installation/nextcloud_itopie.md

+## Installation Nextcloud selon les pratiques d'itopie
+
+[[_TOC_]]
+
+### Installation de PHP
+
+#### PHP 8.2
+1. Ajout du dépôt [sury|https://packages.sury.org/php/] pour PHP 
+   - Suivre les indications du [README|https://packages.sury.org/php/README.txt]
+1. Installation des paquets php nécessaires pour Nextcloud
+
+```
+# apt install php8.2-{apcu,bcmath,cli,common,ctype,curl,dom,exif,fpm,ftp,gd,gmp,imagick,imap,intl,ldap,mbstring,pgsql,posix,redis,smbclient,xml,xsl,zip}                                                                   [15:56:38]
+```
+   **NB**, pour vérifier les modules installés : `php -m | grep -i <module_name>`
+1. Éditer la configuration de PHP FPM : /etc/php/8.x/fpm/php.ini
+   - A modifier : paramètres opcache, tiemzone et la limite mémoire.
+   ```
+   # cat /etc/php/8.2/fpm/php.ini | grep ^opcache
+   opcache.enable=1
+   opcache.memory_consumption=256
+   opcache.interned_strings_buffer=16
+   opcache.max_accelerated_files=10000
+   opcache.revalidate_freq=1
+   opcache.save_comments=1
+
+   # cat /etc/php/8.2/fpm/php.ini | grep ^date.timezone
+   date.timezone = Europe/Zurich
+
+   # cat /etc/php/8.2/fpm/php.ini | grep ^memory_limit
+   memory_limit = 512M
+   ```
+1. Éditer la configuration de PHP CLI : /etc/php/8.x/cli/php.ini
+   ```
+   # cat /etc/php/8.2/cli/php.ini | grep ^date.timezone
+   date.timezone = Europe/Zurich
+   ```
+1. Ajouter le fichier nextcloud.conf dans /etc/php/8.x/fpm/pool.d/
+   **NB**, ce fichier contient la configuration du socket Unix pour l'exécution des requêtes PHP.
+   **ATTENTION**, les valeurs de ce fichiers doivent être adaptées en fonction des ressources de la machine. Il existe un [calculateur en ligne|https://spot13.com/pmcalculator/] qui permet de les calculer.
+   ```
+   [nextcloud]
+   listen = /run/php/php8.2-fpm-nextcloud.sock                                       ; The access log file
+   listen.owner = www-data                                                           ; Default: not set
+   listen.group = www-data                                                           ;access.log = log/$pool.access.log
+
+   user = www-data                                                                   ; The access log format.
+   group = www-data                                                                  ; The following syntax is allowed
+                                                                                     ;  %%: the '%' character
+   pm = dynamic                                                                      ;  %C: %CPU used by the request
+   pm.max_children = 172                                                             ;      it can accept the following format:
+   pm.process_idle_timeout = 10s                                                     ;      - %{user}C for user CPU only
+   pm.max_requests = 200                                                             ;      - %{system}C for system CPU only
+   pm.start_servers = 43                                                             ;      - %{total}C  for user + system CPU (default)
+   pm.min_spare_servers = 43                                                         ;  %d: time taken to serve the request
+   pm.max_spare_servers = 129                                                        ;      it can accept the following format:
+   pm.status_path = /fpm-status                                                      ;      - %{seconds}d (default)
+                                                                                     ;      - %{milliseconds}d
+   env[HOSTNAME] = $HOSTNAME                                                         ;      - %{milli}d
+   env[PATH] = /usr/local/bin:/usr/bin:/bin                                          ;      - %{microseconds}d
+   env[TMP] = /tmp                                                                   ;      - %{micro}d
+   env[TMPDIR] = /tmp                                                                ;  %e: an environment variable (same as $_ENV or $_SERVER)
+   env[TEMP] = /tmp                                                                  ;      it must be associated with embraces to specify the name of the env
+                                                                                     ;      variable. Some examples:
+   catch_workers_output = yes                                                        ;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+   php_flag[display_errors] = on                                                     ;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+   php_admin_value[error_log] = /var/log/fpm-php.nextcloud.log                       ;  %f: script filename
+   php_admin_flag[log_errors] = on
+   ```
+1. Fixer la version active de PHP : `# update-alternatives --config php`
+1. Redémarrer PHP-FPM : `# systemctl restart php8.2-fpm.service` 
+
+### Installation de nginx
+1. Installer nginx : `# apt install nginx`
+1. Ajouter la configuration suivante dans /etc/nginx/sites-available/${WebsiteName.tld}
+   **ATTENTION**, variable à modifier par le nom du service : ${WebsiteName.tld} !
