Collabora. Debian 11. Установка Nextcloud + Collabora

Материал из Wiki
Перейти к навигации Перейти к поиску


Ссылки

https://fscene8.me/nextcloud-collabora-hpd-installation-guide/

Общая установка

apt update && apt upgrade -y

hostnamectl set-hostname cloud

apt install -y apache2 mariadb-server php-common libapache2-mod-php php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-bcmath imagemagick php-imagick ffmpeg php-xml php-zip php-bz2 php-redis redis-server python3-certbot-apache

Настройка видимости машин nextcloud и collabora

Вариант 1. Hosts

nano /etc/hosts 

...
127.0.0.1 cloud.domain123.ru cloud
127.0.0.1 collabora.domain123.ru

Вариант 1. Порты 80,443 пробрасываются через NAT на маршрутизаторе напрямую на машину с nextcloud/collabora

nano /etc/apache2/sites-available/nextcloud.conf

---

<VirtualHost *:80>

       ServerName cloud.domain123.ru

       DocumentRoot /var/www/nextcloud

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

---

wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2

tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/

chown -R www-data: /var/www/nextcloud

a2ensite nextcloud

a2enmod rewrite headers

systemctl restart apache2

mysql_secure_installation

mariadb

   CREATE DATABASE nextcloud;

   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'dispersia85D';

   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';

   quit

certbot --apache

https://cloud.domain123.ru

apt install -y gnupg

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D

echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list

apt update -y

apt install -y coolwsd code-brand hunspell

nano /etc/apache2/sites-available/collabora.conf

---

<VirtualHost *:80>

       ServerName collabora.domain123.ru

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

---

a2ensite collabora

systemctl reload apache2

certbot --apache

a2enmod proxy proxy_wstunnel proxy_http

nano /etc/apache2/sites-enabled/collabora-le-ssl.conf

---

<IfModule mod_ssl.c>

<VirtualHost *:443>

       ServerName collabora.domain123.ru

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

       # Collabora config:

       Options -Indexes

       # Encoded slashes need to be allowed

       AllowEncodedSlashes NoDecode

       # Container uses a unique non-signed certificate

       SSLProxyEngine On

       SSLProxyVerify None

       SSLProxyCheckPeerCN Off

       SSLProxyCheckPeerName Off

       # keep the host

       ProxyPreserveHost On

       # static html, js, images, etc. served from coolwsd

       # (broswer is the client part of Collabora Online)

       ProxyPass /browser http://127.0.0.1:9980/browser retry=0

       ProxyPassReverse /browser http://127.0.0.1:9980/browser

       # WOPI discovery URL

       ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0

       ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery

       # Capabilities

       ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0

       ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities

       # Main websocket

       ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon

       # Admin Console websocket

       ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws

       # Download as, Fullscreen presentation and Image upload operations

       ProxyPass /cool http://127.0.0.1:9980/cool

       ProxyPassReverse /cool http://127.0.0.1:9980/cool

SSLCertificateFile /etc/letsencrypt/live/collabora.domain123.ru/fullchain.pem

SSLCertificateKeyFile /etc/letsencrypt/live/collabora.domain123.ru/privkey.pem

Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>

</IfModule>

---

systemctl restart apache2

#    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

#    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

#    - For the inner tag that contains <enable type="bool" and set the value to false.

#    - for the inner tag that contains <termination desc and set the value to true

nano /etc/coolwsd/coolwsd.xml

...

