Collabora. Debian 11. Установка Nextcloud + Collabora: различия между версиями

Материал из Wiki
Перейти к навигации Перейти к поиску
Строка 68: Строка 68:
<code>   10.100.199.1</code>
<code>   10.100.199.1</code>


=== Вариант 1. Hosts (работает некорректно, не использовать) ===
=== Вариант 2. Hosts (работает некорректно, не использовать) ===
<code>nano /etc/hosts</code>
<code>nano /etc/hosts</code>
  ...
  ...

Версия 10:11, 3 апреля 2022


Ссылки

https://fscene8.me/nextcloud-collabora-hpd-installation-guide/

Общая установка

apt update && apt upgrade -y

hostnamectl set-hostname cloud

apt install -y apache2 mariadb-server php-common libapache2-mod-php php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-bcmath imagemagick php-imagick ffmpeg php-xml php-zip php-bz2 php-redis redis-server python3-certbot-apache

Настройка видимости машин nextcloud и collabora

Вариант 1. Зеркалирование запросов из локальной сети по внешнему адресу на маршрутизаторе Mikrotik

10.100.199.14 - машина nextcloud+collabora

188.235.62.224 - внешний адрес маршрутизатора

ether3-wan1 - внешний интерфейс

192.168.199.0/24 - локальная сеть 1

10.100.199.0/24 - локальная сеть 2

10.100.199.1 - адрес локального адреса маршрутизатора локальной сети 2

bridge-vlan1100-esxi-servers - интерфейс локальной сети

443 - порт nextcloud

4000 - порт collabora

/ip firewall nat

add action=dst-nat chain=dstnat comment=alef-proxyMultidomain-osn_nginx dst-port=443 in-interface=ether3-wan1 protocol=tcp to-addresses=192.168.199.229

add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-local protocol=tcp src-address=\

   192.168.199.0/24 to-addresses=192.168.199.229

add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-local protocol=tcp src-address=\

   192.168.199.0/24 to-addresses=192.168.199.1

add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-vlan1100-esxi-servers protocol=tcp \

   src-address=10.100.199.0/24 to-addresses=192.168.199.229

add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-vlan1100-esxi-servers protocol=tcp \

   src-address=10.100.199.0/24 to-addresses=192.168.199.1

/ip firewall nat

add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\

   10.100.199.14

add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\

   10.100.199.1

Вариант 2. Hosts (работает некорректно, не использовать)

nano /etc/hosts 

...
127.0.0.1 cloud.domain123.ru cloud
127.0.0.1 collabora.domain123.ru

Настройка типа работы запросов с внешнего адреса до машины Nextcloud+Collabora

Вариант 1. Порты 80,443 пробрасываются через NAT на маршрутизаторе напрямую на машину с nextcloud/collabora

Настройка apache для nextcloud

nano /etc/apache2/sites-available/nextcloud.conf 

<VirtualHost *:80>
       ServerName cloud.domain123.ru
       DocumentRoot /var/www/nextcloud
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Установка nextcloud

wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2

tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/

chown -R www-data: /var/www/nextcloud

a2ensite nextcloud

a2enmod rewrite headers

systemctl restart apache2

Настройка БД для nextcloud

mysql_secure_installation

mariadb

   CREATE DATABASE nextcloud;

   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'dispersia85D';

   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';

   quit

Настройка HTTPS для nextcloud

certbot --apache

Проверяем доступность через браузер

https://cloud.domain123.ru

Установка collabora

apt install -y gnupg

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D

echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list

apt update -y

apt install -y coolwsd code-brand hunspell

nano /etc/apache2/sites-available/collabora.conf 

<VirtualHost *:80>
       ServerName collabora.domain123.ru
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

