简介

NextCloud 是一款开源网络硬盘系统，最新版本是12，NextCloud 源代码完全开放，你可以在开源许可协议的约束下免费使用，对于需要专业支持的用户可以购买 NextCloud 官方的专业版订阅服务。同时它还支持Android和IOS客户端，方便同步。
详情参见：NextCloud官网

前提

要搭建云服务，请确保你已经有一台VPS。因为要配置服务器，你还需要有一个域名，这些你都可在阿里云或腾讯云进行购买。

VPS系统

Ubuntu 16.0.4

搭建方式

搭建NextCloud有两种方式，一是以Docker方式安装，另一种以php环境下安装，本文以php方式安装，以Docker方式安装参见Docker安装私有云盘NextCloud过程记录，下面开始安装。

安装依赖

服务器

这里我们使用nginx作为服务器，通过以下命令安装nginx

apt-get install nginx

数据库

NextCloud可用的数据库有MySQL/MariaDB，PostgreSQL，Oracle。官方推荐MySQL/MariaDB，这里以mysql为例，执行以下指令安装mysql：

apt-get install mysql-server
mysql_secure_installation

期间会让你设置root密码和密码强度，请自行判断。

运行环境要求

执行下面的命令安装php

apt-get install php

官方要求php5.0+，通过以下指令查看php版本

php -v

这里推荐使用php7.0，有更高的性能表现。

然后安装NextCloud所需的其它php依赖

apt-get install php-zip
apt-get install php-dompdf
apt-get install php-xml
apt-get install php-mbstring
apt-get install php-curl
apt-get install php-mysql

这样环境就安装完毕了。

安装NextCloud

进入安装目录/var/www下，通过下面的命令下载NextCloud 12并解压：

wget https://download.nextcloud.com/server/releases/nextcloud-12.0.3.zip
unzip nextcloud-*.zip

配置数据库

NextCloud需要一个数据库保存数据，这里以Mysql为例创建数据库，其它数据库相似，

进入mysql命令界面：

mysql -u root -p

创建数据库

create database your_db;

再为NextCloud创建一个数据库用户:

create user 'your_username'@'localhost' identified by 'your_passwd'

其中your_username是用户名,localhost指明只能通过本地访问。要想通过远程访问可改为remote同时配置你的mysql访问策略。your_passwd即所对应的密码。
如果遇到Your password does not satisfy the current policy requirements 问题，这是因为你的密码强度级别设置太高，通过set global validate_password_policy=0可以设置为最低级别，关于密码强度的说明请参考百度。

为所创建的用户授予权限:

grant all privileges on your_db.* to 'your_username'@'localhost' identified by 'your_passwd';
flush privileges;
quit

到此数据库的部分已经完成了。

配置Nginx服务器

进入/etc/nginx/sites-available/目录下

cd /etc/nginx/sites-available/

创建一个文件cloud（文件名任意，可读性好，最好为你的域名就行）,

touch cloud

进入/etc/nginx/sites-enabled/目录

cd /etc/nginx/sites-enabled/

执行以下命令创建链接

ln -s ../sites-available/cloud cloud

编辑cloud

vi cloud

在NextCoud的配置官方文档中可以找到nginx服务器的配置。复制到cloud中，需要修改的部分已用中文注释

upstream php-handler {
    #server 127.0.0.1:9000;
    server  unix:/var/run/php/php7.0-fpm.sock; #使用sock加速磁盘访问
}

#若使用https，取消下面这段注释
#server {
#    listen 80;
#    server_name cloud.example.com; #将cloud.example.com替换为你的域名
#    # enforce https
#    return 301 https://$server_name$request_uri;
#}

server {
    #listen 443 ssl http2; #若使用https，取消本行注释，同时注释下面这行
    listen 80; 
    server_name cloud.example.com; #将cloud.example.com替换为你的域名

    #若使用https，取消注释下面两行
    #ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
    #ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    # add_header Strict-Transport-Security "max-age=15768000;
    # includeSubDomains; preload;";
    #
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/nextcloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
    return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
    return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param HTTPS on; # 若使用https取消这行注释
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=15778463";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        # add_header Strict-Transport-Security "max-age=15768000;
        #  includeSubDomains; preload;";
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

