Collabora. Debian 11. Установка Nextcloud + Collabora: различия между версиями
Перейти к навигации
Перейти к поиску
Cless (обсуждение | вклад) |
Cless (обсуждение | вклад) |
||
| (не показаны 3 промежуточные версии этого же участника) | |||
| Строка 68: | Строка 68: | ||
<code> 10.100.199.1</code> | <code> 10.100.199.1</code> | ||
=== Вариант | === Вариант 2. Hosts (работает некорректно, не использовать) === | ||
<code>nano /etc/hosts</code> | <code>nano /etc/hosts</code> | ||
... | ... | ||
127.0.0.1 cloud.domain123.ru cloud | 127.0.0.1 cloud.domain123.ru cloud | ||
127.0.0.1 collabora.domain123.ru | 127.0.0.1 collabora.domain123.ru | ||
== Настройка типа работы запросов с внешнего адреса до машины Nextcloud+Collabora == | |||
=== Вариант 1. Порты 80,443 пробрасываются через NAT на маршрутизаторе напрямую на машину с nextcloud/collabora === | |||
Настройка '''apache''' для '''nextcloud''' | |||
<VirtualHost *:80> | <code>nano /etc/apache2/sites-available/nextcloud.conf</code> | ||
<VirtualHost *:80> | |||
ServerName cloud.domain123.ru | |||
DocumentRoot /var/www/nextcloud | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
</VirtualHost> | |||
Установка '''nextcloud''' | |||
<code>wget <nowiki>https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2</nowiki></code> | |||
<code>tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/</code> | |||
<code>chown -R www-data: /var/www/nextcloud</code> | |||
<code>a2ensite nextcloud</code> | |||
</ | <code>a2enmod rewrite headers</code> | ||
<code>systemctl restart apache2</code> | |||
Настройка БД для '''nextcloud''' | |||
<code>mysql_secure_installation</code> | |||
<code>mariadb</code> | |||
<code> CREATE DATABASE nextcloud;</code> | |||
<code> CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';</code> | |||
<code> GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';</code> | |||
<code> quit</code> | |||
Настройка '''HTTPS''' для '''nextcloud''' | |||
<code>certbot --apache</code> | |||
Проверяем доступность через браузер | |||
''<code><nowiki>https://cloud.domain123.ru</nowiki></code>'' | |||
Установка '''collabora''' | |||
<code>apt install -y gnupg</code> | |||
< | <code>apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D</code> | ||
apt | <code>echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11</nowiki> ./' >> /etc/apt/sources.list</code> | ||
apt- | <code>apt update -y</code> | ||
<code>apt install -y coolwsd code-brand hunspell</code> | |||
<code>nano /etc/apache2/sites-available/collabora.conf</code> | |||
<VirtualHost *:80> | |||
ServerName collabora.domain123.ru | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
</VirtualHost> | |||
<code>a2ensite collabora</code> | |||
<code>systemctl reload apache2</code> | |||
<code>certbot --apache</code> | |||
<code>a2enmod proxy proxy_wstunnel proxy_http</code> | |||
<VirtualHost *: | <code>nano /etc/apache2/sites-enabled/collabora-le-ssl.conf</code> | ||
<IfModule mod_ssl.c> | |||
<VirtualHost *:443> | |||
ServerName collabora.domain123.ru | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
# Collabora config: | |||
Options -Indexes | |||
# Encoded slashes need to be allowed | |||
AllowEncodedSlashes NoDecode | |||
# Container uses a unique non-signed certificate | |||
SSLProxyEngine On | |||
SSLProxyVerify None | |||
SSLProxyCheckPeerCN Off | |||
SSLProxyCheckPeerName Off | |||
# keep the host | |||
ProxyPreserveHost On | |||
# static html, js, images, etc. served from coolwsd | |||
# (broswer is the client part of Collabora Online) | |||
ProxyPass /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> retry=0 | |||
ProxyPassReverse /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> | |||
# WOPI discovery URL | |||
ProxyPass /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> retry=0 | |||
ProxyPassReverse /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> | |||
# Capabilities | |||
ProxyPass /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> retry=0 | |||
ProxyPassReverse /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> | |||
# Main websocket | |||
ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon | |||
# Admin Console websocket | |||
ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws | |||
# Download as, Fullscreen presentation and Image upload operations | |||
ProxyPass /cool <nowiki>http://127.0.0.1:9980/cool</nowiki> | |||
ProxyPassReverse /cool <nowiki>http://127.0.0.1:9980/cool</nowiki> | |||
SSLCertificateFile /etc/letsencrypt/live/collabora.domain123.ru/fullchain.pem | |||
SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain123.ru/privkey.pem | |||
Include /etc/letsencrypt/options-ssl-apache.conf | |||
</VirtualHost> | |||
</IfModule> | |||
<code>systemctl restart apache2</code> | |||
<code>nano /etc/coolwsd/coolwsd.xml</code> | |||
< | |||
nano /etc/ | |||
</ | |||
<nowiki>#</nowiki> - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line. | <nowiki>#</nowiki> - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line. | ||
