Nextcloud 16.04.1 Install on Debian 9
Be sure to regularly login to Nextcloud as admin as there are frequent app updates.
Note the problems that having headers configured in both .htaccess and the apache conf files: https://help.nextcloud.com/t/nextcloud-17-false-warnings/61024
Upgrade to 17.0 from 16.0.5 | Nextcloud notes | nc Docker notes |
Install procedures were customized from this nextcloud source.
The native Debian install had lot of cautionary messages in admin Overview panel but the Docker version just had these. Followup with this article.
- The “X-Content-Type-Options” HTTP header is not set to “nosniff”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
- The “X-Frame-Options” HTTP header is not set to “SAMEORIGIN”. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
- The “Strict-Transport-Security” HTTP header is not set to at least “15552000” seconds. For enhanced security, it is recommended to enable HSTS as described in the security tips ↗.
Docker container Nextcloud self-signed SSL certificate info -——
2019-09-10 Initially used a Docker container for Nextcloud, but I later thought it was too much of a hassle to keep it up to date and rebuilding it for updates which involved numerous layered images. So I decided to try a native install with Apache, PHP, and Sqlite3.
First installed Apache 2.4.25 default debian package
Installed the sury.org php 7.3.9 package (cat /etc/apt/sources.list.d/ondrej.list
). See linuxize instructions.
Created a self-signed SSL certificate. The initial SSL self-signed certificate creation worked in Docker nextcloud container, but did not work when I next installed apache2 on compute-engine and tried to set up https. Couldn't get it to work or figure out why it didn't work. So I completely removed apache2, and the apache self-signed certificate in /etc/ssl/certs. Then made a copy of the following files from docker nextcloud container: 000-default.conf apache-selfsigned.crt apache-selfsigned.key default-ssl.conf ssl-params.conf. Then redid the procedures with those files and using these procedures. This worked!
2019-09-20 Did a manual install of nextcloud 16.04.1 on Google Compute Engine, Debian 9 instance using these instructions.
Prerequisites for manual installation
The Nextcloud .tar or .zip archive contains all of the required PHP modules. This section lists all required and optional PHP modules. Consult the PHP manual for more information on modules. Your Linux distribution should have packages for all required modules. You can check the presence of a module by typing php -m | grep -i <module_name>
. If you get a result, the module is present.
Required:
- PHP (7.1, 7.2 or 7.3)
- PHP module ctype
- PHP module curl
- PHP module dom
- PHP module GD
- PHP module iconv
- PHP module JSON
- PHP module libxml (Linux package libxml2 must be >=2.7.0)
- PHP module mbstring
- PHP module openssl
- PHP module posix
- PHP module session
- PHP module SimpleXML
- PHP module XMLReader
- PHP module XMLWriter
- PHP module zip
- PHP module zlib
Database connectors (pick the one for your database:)
- PHP module pdo_sqlite (>= 3, usually not recommended for performance reasons)
- PHP module pdo_mysql (MySQL/MariaDB)
- PHP module pdo_pgsql (requires PostgreSQL >= 9.0)
Recommended packages:
- PHP module fileinfo (highly recommended, enhances file analysis performance)
- PHP module bz2 (recommended, required for extraction of apps)
- PHP module intl (increases language translation performance and fixes sorting of non-ASCII characters)
Required for specific apps:
- PHP module ldap (for LDAP integration)
- PHP module smbclient (SMB/CIFS integration, see SMB/CIFS)
- PHP module ftp (for FTP storage / external user authentication)
- PHP module imap (for external user authentication)
Recommended for specific apps (optional):
- PHP module exif (for image rotation in pictures app)
- PHP module gmp (for SFTP storage)
For enhanced server performance (optional) select one of the following memcaches:
- PHP module apcu (>= 4.0.6)
- PHP module memcached
- PHP module redis (>= 2.2.6, required for Transactional File Locking)
See Memory caching to learn how to select and configure a memcache.
