcloud rules due to that we use PHP-FPM and .htaccess aren't read
Include $NCPATH/.htaccess
</Directory>
# Deny access to your data directory
<Directory $NCDATA>
Require all denied
</Directory>
# Deny access to the Nextcloud config folder
<Directory $NCPATH/config/>
Require all denied
</Directory>
<IfModule mod_dav.c>
Dav off
</IfModule>
# The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients.
<Files ".ht*">
Require all denied
</Files>
SetEnv HOME $NCPATH
SetEnv HTTP_HOME $NCPATH
# Disable HTTP TRACE method.
TraceEnable off
# Disable HTTP TRACK method.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [R=405,L]
# Avoid "Sabre\DAV\Exception\BadRequest: expected filesize XXXX got XXXX"
<IfModule mod_reqtimeout.c>
RequestReadTimeout body=0
</IfModule>
# Avoid zero byte files (only works in Ubuntu 24.04 -->>)
# See https://github.com/nextcloud/server/issues/3056
SetEnv proxy-sendcl 1
### LOCATION OF CERT FILES ###
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
</VirtualHost>
TLS_CREATE
print_text_in_color "$IGreen" "$SITES_AVAILABLE/$TLS_CONF was successfully created."
fi
# Enable new config
a2ensite "$TLS_CONF"
a2ensite "$HTTP_CONF"
a2dissite default-ssl
restart_webserver
if [ -n "$PROVISIONING" ]
then
choice="Calendar Contacts IssueTemplate PDFViewer Extract Text Mail Deck Group-Folders"
else
choice=$(whiptail --title "$TITLE - Install apps or software" --checklist \
"Automatically configure and install selected apps or software
$CHECKLIST_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
"Calendar" "" ON \
"Contacts" "" ON \
"PDFViewer" "" ON \
"Extract" "" ON \
"Text" "" ON \
"Mail" "" ON \
"Deck" "" ON \
"Collectives" "" ON \
"Suspicious Login detection" "" ON \
"IssueTemplate" "" OFF \
"Group-Folders" "" OFF 3>&1 1>&2 2>&3)
fi
case "$choice" in
*"Calendar"*)
install_and_enable_app calendar
;;&
*"Contacts"*)
install_and_enable_app contacts
;;&
*"IssueTemplate"*)
# install_and_enable_app issuetemplate
rm -rf "$NCPATH"apps/issuetemplate
nextcloud_occ app:install --force --keep-disabled issuetemplate
sed -i "s|20|${CURRENTVERSION%%.*}|g" "$NCPATH"/apps/issuetemplate/appinfo/info.xml
nextcloud_occ_no_check app:enable issuetemplate
;;&
*"PDFViewer"*)
install_and_enable_app files_pdfviewer
;;&
*"Extract"*)
if install_and_enable_app extract
then
install_if_not unrar
install_if_not p7zip
install_if_not p7zip-full
fi
;;&
*"Text"*)
install_and_enable_app text
;;&
*"Mail"*)
install_and_enable_app mail
;;&
*"Deck"*)
install_and_enable_app deck
;;&
*"Collectives"*)
install_and_enable_app collectives
install_if_not php"$PHPVER"-sqlite3
;;&
*"Suspicious Login detection"*)
install_and_enable_app suspicios_login
;;&
*"Group-Folders"*)
install_and_enable_app groupfolders
;;&
*)
;;
esac
# Cleanup
apt-get autoremove -y
apt-get autoclean
find /root "/home/$UNIXUSER" -type f \( -name '*.sh*' -o -name '*.html*' -o -name '*.tar*' -o -name '*.zip*' \) -delete