Nextcloud

alias off="sudo -u www-data php /var/www/cloud.technat.ch/occ maintenance:mode --off"
alias on="sudo -u www-data php /var/www/cloud.technat.ch/occ maintenance:mode --on"
alias occ="sudo -u www-data php /var/www/cloud.technat.ch/occ"
alias l="ls -lahF"

technat@cloud:~$ sudo fdisk /dev/sdb

Welcome to fdisk (util-linux 2.36.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0x5795d6a5.

Command (m for help): g
Created a new GPT disklabel (GUID: EC377253-3EF3-3A4E-B3BA-3D1C12093F4F).

Command (m for help): p
Disk /dev/sdb: 150 GiB, 161061273600 bytes, 314572800 sectors
Disk model: QEMU HARDDISK
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: EC377253-3EF3-3A4E-B3BA-3D1C12093F4F

Command (m for help): n
Partition number (1-128, default 1):
First sector (2048-314572766, default 2048):
Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-314572766, default 314572766):

Created a new partition 1 of type 'Linux filesystem' and of size 150 GiB.

Command (m for help): t
Selected partition 1
Partition type or alias (type L to list all): 30
Changed type of partition 'Linux filesystem' to 'Linux LVM'.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

technat@nc:~$ sudo cryptsetup luksFormat -v /dev/sdb1

WARNING!
========
This will overwrite data on /dev/sdb1 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sdb1:
Verify passphrase:
Passphrases do not match.
Command failed with code -2 (no permission or bad passphrase).
root@nc:~# cryptsetup luksFormat -v /dev/sdb1

WARNING!
========
This will overwrite data on /dev/sdb1 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sdb1:
Verify passphrase:
Key slot 0 created.
Command successful.

technat@nc:~$ sudo cryptsetup luksOpen /dec/sdb1 cryptlvm

Enter passphrase for /dev/sdb1:
technat@nc:~$ lsblk
NAME     MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
sda        8:0    0 38.1G  0 disk
├─sda1     8:1    0   38G  0 part  /
├─sda14    8:14   0    1M  0 part
└─sda15    8:15   0  122M  0 part  /boot/efi
sdb        8:16   0   10G  0 disk
└─sdb1     8:17   0   10G  0 part
  └─data 253:0    0   10G  0 crypt
sr0       11:0    1 1024M  0 rom

technat@nc:~$ sudo dd bs=512 count=4 if=/dev/random of=/keyfile iflag=fullblock
4+0 records in
4+0 records out
2048 bytes (2.0 kB, 2.0 KiB) copied, 0.000119724 s, 17.1 MB/s

technat@nc:~$ sudo chmod 400 /keyfile

technat@nc:~$ sudo cryptsetup luksAddKey /dev/sdb1 /keyfile
Enter any existing passphrase:

technat@nc:~$ sudo cryptsetup status cryptlvm
/dev/mapper/data is active.
  type:    LUKS2
  cipher:  aes-xts-plain64
  keysize: 512 bits
  key location: keyring
  device:  /dev/sdb1
  sector size:  512
  offset:  32768 sectors
  size:    20936671 sectors
  mode:    read/write

sudo pvcreate /dev/mapper/cryptlvm
sudo vgcreate data /dev/mapper/cryptlvm
sudo lvcreate data -n nc -l 100%FREE
echo '/dev/data/nc /data ext4 defaults 0 1' | sudo tee -a /etc/fstab
sudo mkfs.ext4 /dev/data/nc
sudo mkdir /data

technat@nc:~$ echo "cryptlvm /dev/sdb1 /keyfile" |sudo tee -a /etc/crypttab

sudo apt install fail2ban -y

sudo apt-get install postgresql -y

sudo systemctl start postgresql
sudo systemctl stop postgresql
sudo systemctl restart postgresql

CREATE USER "www-data" CREATEDB;
CREATE DATABASE ncdb OWNER "www-data";
\q

sudo apt install apt-transport-https lsb-release ca-certificates wget -y
sudo wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" |sudo tee /etc/apt/sources.list.d/php.list
sudo apt update

sudo apt install php8.0-fpm -y
sudo apt install php8.0-curl php8.0-gd php8.0-mbstring php8.0-xml php8.0-zip php8.0-opcache php8.0-pdo php8.0-intl php8.0-gmp php8.0-imagick php8.0-bcmath php8.0-bz2 php8.0-pgsql -y
sudo apt install libmagickcore-6.q16-6-extra -y # if warning Module php-imagick in this instance has no SVG support. For better compatibility it is recommended to install it.

