{"id":4862,"date":"2020-01-03T13:17:01","date_gmt":"2020-01-03T10:17:01","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4862"},"modified":"2024-03-13T07:49:02","modified_gmt":"2024-03-13T04:49:02","slug":"install-nextcloud-with-nginx-and-ssl-tls-certificates-on-centos-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-nextcloud-with-nginx-and-ssl-tls-certificates-on-centos-8\/","title":{"rendered":"Install Nextcloud with Nginx and SSL\/TLS Certificates on CentOS 8"},"content":{"rendered":"\n

Welcome to our guide on yet another enterprise file sync and share solution. We will learn how to install Nextcloud<\/a> with Nginx and SSL\/TLS Certificates on CentOS 8.<\/p>\n\n\n\n

Want to try ownCloud? Check our guide on setting up ownCloud server on CentOS 8 by following the link below;<\/p>\n\n\n\n

Install ownCloud Server on CentOS 8<\/a><\/p>\n\n\n\n

Installing Nextcloud with Nginx and SSL\/TLS on CentOS 8<\/h2>\n\n\n\n

To install Nextcloud with Nginx and SSL\/TLS, these are the steps that were used in our environment. Feel free to modify the steps to suit your environment.<\/p>\n\n\n\n

Run System Update<\/h3>\n\n\n\n

Ensure that your system packages are up-to-date.<\/p>\n\n\n\n

dnf update<\/code><\/pre>\n\n\n\n
Install LEMP Stack<\/h3>\n\n\n\n
To run Nextcloud with Nginx, you first need to setup LEMP stack. We have provided a guide on how to setup LEMP stack on CentOS 8 in our previous guide. Follow the link below;<\/p>\n\n\n\n
Install LEMP Stack on CentOS 8<\/a><\/p>\n\n\n\n
Install Other Required PHP Modules<\/h3>\n\n\n\n
To install other required PHP modules and other packages, run the commands below;<\/p>\n\n\n\n
dnf install php-gd php-json php-curl php-mbstring php-intl php-xml php-zip php-pear php-soap<\/code><\/pre>\n\n\n\n
Install other required packages;<\/p>\n\n\n\n
dnf install zip wget tar policycoreutils-python-utils<\/code><\/pre>\n\n\n\n
Configure PHP<\/h3>\n\n\n\n
Edit the \/etc\/php.ini<\/code> and set the value of cgi.fix_pathinfo<\/code> to 0<\/strong>.<\/p>\n\n\n\n
vim \/etc\/php.ini<\/code><\/pre>\n\n\n\n
...\n;cgi.fix_pathinfo=1\ncgi.fix_pathinfo=0<\/strong>\n...<\/code><\/pre>\n\n\n\n
Edit the \/etc\/php-fpm.d\/www.conf<\/code> and make the following changes;<\/p>\n\n\n\n
vim \/etc\/php-fpm.d\/www.conf<\/code><\/pre>\n\n\n\n
...\nuser = nginx\ngroup = nginx\n...\n# Uncomment these lines by removing the ; at the beginning of the lines.<\/strong>\nenv[HOSTNAME] = $HOSTNAME\nenv[PATH] = \/usr\/local\/bin:\/usr\/bin:\/bin\nenv[TMP] = \/tmp\nenv[TMPDIR] = \/tmp\nenv[TEMP] = \/tmp\n...<\/code><\/pre>\n\n\n\n
Create Nextcloud Database and Database User<\/h3>\n\n\n\n
Before you can create MariaDB\/MySQL database for Nextcloud ensure that InnoDB is the default storage engine;<\/p>\n\n\n\n
mysql -u root -p<\/code><\/pre>\n\n\n\n
show engines;<\/code><\/pre>\n\n\n\n
+--------------------+---------+----------------------------------------------------------------------------------+--------------+------+------------+\n| Engine             | Support | Comment                                                                          | Transactions | XA   | Savepoints |\n+--------------------+---------+----------------------------------------------------------------------------------+--------------+------+------------+\n...\n...\n| InnoDB             | DEFAULT | Supports transactions, row-level locking, foreign keys and encryption for tables | YES          | YES  | YES        |<\/strong>\n...<\/code><\/pre>\n\n\n\n
Ensure that the support is set to DEFAULT<\/strong>.<\/p>\n\n\n\n
Next, create Nextcloud database (The names of the database and database user used here are not standard, use whatever names you like<\/strong>).<\/p>\n\n\n\n
