Просмотр кода страницы Collabora. Debian 11. Установка Nextcloud + Collabora

[[Категория:Collabora]]
[[Категория:Nextcloud]]
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__

== Ссылки ==
https://fscene8.me/nextcloud-collabora-hpd-installation-guide/

== Общая установка ==
<code>apt update && apt upgrade -y</code>

<code>hostnamectl set-hostname cloud</code>

<code>apt install -y apache2 mariadb-server php-common libapache2-mod-php php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-bcmath imagemagick php-imagick ffmpeg php-xml php-zip php-bz2 php-redis redis-server python3-certbot-apache</code>

== Настройка видимости машин nextcloud и collabora ==

=== Вариант 1. Зеркалирование запросов из локальной сети по внешнему адресу на маршрутизаторе '''Mikrotik''' ===
'''''10.100.199.14''''' - машина nextcloud+collabora

'''''188.235.62.224''''' - внешний адрес маршрутизатора

'''''ether3-wan1''''' - внешний интерфейс

'''''192.168.199.0/24''''' - локальная сеть 1

'''''10.100.199.0/24''''' - локальная сеть 2

'''''10.100.199.1''''' - адрес локального адреса маршрутизатора локальной сети 2

'''''bridge-vlan1100-esxi-servers''''' - интерфейс локальной сети

'''''443''''' - порт nextcloud

'''''4000''''' - порт collabora

<code>/ip firewall nat</code>

<code>add action=dst-nat chain=dstnat comment=alef-proxyMultidomain-osn_nginx dst-port=443 in-interface=ether3-wan1 protocol=tcp to-addresses=192.168.199.229</code>

<code>add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-local protocol=tcp src-address=\</code>

<code>   192.168.199.0/24 to-addresses=192.168.199.229</code>

<code>add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-local protocol=tcp src-address=\</code>

<code>   192.168.199.0/24 to-addresses=192.168.199.1</code>

<code>add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-vlan1100-esxi-servers protocol=tcp \</code>

<code>   src-address=10.100.199.0/24 to-addresses=192.168.199.229</code>

<code>add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-vlan1100-esxi-servers protocol=tcp \</code>

<code>   src-address=10.100.199.0/24 to-addresses=192.168.199.1</code>

<code>/ip firewall nat</code>

<code>add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14</code>

<code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=10.100.199.14</code>

<code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\</code>

<code>   10.100.199.14</code>

<code>add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\</code>

<code>   10.100.199.1</code>

=== Вариант 2. Hosts (работает некорректно, не использовать) ===
<code>nano /etc/hosts</code>
 ...
 127.0.0.1 cloud.domain123.ru cloud
 127.0.0.1 collabora.domain123.ru

== Настройка типа работы запросов с внешнего адреса до машины Nextcloud+Collabora ==

=== Вариант 1. Порты 80,443 пробрасываются через NAT на маршрутизаторе напрямую на машину с nextcloud/collabora ===
Настройка '''apache''' для '''nextcloud'''

<code>nano /etc/apache2/sites-available/nextcloud.conf</code>
 <VirtualHost *:80>
        ServerName cloud.domain123.ru
        DocumentRoot /var/www/nextcloud
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
 </VirtualHost>
Установка '''nextcloud'''

<code>wget <nowiki>https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2</nowiki></code>

<code>tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/</code>

<code>chown -R www-data: /var/www/nextcloud</code>

<code>a2ensite nextcloud</code>

<code>a2enmod rewrite headers</code>

<code>systemctl restart apache2</code>

Настройка БД для '''nextcloud'''

<code>mysql_secure_installation</code>

<code>mariadb</code>

<code>   CREATE DATABASE nextcloud;</code>

<code>   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';</code>

<code>   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';</code>

<code>   quit</code>

Настройка '''HTTPS''' для '''nextcloud'''

<code>certbot --apache</code>

Проверяем доступность через браузер

''<code><nowiki>https://cloud.domain123.ru</nowiki></code>''

Установка '''collabora'''

<code>apt install -y gnupg</code>

<code>apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D</code>

<code>echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11</nowiki> ./' >> /etc/apt/sources.list</code>

<code>apt update -y</code>

<code>apt install -y coolwsd code-brand hunspell</code>

<code>nano /etc/apache2/sites-available/collabora.conf</code>
 <VirtualHost *:80>
        ServerName collabora.domain123.ru
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
 </VirtualHost>
<code>a2ensite collabora</code>

