Author: Kenn

Setup In-memory cache on Nextcloud

You shoud setup memory cache on Nextcloud for performance. Now I choosed APCu for local memory cache, Redis for distributed and locking memory cache.

Enable memory cache on Nextcloud

Edit nextcloud config.php file.

$ sudo vi /misc/extHDD/nc.lama-lab.mydns.jp/config/config.php

...
'memcache.local'=>'\OC\Memcache\APCu',
'memcache.distributed'=>'\OC\Memcache\Redis',
'memcache.locking'=>'\OC\Memcache\Redis',
'redis' =>
  array (
    'host'=>'/run/redis/redis.sock',
    'port'=>0,
    'dbindex'=>0,
    'password'=>'',
    'timeout'=>1.5,
  ),
...

Restart Nginx

$ sudo systemctl restart nginx

Enable HTTP/2

To enable HTTP/2 connections, edit nginx site speciffic files.

$ sudo vi /etc/nginx/sites-available/www.lama-lab.mydns.jp.conf

Add “http2” word at the end of listen sentence.

...
listen 443 ssl http2
listen [::]:443 ssl http2
...

Then restart Nginx.

$ sudo systemctl restart nginx

Deploy config files

Nextcloud config file

$ sudo vi /etc/nginx/global/nextcloud.conf

# Prevent nginx HTTP Server Detection
server_tokens off;

# set max upload size and increase upload timeout:
client_max_body_size 5G;
client_body_buffer_size 512M;
client_body_timeout 1800s;
fastcgi_read_timeout 1800s;
fastcgi_buffers 64 8K;

# HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer"   always;
add_header X-Content-Type-Options "nosniff"       always;
add_header X-Download-Options "noopen"        always;
add_header X-Frame-Options "SAMEORIGIN"    always;
add_header X-Permitted-Cross-Domain-Policies "none"          always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;

# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;

# Specify how to handle directories -- specifying `/index.php$request_uri`
# here as the fallback means that Nginx always exhibits the desired behaviour
# when a client requests a path that corresponds to a directory that exists
# on the server. In particular, if that directory contains an index.php file,
# that file is correctly served; if it doesn't, then the request is passed to
# the front-end controller. This consistent behaviour means that we don't need
# to specify custom rules for certain paths (e.g. images and other assets,
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
# `try_files $uri $uri/ /index.php$request_uri`
# always provides the desired behaviour.
index index.php index.html /index.php$request_uri;

# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / {
    if ( $http_user_agent ~ ^DavClnt ) {
        return 302 /remote.php/webdav/$is_args$args;
    }
}

# Make a regex exception for `/.well-known` so that clients can still
# access it despite the existence of the regex rule
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
# for `/.well-known`.
location ^~ /.well-known {
    # The rules in this block are an adaptation of the rules
    # in `.htaccess` that concern `/.well-known`.

    location = /.well-known/carddav { return 301 /remote.php/dav/; }
    location = /.well-known/caldav  { return 301 /remote.php/dav/; }

    location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
    location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

    # Let Nextcloud's API for `/.well-known` URIs handle all other
    # requests by passing them to the front-end controller.
    return 301 /index.php$request_uri;
}

# Rules borrowed from `.htaccess` to hide certain paths from clients
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

# Ensure this block, which passes PHP files to the PHP process, is above the blocks
# which handle static assets (as seen below). If this block is not declared first,
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
# to the URI, resulting in a HTTP 500 error response.
location ~ \.php(?:$|/) {
    # Required for legacy support
    rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    set $path_info $fastcgi_path_info;

    try_files $fastcgi_script_name =404;

    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $path_info;
    fastcgi_param HTTPS on;

    fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
    fastcgi_param front_controller_active true;     # Enable pretty urls
    fastcgi_pass php-handler;

    fastcgi_intercept_errors on;
    fastcgi_request_buffering off;

    fastcgi_max_temp_file_size 0;
    fastcgi_connect_timeout 1800s;
    fastcgi_read_timeout 1800s;
}

location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
    try_files $uri /index.php$request_uri;
    add_header Cache-Control "public, max-age=15778463, $asset_immutable";
    access_log off;     # Optional: Don't log access to assets

    location ~ \.wasm$ {
        default_type application/wasm;
    }
}

location ~ \.woff2?$ {
    try_files $uri /index.php$request_uri;
    expires 7d;         # Cache-Control policy borrowed from `.htaccess`
    access_log off;     # Optional: Don't log access to assets
}

# Rule borrowed from `.htaccess`
location /remote {
    return 301 /remote.php$request_uri;
}

location / {
    try_files $uri $uri/ /index.php$request_uri;
}

Site specific config file

$ sudo vi /etc/nginx/sites-available/nc.lama-lab.mydns.jp

# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}

# Redirect everything to the main site. We use a separate server statement and >
#server {
#        server_name  _;
#        return 302 $scheme://nc.lama-lab.mydns.jp$request_uri;
#}

server {
    server_name nc.lama-lab.mydns.jp;
    root /misc/extHDD/nc.lama-lab.mydns.jp;

    access_log /var/log/nginx/nc.lama-lab.mydns.jp.access.log;
    error_log /var/log/nginx/nc.lama-lab.mydns.jp.error.log;

    index index.php;

    include global/restrictions.conf;