| Строка 246: | Строка 198: | ||
<nowiki>#</nowiki> - for the inner tag that contains <termination desc and set the value to true | <nowiki>#</nowiki> - for the inner tag that contains <termination desc and set the value to true | ||
... | |||
<ssl desc="SSL settings"> | |||
... | |||
.. | <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable> | ||
... | |||
<ssl desc="SSL settings"> | <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination> | ||
... | |||
<code>systemctl restart coolwsd</code> | |||
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable> | |||
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination> | |||
... | |||
systemctl restart coolwsd | |||
- логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki> | - логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki> | ||
| Строка 273: | Строка 215: | ||
Использовать собственный сервер: | Использовать собственный сервер: | ||
<nowiki>https://collabora.domain123.ru</nowiki> | '''<nowiki>https://collabora.domain123.ru</nowiki>''' | ||
Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora | === Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora === | ||
==== Настройка маршрутизатора ==== | |||
80,443 порты должны быть проброшены на машину NGINX PROXY | 80,443 порты должны быть проброшены на машину NGINX PROXY | ||
4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA | 4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA | ||
Зеркалирование порта 4000 если также неободимо подключаться к NEXTCLOUD/COLLABORA из локальной подсети, в которой находится машина NEXTCLOUD/COLLABORA | |||
/ip firewall filter | <code>/ip firewall filter</code> | ||
add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14 | <code>add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14</code> | ||
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\ | <code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\</code> | ||
10.100.199.14 | <code> 10.100.199.14</code> | ||
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \ | <code>add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \</code> | ||
to-addresses=10.100.199.14 | <code> to-addresses=10.100.199.14</code> | ||
add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \ | <code>add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \</code> | ||
to-addresses=10.100.199.1 | <code> to-addresses=10.100.199.1</code> | ||
Настройка NGINX PROXY (192.168.199.229) | ==== Настройка NGINX PROXY (192.168.199.229) ==== | ||
<code>yum install sshpass</code> | |||
Получаем сертификаты | |||
<code>certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d cloud.domain123.ru</code> | |||
< | <code>certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d collabora.domain123.ru</code> | ||
Копируем сертификаты на машину '''nextcloud/collabora''' | |||
<code>sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/</code> | |||
< | <code>sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/</code> | ||
Периодически обновляем сертификаты и копируем их на машину '''nextcloud/collabora''' | |||
<code>crontab -e</code> | |||
... | |||
< | 0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx; | ||
0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/ | |||
0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/ | |||
Конфиг для проксирования '''cloud.domain123.ru''' с внешки на машину '''nextcloud/collabora''' | |||
... | |||
0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx; | |||
0 8 * * 7 sshpass -p " | |||
0 8 * * 7 sshpass -p " | |||
--- | <code>nano /etc/nginx.conf.d/cloud.domain123.ru_HTTPS.conf</code> | ||
server { | |||
listen 80; | |||
server_name cloud.domain123.ru; | |||
return 301 <nowiki>https://$host$request_uri</nowiki>; | |||
} | |||
server { | |||
listen 443 ssl; | |||
server_name cloud.domain123.ru; | |||
ssl_certificate /etc/letsencrypt/live/cloud.domain123.ru/fullchain.pem; | |||
ssl_certificate_key /etc/letsencrypt/live/cloud.domain123.ru/privkey.pem; | |||
#ssl on; | |||
ssl_session_cache builtin:1000 shared:SSL:10m; | |||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |||
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; | |||
ssl_prefer_server_ciphers on; | |||
access_log /var/log/nginx/cloud.domain123.ru.access.log; | |||
# Для обновления сертификатов | |||
location /.well-known { | |||
alias /var/www/cloud.domain123.ru/.well-known; | |||
} | |||
location / { | |||
proxy_set_header Host $host; | |||
proxy_set_header X-Real-IP $remote_addr; | |||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |||
proxy_set_header X-Forwarded-Proto $scheme; | |||
# Fix the “It appears that your reverse proxy set up is broken" error. | |||
proxy_pass <nowiki>https://10.100.199.14/</nowiki>; | |||
proxy_read_timeout 90; | |||
proxy_redirect <nowiki>https://10.100.199.14/</nowiki> <nowiki>https://cloud.domain123.ru</nowiki>; | |||
} | |||
} | |||
<code>systemctl restart nginx</code> | |||