create database ncdb;<\/code><\/pre>\n\n\n\n
Create Nextcloud database user with full privileges granted on the Nextcloud database.<\/p>\n\n\n\n
grant all privileges on ncdb.* to ncadmin@localhost identified by 'P@ssW0rd';<\/code><\/pre>\n\n\n\n
Reload privileges tables and exit the DB.<\/p>\n\n\n\n
flush privileges;\nquit<\/code><\/pre>\n\n\n\n
Download and Install Nextcloud<\/h3>\n\n\n\n
In this guide, we are going to install Nextcloud from the source. As such, download the latest stable release version of Nextcloud, v17.0.2, as of this writing from the releases page<\/a>.<\/p>\n\n\n\n
wget https:\/\/download.nextcloud.com\/server\/releases\/latest.zip<\/code><\/pre>\n\n\n\n
Extract Nextcloud to Web Root Directory<\/h4>\n\n\n\n
Since we are using Nginx as our Web server, we are gonna place the Nextcloud files and configurations under, \/usr\/share\/nginx\/html\/nextcloud<\/code>. The path might be different for your case.<\/p>\n\n\n\n
unzip latest.zip -d \/usr\/share\/nginx\/html\/<\/code><\/pre>\n\n\n\n
Generate SSL\/TLS Certificates<\/h3>\n\n\n\n
Well, to setup Nextcloud with SSL\/TLS certificates, you first need to generate the certificates. This guide uses self signed certificates for demonstration purposes. If you are running Nextcloud in production environments, consider using the publicly trusted certificates from your preferred CA.<\/p>\n\n\n\n
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/pki\/tls\/nc-selfsigned.key -out \/etc\/pki\/tls\/nc-selfsigned.crt<\/code><\/pre>\n\n\n\n
Configuring Nginx for Nextcloud<\/h3>\n\n\n\n
Nextcloud provides a sample Nginx configuration code for Nextcloud<\/a>. You can simply grab the configuration and adjust it to suit your environment setting.<\/p>\n\n\n\n
vim \/etc\/nginx\/conf.d\/nextcloud.conf<\/code><\/pre>\n\n\n\n
Be sure to replace the server name, the web root directory, the path to the SSL\/TLS certificates accordingly<\/strong>.<\/p>\n\n\n\n
upstream php-handler {\n    server unix:\/run\/php-fpm\/www.sock;\n}\n\nserver {\n    listen 80;\n    server_name nextcloud.kifarunix-demo.com<\/strong>;\n    # enforce https\n    return 301 https:\/\/$server_name:443$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name nextcloud.kifarunix-demo.com<\/strong>;\n\n    ssl_certificate \/etc\/pki\/tls\/nc-selfsigned.crt;\n    ssl_certificate_key \/etc\/pki\/tls\/nc-selfsigned.key;<\/strong>\n\n    add_header Referrer-Policy \"no-referrer\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    add_header X-Download-Options \"noopen\" always;\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Permitted-Cross-Domain-Policies \"none\" always;\n    add_header X-Robots-Tag \"none\" always;\n    add_header X-XSS-Protection \"1; mode=block\" always;\n\n    fastcgi_hide_header X-Powered-By;\n\n    # Path to the root of your installation\n    root \/usr\/share\/nginx\/html\/nextcloud<\/strong>;\n\n    access_log \/var\/log\/nginx\/nc_access_log<\/strong>;\n    error_log \/var\/log\/nginx\/nc_error_log<\/strong>;\n\n    location = \/robots.txt {\n        allow all;\n        log_not_found off;\n        access_log off;\n    }\n\n    location = \/.well-known\/carddav {\n      return 301 $scheme:\/\/$host:$server_port\/remote.php\/dav;\n    }\n    location = \/.well-known\/caldav {\n      return 301 $scheme:\/\/$host:$server_port\/remote.php\/dav;\n    }\n\n    # set max upload size\n    client_max_body_size 512M;\n    fastcgi_buffers 64 4K;\n\n    # Enable gzip but do not remove ETag headers\n    gzip on;\n    gzip_vary on;\n    gzip_comp_level 4;\n    gzip_min_length 256;\n    