<code>systemctl reload apache2</code>

<code>certbot --apache</code>

<code>a2enmod proxy proxy_wstunnel proxy_http</code>

<code>nano /etc/apache2/sites-enabled/collabora-le-ssl.conf</code>
 <IfModule mod_ssl.c>
 <VirtualHost *:443>
        ServerName collabora.domain123.ru
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        # Collabora config:
        Options -Indexes
        # Encoded slashes need to be allowed
        AllowEncodedSlashes NoDecode
        # Container uses a unique non-signed certificate
        SSLProxyEngine On
        SSLProxyVerify None
        SSLProxyCheckPeerCN Off
        SSLProxyCheckPeerName Off
        # keep the host
        ProxyPreserveHost On
        # static html, js, images, etc. served from coolwsd
        # (broswer is the client part of Collabora Online)
        ProxyPass /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> retry=0
        ProxyPassReverse /browser <nowiki>http://127.0.0.1:9980/browser</nowiki>
        # WOPI discovery URL
        ProxyPass /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> retry=0
        ProxyPassReverse /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki>
        # Capabilities
        ProxyPass /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> retry=0
        ProxyPassReverse /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki>
        # Main websocket
        ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
        # Admin Console websocket
        ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
        # Download as, Fullscreen presentation and Image upload operations
        ProxyPass /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
        ProxyPassReverse /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
 SSLCertificateFile /etc/letsencrypt/live/collabora.domain123.ru/fullchain.pem
 SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain123.ru/privkey.pem
 Include /etc/letsencrypt/options-ssl-apache.conf
 </VirtualHost>
 </IfModule>
<code>systemctl restart apache2</code>

<code>nano /etc/coolwsd/coolwsd.xml</code>

<nowiki>#</nowiki>    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

<nowiki>#</nowiki>    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

<nowiki>#</nowiki>    - For the inner tag that contains <enable type="bool" and set the value to false.

<nowiki>#</nowiki>    - for the inner tag that contains <termination desc and set the value to true
 ...
 <ssl desc="SSL settings">
         ...
         <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
         ...
         <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
 ...
<code>systemctl restart coolwsd</code>

- логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki>

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           '''<nowiki>https://collabora.domain123.ru</nowiki>'''

=== Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora ===

==== Настройка маршрутизатора ====
80,443 порты должны быть проброшены на машину NGINX PROXY

4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA

Зеркалирование порта 4000 если также неободимо подключаться к NEXTCLOUD/COLLABORA из локальной подсети, в которой находится машина NEXTCLOUD/COLLABORA

<code>/ip firewall filter</code>

<code>add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14</code>

<code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\</code>

<code>   10.100.199.14</code>

<code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \</code>

<code>   to-addresses=10.100.199.14</code>

<code>add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \</code>

<code>   to-addresses=10.100.199.1</code>

==== Настройка NGINX PROXY (192.168.199.229) ====
<code>yum install sshpass</code>

Получаем сертификаты

<code>certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d cloud.domain123.ru</code>

<code>certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d collabora.domain123.ru</code>

Копируем сертификаты на машину '''nextcloud/collabora'''

<code>sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/</code>

<code>sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/</code>

Периодически обновляем сертификаты и копируем их на машину '''nextcloud/collabora'''

<code>crontab -e</code>
 ...
 0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx;
 0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/
 0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/
Конфиг для проксирования '''cloud.domain123.ru''' с внешки на машину '''nextcloud/collabora'''

<code>nano /etc/nginx.conf.d/cloud.domain123.ru_HTTPS.conf</code>
 server {
    listen 80;
    server_name cloud.domain123.ru;
    return 301 <nowiki>https://$host$request_uri</nowiki>;
 }
 server {
    listen 443 ssl;
    server_name cloud.domain123.ru;
    ssl_certificate           /etc/letsencrypt/live/cloud.domain123.ru/fullchain.pem;
    ssl_certificate_key       /etc/letsencrypt/live/cloud.domain123.ru/privkey.pem;
    #ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;
    access_log            /var/log/nginx/cloud.domain123.ru.access.log;
    # Для обновления сертификатов
    location /.well-known {
        alias /var/www/cloud.domain123.ru/.well-known;
    }
    location / {
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;
      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          <nowiki>https://10.100.199.14/</nowiki>;
      proxy_read_timeout  90;
      proxy_redirect      <nowiki>https://10.100.199.14/</nowiki> <nowiki>https://cloud.domain123.ru</nowiki>;
    }
 }
<code>systemctl restart nginx</code>

==== Настройка машины NEXTCLOUD/COLLABORA (10.100.199.14) ====
<code>nano /etc/apache2/sites-enabled/nextcloud.conf</code>
 <VirtualHost *:80>
        ServerName cloud.domain123.ru
        DocumentRoot /var/www/nextcloud
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
 </VirtualHost>
<code>nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf</code>
 <IfModule mod_ssl.c>
     <VirtualHost *:443>
        ServerName cloud.domain123.ru
        DocumentRoot /var/www/nextcloud
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLCertificateFile /opt/certs/cloud.domain123.ru/fullchain.pem
        SSLCertificateKeyFile /opt/certs/cloud.domain123.ru/privkey.pem
        <nowiki>#</nowiki>Include /etc/letsencrypt/options-ssl-apache.conf
        SSLEngine on
        <nowiki>#</nowiki> Intermediate configuration, tweak to your needs
        SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
        SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        SSLHonorCipherOrder     off
        SSLSessionTickets       off
        SSLOptions +StrictRequire
        <nowiki>#</nowiki> Add vhost name to log entries:
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
        LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
     </VirtualHost>
 </IfModule>
Установка '''nextcloud'''