<VirtualHost *:80> | ==== Настройка машины NEXTCLOUD/COLLABORA (10.100.199.14) ==== | ||
<code>nano /etc/apache2/sites-enabled/nextcloud.conf</code> | |||
<VirtualHost *:80> | |||
ServerName cloud.domain123.ru | |||
DocumentRoot /var/www/nextcloud | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
</VirtualHost> | |||
<code>nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf</code> | |||
<IfModule mod_ssl.c> | |||
<VirtualHost *:443> | |||
ServerName cloud.domain123.ru | |||
DocumentRoot /var/www/nextcloud | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
SSLCertificateFile /opt/certs/cloud.domain123.ru/fullchain.pem | |||
SSLCertificateKeyFile /opt/certs/cloud.domain123.ru/privkey.pem | |||
<nowiki>#</nowiki>Include /etc/letsencrypt/options-ssl-apache.conf | |||
SSLEngine on | |||
<nowiki>#</nowiki> Intermediate configuration, tweak to your needs | |||
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | |||
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 | |||
SSLHonorCipherOrder off | |||
SSLSessionTickets off | |||
SSLOptions +StrictRequire | |||
<nowiki>#</nowiki> Add vhost name to log entries: | |||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined | |||
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common | |||
</VirtualHost> | |||
</IfModule> | |||
Установка '''nextcloud''' | |||
<code>wget <nowiki>https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2</nowiki></code> | |||
<code>tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/</code> | |||
<code>chown -R www-data: /var/www/nextcloud</code> | |||
<code>a2ensite nextcloud</code> | |||
</ | <code>a2enmod rewrite headers</code> | ||
<code>systemctl restart apache2</code> | |||
Настройка БД для '''nextcloud''' | |||
<code>mysql_secure_installation</code> | |||
< | <code>mariadb</code> | ||
< | <code> CREATE DATABASE nextcloud;</code> | ||
<code> CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';</code> | |||
<code> GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';</code> | |||
<code> quit</code> | |||
Установка '''collabora''' | |||
<code>apt install -y gnupg</code> | |||
<code>apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D</code> | |||
<nowiki> | <code>echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11</nowiki> ./' >> /etc/apt/sources.list</code> | ||
<code>apt update -y</code> | |||
< | <code>apt install -y coolwsd code-brand hunspell</code> | ||
<code>a2ensite collabora</code> | |||
<code>systemctl reload apache2</code> | |||
<code>a2enmod proxy proxy_wstunnel proxy_http</code> | |||
SSLSessionTickets off | <code>nano /etc/apache2/sites-enabled/collabora.conf</code> | ||
<VirtualHost *:80> | |||
ServerName collabora.domain123.ru | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
</VirtualHost> | |||
<code>nano /etc/apache2/sites-enabled/collabora-le-ssl.conf</code> | |||
<IfModule mod_ssl.c> | |||
<VirtualHost *:4000> | |||
ServerName collabora.domain123.ru | |||
ErrorLog ${APACHE_LOG_DIR}/error.log | |||
CustomLog ${APACHE_LOG_DIR}/access.log combined | |||
# Collabora config: | |||
Options -Indexes | |||
# Encoded slashes need to be allowed | |||
AllowEncodedSlashes NoDecode | |||
# Container uses a unique non-signed certificate | |||
SSLProxyEngine On | |||
SSLProxyVerify None | |||
SSLProxyCheckPeerCN Off | |||
SSLProxyCheckPeerName Off | |||
# keep the host | |||
ProxyPreserveHost On | |||
# static html, js, images, etc. served from coolwsd | |||
# (broswer is the client part of Collabora Online) | |||
ProxyPass /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> retry=0 | |||
ProxyPassReverse /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> | |||
# WOPI discovery URL | |||
ProxyPass /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> retry=0 | |||
ProxyPassReverse /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> | |||
# Capabilities | |||
ProxyPass /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> retry=0 | |||
ProxyPassReverse /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> | |||
# Main websocket | |||
ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon | |||
# Admin Console websocket | |||
ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws | |||
# Download as, Fullscreen presentation and Image upload operations | |||
ProxyPass /cool <nowiki>http://127.0.0.1:9980/cool</nowiki> | |||
ProxyPassReverse /cool <nowiki>http://127.0.0.1:9980/cool</nowiki> | |||
SSLCertificateFile /opt/certs/collabora.domain123.ru/fullchain.pem | |||
SSLCertificateKeyFile /opt/certs/collabora.domain123.ru/privkey.pem | |||
<nowiki>#</nowiki>Include /etc/letsencrypt/options-ssl-apache.conf | |||
SSLEngine on | |||
<nowiki>#</nowiki> Intermediate configuration, tweak to your needs | |||
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 | |||
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 | |||
SSLHonorCipherOrder off | |||
SSLSessionTickets off | |||
SSLOptions +StrictRequire | |||
