本文最后更新于 2024-01-19，文章内容可能已经过时。

install nextcloud ubuntu 22.04 nginx

在 Ubuntu 22.04 上安装 Nextcloud 并使用 Nginx 作为 Web 服务器的步骤如下：

环境说明

操作系统：ubuntu2204

PHP版本：8.2

nextcloud： 27

安装和配置 PHP

使用以下命令安装 PHP 和必要的组件（多余的组件将在优化nextcloud中用到，所以一并给它装上）：

sudo apt update && sudo apt upgrade && LC_ALL=C.UTF-8 sudo add-apt-repository ppa:ondrej/php 

sudo apt install -y  php8.2 php8.2-fpm php8.2-gd  php8.2-mysql  php8.2-curl  php8.2-mbstring  php8.2-intl  php8.2-apcu php8.2-gmp php8.2-bcmath  php8.2-xml php8.2-imagick  php8.2-zip php8.2-bz2 php8.2-redis unzip nginx

打开 PHP 配置文件，并根据您的系统配置进行更改：

sudo vim /etc/php/8.2/fpm/php.ini

在文件中找到以下行并取消注释：

cgi.fix_pathinfo=0

安装和配置 Nginx

使用以下命令安装 Nginx：

sudo apt install nginx

使用以下命令创建一个名为 nextcloud.conf 的 Nginx 配置文件：

sudo vim /etc/nginx/conf.d/nextcloud.conf

将以下内容添加到文件中：

upstream php-handler {
    #server 127.0.0.1:9000;
    server unix:/run/php/php8.2-fpm.sock;
}

# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}


server {
    listen 80;
    listen [::]:80;
    server_name 10.0.0.2;

    # Prevent nginx HTTP Server Detection
    server_tokens off;

    # Enforce HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443      ssl http2;
    listen [::]:443 ssl http2;
    server_name 10.0.0.2;

    # Path to the root of your installation
    root /var/www/nextcloud;

    # Use Mozilla's guidelines for SSL/TLS settings
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
    ssl_certificate     /opt/ssl/fullchain.cer;
    ssl_certificate_key /opt/ssl/cert.key;

    # Prevent nginx HTTP Server Detection
    server_tokens off;

    # HSTS settings
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

    # set max upload size and increase upload timeout:
    client_max_body_size 5120000M;
    client_body_timeout 300s;
    fastcgi_buffers 128 8K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Pagespeed is not supported by Nextcloud, so if your server is built
    # with the `ngx_pagespeed` module, uncomment this line to disable it.
    #pagespeed off;

    # The settings allows you to optimize the HTTP2 bandwidth.
    # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
    # for tuning hints
    client_body_buffer_size 512k;

    # HTTP response headers borrowed from Nextcloud `.htaccess`
    add_header Strict-Transport-Security 'max-age=15552000' always;
    add_header Referrer-Policy                   "no-referrer"       always;
    add_header X-Content-Type-Options            "nosniff"           always;
    add_header X-Frame-Options                   "SAMEORIGIN"        always;
    add_header X-Permitted-Cross-Domain-Policies "none"              always;
    add_header X-Robots-Tag                      "noindex, nofollow" always;
    add_header X-XSS-Protection                  "1; mode=block"     always;

    # Remove X-Powered-By, which is an information leak
    fastcgi_hide_header X-Powered-By;

    # Add .mjs as a file extension for javascript
    # Either include it in the default mime.types list
    # or include you can include that list explicitly and add the file extension
    # only for Nextcloud like below:
    include mime.types;
    types {
        text/javascript js mjs;
    }

    # Specify how to handle directories -- specifying `/index.php$request_uri`
    # here as the fallback means that Nginx always exhibits the desired behaviour
    # when a client requests a path that corresponds to a directory that exists
    # on the server. In particular, if that directory contains an index.php file,
    # that file is correctly served; if it doesn't, then the request is passed to
    # the front-end controller. This consistent behaviour means that we don't need
    # to specify custom rules for certain paths (e.g. images and other assets,
    # `/updater`, `/ocs-provider`), and thus
    # `try_files $uri $uri/ /index.php$request_uri`
    # always provides the desired behaviour.
    index index.php index.html /index.php$request_uri;

    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # Make a regex exception for `/.well-known` so that clients can still
    # access it despite the existence of the regex rule
    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
    # for `/.well-known`.
    location ^~ /.well-known {

            location = /.well-known/webfinger   { return 301 $scheme://$host:$server_port/index.php/.well-known/webfinger; }
            location = /.well-known/nodeinfo    {return 301 $scheme://$host:$server_port/index.php/.well-known/nodeinfo;}

            location = /.well-known/carddav     { return 301 $scheme://$host:$server_port/remote.php/dav/; }
            location = /.well-known/caldav      { return 301 $scheme://$host:$server_port/remote.php/dav/; }

            try_files $uri $uri/ =404;
        }

    # Rules borrowed from `.htaccess` to hide certain paths from clients
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
    # which handle static assets (as seen below). If this block is not declared first,
    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
    # to the URI, resulting in a HTTP 500 error response.
    location ~ \.php(?:$|/) {
        # Required for legacy support
        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;

        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
        fastcgi_param front_controller_active true;     # Enable pretty urls
        fastcgi_pass php-handler;
	fastcgi_read_timeout 86400;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;

        fastcgi_max_temp_file_size 0;
    }

    # Serve static files
    location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463, $asset_immutable";
        access_log off;     # Optional: Don't log access to assets

        location ~ \.wasm$ {
            default_type application/wasm;
        }
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri;
        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
        access_log off;     # Optional: Don't log access to assets
    }

    # Rule borrowed from `.htaccess`
    location /remote {
        return 301 /remote.php$request_uri;
    }

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }
}

然后，重新加载 Nginx 配置：

sudo systemctl reload nginx

下载和配置 Nextcloud

使用以下命令下载 Nextcloud，或前往nextcloud官网下载：

mkdir /opt/temp/
cd /opt/temp/
apt install -y wget unzip && wget -L https://glxaa.com:11224/s/LQ6XMigwsZ9GcCS/download/nextcloud-27.1.5.zip && unzip ./nextcloud-27.1.5.zip

将 Nextcloud 移动到 Nginx 根目录：

sudo cp -rf  /opt/temp/nextcloud /var/www/

创建 Nginx 配置文件所需的 Nextcloud 数据目录：

sudo mkdir /var/www/nextcloud/data
sudo chown -R www-data:www-data /var/www/

生成SSL自签名

要在 Nginx 中使用自签名证书，你需要生成一个自签名的 SSL 证书和私钥。以下是一个简单的步骤，使用 OpenSSL 工具生成自签名证书：

或者也可以上传自己的ssl证书

生成私钥（key）：

mkdir -p /opt/ssl
cd /opt/ssl
openssl genpkey -algorithm RSA -out server.key

生成证书签名请求（CSR）：
```
openssl req -new -key server.key -out server.csr
```
在这个过程中，你需要输入一些证书信息，比如国家、省、城市等。这些信息将用于生成证书。
生成自签名证书（crt）：
```
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
```
这将生成一个有效期为 365 天的自签名证书。

配置数据库

安装 MariaDB：

sudo apt install mariadb-server
sudo mysql

 CREATE DATABASE nextcloud;
 CREATE USER 'glxaa'@'localhost' IDENTIFIED BY '123456';
 GRANT ALL PRIVILEGES ON nextcloud.* TO 'glxaa'@'localhost';
 FLUSH PRIVILEGES;
 exit