nextcloud_dans_lxc_-_2
Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| nextcloud_dans_lxc_-_2 [2019/10/29 09:47] – [MariaDB] simon | nextcloud_dans_lxc_-_2 [Date inconnue] (Version actuelle) – supprimée - modification externe (Date inconnue) 127.0.0.1 | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| - | ====== Nextcloud dans lxc - 2 ====== | ||
| - | <WRAP center round important 60%> | ||
| - | 29/10/2019 : Essais d'une installation complète en suivant le tutoriel [[https:// | ||
| - | </ | ||
| - | ===== lxc ===== | ||
| - | <code bash> | ||
| - | lxc-create -t download -n nextcloud2 -- --dist debian --release buster --arch amd64 | ||
| - | </ | ||
| - | |||
| - | On configure ce qu'il faut pour avoir une IP statique (voir [[lxc]]). | ||
| - | |||
| - | ===== prérequis ===== | ||
| - | <code bash> | ||
| - | # lxc-attach nextcloud2 | ||
| - | |||
| - | root@nextcloud2:/# | ||
| - | |||
| - | root@nextcloud2:/# | ||
| - | </ | ||
| - | |||
| - | ===== Dépôts pour Nginx, PHP et MariaDB ===== | ||
| - | ==== Nginx ==== | ||
| - | <code bash> | ||
| - | # cd / | ||
| - | |||
| - | # echo "deb [arch=amd64] http:// | ||
| - | |||
| - | # curl -fsSL https:// | ||
| - | </ | ||
| - | |||
| - | ==== PHP ==== | ||
| - | <code bash> | ||
| - | # cd / | ||
| - | |||
| - | # echo "deb [arch=amd64] https:// | ||
| - | |||
| - | # root@nextcloud2:/ | ||
| - | OK | ||
| - | </ | ||
| - | |||
| - | ==== MariaDB ==== | ||
| - | <code bash> | ||
| - | # cd / | ||
| - | |||
| - | # echo "deb [arch=amd64] http:// | ||
| - | |||
| - | # apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xF1656F24C74CD1D8 | ||
| - | Executing: / | ||
| - | gpg: clef F1656F24C74CD1D8 : | ||
| - | gpg: | ||
| - | gpg: | ||
| - | </ | ||
| - | |||
| - | ==== Upgrade ==== | ||
| - | |||
| - | On met à jour : | ||
| - | <code bash> | ||
| - | # apt update && apt upgrade -y | ||
| - | |||
| - | # make-ssl-cert generate-default-snakeoil -y | ||
| - | |||
| - | # apt remove nginx nginx-extras nginx-common nginx-full -y --allow-change-held-packages | ||
| - | |||
| - | # apt autoremove | ||
| - | </ | ||
| - | |||
| - | ===== Installations et configurations ===== | ||
| - | ==== Nginx ==== | ||
| - | <code bash> | ||
| - | # apt install nginx -y | ||
| - | |||
| - | # nginx -V | ||
| - | nginx version: nginx/ | ||
| - | |||
| - | # systemctl enable nginx.service | ||
| - | |||
| - | # mv / | ||
| - | |||
| - | root@nextcloud2:/ | ||
| - | (...) | ||
| - | 27: eth0@if28: < | ||
| - | (...) | ||
| - | inet 10.0.3.162/ | ||
| - | (...) | ||
| - | |||
| - | root@nextcloud2:/ | ||
| - | |||
| - | root@nextcloud2:/ | ||
| - | user www-data; | ||
| - | worker_processes auto; | ||
| - | pid / | ||
| - | |||
| - | events { | ||
| - | worker_connections 1024; | ||
| - | multi_accept on; | ||
| - | use epoll; | ||
| - | } | ||
| - | |||
| - | http { | ||
| - | server_names_hash_bucket_size 64; | ||
| - | upstream php-handler { | ||
| - | server unix:/ | ||
| - | } | ||
| - | |||
| - | set_real_ip_from 127.0.0.1; | ||
| - | set_real_ip_from 10.0.3.0/ | ||
| - | real_ip_header X-Forwarded-For; | ||
| - | real_ip_recursive on; | ||
| - | include / | ||
| - | #include / | ||
| - | #include / | ||
| - | #include / | ||
| - | #include / | ||
| - | default_type application/ | ||
| - | access_log / | ||
| - | error_log / | ||
| - | sendfile on; | ||
| - | send_timeout 3600; | ||
| - | tcp_nopush on; | ||
| - | tcp_nodelay on; | ||
| - | open_file_cache max=500 inactive=10m; | ||
| - | open_file_cache_errors on; | ||
| - | keepalive_timeout 65; | ||
| - | reset_timedout_connection on; | ||
| - | server_tokens off; | ||
| - | resolver 10.0.3.162 valid=30s; | ||
| - | #resolver 127.0.0.53 valid=30s; is recommended but reuqires a valid resolver configuration | ||
| - | resolver_timeout 5s; | ||
| - | include / | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | On teste la config et on redémarre nginx : | ||
| - | <code bash> | ||
| - | # nginx -t && service nginx restart | ||
| - | </ | ||
| - | |||
| - | On crée le dossier nextcloud et on lui met les bons droits : | ||
| - | <code bash> | ||
| - | # mkdir -p / | ||
| - | |||
| - | # chown -R www-data: | ||
| - | </ | ||
| - | |||
| - | ==== PHP ==== | ||
| - | <code bash> | ||
| - | # apt update && apt install php7.3-fpm php7.3-gd php7.3-mysql php7.3-curl php7.3-xml php7.3-zip php7.3-intl php7.3-mbstring php7.3-json php7.3-bz2 php7.3-ldap php-apcu imagemagick php-imagick php-smbclient -y | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | Je ne mets pas de "#" | ||