+   ```
+   upstream php-handler {
+       #server 127.0.0.1:9000;
+       server unix:/run/php/php8.2-fpm-nextcloud.sock;
+   }
+
+   # Set the `immutable` cache control options only for assets with a cache busting `v` argument
+   map $arg_v $asset_immutable {
+       "" "";
+       default "immutable";
+   }
+
+
+   server {
+       listen 80;
+       listen [::]:80;
+       server_name ${WebsiteName.tld};
+
+       access_log /var/log/nginx/${WebsiteName.tld}.access.log;
+       error_log /var/log/nginx/${WebsiteName.tld}.error.log;
+
+       # Prevent nginx HTTP Server Detection
+       server_tokens off;
+
+       # Enforce HTTPS
+       return 301 https://$server_name$request_uri;
+   }
+
+   server {
+       listen 443      ssl http2;
+       listen [::]:443 ssl http2;
+       server_name ${WebsiteName.tld};
+
+       # Path to the root of your installation
+       root /srv/nextcloud;
+
+       # Use Mozilla's guidelines for SSL/TLS settings
+       # https://mozilla.github.io/server-side-tls/ssl-config-generator/
+       ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+       ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+
+       # Logs
+       access_log /var/log/nginx/${WebsiteName.tld}.access.log;
+       error_log /var/log/nginx/${WebsiteName.tld}.error.log;
+
+       # Prevent nginx HTTP Server Detection
+       server_tokens off;
+
+       # HSTS settings
+       # WARNING: Only add the preload option once you read about
+       # the consequences in https://hstspreload.org/. This option
+       # will add the domain to a hardcoded list that is shipped
+       # in all major browsers and getting removed from this list
+       # could take several months.
+       add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+
+       # set max upload size and increase upload timeout:
+       client_max_body_size 1024M;
+       client_body_timeout 3600s;
+       fastcgi_buffers 64 4K;
+
+       # Enable gzip but do not remove ETag headers
+       gzip on;
+       gzip_vary on;
+       gzip_comp_level 4;
+       gzip_min_length 256;
+       gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+       gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+       # Pagespeed is not supported by Nextcloud, so if your server is built
+       # with the `ngx_pagespeed` module, uncomment this line to disable it.
+       #pagespeed off;
+
+       # HTTP response headers borrowed from Nextcloud `.htaccess`
+       add_header Referrer-Policy                      "no-referrer"   always;
+       add_header X-Content-Type-Options               "nosniff"       always;
+       add_header X-Download-Options                   "noopen"        always;
+       add_header X-Frame-Options                      "SAMEORIGIN"    always;
+       add_header X-Permitted-Cross-Domain-Policies    "none"          always;
+       add_header X-Robots-Tag                         "noindex, nofollow"          always;
+       add_header X-XSS-Protection                     "1; mode=block" always;
+
+       # Remove X-Powered-By, which is an information leak
+       fastcgi_hide_header X-Powered-By;
+
+       # Specify how to handle directories -- specifying `/index.php$request_uri`
+       # here as the fallback means that Nginx always exhibits the desired behaviour
+       # when a client requests a path that corresponds to a directory that exists
+       # on the server. In particular, if that directory contains an index.php file,
+       # that file is correctly served; if it doesn't, then the request is passed to
+       # the front-end controller. This consistent behaviour means that we don't need
+       # to specify custom rules for certain paths (e.g. images and other assets,
+       # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+       # `try_files $uri $uri/ /index.php$request_uri`
+       # always provides the desired behaviour.
+       index index.php index.html /index.php$request_uri;
+
+       # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+       location = / {
+           if ( $http_user_agent ~ ^DavClnt ) {
+               return 302 /remote.php/webdav/$is_args$args;
+           }
+       }
+
+       location = /robots.txt {
+           allow all;
+           log_not_found off;
+           access_log off;
+       }
+
+       # Make a regex exception for `/.well-known` so that clients can still
+       # access it despite the existence of the regex rule
+       # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+       # for `/.well-known`.
+       location ^~ /.well-known {
+           # The rules in this block are an adaptation of the rules
+           # in `.htaccess` that concern `/.well-known`.
