Nextcloud docker 版安装部署 自制证书https访问 添加onlyoffice以及调优解决概览报错

第一步将资源上传到服务器

文件列表
docker–文件夹rpm包20.10.9
fontwin–字体文件夹
mysql–docker版mysql
nextcloud–docker版nextcloud
officeonly741.tar–docker版onlyoffice
redis-----docker版redis
onlyoffice.tar.gz–nextcloud的组件，连接
nextcloudcron.service–nextcloud的定时任务脚本
nextcloudcron.timer–nextcloud的定时任务脚本

第二步挂载镜像源（可省略，因为都是用的docker版）

mkdir /mnt/cdrom
#mount -o loop /media/镜像文件 /mnt/cdrom/
mount /dev/cdrom /mnt/cdrom/
#撤销挂载
#umount /mnt/dvd
开机自动挂载
vi /etc/fstab
/dev/cdrom   /mnt/cdrom   iso9660 ro  0 0

vi /etc/yum.repos.d/centos-everything.repo
[Centos7-Everything]
name=centos yum
baseurl=file:///mnt/cdrom
enabled=1
gpgcheck=0

将原有挂载配置文件改为.bak

mv ./*.repo bak

加载配置

yum clean all && yum makecache

#第三步安装docker

cd docker
rpm -ivh ./*.rpm
systemctl enable docker
systemctl start docker 
docker --version

#第四步将docker镜像加载至docker内

docker load < nextcloud
docker load < mysql
docker load < officeonly
docker load < redis
#若没有镜像可通过docker pull 名称即可

#第五步，挂载docker镜像并运行

docker run -d --restart=always --name nextcloud -p 80:80 -p 443:443 --privileged=true \
-e TZ="Asia/Shanghai" \
-v /data/nextcloud/data/:/var/www/html/data \
-v /data/nextcloud/apps/:/var/www/html/apps \
-v /data/nextcloud/config/:/var/www/html/config \
-v /etc/localtime:/etc/localtime:ro \
-d nextcloud:latest

docker run -p 3306:3306 --name mysql --restart=always --privileged=true \
-e TZ="Asia/Shanghai" \
-v /data/mysql/log:/var/log/mysql \
-v /data/mysql/data:/var/lib/mysql \
-v /data/mysql/conf.d:/etc/mysql/conf.d \
-v /etc/localtime:/etc/localtime:ro \
-e MYSQL_ROOT_PASSWORD=密码 \
-d mysql:latest

docker run -i -t -d -e TZ="Asia/Shanghai" -p 8080:443  \
-v /data/onlyoffice/logs:/var/log/onlyoffice \
-v /data/onlyoffice/data:/var/www/onlyoffice/Data \
-v /data/onlyoffice/lib:/var/lib/onlyoffice \
-v /data/onlyoffice/db:/var/lib/postgresql  \
-v /etc/localtime:/etc/localtime:ro \
-v /data/onlyoffice/fonts/:/usr/share/fonts/truetype/custom/ \
--restart=always --privileged=true \
--name onlyoffice \
onlyoffice/documentserver:7.4.1

docker run --rm -d --name redis -p 6379:6379 redis:latest --requirepass "密码"

#第六步，关闭slinux，开放防火墙端口

#关闭防火墙
systemctl stop firewalld
firewall-cmd --state //--list-all
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload
#关闭selinux
vi /etc/selinux/config将enforcing改为disabled

#第七步，接入mysql，创建nextcloud用户，并赋予权限

docker exec -it mysql bash
mysql -uroot -p
123456
mysql> create database nextcloud;
Query OK, 1 row affected (0.01 sec)

mysql> create user 'nextcloud'@'%' identified by '密码';
Query OK, 0 rows affected (0.01 sec)

mysql> grant all privileges on nextcloud.* to 'nextcloud'@'%';

#第八步，登陆nextcloud，连接mysql，对数据进行初始化
浏览器输入http://localhost
连接数据库进行数据初始化
#第九步，更改config.php,添加信任域名访问

vi /data/nextcloud/config/config.php
在  'trusted_domains' => 
  array (
    0 => 'localhost',
	1 => '你的ip地址',
  ),

#第十步，安装应用officeonline连接onlyoffice
登陆localhost:8080
//生成秘钥

 sudo docker exec 92d7c39d1cf1 /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'