<ssl desc="SSL settings">

      

       <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>

      

       <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>

...

systemctl restart coolwsd

- логинимся в nextcloud https://cloud.domain123.ru

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           https://collabora.domain123.ru

Вариант 2. Порт 443 (для https nextcloud) пробрасываeтся через NAT на машину с NGINX HTTP PROXY, а там распределяется на машину nextcloud/collabora. Порт 4000 (для https collabora) пробрасывается напрямую на машину nextcloud/collabora

Настройка маршрутизатора

---

80,443 порты должны быть проброшены на машину NGINX PROXY

4000 порт должен быть проброшен на машину NEXTCLOUD/COLLABORA

# зеркалирование порта 4000 если также неободимо подключаться к NEXTCLOUD/COLLABORA из локальной подсети, в которой находится машина NEXTCLOUD/COLLABORA

/ip firewall filter

add action=dst-nat chain=dstnat comment="collabora https" dst-port=4000 in-interface=ether3-wan1 protocol=tcp to-addresses=10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-local protocol=tcp src-address=192.168.199.0/24 to-addresses=\

   10.100.199.14

add action=dst-nat chain=dstnat comment=collabora dst-address=188.235.62.224 dst-port=4000 in-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \

   to-addresses=10.100.199.14

add action=src-nat chain=srcnat comment=collabora dst-address=10.100.199.14 dst-port=4000 out-interface=bridge-vlan1100-esxi-servers protocol=tcp src-address=10.100.199.0/24 \

   to-addresses=10.100.199.1

Настройка NGINX PROXY (192.168.199.229)

---

yum install sshpass

# получаем сертификаты

certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d cloud.domain123.ru

certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d collabora.domain123.ru

# копируем сертификаты на машину nextcloud/collabora

sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/

sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/

# периодически обновляем сертификаты и копируем их на машину nextcloud/collabora

crontab -e

...

0 8 * * 7 systemctl stop nginx; certbot renew --force-renewal; systemctl restart nginx;

0 8 * * 7 sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/collabora.domain123.ru root@10.100.199.14:/opt/certs/

0 8 * * 7 sshpass -p "dispersia85D" rsync -avPhL /etc/letsencrypt/live/cloud.domain123.ru root@10.100.199.14:/opt/certs/

---

# конфиг для проксирования cloud.domain123.ru с внешки на машину nextcloud/collabora

cat /etc/nginx.conf.d/cloud.domain123.ru_HTTPS.conf

---

server {

   listen 80;

   server_name cloud.domain123.ru;

   return 301 https://$host$request_uri;

}

server {

   listen 443 ssl;

   server_name cloud.domain123.ru;

   ssl_certificate           /etc/letsencrypt/live/cloud.domain123.ru/fullchain.pem;

   ssl_certificate_key       /etc/letsencrypt/live/cloud.domain123.ru/privkey.pem;

   #ssl on;

   ssl_session_cache  builtin:1000  shared:SSL:10m;

   ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;

   ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

   ssl_prefer_server_ciphers on;

   access_log            /var/log/nginx/cloud.domain123.ru.access.log;

   # Для обновления сертификатов

   location /.well-known {

       alias /var/www/cloud.domain123.ru/.well-known;

   }

   location / {

     proxy_set_header        Host $host;

     proxy_set_header        X-Real-IP $remote_addr;

     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

     proxy_set_header        X-Forwarded-Proto $scheme;

     # Fix the “It appears that your reverse proxy set up is broken" error.

     proxy_pass          https://10.100.199.14/;

     proxy_read_timeout  90;

     proxy_redirect      https://10.100.199.14/ https://cloud.domain123.ru;

   }

}

systemctl restart nginx

Настройка машины NEXTCLOUD/COLLABORA (10.100.199.14)

---

nano /etc/apache2/sites-enabled/nextcloud.conf

---

<VirtualHost *:80>

       ServerName cloud.domain123.ru

       DocumentRoot /var/www/nextcloud

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

---

nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf

---

<IfModule mod_ssl.c>

<VirtualHost *:443>

       ServerName cloud.domain123.ru

       DocumentRoot /var/www/nextcloud

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLCertificateFile /opt/certs/cloud.domain123.ru/fullchain.pem

