6.6 KiB
NextCloud
NextCloud in a container. A simple PHP-FPM deployment. You'll need the Web Server container setup to get access. This just gives a very basic, non-web-server version of NextCloud.
NOTE: You may want to use a filesystem on a USB disk instead of /var for the volumes setup in the below Docker command(s) to help reduce writes to the micro sd card
Inspiration / Sources
- https://github.com/nextcloud/docker
- https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion
- https://hub.docker.com/_/nextcloud/
- https://hub.docker.com/r/arm64v8/nextcloud/
- https://hub.docker.com/r/arm32v5/nextcloud/
- https://hub.docker.com/r/arm32v7/nextcloud/
Install / Update / Run Script
Setup a generic script that'll auto update NextCloud, build a container and launch it. You should only run this script at first launch and/or when you're looking for updates.
mkdir /var/nextcloud
chown -R www-data: /var/nextcloud
cat > /scratch/docker/nextcloud.sh <<EOF
#!/bin/bash
##########
# For postgresql instead of sqlite run the following commands
#docker exec -it postgres psql -U postgres
#create role nextcloud nocreatedb nocreaterole login PASSWORD 'password';
#create database nextcloud owner=nextcloud encoding=UTF8;
# Setup using the above database/username/role and ip of 172.30.12.12
##########
ARCH=\`arch\`
if [ \$ARCH == "aarch64" ]
then
ARCH="arm64v8"
else
ARCH="arm32v7"
fi
docker pull registry.lollipopcloud.solutions/\$ARCH/nextcloud
docker container stop nextcloud
docker container rm nextcloud
docker run \\
--name nextcloud \\
--restart unless-stopped \\
--net docker-private \\
--ip 172.30.7.7 \\
-e TZ=UTC \\
-e DEBUG=1 \\
-v /var/nextcloud:/var/www/html \\
registry.lollipopcloud.solutions/\$ARCH/nextcloud
EOF
chmod a+x /scratch/docker/nextcloud.sh
Run NextCloud
Simply execute /scratch/docker/nextcloud.sh
to update/run NextCloud.
Update Unbound
cat > /etc/unbound/local_zone/nextcloud.conf <<EOF
local-data: "nextcloud-insecure A 172.30.7.7"
local-data-ptr: "172.30.7.7 nextcloud-insecure"
local-data: "nextcloud-insecure.domain.tld A 172.30.7.7"
local-data-ptr: "172.30.7.7 nextcloud-insecure.domain.tld"
local-data: "nextcloud A 172.30.0.1"
local-data: "nextcloud.domain.tld A 172.30.0.1"
local-data-ptr: "172.30.0.1 nextcloud"
local-data-ptr: "172.30.0.1 nextcloud.domain.tld"
EOF
Serving Via Caddy
cat > /etc/caddy/services/nextcloud.conf <<EOF
# Nextcloud proxy
nextcloud:80, nextcloud:443, nextcloud.domain.tld:80, nextcloud.domain.tld:443 {
redir 301 {
if {scheme} is http
/ https://nextcloud.domain.tld{uri}
}
log /var/log/caddy/nextcloud.log
proxy / 172.30.7.7:80 {
transparent
}
# Use acme.sh Let's Encrypt SSL cert setup
tls /var/acme.sh/domain.tld/fullchain.cer /var/acme.sh/domain.tld/domain.tld.key
header / {
# Enable HTTP Strict Transport Security (HSTS) to force clients to always
# connect via HTTPS (do not use if only testing)
Strict-Transport-Security "max-age=15552000;"
# Enable cross-site filter (XSS) and tell browser to block detected attacks
X-XSS-Protection "1; mode=block"
# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
X-Content-Type-Options "nosniff"
# Disallow the site to be rendered within a frame (clickjacking protection)
X-Frame-Options "DENY"
}
}
EOF
First Run / Finalize Setup
- Navigate to
http://nextcloud-insecure.domain.tld
- Follow on-screen prompts for finalizing the NextCloud setup
- Login as Admin
Post Install
Update/Install/Enable Apps
Enabled Apps
- Update any apps that are showing as out of date
Disabled apps
- Enable Auditing / Logging app
- Enable Default encryption module
- Enable external storage support
- Enable PDF Viewer
Customization
- Install External sites app
Files
- Install Group folders app
Office & Text
- Enable Calendar app
- Enable Contacts app
- Enable Notes app
- Enable Tasks app
Organization
- Install Annoucement center app
- Enable bookmarks app
Security
- Enable brute force settings app
- Enable restrict login to IP addresses app
- Enable Two Factor TOTP Provider app
- Enable Two Factor U2F app
- Enable Two Factory Yubikey
Social & communication
- Enable circles app
Tools
- Enable Impersonate app
Basic Setup
Adjust default view
If you'd like to see the activities view as your default view in NextCloud, edit /var/nextcloud/config/config.php
and add 'defaultapp' => 'activity',
to the file.
Add Cronjob
In the settings change from Ajax
for scheduled jobs to Cron
and run the following commands on your device.
This will lessen the page loads and keep the cron job constrained to a reasonable duration.
cat > /etc/systemd/system/nextcloudcron.service <<EOF
[Unit]
Description=Nextcloud cron.php job
[Service]
User=roo
ExecStart=/usr/bin/docker exec --user www-data nextcloud php /var/www/html/cron.php
[Install]
WantedBy=basic.target
EOF
cat > /etc/systemd/system/nextcloudcron.timer <<EOF
[Unit]
Description=Run Nextcloud cron.php every 90 minutes
[Timer]
OnBootSec=10min
OnUnitActiveSec=90min
Unit=nextcloudcron.service
[Install]
WantedBy=timers.target
EOF
systemctl daemon-reload
systemctl start nextcloudcron.timer
systemctl enable nextcloudcron.timer
Adjust Sharing settings
- Disable
Allow public uploads
- Disable
Allow users on this server to send shares to other servers
- Disable
Send password by mail
Adjust Security settings
Recommended Settings (Up to you)
- Minimal Length : 12
- Forbid common passwords
- Enforce upper and lower case characters
- Enforce numeric characters
Setup Apps
- Setup file encryption : https://docs.nextcloud.com/server/13/admin_manual/configuration_files/encryption_configuration.html
- Setup external sites app as appropriate
- Setup remaining apps from above
Configure groups (as appropriate)
- Create group for standard users
- Create group folder for the new group (non-syncthing dumping ground for sync)
- Setup shared contacts list for new group
- Setup shared calendar for new group