解压onlyoffice.tar.gz到/data/nextcloud/apps/下

tar -xvf onlyoffice.tar.gz
mv onlyoffice /data/nextcloud/apps/

进入nextcloud的docker，更改onlyoffice权限

docker exec -it nextcloud bash
chown -R www-data:www-data /var/www/html/apps/onlyoffice

管理员登陆nextcloud，在应用中启用officeonline填写onlyoffice地址及秘钥，如果使用https请看调优重解决方案

---

---

---

调优

1.解决电话区域报错

docker exec -it nextcloud bash
cd /config
config.php添加
'default_phone_region'=>'CN',

2.定时任务开启cron
为nextcloud docker编写 cron定时任务脚本

在/etc/systemd/system目录新建nextcloudcron.sh文件写入

#! /bin/bash
docker exec --user www-data nextcloud php -f /var/www/html/cron.php

在/etc/systemd/system目录新建nextcloudcron.service和nextcloudcron.timer两个文件

[Unit]
Description=Nextcloud cron.php job

[Service]
User=apache
ExecStart=/etc/systemd/system/nextcloudcron.sh

[Install]
WantedBy=basic.target

---

[Unit]
Description=Run Nextcloud cron.php every 5 minutes

[Timer]
OnBootSec=5min
OnUnitActiveSec=5min
Unit=nextcloudcron.service

[Install]
WantedBy=timers.target

最后，系统执行命令

systemctl enable --now nextcloudcron.timer

3.onlyoffice添加字体

#复制字体到容器内
docker cp -a /home/nextcloud/app/fontwin/ onlyoffice:/usr/share/fonts/truetype/custom/
#进入容器
docker exec -it onlyoffice bash 
cd /usr/bin
#加载字体
./documentserver-generate-allfonts.sh 

4.nextcloud添加redis为缓存

安装redis

docker exec -it redis bash
 redis-cli
 auth 密码
 测试
 set age 15
get age

配置nextcloud添加redis
编辑nextcloud的conf.php

  'memcache.local' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => '192.168.18.128',
    'port' => '6379',
    'password' => '1qaz2wsx3edc',
  ),

非docker的redis安装

# yum -y install tcl  cpp binutils glibc glibc-kernheaders glibc-common glibc-devel gcc automake autoconf libtool gcc-c++ make
# ps -aux | grep redis
# redis安装
# tar -zxvf redis-5.0.3.tar.gz
# make MALLOC=libc
# make install
# redis 配置
# vi /usr/local/redis/redis.conf
# 约136行
# daemonize no 改为yes
# 88行
# protected-mode no  #yes只允许本地连接
# 69行
# bind 127.0.0.1   #注释掉 否则只接受改地址
# timeout 50000   #默认0无法连接
# 启动指定conf
# cd /usr/local/redis/src/
# ./redis-server ../redis.conf
# 设置开机自启
# 关闭reids服务进程
# ps -aux | grep redis
# kill 15654
# 删除进程文件
# rm -f /var/run/redis_6379.pid
# netstat -nlpt 查看端口是否还存在
# cd /usr/local/redis/
# mkdir /etc/redis
# cp ./redis.conf /etc/redis/6379.conf
# cp ./utils/redis_init_script /etc/init.d/redisd
# cd /etc/init.d/
# chkconfig -add redisd
# chkconfig redisd on
# service redisd start
# 执行进入
# redis-cli
# 配置redis密码
# vi /etc/redis/6379.conf
# 大约507行 requirepass foobared
# 改为 requirepass 密码
# 修改脚本
# vi /etc/init.d/redisd
# 39行
# $CLIEXEC -p $PEDISPORT shutdown
# 改为
# $CLIEXEC -a "密码" -p $PEDISPORT shutdown

# 访问客户端设置auth密码
# redis-cli
# auth 密码

---

5.制作证书，https访问nextcloud

创建根 CA 证书

---

openssl genrsa -des3 -out nextcloud.key 4096
openssl req -new -key nextcloud.key -out nextcloud.csr
# Country Name (2 letter code) [XX]:CN
# State or Province Name (full name) []:beijing
# Locality Name (eg, city) [Default City]:beijing
# Organization Name (eg, company) [Default Company Ltd]:mylocal
# Organizational Unit Name (eg, section) []:mylocal
# Common Name (eg, your name or your server's hostname) []:www.nextcloud.com
# Email Address []:123456@outlook.com

# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:1qaz2wsx3edc
# An optional company name []:mylocal
cp nextcloud.key nextcloud.key.org
openssl rsa -in nextcloud.key.org -out nextcloud.key
openssl x509 -req -days 3650 -in nextcloud.csr -signkey nextcloud.key -out nextcloud.crt
#复制文件到nextcloud容器/etc/apache2
docker cp cert/ nextcloud:/etc/apache2/ca
-------------------------------------

#进入容器执行
a2enmod ssl
a2ensite default-ssl
#修改ssl.load配置文件
vim /etc/apache2/mods-available/ssl.load
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
docker cp nextcloud:/etc/apache2/sites-available/default-ssl.conf ./ 
#找到SSLEngine on
SSLCertificateFile
SSLCertificateKeyFile
#注释掉在下方添加
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
SSLEngine on
SSLCertificateFile /etc/apache2/cert/nextcloud.crt
SSLCertificateKeyFile /etc/apache2/cert/nextcloud.pem
#开启hsts
Header always set Strict-Transport-Security "max-age=15552000; includeSubdomains; preload"
docker cp default-ssl.conf nextcloud:/etc/apache2/sites-available/

#SSLCertificateChainFile /wtc/apache2/cert/nextcloud.crt
#重启docker访问https即可
#nextcloud的config.php写入强制https
vi /data/nextcloud/config/config.php
'overwriteprotocol' => 'https',

#6.制作证书，https访问onlyoffice
openssl genrsa -des3 -out onlyoffice.key 4096
openssl req -new -key onlyoffice.key -out onlyoffice.csr
# Country Name (2 letter code) [XX]:CN
# State or Province Name (full name) []:beijing
# Locality Name (eg, city) [Default City]:beijing
# Organization Name (eg, company) [Default Company Ltd]:dmylocal
# Organizational Unit Name (eg, section) []:mylocal
# Common Name (eg, your name or your server's hostname) []:www.nextcloud.com
# Email Address []:123456@outlook.com

# Please enter the following 'extra' attributes
# to be sent with your certificate request
# A challenge password []:1qaz2wsx3edc
# An optional company name []:mylocal
cp onlyoffice.key onlyoffice.key.org
openssl rsa -in onlyoffice.key.org -out onlyoffice.key
openssl x509 -req -days 3650 -in onlyoffice.csr -signkey onlyoffice.key -out onlyoffice.crt
openssl dhparam -out dhparam.pem 2048

cp ./* /data/onlyoffice/data/certs/
docker exec -it onlyoffice bash

nextcloud链接office

docker cp onlyoffice:/etc/onlyoffice/documentserver/default.json ./

修改

"rejectUnauthorized": false
docker cp default.json onlyoffice:/etc/onlyoffice/documentserver/

7.nextcloud调整php上传大小限制
进入nextcloud容器

docker exec -it nextcloud bash
docker cp nextcloud:/var/www/html/3rdparty/aws/aws-crt-php/php.ini ./
docker cp nextcloud:/var/www/html/.user.ini ./
docker cp nextcloud:/var/www/html/.htaccess ./

php.ini 添加
upload_max_filesize =100G #文件大小限制
post_max_size=100G  #post大小限制
memory_limit=1024M   #内存占用限制 

.user.ini 添加
upload_max_filesize =100G 
post_max_size=100G
memory_limit=1024M 

.htaccess添加在<IfModule mod_php.c>里
  php_value upload_max_filesize 100G
  php_value post_max_size 100G
  php_value memory_limit 1024M

docker cp php.ini nextcloud:/var/www/html/3rdparty/aws/aws-crt-php/
docker cp ./.user.ini nextcloud:/var/www/html/ 
docker cp ./.htaccess nextcloud:/var/www/html/ 

8.nextcloud解除文件锁，避免无法删除

config.php添加
  'default_language' => 'zh_CN',
  'default_locale' => 'zh',
  'filelocking.ebable' => 'false',

9。nextcloud删除默认模板

#删除文件 */core/skeleton/下
#或者设置config.php参数
'skeletondirectory' => '',

最后关闭不必要端口

firewall-cmd --permanent --remove-port=80/tcp
firewall-cmd --permanent --remove-port=8080/tcp
firewall-cmd --reload