For preview generation (optional):
- PHP module imagick
- avconv or ffmpeg
- OpenOffice or LibreOffice
For command line processing (optional):
– PHP module pcntl (enables command interruption by pressing ctrl-c
)
After completion and everything working, these are the installed PHP packages (
php -m):
curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imagick, json, libxml, mbstring, mysqli, mysqlnd, openssl, pcntl, pcre, PDO, pdo_mysql, pdo_sqlite, Phar, posix, readline, Reflection, session, shmop, SimpleXML, sockets, sodium, SPL, sqlite3, standard, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xml, xmlreader, xmlwriter, xsl, Zend OPcache, zip, zlib, [Zend Modules], Zend OPcache
Loaded Apache modules (
sudo apachectl -M): core_module (static), so_module (static), watchdog_module (static), http_module (static), log_config_module (static), logio_module (static), version_module (static), unixd_module (static), access_compat_module (shared), alias_module (shared), auth_basic_module (shared), authn_core_module (shared), authn_file_module (shared), authz_core_module (shared), authz_host_module (shared), authz_user_module (shared), autoindex_module (shared), deflate_module (shared), dir_module (shared), env_module (shared), filter_module (shared), headers_module (shared), mime_module (shared), mpm_prefork_module (shared), negotiation_module (shared), php7_module (shared), reqtimeout_module (shared), rewrite_module (shared), setenvif_module (shared), socache_shmcb_module (shared), ssl_module (shared), status_module (shared)
You don't need the WebDAV module for your Web server (i.e. Apache's mod_webdav
), as Nextcloud has a built-in WebDAV server of its own, SabreDAV. If mod_webdav
is enabled you must disable it for Nextcloud. (See Apache Web server configuration for an example configuration.)
Example installation on Ubuntu 18.04 LTS server
On a machine running a pristine Ubuntu 18.04 LTS server, you have three options:
For (1) bash scripts and (2) snap packages, see original nextcloud install procedures
(3) Debian packages: Installing Nextcloud
Or you can use .deb packages to install the required and recommended modules for a typical Nextcloud installation, using Apache and MariaDB, by issuing the following commands in a terminal:
apt-get install apache2 mariadb-server libapache2-mod-php7.3
apt-get install php7.3-gd php7.3-json php7.3-mysql php7.3-curl php7.3-mbstring
apt-get install php7.3-intl php-imagick php7.3-xml php7.3-zip
This installs the packages for the Nextcloud core system. libapache2-mod-php7.3
provides the following PHP extensions:
bcmath bz2 calendar Core ctype date dba dom ereg exif fileinfo filter ftp gettext hash iconv libxml mhash openssl pcre Phar posix Reflection session shmop SimpleXML soap sockets SPL standard sysvmsg sysvsem sysvshm tokenizer wddx xmlreader xmlwriter zlib
If you are planning on running additional apps, keep in mind that they might require additional packages. See Prerequisites for manual installation for details.
- At the installation of the MySQL/MariaDB server, you will be prompted to create a root password. Be sure to remember your password as you will need it during Nextcloud database setup.
Now download the archive of the latest Nextcloud version:
Go to the Nextcloud Download Page.
Go to Download Nextcloud Server > Download > Archive file for server owners and download either the tar.bz2 or .zip archive.
This downloads a file named nextcloud-x.y.z.tar.bz2 or nextcloud-x.y.z.zip (where x.y.z is the version number).
Download its corresponding checksum file, e.g. nextcloud-x.y.z.tar.bz2.md5, or nextcloud-x.y.z.tar.bz2.sha256.
Verify the MD5 or SHA256 sum:
md5sum -c nextcloud-x.y.z.tar.bz2.md5 < nextcloud-x.y.z.tar.bz2 sha256sum -c nextcloud-x.y.z.tar.bz2.sha256 < nextcloud-x.y.z.tar.bz2 md5sum -c nextcloud-x.y.z.zip.md5 < nextcloud-x.y.z.zip sha256sum -c nextcloud-x.y.z.zip.sha256 < nextcloud-x.y.z.zip
You may also verify the PGP signature:
wget https://download.nextcloud.com/server/releases/nextcloud-x.y.z.tar.bz2.asc wget https://nextcloud.com/nextcloud.asc gpg --import nextcloud.asc gpg --verify nextcloud-x.y.z.tar.bz2.asc nextcloud-x.y.z.tar.bz2
Now you can extract the archive contents. Run the appropriate unpacking command for your archive type. Copy the content over to the root directory of your webserver. In our case, we are using apache so it will be
/var/www/html/
:tar -xjf nextcloud-x.y.z.tar.bz2
unzip nextcloud-x.y.z.zip (I did the zip file) Or:unzip nextcloud-*.zip
This unpacks to a single
nextcloud
directory. Copy the Nextcloud directory to its final destination.cp -rp nextcloud /var/www/html (I did this; it copies with recursion preserving mode, ownership, timestamps) Or with the tar file in /var/www/html, just unzip it.
During the install process, no data folder is created, so we will create one manually to help with the installation wizard: mkdir /var/www/html/nextcloud/data
Make sure that apache has read and write access to the whole nextcloud folder:
chown -R www-data:root /var/www/html/nextcloud (this duplicated the Docker ownership; it did not work as root:root). Note that the nextcloud data folder and all files in it have www-data:www-data ownership.
