On a clean Debian 10 install type the following
apt-get install apache2 mariadb-server libapache2-mod-php7.2
apt-get install php7.2-gd php7.2-json php7.2-mysql php7.2-curl php7.2-mbstring
apt-get install php7.2-intl php-imagick php7.2-xml php7.2-zip
download the latest versnion from https://nextcloud.com/install/#instructions-server for example:
wget https://download.nextcloud.com/server/releases/nextcloud-17.0.1.tar.bz2
after just decompress the file
tar -xjf nextcloud-17.0.1.tar.bz2
Then copy the installation files to the root of the webserver
cp -r nextcloud /var/www
Please note when you are running the Apache HTTP server you may safely install Nextcloud in your Apache document root!
Give read/write access to web server on the new folder
chown -R www-data:www-data /var/www/nextcloud/
create a configuration file for nextcloud in Apache
pico /etc/apache2/sites-available/nextcloud.conf
with the following content
Alias /nextcloud "/var/www/nextcloud/"
<Directory /var/www/nextcloud/>
Require all granted
Options FollowSymlinks MultiViews
AllowOverride All
<IfModule mod_dav.c>
Dav off
</IfModule>
SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>
enable it by issuing
a2ensite nextcloud.conf
enable some needed modules
a2enmod rewrite
a2enmod headers
a2enmod env
a2enmod dir
a2enmod mime
and do not forget to restart Apache
systemctl reload apache2
Now before we go ahead lets prepare MariaDB
systemctl start mariadb
mysql_secure_installation
and after that
mysql
MariaDB> use mysql;
MariaDB> update user set plugin='' where User='root';
MariaDB> flush privileges;
MariaDB> quit
Now you can login to mysql only with the -p option and the password you setup in the previous step. I strongly suggest to setup a user for nextcloud database. Do not use root to create the database.
mysql -u root -p
CREATE USER 'next'@'localhost' IDENTIFIED BY 'YourPassword';
CREATE DATABASE nextcloud;
GRANT ALL ON press.* TO next@localhost; FLUSH PRIVILEGES; exit;
After that you are pretty much ready to go. Head to the http://IP/nextcloud and follow the steps.
An optional but important step (which I strongly advice to follow is to enable https by default. This will encrypt the communication. To do that we will use Let’sEncrypt.
a2enmod rewrite ssl
nano /etc/apache2/sites-available/default-ssl.conf
SSLProtocol all -SSLv2 -SSLv3
Add SSL Cipher in one long line
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder on
SSLOptions +StrictRequire
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
This will enable ssl on Apache and then you have to add the ciphers to support along with some more security enhancements
Install the certbot. It will do most of the job for you.
apt-get -y install certbot
apt-get -y install python-certbot-apache
certbot --authenticator webroot --installer apache
crontab -e
0 2 * * * certbot renew >> /var/log/letsencrypt.log
That’s it! You are done.