<nowiki>#</nowiki> Add vhost name to log entries: | |||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined | |||
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common | |||
</VirtualHost> | |||
</IfModule> | |||
<code>nano /etc/apache2/ports.conf</code> | |||
<nowiki>#</nowiki> If you just change the port or add more ports here, you will likely also | |||
<nowiki>#</nowiki> have to change the VirtualHost statement in | |||
<nowiki>#</nowiki> /etc/apache2/sites-enabled/000-default.conf | |||
Listen 80 | |||
<IfModule ssl_module> | |||
Listen 443 | |||
</IfModule> | |||
<IfModule mod_gnutls.c> | |||
Listen 443 | |||
</IfModule> | |||
<IfModule ssl_module> | |||
Listen 4000 | |||
</IfModule> | |||
<IfModule mod_gnutls.c> | |||
Listen 4000 | |||
</IfModule> | |||
<nowiki>#</nowiki> vim: syntax=apache ts=4 sw=4 sts=4 sr noet | |||
Загрузим модуль mod_ssl | |||
< | <code>a2enmod ssl</code> | ||
<code>systemctl restart apache2</code> | |||
<code>nano /etc/coolwsd/coolwsd.xml</code> | |||
nano /etc/ | |||
<nowiki>#</nowiki> - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line. | <nowiki>#</nowiki> - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line. | ||
| Строка 686: | Строка 465: | ||
<nowiki>#</nowiki> - for the inner tag that contains <termination desc and set the value to true | <nowiki>#</nowiki> - for the inner tag that contains <termination desc and set the value to true | ||
... | |||
<ssl desc="SSL settings"> | |||
... | |||
... | <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable> | ||
... | |||
<ssl desc="SSL settings"> | <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination> | ||
... | |||
<code>systemctl restart coolwsd</code> | |||
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable> | |||
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination> | |||
... | |||
systemctl restart coolwsd | |||
- логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki> | - логинимся в nextcloud <nowiki>https://cloud.domain123.ru</nowiki> | ||
| Строка 713: | Строка 482: | ||
Использовать собственный сервер: | Использовать собственный сервер: | ||
<nowiki>https://collabora.domain123.ru:4000</nowiki> | '''<nowiki>https://collabora.domain123.ru:4000</nowiki>''' | ||
Текущая версия на 11:30, 5 октября 2023
Ссылки
https://fscene8.me/nextcloud-collabora-hpd-installation-guide/
Общая установка
apt update && apt upgrade -y
hostnamectl set-hostname cloud
apt install -y apache2 mariadb-server php-common libapache2-mod-php php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-bcmath imagemagick php-imagick ffmpeg php-xml php-zip php-bz2 php-redis redis-server python3-certbot-apache
Настройка видимости машин nextcloud и collabora
Вариант 1. Зеркалирование запросов из локальной сети по внешнему адресу на маршрутизаторе Mikrotik
10.100.199.14 - машина nextcloud+collabora
188.235.62.224 - внешний адрес маршрутизатора
ether3-wan1 - внешний интерфейс
192.168.199.0/24 - локальная сеть 1
10.100.199.0/24 - локальная сеть 2
10.100.199.1 - адрес локального адреса маршрутизатора локальной сети 2
bridge-vlan1100-esxi-servers - интерфейс локальной сети
443 - порт nextcloud
4000 - порт collabora
/ip firewall nat
add action=dst-nat chain=dstnat comment=alef-proxyMultidomain-osn_nginx dst-port=443 in-interface=ether3-wan1 protocol=tcp to-addresses=192.168.199.229
add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-local protocol=tcp src-address=\
192.168.199.0/24 to-addresses=192.168.199.229
add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-local protocol=tcp src-address=\
192.168.199.0/24 to-addresses=192.168.199.1
add action=dst-nat chain=dstnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=188.235.62.224 dst-port=443 in-interface=bridge-vlan1100-esxi-servers protocol=tcp \
src-address=10.100.199.0/24 to-addresses=192.168.199.229
add action=src-nat chain=srcnat comment="443 mirroring from local net to local HTTPS proxy" dst-address=192.168.199.229 dst-port=443 out-interface=bridge-vlan1100-esxi-servers protocol=tcp \
src-address=10.100.199.0/24 to-addresses=192.168.199.1
/ip firewall nat
add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=10.100.199.14
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\
10.100.199.14
add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 to-addresses=\
10.100.199.1
Вариант 2. Hosts (работает некорректно, не использовать)
nano /etc/hosts
... 127.0.0.1 cloud.domain123.ru cloud 127.0.0.1 collabora.domain123.ru
Настройка типа работы запросов с внешнего адреса до машины Nextcloud+Collabora
Вариант 1. Порты 80,443 пробрасываются через NAT на маршрутизаторе напрямую на машину с nextcloud/collabora
Настройка apache для nextcloud
nano /etc/apache2/sites-available/nextcloud.conf
<VirtualHost *:80>
ServerName cloud.domain123.ru
DocumentRoot /var/www/nextcloud
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
Установка nextcloud
wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2
tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/
chown -R www-data: /var/www/nextcloud
a2ensite nextcloud
a2enmod rewrite headers
systemctl restart apache2
Настройка БД для nextcloud
mysql_secure_installation
mariadb
CREATE DATABASE nextcloud;
CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';
GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';
quit
Настройка HTTPS для nextcloud
certbot --apache
Проверяем доступность через браузер
https://cloud.domain123.ru
Установка collabora
apt install -y gnupg
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D
echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list
apt update -y
apt install -y coolwsd code-brand hunspell
nano /etc/apache2/sites-available/collabora.conf
<VirtualHost *:80>
ServerName collabora.domain123.ru
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
a2ensite collabora
systemctl reload apache2
certbot --apache
a2enmod proxy proxy_wstunnel proxy_http
nano /etc/apache2/sites-enabled/collabora-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName collabora.domain123.ru
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# Collabora config:
Options -Indexes
# Encoded slashes need to be allowed
AllowEncodedSlashes NoDecode
# Container uses a unique non-signed certificate
SSLProxyEngine On
SSLProxyVerify None
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off
# keep the host
ProxyPreserveHost On
# static html, js, images, etc. served from coolwsd
# (broswer is the client part of Collabora Online)
ProxyPass /browser http://127.0.0.1:9980/browser retry=0
ProxyPassReverse /browser http://127.0.0.1:9980/browser
# WOPI discovery URL
ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery
# Capabilities
ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities
# Main websocket
ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
# Admin Console websocket
ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
# Download as, Fullscreen presentation and Image upload operations
ProxyPass /cool http://127.0.0.1:9980/cool
ProxyPassReverse /cool http://127.0.0.1:9980/cool
SSLCertificateFile /etc/letsencrypt/live/collabora.domain123.ru/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain123.ru/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
systemctl restart apache2
nano /etc/coolwsd/coolwsd.xml
# - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.
# - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.
# - For the inner tag that contains <enable type="bool" and set the value to false.
# - for the inner tag that contains <termination desc and set the value to true
...
<ssl desc="SSL settings">
...
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
...
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
...
systemctl restart coolwsd
- логинимся в nextcloud https://cloud.domain123.ru
- Настройки - Office:
- Nextcloud Collabora:
Использовать собственный сервер:
https://collabora.domain123.ru
Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora
Настройка маршрутизатора
80,443 порты должны быть проброшены на машину NGINX PROXY
4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA
Зеркалирование порта 4000 если также неободимо подключаться к NEXTCLOUD/COLLABORA из локальной подсети, в которой находится машина NEXTCLOUD/COLLABORA
/ip firewall filter
add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\
10.100.199.14
add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \
to-addresses=10.100.199.14
add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \
to-addresses=10.100.199.1
Настройка NGINX PROXY (192.168.199.229)
yum install sshpass
Получаем сертификаты
certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d cloud.domain123.ru
certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d collabora.domain123.ru
Копируем сертификаты на машину nextcloud/collabora
sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/
sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/
Периодически обновляем сертификаты и копируем их на машину nextcloud/collabora
crontab -e
... 0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx; 0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/ 0 8 * * 7 sshpass -p "PassWord" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/
Конфиг для проксирования cloud.domain123.ru с внешки на машину nextcloud/collabora
nano /etc/nginx.conf.d/cloud.domain123.ru_HTTPS.conf
server {
listen 80;
server_name cloud.domain123.ru;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name cloud.domain123.ru;
ssl_certificate /etc/letsencrypt/live/cloud.domain123.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cloud.domain123.ru/privkey.pem;
#ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/cloud.domain123.ru.access.log;
# Для обновления сертификатов
location /.well-known {
alias /var/www/cloud.domain123.ru/.well-known;
}
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Fix the “It appears that your reverse proxy set up is broken" error.
