Owncloud

Hallo,

ich habe meine Owncloud auf einen neuen schnelleren und größeren Server migriert. Dabei habe ich gleich gleich einige Optimierungen vorgenommen und für euch zusammengefasst.

Was	Alt	Neu
Webserver	Apache 2.4	nginx 1.10.3
PHP	PHP 5.6	PHP 7.0
Datenbank	MySQL 5.5	MariaDB 10.0.33
HTTPS Zertifikat	Let's Encrypt manuell	Let's Encrypt automatisch

Warum diese ganzen Änderungen? Für mich hauptsächlich um die Performance zu verbessern. Für diesen Artikel habe ich die Neuinstallation von Owncloud beschrieben, da ja vermutlich wenige mit einer Migration starten :)

Dieses Tutorial richtet sich an alle, die schon etwas Vorwissen haben. Ich setze voraus, dass ihr wisst:

Wie ihr auf der Console arbeitet.
Config-Dateien editiert. (vim, nano, usw..)
Was die Komponenten sind.

Es ist ein Leitfaden für mich selbst und alle die einfach nur schnell "das richtige Setup" wollen.

1. Webserver: nginx installieren

Exkurs: Vergleich Apache vs. nginx

nginx installieren

apt-get update && apt-get upgrade
apt-get install nginx

SSL Zertifikat mit Let's Encrypt installieren

Dafür gibt es ein Tool "certbot" und ein Plugin für nginx. Wenn wir beides nutzen wird auch das Zertifikat automatisch erneuert.

apt-get install software-properties-common python-software-properties
add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install python-certbot-nginx

Anpassen des ServerName in der nginx-Config:

vim /etc/nginx/sites-available/default

. . .
server_name owncloud.example.com;
. . .

(Optional) Config-Syntax prüfen: nginx -t

und anschließend neu laden:

`systemctl reload nginx`

Zertifikat erstellen und einbinden:

certbot --nginx -d owncloud.example.com

Certbot hat ein Script /etc/cron.d/certbot abgelegt, welches automatisch die Zertifikate erneuert. Prüfen ob das automatische erneuern funktionieren würde:
certbot renew --dry-run

2. Datenbank MariaDB installieren

Weblink: Exkurs: Vergleich MariaDB vs. MySQL

Grundinstallation

apt-get install mariadb-server mariadb-client
mysql_secure_installation

Datenbank und User für owncloud anlegen

mysql -u root -p
MariaDB [(none)]> CREATE DATABASE owncloud;
CREATE USER 'ownclouduser'@'localhost' IDENTIFIED BY 'PASSWORTFUERUSER';
GRANT ALL ON owncloud.* TO 'ownclouduser'@'localhost' IDENTIFIED BY 'PASSWORTFUERUSER' WITH GRANT OPTION;
FLUSH PRIVILEGES;
EXIT;

3. PHP7 - PHP-fpm installieren

Weblink: Exkurs: Vergleich PHP7 vs. PHP5 Performance

apt install php7.0-fpm php7.0-common php7.0-mbstring php7.0-xmlrpc php7.0-soap php7.0-ldap php7.0-gd php7.0-xml php7.0-intl php7.0-json php7.0-mysql php7.0-cli php7.0-mcrypt php7.0-ldap php7.0-zip php7.0-curl

php.ini anpassen:
vim /etc/php/7.0/fpm/php.ini

memory_limit = 256M
upload_max_filesize = 2048M
max_execution_time = 360
cgi.fix_pathinfo=0

4. OwnCloud herunterladen und installieren

cd /var/www/
wget https://download.owncloud.org/community/owncloud-10.0.7.zip
apt-get install unzip
unzip owncloud-10.0.7.zip
chown -R www-data:www-data owncloud

nginx Config anpassen

/etc/nginx/sites-available/owncloud

upstream php-handler {
    server unix:/var/run/php/php7.0-fpm.sock;
}

server {
    listen 80;
    server_name owncloud.example.com
    # enforce https
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name owncloud.example.com;

#    listen [::]:443 ssl ipv6only=on; # managed by Certbot
#    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/owncloud.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/owncloud.example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this topic first.
    #add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/owncloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

    location = /.well-known/carddav {
        return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
        return 301 $scheme://$host/remote.php/dav;
    }

    location /.well-known/acme-challenge { }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Disable gzip to avoid the removal of the ETag header
    gzip off;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        return 404;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        return 404;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off; #Available since nginx 1.7.11
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into this topic first.
        #add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

Seite aktivieren

ln -s /etc/nginx/sites-available/owncloud /etc/nginx/sites-enabled/
systemctl restart nginx.service

5. Optional: Caching aktivieren

Offizielle Doku

apt install php-apcu redis-server php-redis

vim /etc/redis/redis.conf

port 0
unixsocket /var/run/redis/redis.sock
unixsocketperm 770

sudo usermod -a -G redis www-data
service redis-server start
systemctl enable redis-server
/etc/init.d/php7.0-fpm stop
/etc/init.d/php7.0-fpm start

Anpassung der config/config.php von OwnCloud:

...
 /* Memcache */
 'memcache.local' => '\\OC\\Memcache\\APCu',
 
 /* Redis Cache*/
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
 "redis": {
     "host": "localhost",
     "port": 6379,
     "timeout": 0,
     "dbindex": 0
 },
...

Owncloud Setup mit Nginx, MariaDB, PHP7 und automatischen Lets Encrypt SSL Zertifikaten