a2ensite collabora

systemctl reload apache2

certbot --apache

a2enmod proxy proxy_wstunnel proxy_http

nano /etc/apache2/sites-enabled/collabora-le-ssl.conf 

<IfModule mod_ssl.c>
<VirtualHost *:443>
       ServerName collabora.domain123.ru
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
       # Collabora config:
       Options -Indexes
       # Encoded slashes need to be allowed
       AllowEncodedSlashes NoDecode
       # Container uses a unique non-signed certificate
       SSLProxyEngine On
       SSLProxyVerify None
       SSLProxyCheckPeerCN Off
       SSLProxyCheckPeerName Off
       # keep the host
       ProxyPreserveHost On
       # static html, js, images, etc. served from coolwsd
       # (broswer is the client part of Collabora Online)
       ProxyPass /browser http://127.0.0.1:9980/browser retry=0
       ProxyPassReverse /browser http://127.0.0.1:9980/browser
       # WOPI discovery URL
       ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
       ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery
       # Capabilities
       ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
       ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities
       # Main websocket
       ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
       # Admin Console websocket
       ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
       # Download as, Fullscreen presentation and Image upload operations
       ProxyPass /cool http://127.0.0.1:9980/cool
       ProxyPassReverse /cool http://127.0.0.1:9980/cool
SSLCertificateFile /etc/letsencrypt/live/collabora.domain123.ru/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain123.ru/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

systemctl restart apache2

nano /etc/coolwsd/coolwsd.xml

#    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

#    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

#    - For the inner tag that contains <enable type="bool" and set the value to false.

#    - for the inner tag that contains <termination desc and set the value to true 

...
<ssl desc="SSL settings">
        ...
        <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
        ...
        <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
...

systemctl restart coolwsd

- логинимся в nextcloud https://cloud.domain123.ru

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           https://collabora.domain123.ru

Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora

Настройка маршрутизатора

80,443 порты должны быть проброшены на машину NGINX PROXY

4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA

Зеркалирование порта 4000 если также неободимо подключаться к NEXTCLOUD/COLLABORA из локальной подсети, в которой находится машина NEXTCLOUD/COLLABORA

/ip firewall filter

add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\

   10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \

   to-addresses=10.100.199.14

add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \

   to-addresses=10.100.199.1

Настройка NGINX PROXY (192.168.199.229)

yum install sshpass

Получаем сертификаты

certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d cloud.domain123.ru

certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d collabora.domain123.ru

Копируем сертификаты на машину nextcloud/collabora

sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/

sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/

Периодически обновляем сертификаты и копируем их на машину nextcloud/collabora

crontab -e 

...
0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx;
0 8 * * 7 sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/
0 8 * * 7 sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/

Конфиг для проксирования cloud.domain123.ru с внешки на машину nextcloud/collabora

nano /etc/nginx.conf.d/cloud.domain123.ru_HTTPS.conf 

server {
   listen 80;
   server_name cloud.domain123.ru;
   return 301 https://$host$request_uri;
}
server {
   listen 443 ssl;
   server_name cloud.domain123.ru;
   ssl_certificate           /etc/letsencrypt/live/cloud.domain123.ru/fullchain.pem;
   ssl_certificate_key       /etc/letsencrypt/live/cloud.domain123.ru/privkey.pem;
   #ssl on;
   ssl_session_cache  builtin:1000  shared:SSL:10m;
   ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
   ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
   ssl_prefer_server_ciphers on;
   access_log            /var/log/nginx/cloud.domain123.ru.access.log;
   # Для обновления сертификатов
   location /.well-known {
       alias /var/www/cloud.domain123.ru/.well-known;
   }
   location / {
     proxy_set_header        Host $host;
     proxy_set_header        X-Real-IP $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header        X-Forwarded-Proto $scheme;
     # Fix the “It appears that your reverse proxy set up is broken" error.
     proxy_pass          https://10.100.199.14/;
     proxy_read_timeout  90;
     proxy_redirect      https://10.100.199.14/ https://cloud.domain123.ru;
   }
}

systemctl restart nginx

Настройка машины NEXTCLOUD/COLLABORA (10.100.199.14)

nano /etc/apache2/sites-enabled/nextcloud.conf 

<VirtualHost *:80>
       ServerName cloud.domain123.ru
       DocumentRoot /var/www/nextcloud
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf 