至此服务器已经配置完成。
重启服务器：

systemctl reload nginx.service

打开浏览器，输入你的域名，若一切正常，就可以看到安装界面了，若仍有依赖未安装，按照提示进行安装即可。

可能遇到的问题

• 你没有安装php-*依赖

  解：请确保你已经安装完上面的所有php依赖

• 安装后打开浏览器出现502异常

  解：这是由于你解压nextcloud压缩文件时是作为root（或其它）用户进行操作的，而php使用的用户默认为www-data，你需要更改文件所有者:

  cd /var/www
  chown -R www-data:www-data nextcloud/
  

管理界面出现安全警告：

• PHP 的设置似乎有问题, 无法获取系统环境变量. 使用 getenv("PATH") 测试时仅返回空结果

  解：取消/etc/php/7.0/fpm/pool.d/www.conf中这几行的注释

  ;env[HOSTNAME] = $HOSTNAME
  ;env[PATH] = /usr/local/bin:/usr/bin:/bin
  ;env[TMP] = /tmp
  ;env[TMPDIR] = /tmp
  ;env[TEMP] = /tmp
  

• 内存缓存未配置

  解：请查看性能优化一节。

性能优化

nextcloud支持内存加速，它可支持3种方式APCu，Memcached，Redis。这里只展示APCu的配置，其它方式可参考官方配置。

配置APCu步骤

安装apcu

sudo apt-get update
sudo apt-get install php-apcu -y

打开/var/www/nextcloud/config/config.php文件，添加下面这行

'memcache.local' => '\OC\Memcache\APCu',

最终的config.php类似这样

<?php
$CONFIG = array (
  'instanceid' => '',
  'passwordsalt' => '',
  'secret' => '',
  'trusted_domains' =>
  array (
    0 => 'cloud.host.com',
  ),
  'datadirectory' => '/var/www/nextcloud/data',
  'overwrite.cli.url' => 'https://cloud.host.com',
  'dbtype' => 'mysql',
  'version' => '12.0.3.3',
  'dbname' => 'nextcloud_db',
  'dbhost' => 'localhost:3306',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',
  'dbpassword' => '*_mycloud',
  'installed' => true,
  'memcache.local' => '\OC\Memcache\APCu', #添加到这里
);

重启php7.0-fpm服务

sudo systemctl reload php7.0-fpm.service

重启服务器

sudo systemctl reload nginx.service

若此时进入管理界面，没有任何安全警告，恭喜你，你以完成nextcloud的搭建工作，nextcloud还拥有大量的插件协助你的工作，敬请发现吧！

配置HTTPS

在前面的配置中，并没有启用https，通过https的方式访问网站，别人窃取你密码的机会将会大大减少。实现HTTPS访问需要SSL证书，但是SSL证书一般都需要购买，好在有免费开源的let's encrypt证书可用，let's encrypt的配置一般相当麻烦，正因为此certbot诞生了，通过这款开源工具，你可以很快安装好SSL证书。下面开始SSL的安装：

安装cerbot

sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx

自动安装SSL

certbot

cerbot会自动识别你的服务器和域名，请根据提示进行操作，安装期间它会告诉你安装好的证书所在位置。
这里需要注意的是let's encrypt为了让所有人都能享受到证书服务，你的子域名每周只能重复申请3-5次证书，主域名一旦申请超过3次就会被限制申请，只有等5天后才能再次申请。所以申请好的证书请保管好，没有其它问题不要经常申请。详情参见官方说明频率限制。

现在解除掉/etc/nginx/sites-enabled/cloud文件中关于https的限制，最终的cloud文件如下所示:

upstream php-handler {
    # server 127.0.0.1:9000;
    server unix:/var/run/php/php7.0-fpm.sock;
}

server {
    listen 80;
    server_name cloud.example.com;
    # enforce https
    return 301 https://$server_name$request_uri;

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    } # managed by Certbot

}

server {
    listen 443 ssl http2;
    server_name cloud.example.com;

    #ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
    #ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    add_header Strict-Transport-Security "max-age=15768000;includeSubDomains; preload;";
    #
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/nextcloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~ \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=15778463";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        # add_header Strict-Transport-Security "max-age=15768000;
        #  includeSubDomains; preload;";
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
ssl_certificate /etc/letsencrypt/live/cloud.manlier.top/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/cloud.manlier.top/privkey.pem; # managed by Certbot
}

你也可以看到certbot帮你修改的部分

最后重启你的服务器

systemctl reload nginx.service

如果你使用类谷歌浏览器，网址左侧应该会显示一把小绿锁，表示你成功配置好了https服务