Restart apache: sudo systemctl restart apache2
Create a firewall rule for access to apache:
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload
Note: If you use this tutorial, and you see warnings in the web browser after installation about OPcache
not being enabled or configured correctly, you need to make the suggested changes in /etc/opt/rh/rh-php72/php.d/10-opcache.ini
for the errors to disappear. These warnings will be on the Admin page, under Basic settings.
Because we used Redis
as a memcache, you will need a config similar to the following example in /var/www/html/nextcloud/config/config.php
which is auto-generated when you run the online installation wizard mentioned earlier.
Example config:
'memcache.distributed' => '\OC\Memcache\Redis', 'memcache.locking' => '\OC\Memcache\Redis', 'memcache.local' => '\OC\Memcache\APCu', 'redis' => array( 'host' => 'localhost', 'port' => 6379, ),
Remember, this tutorial is only for a basic setup of Nextcloud with PHP 7.3. If you are going to use more features like LDAP or Single Sign On, you will need additional PHP modules as well as extra configurations. So please visit the rest of the Admin manual, Introduction, for detailed descriptions on how to get this done.
Apache Web server configuration
On Debian, Ubuntu, and their derivatives, Apache installs with a useful configuration so all you have to do is create a /etc/apache2/sites-available/nextcloud.conf
file with these lines in it, replacing the Directory and other filepaths with your own filepaths: Alias /nextcloud "/var/www/nextcloud/"
<Directory /var/www/nextcloud/>
Require all granted
Options FollowSymlinks MultiViews
AllowOverride All
<IfModule mod_dav.c>
Dav off
</IfModule>
SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>
Then enable the newly created site: a2ensite nextcloud.conf
Additional Apache configurations
For Nextcloud to work correctly, we need the module
mod_rewrite
. Enable it by running:a2enmod rewrite
Additional recommended modules are
mod_headers
,mod_env
,mod_dir
andmod_mime
:a2enmod headers a2enmod env a2enmod dir a2enmod mime
If you're running
mod_fcgi
instead of the standardmod_php
also enable:a2enmod setenvif
You must disable any server-configured authentication for Nextcloud, as it uses Basic authentication internally for DAV services. If you have turned on authentication on a parent folder (via e.g. an
AuthType Basic
directive), you can turn off the authentication specifically for the Nextcloud entry. Following the above example configuration file, add the following line in the<Directory>
section:Satisfy Any
When using SSL, take special note of the ServerName. You should specify one in the server configuration, as well as in the CommonName field of the certificate. If you want your Nextcloud to be reachable via the internet, then set both of these to the domain you want to reach your Nextcloud server.
Now restart Apache:
sudo systemctl restart apache2
If you're running Nextcloud in a subdirectory and want to use CalDAV or CardDAV clients make sure you have configured the correct Service discovery URLs.
Pretty URLs (I didn't do this)
Pretty URLs remove the index.php
-part in all Nextcloud URLs, for example in sharing links like https://example.org/nextcloud/index.php/s/Sv1b7krAUqmF8QQ
, making URLs shorter and thus prettier.
mod_env
and mod_rewrite
must be installed on your webserver and the .htaccess
must be writable by the HTTP user. Then you can set in the config.php
two variables:
'overwrite.cli.url' => 'https://example.org/nextcloud', 'htaccess.RewriteBase' => '/nextcloud',
If your setup is available on https://example.org/nextcloud
or:
'overwrite.cli.url' => 'https://example.org/', 'htaccess.RewriteBase' => '/',
if it isn't installed in a subfolder. Finally run this occ-command to update your .htaccess file:
sudo -u www-data php /var/www/nextcloud/occ maintenance:update:htaccess
After each update, these changes are automatically applied to the .htaccess
-file.
Enabling SSL
These procedures worked for a self-signed SSL certificate.
You can use Nextcloud over plain HTTP, but we strongly encourage you to use SSL/TLS to encrypt all of your server traffic, and to protect user's logins and data in transit.
Apache installed under Ubuntu comes already set-up with a simple self-signed certificate. All you have to do is to enable the ssl module and the default site (this is probably the snake oil certificate?). Open a terminal and run:
a2enmod ssl
a2ensite default-ssl
service apache2 reload
Self-signed certificates have their drawbacks – especially when you plan to make your Nextcloud server publicly accessible. You might want to consider getting a certificate signed by a commercial signing authority. Check with your domain name registrar or hosting service for good deals on commercial certificates.
After restarting Apache you must complete your installation by running either the graphical Installation Wizard, or on the command line with the occ
command. To enable this, change the ownership on your Nextcloud directories to your HTTP user:
chown -R www-data:www-data /var/www/nextcloud/ (see note above re the ownerships I actually used, which were the same as in the Docker container)
Note
To use occ
see Installing from command line.
To use the graphical Installation Wizard see Installation wizard.