proxy_pass https://10.100.199.14/;
proxy_read_timeout 90;
proxy_redirect https://10.100.199.14/ https://cloud.domain123.ru;
}
}
systemctl restart nginx
Настройка машины NEXTCLOUD/COLLABORA (10.100.199.14)
nano /etc/apache2/sites-enabled/nextcloud.conf
<VirtualHost *:80>
ServerName cloud.domain123.ru
DocumentRoot /var/www/nextcloud
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName cloud.domain123.ru
DocumentRoot /var/www/nextcloud
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLCertificateFile /opt/certs/cloud.domain123.ru/fullchain.pem
SSLCertificateKeyFile /opt/certs/cloud.domain123.ru/privkey.pem
#Include /etc/letsencrypt/options-ssl-apache.conf
SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
</VirtualHost>
</IfModule>
Установка nextcloud
wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2
tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/
chown -R www-data: /var/www/nextcloud
a2ensite nextcloud
a2enmod rewrite headers
systemctl restart apache2
Настройка БД для nextcloud
mysql_secure_installation
mariadb
CREATE DATABASE nextcloud;
CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'PassWord';
GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';
quit
Установка collabora
apt install -y gnupg
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D
echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list
apt update -y
apt install -y coolwsd code-brand hunspell
a2ensite collabora
systemctl reload apache2
a2enmod proxy proxy_wstunnel proxy_http
nano /etc/apache2/sites-enabled/collabora.conf
<VirtualHost *:80>
ServerName collabora.domain123.ru
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
nano /etc/apache2/sites-enabled/collabora-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:4000>
ServerName collabora.domain123.ru
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# Collabora config:
Options -Indexes
# Encoded slashes need to be allowed
AllowEncodedSlashes NoDecode
# Container uses a unique non-signed certificate
SSLProxyEngine On
SSLProxyVerify None
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off
# keep the host
ProxyPreserveHost On
# static html, js, images, etc. served from coolwsd
# (broswer is the client part of Collabora Online)
ProxyPass /browser http://127.0.0.1:9980/browser retry=0
ProxyPassReverse /browser http://127.0.0.1:9980/browser
# WOPI discovery URL
ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery
# Capabilities
ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities
# Main websocket
ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
# Admin Console websocket
ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
# Download as, Fullscreen presentation and Image upload operations
ProxyPass /cool http://127.0.0.1:9980/cool
ProxyPassReverse /cool http://127.0.0.1:9980/cool
SSLCertificateFile /opt/certs/collabora.domain123.ru/fullchain.pem
SSLCertificateKeyFile /opt/certs/collabora.domain123.ru/privkey.pem
#Include /etc/letsencrypt/options-ssl-apache.conf
SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
</VirtualHost>
</IfModule>
nano /etc/apache2/ports.conf
# If you just change the port or add more ports here, you will likely also # have to change the VirtualHost statement in # /etc/apache2/sites-enabled/000-default.conf Listen 80 <IfModule ssl_module> Listen 443 </IfModule> <IfModule mod_gnutls.c> Listen 443 </IfModule> <IfModule ssl_module> Listen 4000 </IfModule> <IfModule mod_gnutls.c> Listen 4000 </IfModule> # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
Загрузим модуль mod_ssl
a2enmod ssl
systemctl restart apache2
nano /etc/coolwsd/coolwsd.xml
# - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.
# - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.
# - For the inner tag that contains <enable type="bool" and set the value to false.
# - for the inner tag that contains <termination desc and set the value to true
...
<ssl desc="SSL settings">
...
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
...
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
...
systemctl restart coolwsd
- логинимся в nextcloud https://cloud.domain123.ru
- Настройки - Office:
- Nextcloud Collabora:
Использовать собственный сервер:
https://collabora.domain123.ru:4000