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;\n    gzip_types application\/atom+xml application\/javascript application\/json application\/ld+json application\/manifest+json application\/rss+xml application\/vnd.geo+json application\/vnd.ms-fontobject application\/x-font-ttf application\/x-web-app-manifest+json application\/xhtml+xml application\/xml font\/opentype image\/bmp image\/svg+xml image\/x-icon text\/cache-manifest text\/css text\/plain text\/vcard text\/vnd.rim.location.xloc text\/vtt text\/x-component text\/x-cross-domain-policy;\n\n    location \/ {\n        rewrite ^ \/index.php;\n    }\n\n    location ~ ^\\\/(?:build|tests|config|lib|3rdparty|templates|data)\\\/ {\n        deny all;\n    }\n    location ~ ^\\\/(?:\\.|autotest|occ|issue|indie|db_|console) {\n        deny all;\n    }\n\n    location ~ ^\\\/(?:index|remote|public|cron|core\\\/ajax\\\/update|status|ocs\\\/v[12]|updater\\\/.+|oc[ms]-provider\\\/.+)\\.php(?:$|\\\/) {\n        fastcgi_split_path_info ^(.+?\\.php)(\\\/.*|)$;\n        set $path_info $fastcgi_path_info;\n        try_files $fastcgi_script_name =404;\n        include fastcgi_params;\n        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n        fastcgi_param PATH_INFO $path_info;\n        fastcgi_param HTTPS on;\n        fastcgi_param modHeadersAvailable true;\n        fastcgi_param front_controller_active true;\n        fastcgi_pass php-handler;\n        fastcgi_intercept_errors on;\n        fastcgi_request_buffering off;\n    }\n\n    location ~ ^\\\/(?:updater|oc[ms]-provider)(?:$|\\\/) {\n        try_files $uri\/ =404;\n        index index.php;\n    }\n\n    location ~ \\.(?:css|js|woff2?|svg|gif|map)$ {\n        try_files $uri \/index.php$request_uri;\n        add_header Cache-Control \"public, max-age=15778463\";\n        add_header Referrer-Policy \"no-referrer\" always;\n        add_header X-Content-Type-Options \"nosniff\" always;\n        add_header X-Download-Options \"noopen\" always;\n        add_header X-Frame-Options \"SAMEORIGIN\" always;\n        add_header X-Permitted-Cross-Domain-Policies \"none\" always;\n        add_header X-Robots-Tag \"none\" always;\n        add_header X-XSS-Protection \"1; mode=block\" always;\n\n        access_log off;\n    }\n\n    location ~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {\n        try_files $uri \/index.php$request_uri;\n        access_log off;\n    }\n}<\/code><\/pre>\n\n\n\n
Save and quit the configuration file.<\/p>\n\n\n\n
Create Nextcloud data directory;<\/p>\n\n\n\n
mkdir \/usr\/share\/nginx\/html\/nextcloud\/data<\/code><\/pre>\n\n\n\n
Set the user and group ownership of the Nextcloud directory to nginx.<\/p>\n\n\n\n
chown -R nginx:nginx \/usr\/share\/nginx\/html\/nextcloud<\/code><\/pre>\n\n\n\n
Set proper permissions for Nextcloud directories and files.<\/p>\n\n\n\n
find \/usr\/share\/nginx\/html\/nextcloud\/ -type d -exec chmod 750 {} \\;<\/code><\/pre>\n\n\n\n
find \/usr\/share\/nginx\/html\/nextcloud\/ -type f -exec chmod 640 {} \\;<\/code><\/pre>\n\n\n\n
Set the ownership of PHP session directory to nginx.<\/p>\n\n\n\n
chown nginx:nginx -R \/var\/lib\/php\/session\/<\/code><\/pre>\n\n\n\n
Verify Nginx for syntax errors.<\/p>\n\n\n\n
nginx -t<\/code><\/pre>\n\n\n\n
nginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful<\/code><\/pre>\n\n\n\n
Restart Nginx and PHP-FPM.<\/p>\n\n\n\n
systemctl restart nginx php-fpm<\/code><\/pre>\n\n\n\n
Allow Nginx HTTP\/HTTPS traffic on FirewallD<\/h3>\n\n\n\n
If firewallD is running, run the command below to open both port 80 and 443.<\/p>\n\n\n\n
firewall-cmd --add-port={80,443}\/tcp --permanent<\/code><\/pre>\n\n\n\n
firewall-cmd --reload<\/code><\/pre>\n\n\n\n