| - | </ | ||
| - | |||
| - | |||
| - | Backup des configurations : | ||
| - | <code bash> | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | cp / | ||
| - | |||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | |||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | |||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | |||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | sed -i " | ||
| - | </ | ||
| - | |||
| - | <code bash> | ||
| - | # service php7.3-fpm restart | ||
| - | # service nginx restart | ||
| - | </ | ||
| - | |||
| - | ==== MariaDB ==== | ||
| - | <code bash> | ||
| - | # apt update && apt install mariadb-server -y | ||
| - | |||
| - | # mysql --version | ||
| - | mysql Ver 15.1 Distrib 10.4.8-MariaDB, | ||
| - | </ | ||
| - | |||
| - | Le service ne démarre pas : | ||
| - | <code bash> | ||
| - | root@nextcloud2:/ | ||
| - | ● mariadb.service - MariaDB 10.4.8 database server | ||
| - | | ||
| - | Drop-In: / | ||
| - | | ||
| - | | ||
| - | Docs: man: | ||
| - | | ||
| - | |||
| - | oct 29 09:02:09 nextcloud2 systemd[1]: Starting MariaDB 10.4.8 database server... | ||
| - | oct 29 09:02:09 nextcloud2 systemd[18087]: | ||
| - | oct 29 09:02:09 nextcloud2 systemd[18087]: | ||
| - | oct 29 09:02:09 nextcloud2 systemd[1]: mariadb.service: | ||
| - | oct 29 09:02:09 nextcloud2 systemd[1]: mariadb.service: | ||
| - | oct 29 09:02:09 nextcloud2 systemd[1]: Failed to start MariaDB 10.4.8 database server. | ||
| - | </ | ||
| - | |||
| - | Après quelques recherches sur les internets, j'ai vu que le soucis semble causé par AppArmor. Pour le désactiver : | ||
| - | <code bash> | ||
| - | # cat / | ||
| - | (...) | ||
| - | lxc.apparmor.profile = unconfined | ||
| - | (...) | ||
| - | </ | ||
| - | |||
| - | Il faut ensuite redémarrer le conteneur : | ||
| - | <code bash> | ||
| - | # lxc-stop nextcloud2 | ||
| - | # lxc-start nextcloud2 | ||
| - | </ | ||
| - | |||
| - | On sécurise l' | ||
| - | <code bash> | ||
| - | root@nextcloud2: | ||
| - | |||
| - | NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB | ||
| - | SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY! | ||
| - | |||
| - | In order to log into MariaDB to secure it, we'll need the current | ||
| - | password for the root user. If you've just installed MariaDB, and | ||
| - | haven' | ||
| - | |||
| - | Enter current password for root (enter for none): | ||
| - | OK, successfully used password, moving on... | ||
| - | |||
| - | Setting the root password or using the unix_socket ensures that nobody | ||
| - | can log into the MariaDB root user without the proper authorisation. | ||
| - | |||
| - | You already have your root account protected, so you can safely answer ' | ||
| - | |||
| - | Switch to unix_socket authentication [Y/n] N | ||
| - | ... skipping. | ||
| - | |||
| - | You already have your root account protected, so you can safely answer ' | ||
| - | |||
| - | Change the root password? [Y/n] n | ||
| - | ... skipping. | ||
| - | |||
| - | By default, a MariaDB installation has an anonymous user, allowing anyone | ||
| - | to log into MariaDB without having to have a user account created for | ||
| - | them. This is intended only for testing, and to make the installation | ||
| - | go a bit smoother. | ||
| - | production environment. | ||
| - | |||
| - | Remove anonymous users? [Y/n] y | ||
| - | ... Success! | ||
| - | |||
| - | Normally, root should only be allowed to connect from ' | ||
| - | ensures that someone cannot guess at the root password from the network. | ||
| - | |||
| - | Disallow root login remotely? [Y/n] y | ||
| - | ... Success! | ||
| - | |||
| - | By default, MariaDB comes with a database named ' | ||
| - | access. | ||
| - | before moving into a production environment. | ||
| - | |||
| - | Remove test database and access to it? [Y/n] y | ||
| - | - Dropping test database... | ||
| - | ... Success! | ||
| - | - Removing privileges on test database... | ||
| - | ... Success! | ||
| - | |||
| - | Reloading the privilege tables will ensure that all changes made so far | ||
| - | will take effect immediately. | ||
| - | |||
| - | Reload privilege tables now? [Y/n] y | ||
| - | ... Success! | ||
| - | |||
| - | Cleaning up... | ||
| - | |||
| - | All done! If you've completed all of the above steps, your MariaDB | ||
| - | installation should now be secure. | ||
| - | |||
| - | Thanks for using MariaDB! | ||
| - | </ | ||
nextcloud_dans_lxc_-_2.1572342464.txt.gz · Dernière modification : 2020/08/09 12:59 (modification externe)