<code>wget <nowiki>https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2</nowiki></code>

<code>tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/</code>

<code>chown -R www-data: /var/www/nextcloud</code>

<code>a2ensite nextcloud</code>

<code>a2enmod rewrite headers</code>

<code>systemctl restart apache2</code>

Настройка БД для '''nextcloud'''

<code>mysql_secure_installation</code>

<code>mariadb</code>

<code>   CREATE DATABASE nextcloud;</code>

<code>   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';</code>

<code>   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';</code>

<code>   quit</code>

Установка '''collabora'''

<code>apt install -y gnupg</code>

<code>apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D</code>

<code>echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11</nowiki> ./' >> /etc/apt/sources.list</code>

<code>apt update -y</code>

<code>apt install -y coolwsd code-brand hunspell</code>

<code>a2ensite collabora</code>

<code>systemctl reload apache2</code>

<code>a2enmod proxy proxy_wstunnel proxy_http</code>

<code>nano /etc/apache2/sites-enabled/collabora.conf</code>
 <VirtualHost *:80>
        ServerName collabora.domain123.ru
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
 </VirtualHost>
<code>nano /etc/apache2/sites-enabled/collabora-le-ssl.conf</code>
 <IfModule mod_ssl.c>
     <VirtualHost *:4000>
        ServerName collabora.domain123.ru
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        # Collabora config:
        Options -Indexes
        # Encoded slashes need to be allowed
        AllowEncodedSlashes NoDecode
        # Container uses a unique non-signed certificate
        SSLProxyEngine On
        SSLProxyVerify None
        SSLProxyCheckPeerCN Off
        SSLProxyCheckPeerName Off
        # keep the host
        ProxyPreserveHost On
        # static html, js, images, etc. served from coolwsd
        # (broswer is the client part of Collabora Online)
        ProxyPass /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> retry=0
        ProxyPassReverse /browser <nowiki>http://127.0.0.1:9980/browser</nowiki>
        # WOPI discovery URL
        ProxyPass /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> retry=0
        ProxyPassReverse /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki>
        # Capabilities
        ProxyPass /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> retry=0
        ProxyPassReverse /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki>
        # Main websocket
        ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
        # Admin Console websocket
        ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
        # Download as, Fullscreen presentation and Image upload operations
        ProxyPass /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
        ProxyPassReverse /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
        SSLCertificateFile /opt/certs/collabora.domain123.ru/fullchain.pem
        SSLCertificateKeyFile /opt/certs/collabora.domain123.ru/privkey.pem
        <nowiki>#</nowiki>Include /etc/letsencrypt/options-ssl-apache.conf
        SSLEngine on
        <nowiki>#</nowiki> Intermediate configuration, tweak to your needs
        SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
        SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        SSLHonorCipherOrder     off
        SSLSessionTickets       off
        SSLOptions +StrictRequire
        <nowiki>#</nowiki> Add vhost name to log entries:
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
        LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
     </VirtualHost>
 </IfModule>

<code>nano /etc/apache2/ports.conf</code>
 <nowiki>#</nowiki> If you just change the port or add more ports here, you will likely also
 <nowiki>#</nowiki> have to change the VirtualHost statement in
 <nowiki>#</nowiki> /etc/apache2/sites-enabled/000-default.conf
 Listen 80
 <IfModule ssl_module>
        Listen 443
 </IfModule>
 <IfModule mod_gnutls.c>
        Listen 443
 </IfModule>
 <IfModule ssl_module>
        Listen 4000
 </IfModule>
 <IfModule mod_gnutls.c>
        Listen 4000
 </IfModule>
 <nowiki>#</nowiki> vim: syntax=apache ts=4 sw=4 sts=4 sr noet
Загрузим модуль mod_ssl

<code>a2enmod ssl</code>

<code>systemctl restart apache2</code>

<code>nano /etc/coolwsd/coolwsd.xml</code>

<nowiki>#</nowiki>    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

<nowiki>#</nowiki>    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

<nowiki>#</nowiki>    - For the inner tag that contains <enable type="bool" and set the value to false.

<nowiki>#</nowiki>    - for the inner tag that contains <termination desc and set the value to true
 ...
 <ssl desc="SSL settings">
        ...
        <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
        ...
        <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
 ...
<code>systemctl restart coolwsd</code>

- логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki>

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           '''<nowiki>https://collabora.domain123.ru:4000</nowiki>'''