# configuration for PHP PostgreSQL module
#extension=pdo_pgsql.so
extension=pgsql.so

[PostgresSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0

sudo usermod -aG postgres www-data

[nextcloud]
listen = /var/run/php8.0-fpm-nextcloud.sock
user = www-data
group = www-data
listen.owner = www-data
listen.group = www-data
; php.ini overrides
php_admin_value[disable_functions] = passthru,system
php_admin_value[memory_limit] = 512M
php_admin_value[upload_max_filesize] = 32G
php_admin_value[post_max_size] = 32G
php_admin_value[date.timezone] = Europe/Zurich
php_admin_flag[allow_url_fopen] = off
php_admin_value[redis.session.locking_enabled] = 1
php_admin_value[redis.session.lock_retries] = -1
php_admin_value[redis.session.lock_wait_time] = 10000
php_admin_value[session.save_handler] = redis
php_admin_value[session.save_path] = "unix:///var/run/redis/redis-server.sock"
php_admin_value[opcache.interned_strings_buffer] = 128
; Choose how the process manager will control the number of child processes.
pm = dynamic
pm.max_children = 200
pm.start_servers = 16
pm.min_spare_servers = 15
pm.max_spare_servers = 30
pm.process_idle_timeout = 10s
; some environment variables
env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp

sudo apt install nginx -y

sudo apt install certbot python3-certbot-nginx -y
sudo certbot certonly --nginx -d cloud.technat.ch --agree-tos -m root@technat.ch

# Ref: https://doc.nextcloud.com/server/latest/admin_manual/installation/nginx.html

upstream php-handler {
    server unix:/var/run/php8.0-fpm-nextcloud.sock;
}

server {
    listen 80;
    listen [::]:80;
    server_name cloud.technat.ch;
    server_tokens off;

    # Enforce HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443      ssl http2;
    listen [::]:443 ssl http2;
    server_name technat.ch;
    server_tokens off;

    # Use Mozilla's guidelines for SSL/TLS settings
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
    ssl_certificate     /etc/letsencrypt/live/cloud.technat.ch/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.technat.ch/privkey.pem;

    # TLS settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM;

    # HSTS settings
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;

    # set max upload size and increase upload timeout:
		client_max_body_size 32G;
    client_body_timeout 300s;
		fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;


		# Pagespeed is not supported by Nextcloud, so if your server is built
		# with the `ngx_pagespeed` module, uncomment this line to disable it.
		#pagespeed off;

		# HTTP response headers borrowed from Nextcloud `.htaccess`
		add_header Referrer-Policy                      "no-referrer"   always;
		add_header X-Content-Type-Options               "nosniff"       always;
		add_header X-Download-Options                   "noopen"        always;
		add_header X-Frame-Options                      "SAMEORIGIN"    always;
		add_header X-Permitted-Cross-Domain-Policies    "none"          always;
		add_header X-Robots-Tag                         "none"          always;
		add_header X-XSS-Protection                     "1; mode=block" always;

		# Remove X-Powered-By, which is an information leak
		fastcgi_hide_header X-Powered-By;

		# Path to the root of your installation
		root /var/www/cloud.technat.ch;

		# Specify how to handle directories -- specifying `/index.php$request_uri`
		# here as the fallback means that Nginx always exhibits the desired behaviour
		# when a client requests a path that corresponds to a directory that exists
		# on the server. In particular, if that directory contains an index.php file,
		# that file is correctly served; if it doesn't, then the request is passed to
		# the front-end controller. This consistent behaviour means that we don't need
		# to specify custom rules for certain paths (e.g. images and other assets,
		# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
		# `try_files $uri $uri/ /index.php$request_uri`
		# always provides the desired behaviour.
		index index.php index.html /index.php$request_uri;

		# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
		location = / {
				if ( $http_user_agent ~ ^DavClnt ) {
						return 302 /remote.php/webdav/$is_args$args;
				}
		}

		location = /robots.txt {
				allow all;
				log_not_found off;
				access_log off;
		}

		# Make a regex exception for `/.well-known` so that clients can still
		# access it despite the existence of the regex rule
		# `location ~ /(\.|autotest|...)` which would otherwise handle requests
		# for `/.well-known`.
		location ^~ /.well-known {
				# The rules in this block are an adaptation of the rules
				# in `.htaccess` that concern `/.well-known`.