SSLCertificateKeyFile /opt/certs/cloud.domain123.ru/privkey.pem

#Include /etc/letsencrypt/options-ssl-apache.conf

SSLEngine on

# Intermediate configuration, tweak to your needs

SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

SSLHonorCipherOrder     off

SSLSessionTickets       off

SSLOptions +StrictRequire

# Add vhost name to log entries:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined

LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

</VirtualHost>

</IfModule>

---

wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2

tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/

chown -R www-data: /var/www/nextcloud

a2ensite nextcloud

a2enmod rewrite headers

systemctl restart apache2

mysql_secure_installation

mariadb

   CREATE DATABASE nextcloud;

   CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'dispersia85D';

   GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';

   quit

apt install -y gnupg

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D

echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list

apt update -y

apt install -y coolwsd code-brand hunspell

a2ensite collabora

systemctl reload apache2

a2enmod proxy proxy_wstunnel proxy_http

nano /etc/apache2/sites-enabled/collabora.conf

---

<VirtualHost *:80>

       ServerName collabora.domain123.ru

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

---

nano /etc/apache2/sites-enabled/collabora-le-ssl.conf

---

<IfModule mod_ssl.c>

<VirtualHost *:4000>

       ServerName collabora.domain123.ru

       ErrorLog ${APACHE_LOG_DIR}/error.log

       CustomLog ${APACHE_LOG_DIR}/access.log combined

       # Collabora config:

       Options -Indexes

       # Encoded slashes need to be allowed

       AllowEncodedSlashes NoDecode

       # Container uses a unique non-signed certificate

       SSLProxyEngine On

       SSLProxyVerify None

       SSLProxyCheckPeerCN Off

       SSLProxyCheckPeerName Off

       # keep the host

       ProxyPreserveHost On

       # static html, js, images, etc. served from coolwsd

       # (broswer is the client part of Collabora Online)

       ProxyPass /browser http://127.0.0.1:9980/browser retry=0

       ProxyPassReverse /browser http://127.0.0.1:9980/browser

       # WOPI discovery URL

       ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0

       ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery

       # Capabilities

       ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0

       ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities

       # Main websocket

       ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon

       # Admin Console websocket

       ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws

       # Download as, Fullscreen presentation and Image upload operations

       ProxyPass /cool http://127.0.0.1:9980/cool

       ProxyPassReverse /cool http://127.0.0.1:9980/cool

SSLCertificateFile /opt/certs/collabora.domain123.ru/fullchain.pem

SSLCertificateKeyFile /opt/certs/collabora.domain123.ru/privkey.pem

#Include /etc/letsencrypt/options-ssl-apache.conf

SSLEngine on

# Intermediate configuration, tweak to your needs

SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

SSLHonorCipherOrder     off

SSLSessionTickets       off

SSLOptions +StrictRequire

# Add vhost name to log entries:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined

LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

</VirtualHost>

</IfModule>

---

nano /etc/apache2/ports.conf

---

# If you just change the port or add more ports here, you will likely also

# have to change the VirtualHost statement in

# /etc/apache2/sites-enabled/000-default.conf

Listen 80

<IfModule ssl_module>

       Listen 443

</IfModule>

<IfModule mod_gnutls.c>

       Listen 443

</IfModule>

<IfModule ssl_module>

       Listen 4000

</IfModule>

<IfModule mod_gnutls.c>

       Listen 4000

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

---

# загрузим модуль mod_ssl

a2enmod ssl

systemctl restart apache2

#    - Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.

#    - Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.

#    - For the inner tag that contains <enable type="bool" and set the value to false.

#    - for the inner tag that contains <termination desc and set the value to true

nano /etc/coolwsd/coolwsd.xml

...

<ssl desc="SSL settings">

      

       <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>

      

       <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>

...

systemctl restart coolwsd

- логинимся в nextcloud https://cloud.domain123.ru

  - Настройки - Office:

   - Nextcloud Collabora:

       Использовать собственный сервер:

           https://collabora.domain123.ru:4000

Источник — https://wiki.cless.pro/index.php?title=Collabora._Debian_11._Установка_Nextcloud_%2B_Collabora&oldid=578