Configure SELinux<\/h3>\n\n\n\n
Also, Nextcloud provide SELinux configurations<\/a> that should at least fix the permission issues with Nextcloud. Run the commands below and be sure to replace the Nextcloud installation paths<\/strong> accordingly.<\/p>\n\n\n\n
semanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/data(\/.*)?'\nsemanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/config(\/.*)?'\nsemanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/apps(\/.*)?'\nsemanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/.htaccess'\nsemanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/.user.ini'\nsemanage fcontext -a -t httpd_sys_rw_content_t '\/usr\/share\/nginx\/html\/nextcloud\/3rdparty\/aws\/aws-sdk-php\/src\/data\/logs(\/.*)?'\n\nrestorecon -Rv '\/usr\/share\/nginx\/html\/nextcloud\/'<\/code><\/pre>\n\n\n\n
Finalize Nextcloud Setup on Browser<\/h3>\n\n\n\n
You can now access Nextcloud from the browser to finalize the installation and setup. Note that we have configured HTTP redirection to HTTPS hence, if you access Nextcloud using the URL, nextcloud.kifarunix-demo.com<\/strong><\/code> (replace accordingly), you will be redirected to HTTPS and since we are using the the self signed SSL\/TLS certificates, skip the warning;<\/p>\n\n\n\n
On the Nextcloud user interface, enter the name and password for the Nextcloud admin user.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Next, you need to define your backend database and the connection details. In this demo, we are using MariaDB and click on the storage and database<\/strong> drop down, set the Nextcloud data directory, choose MySQL\/MariaDB<\/code> as the database and set the connection details as create above.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Click Finish setup<\/strong> to complete the configuration.<\/p>\n\n\n\n
Once the setup is done, you will be welcomed by a login window.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Enter the admin credentials created during setup and login to Nextcloud.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
That marks the end of our tutorial. You can now further explore this awesome tool.<\/p>\n\n\n\n
Reference<\/h4>\n\n\n\n
Nextcloud latest administration manual<\/a><\/p>\n\n\n\n
Related Tutorials<\/h3>\n\n\n\n
Configure ownCloud OpenLDAP Authentication<\/a><\/p>\n\n\n\n
Install ownCloud Server on Debian 10 Buster<\/a><\/p>\n\n\n\n
Install ownCloud Desktop Client on CentOS 8<\/a><\/p>\n\n\n\n
Install ownCloud Desktop Client on Debian 10 Buster<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Welcome to our guide on yet another enterprise file sync and share solution. We will learn how to install Nextcloud with Nginx and SSL\/TLS Certificates<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,1250,39],"tags":[1254,1251,1253,1252],"class_list":["post-4862","post","type-post","status-publish","format-standard","hentry","category-howtos","category-nextcloud","category-storage","tag-nextcloud","tag-nextcloud-on-centos-8","tag-nextcloud-with-nginx","tag-nextcloud-with-ssl-tls","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4862"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4862"}],"version-history":[{"count":9,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4862\/revisions"}],"predecessor-version":[{"id":21306,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4862\/revisions\/21306"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4862"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4862"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4862"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}