				location = /.well-known/carddav { return 301 /remote.php/dav/; }
				location = /.well-known/caldav  { return 301 /remote.php/dav/; }

				location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
				location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

				# Let Nextcloud's API for `/.well-known` URIs handle all other
				# requests by passing them to the front-end controller.
				return 301 /index.php$request_uri;
		}

		# Rules borrowed from `.htaccess` to hide certain paths from clients
		location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
		location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

		# Ensure this block, which passes PHP files to the PHP process, is above the blocks
		# which handle static assets (as seen below). If this block is not declared first,
		# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
		# to the URI, resulting in a HTTP 500 error response.
		location ~ \.php(?:$|/) {
        # Required for legacy support
        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

				fastcgi_split_path_info ^(.+?\.php)(/.*)$;
				set $path_info $fastcgi_path_info;

				try_files $fastcgi_script_name =404;

				include fastcgi_params;
				fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
				fastcgi_param PATH_INFO $path_info;
				fastcgi_param HTTPS on;

				fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
				fastcgi_param front_controller_active true;     # Enable pretty urls
				fastcgi_pass php-handler;

				fastcgi_intercept_errors on;
				fastcgi_request_buffering off;
		}

		location ~ \.(?:css|js|svg|gif|png|jpg|ico)$ {
				try_files $uri /index.php$request_uri;
				expires 6M;         # Cache-Control policy borrowed from `.htaccess`
				access_log off;     # Optional: Don't log access to assets

        location ~ \.wasm$ {
            default_type application/wasm;
        }
		}

		location ~ \.woff2?$ {
				try_files $uri /index.php$request_uri;
				expires 7d;         # Cache-Control policy borrowed from `.htaccess`
				access_log off;     # Optional: Don't log access to assets
		}

		# Rule borrowed from `.htaccess`
		location /remote {
				return 301 /remote.php$request_uri;
		}

		location / {
				try_files $uri $uri/ /index.php$request_uri;
		}
}

sudo ln -s /etc/nginx/sites-available/cloud.technat.ch /etc/nginx/sites-enabled/cloud.technat.ch
sudo rm /etc/nginx/sites-enabled/default
sudo systemctl restart nginx

sudo apt install redis-server php8.0-redis -y

sudo usermod -a -G redis www-data
sudo systemctl restart redis

sudo zip -r cloud.technat.ch.zip /var/www/cloud.technat.ch/

sudo chown -R www-data:www-data /var/www/cloud.technat.ch
sudo chmod -R 770 /var/www/cloud.technat.ch

sudo chown -R www-data:www-data /data/nc
sudo chmod -R 770 /data/nc

'default_phone_region' => 'CH',

'simpleSignUpLink.shown' => false,

*/5  *  *  *  * php -f /var/www/cloud.technat.ch/cron.php

sudo -i -u postgres psql -c "CREATE DATABASE onlyoffice;"
sudo -i -u postgres psql -c "CREATE USER onlyoffice WITH password 'password_here';"
sudo -i -u postgres psql -c "GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;"

sudo apt-get install rabbitmq-server -y

sudo certbot certonly --nginx -d doc.technat.ch --agree-tos -m root@technat.ch

cd /etc/ssl/certs/
openssl dhparam -out dhparam.pem 4096

sudo apt install gnupg2
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys CB2DE8E5
echo "deb https://download.onlyoffice.com/repo/debian squeeze main" | sudo tee /etc/apt/sources.list.d/onlyoffice.list
sudo apt-get update
sudo apt-get install onlyoffice-documentserver -y

cd /etc/onlyoffice/documentserver/nginx/
sudo cp ds-ssl.conf.tmpl ds.conf

{
  "services": {
    "CoAuthoring": {
      "token": {
        "enable": {
          "request": {
            "inbox": true,
            "outbox": true
          },
          "browser": true
        }
      },
      "secret": {
        "inbox": {
          "string": "secret_key"
        },
        "outbox": {
          "string": "secret_key"
        },
        "session": {
          "string": "secret_key"
        }
      }
    }
  }
}

sudo apt-get install ttf-mscorefonts-installer
sudo apt install wget cabextract fontforge
wget https://gist.githubusercontent.com/tavinus/1a92c79d790657d5b66546996dd006b9/raw/ttf-vista-fonts-installer.sh -q -O - | sudo bash
sudo /usr/bin/documentserver-generate-allfonts.sh