<IfModule mod_ssl.c>
    <VirtualHost *:443>
       ServerName cloud.domain123.ru
       DocumentRoot /var/www/nextcloud
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
       SSLCertificateFile /opt/certs/cloud.domain123.ru/fullchain.pem
       SSLCertificateKeyFile /opt/certs/cloud.domain123.ru/privkey.pem
       #Include /etc/letsencrypt/options-ssl-apache.conf
       SSLEngine on
       # Intermediate configuration, tweak to your needs
       SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
       SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
       SSLHonorCipherOrder     off
       SSLSessionTickets       off
       SSLOptions +StrictRequire
       # Add vhost name to log entries:
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
       LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
    </VirtualHost>
</IfModule>

Установка nextcloud

wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2

tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/

chown -R www-data: /var/www/nextcloud

a2ensite nextcloud

a2enmod rewrite headers

systemctl restart apache2

Настройка БД для nextcloud

mysql_secure_installation

mariadb

   CREATE DATABASE nextcloud;

   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'dispersia85D';

   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';

   quit

Установка collabora

apt install -y gnupg

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D

echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list

apt update -y

apt install -y coolwsd code-brand hunspell

a2ensite collabora

systemctl reload apache2

a2enmod proxy proxy_wstunnel proxy_http

nano /etc/apache2/sites-enabled/collabora.conf 

<VirtualHost *:80>
       ServerName collabora.domain123.ru
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

nano /etc/apache2/sites-enabled/collabora-le-ssl.conf 

<IfModule mod_ssl.c>
    <VirtualHost *:4000>
       ServerName collabora.domain123.ru
       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined
       # Collabora config:
       Options -Indexes
       # Encoded slashes need to be allowed
       AllowEncodedSlashes NoDecode
       # Container uses a unique non-signed certificate
       SSLProxyEngine On
       SSLProxyVerify None
       SSLProxyCheckPeerCN Off
       SSLProxyCheckPeerName Off
       # keep the host
       ProxyPreserveHost On
       # static html, js, images, etc. served from coolwsd
       # (broswer is the client part of Collabora Online)
       ProxyPass /browser http://127.0.0.1:9980/browser retry=0
       ProxyPassReverse /browser http://127.0.0.1:9980/browser
       # WOPI discovery URL
       ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
       ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery
       # Capabilities
       ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
       ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities
       # Main websocket
       ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
       # Admin Console websocket
       ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
       # Download as, Fullscreen presentation and Image upload operations
       ProxyPass /cool http://127.0.0.1:9980/cool
       ProxyPassReverse /cool http://127.0.0.1:9980/cool
       SSLCertificateFile /opt/certs/collabora.domain123.ru/fullchain.pem
       SSLCertificateKeyFile /opt/certs/collabora.domain123.ru/privkey.pem
       #Include /etc/letsencrypt/options-ssl-apache.conf
       SSLEngine on
       # Intermediate configuration, tweak to your needs
       SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
       SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
       SSLHonorCipherOrder     off
       SSLSessionTickets       off
       SSLOptions +StrictRequire
       # Add vhost name to log entries:
       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
       LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
    </VirtualHost>
</IfModule>

nano /etc/apache2/ports.conf 

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf
Listen 80
<IfModule ssl_module>
       Listen 443
</IfModule>
<IfModule mod_gnutls.c>
       Listen 443
</IfModule>
<IfModule ssl_module>
       Listen 4000
</IfModule>
<IfModule mod_gnutls.c>
       Listen 4000
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Загрузим модуль mod_ssl

a2enmod ssl

systemctl restart apache2

nano /etc/coolwsd/coolwsd.xml

#    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

#    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

#    - For the inner tag that contains <enable type="bool" and set the value to false.

#    - for the inner tag that contains <termination desc and set the value to true 

...
<ssl desc="SSL settings">
       ...
       <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
       ...
       <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
...

systemctl restart coolwsd

- логинимся в nextcloud https://cloud.domain123.ru

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           https://collabora.domain123.ru:4000

Источник — https://wiki.cless.pro/index.php?title=Collabora._Debian_11._Установка_Nextcloud_%2B_Collabora&oldid=582