    # Additional rules go here.

    # Only include one of the files below.
     include global/nextcloud.conf;
#    include global/nextcloud-ms-subdir.conf;
#    include global/nextcloud-ms-subdomain.conf;

    listen [::]:80;
    listen 80;
}

Enable the Web site

$ sudo ln -s /etc/nginx/sites-available/nc.lama-lab.mydns.jp.conf /etc/nginx/sites-enabled/nc.lama-lab.mydns.jp.conf

$ sudo systemctl restart nginx
$ sudo systemctl restart php-fpm

Database infomation

• Database name : lamalab_db
• User name : lamalab_user
• Password : XXXXXXXX
• Character set : utf8mb4

Create Database

$ sudo mysql -u root -p

> CREATE DATABASE lamalab_db DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
> GRANT ALL PRIVILEGES ON lamalab_db.* TO 'lamalab_user'@'localhost' IDENTIFIED BY 'XXXXXXXX';
> FLUSH PRIVILEGES;
> EXIT;

Make directories

$ sudo mkdir /etc/nginx/global
$ sudo mkdir /etc/nginx/sites-available
$ sudo mkdir /etc/nginx/sites-enable

Configure Nginx

Edit /etc/nginx/nginx.conf

$ sudo vi /etc/nginx/nginx.conf

# Generic startup file.
user http;
 
#usually equal to number of CPUs you have. run command "grep processor /proc/cpuinfo | wc -l" to find it
worker_processes  auto;
worker_cpu_affinity auto;
 
error_log  /var/log/nginx/error.log;
#pid        /run/nginx.pid;
 
# Keeps the logs free of messages about not being able to bind().
#daemon     off;
 
events {
    worker_connections  1024;
}
 
http {
#   rewrite_log on;
 
    include mime.types;
    default_type       application/octet-stream;
    access_log         /var/log/nginx/access.log;
    sendfile           on;
#   tcp_nopush         on;
    keepalive_timeout  3;
#   tcp_nodelay        on;
    gzip               on;
    #php max upload limit cannot be larger than this       
    client_max_body_size 5G;
    index              index.php index.html index.htm;
 
    # Upstream to abstract backend connection(s) for PHP.
    upstream php {
       #this should match value of "listen" directive in php-fpm pool
       server unix:/run/php-fpm/php-fpm.sock;
       #server 127.0.0.1:9000;
    }
 
    include sites-enabled/*;
}

Edit restriction.conf

$ sudo vi /etc/nginx/global/restriction.conf

# Global restrictions configuration file.
# Designed to be included in any server {} block.</p>
location = /favicon.ico {
	log_not_found off;
	access_log off;
}

location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
# If this option is enabled, nextcloud can only upload up to 20MiB.
#location ~ /\. {
#	deny all;
#	access_log off;
#	log_not_found off;
#}

You can use AutoFS to mount HDD dynamically.

Install AutoFS

$ sudo yay -S autofs

Configure AutoFS

$ sudo su
# _ID=$(blkid --output value --match-tag PARTUUID /dev/sda1)
# printf "%s%s\n" "extHDD --fstype=auto PARTUUID="\"${_ID}\"" > /etc/autofs/auto.misc
# exit

1. the first line, change user to root.
2. the second line, input /dev/sda1’s partition UUID to variable _ID.
3. the third line, write out _ID infomation to auto.misc file.
4. the fourth line, exit to root.

Start and Enable AutoFS

$ sudo systemctl start autofs
$ sudo systemctl enable autofs

Check the configuration

$ sudo ls /misc/extHDD

Install gdisk

$ sudo pacman -S gdisk

Search HDD drives

$ sudo fdisk -l

Make partitions

$ sudo gdisk /dev/sda

Make a file system

$ sudo mkfs -t ext4 /dev/sda1

Check the partitions

$ sudo df -T

Install required PHP modules

$ sudo pacman -S php-gd php-imagick php-intl php-sodium

Enable required PHP modules

Edit /etc/php/php.ini file

$ sudo vi /etc/php/php.ini

uncomment following modules

curl, dom, exif, fileinfo, hash, imagick, json, mbstring, mysqli, openssl, pcre, sodium, xml, zip, bcmath, filter, gd, iconv, intl, mcrypt, simplexml, xmlreader, zlib
ssh2, ftp, sockets

Restart PHP-FPM

$ sudo systemctl restart php-fpm

Install Ghostscript

$ sudo pacman -S ghostscript

Install PHP

$ sudo pacman -S php

Install PHP-FPM

PHP-FPM (PHP FastCGI Process Manager) is a PHP implementation of CGI that is useful for heavy-loaded system.

Install PHP-FPM

$ sudo pacman -S php-fpm

Start and Enable PHP-FPM

$ sudo systemctl start php-fpm
$ sudo systemctl enable php-fpm

Install MariaDB

MariaDB is a Open Source Database server.

$ sudo pacman -S mariadb

Setup MariaDB server

$ sudo mysql_install_db --user=mysql --basedir=/usr 
--datadir=/var/lib/mysql

Start and Enable Database server

$ sudo systemctl start mariadb
$ sudo systemctl enable mariadb

Secure Installation

For security issue, secure installation script should be run at first before using MariaDB.

$ sudo mysql_secure_installation

Notice: The first root password is set empty. So If you are requested the root password, you should only hit a Enter key.

On all questions, you would answer “yes” for safety.