+
+           location = /.well-known/carddav { return 301 /remote.php/dav/; }
+           location = /.well-known/caldav  { return 301 /remote.php/dav/; }
+
+           location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
+           location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+
+           # Let Nextcloud's API for `/.well-known` URIs handle all other
+           # requests by passing them to the front-end controller.
+           return 301 /index.php$request_uri;
+       }
+
+       # Rules borrowed from `.htaccess` to hide certain paths from clients
+       location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+       location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+
+       # Ensure this block, which passes PHP files to the PHP process, is above the blocks
+       # which handle static assets (as seen below). If this block is not declared first,
+       # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
+       # to the URI, resulting in a HTTP 500 error response.
+       location ~ \.php(?:$|/) {
+           # Required for legacy support
+           rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
+
+           fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+           set $path_info $fastcgi_path_info;
+
+           try_files $fastcgi_script_name =404;
+
+           include fastcgi_params;
+           fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+           fastcgi_param PATH_INFO $path_info;
+           fastcgi_param HTTPS on;
+
+           fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
+           fastcgi_param front_controller_active true;     # Enable pretty urls
+           fastcgi_pass php-handler;
+
+           fastcgi_intercept_errors on;
+           fastcgi_request_buffering off;
+
+           fastcgi_max_temp_file_size 0;
+       }
+
+       location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
+           try_files $uri /index.php$request_uri;
+           add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+           access_log off;     # Optional: Don't log access to assets
+
+           location ~ \.wasm$ {
+               default_type application/wasm;
+           }
+       }
+
+       location ~ \.woff2?$ {
+           try_files $uri /index.php$request_uri;
+           expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+           access_log off;     # Optional: Don't log access to assets
+       }
+
+       # Rule borrowed from `.htaccess`
+       location /remote {
+           return 301 /remote.php$request_uri;
+       }
+
+       location / {
+           try_files $uri $uri/ /index.php$request_uri;
+       }
+   }
+   ```
+1. Redémarrer NGINX : `# systemctl restart nginx.service` 
+
+### Installation de PostgreSQL
+
+
+
+
+
+
+
+!!!!! CHECK DROITS DES FICHIERS ET DOSSIERS 
+
+
+
+## PostgreSQL
+
+Installer les paquets
+
+    # apt-get install postgresql postgresql-client
+
+Créer l'utilisateur et la base de donnée
+
+    # sudo -u postgres psql -d template1
+    template1=# CREATE USER nextcloud CREATEDB;
+    template1=# CREATE DATABASE nextcloud OWNER nextcloud;
+    template1=# \password nextcloud
+    template1=# \q
+
+
+[source](https://wiki.debian.org/PostgreSql)
+
+## Installation Nextcloud
+
+Télécharger et décompresser les fichiers
+
+    # cd /srv
+    # wget https://download.nextcloud.com/server/releases/nextcloud-17.0.3.tar.bz2
+    # tar xvf nextcloud-17.0.3.tar.bz2
+    # chown -R www-data:www-data /srv/nextcloud   
+
+
+Compléter l'installation avec la commande OCC
+
+    # cd /srv/nextcloud
+    # sudo -u www-data php occ maintenance:install --database "pgsql" --database-host "localhost:/run/postgresql" --database-name "nextcloud" --database-user "nextcloud" --database-pass "password" --admin-user "rescue" --admin-pass "password"
+    Nextcloud was successfully installed
+    
+Corriger la configuration générée 
+
+    # nano /srv/nextcloud/config/config.php
+
+Remplacer `localhost` par `inubo.votredomain.ch`
+
+Puis se connecter à nextcloud via son navigateur
+
+
+## Configuration du cron
+
+     # nano /etC/cron.d/nextcloud
+
+Ajouter:
+
+    */5 *  * * * www-data php -f /srv/nextcloud/cron.php
+
+## Memcache
+
+### Cache local (APCu)
+
+    # apt install php7.3-apcu
+
+Ajouter à **/srv/nextcloud/config/config.php**:
+
+    `'memcache.local' => '\OC\Memcache\APCu',`
+
+### Redis
+
+    # apt intsall redis-server php-redis
+
+Ajouter à **/srv/nextcloud/config/config.php**:
+
+```
+  'memcache.distributed' => '\OC\Memcache\Redis',
+  'redis' => [
+     'host' => 'localhost',
+     'port' => 6379,  
+  ],
+  'memcache.locking' => '\OC\Memcache\Redis',
+```