NextCloud Installation Q & A

    • OMV 3.x

    • We not suppose to turn on the PHP default config.


      @FixXx,

      Apparently, I have the same issue when I ran the test on sslabs.com.

      Another issue is : This server supports weak Diffie-Hellman (DH) key exchange parameters.

      Solution:

      Note: This process may takes 15 to 30 mins depends on your service specs.

      1. Go to and run:

      Source Code

      1. cd /etc/ssl/certs
      2. openssl dhparam -out dhparam.pem 4096

      2. Add this line at the beginning of the vhost config:

      ssl_dhparam /etc/ssl/certs/dhparam.pem;
      OMV v4.0
      Asus Z97-A/3.1; i3-4370
      32GB RAM Corsair Vengeance Pro
      4x3TB RAID10

      The post was edited 4 times, last by tinh_x7 ().

    • tinh_x7 wrote:

      We not suppose to turn on the PHP default config.


      @FixXx,

      Apparently, I have the same issue when I ran the test on sslabs.com.

      Another issue is : This server supports weak Diffie-Hellman (DH) key exchange parameters.

      Solution:

      Note: This process may takes 15 to 30 mins depends on your service specs.

      1. Go to and run:

      Source Code

      1. cd /etc/ssl/certs
      2. openssl dhparam -out dhparam.pem 4096
      2. Add this line at the beginning of the vhost config:

      ssl_dhparam /etc/ssl/certs/dhparam.pem;
      I have no problem with the ssllabs score. I got A+, 100 in every category... thx to this excellent documentation.

      My main problem is the reported /login loop. I've used the vanilla nextcloud13 config to sort the problem out. The config works after i made the common changes (server, cert, root, $socket) but the redirect loop persists.

      Do you - does anyone - have an idea what the reason could be? Is there someone out there with omv4+nc13 installation and without redirect loop reported by ssllabs?

    • FixXx wrote:


      Is there someone out there with omv4+nc13 installation and without redirect loop reported by ssllabs?
      Yes, it works on my system. omv 4 + nc13 but i have installed 12.0.x and updated to nc13.
      omv 4.0.19 | 64 bit | omvextrasorg 4.1.2 | kernel 4.14
      used plugins: nginx | mysql | docker-gui |rsnapshot | antivirus | apt tool | letsEncrypt |
      used other: netxtcloud | logitechmediaserver | emby

    • happyreacer wrote:

      FixXx wrote:

      Is there someone out there with omv4+nc13 installation and without redirect loop reported by ssllabs?
      Yes, it works on my system. omv 4 + nc13 but i have installed 12.0.x and updated to nc13.
      Can you please post your nginx config?

      tinh_x7 wrote:

      I don't know why there is HTTP redirect loop.

      Can you share your vhost config ?

      My current config is based on the official Nextcloud sample. Basically I only added security settings and the omv-generated $socket.

      Source Code

      1. upstream php-handler {
      2. server 127.0.0.1:9000;
      3. #server unix:/var/run/php5-fpm.sock;
      4. }
      6. server {
      7. listen 80;
      8. listen [::]:80;
      9. server_name my.domain.com;
      10. # enforce https
      11. return 301 https://$server_name$request_uri;
      12. }
      14. server {
      15. listen 443 ssl http2;
      16. listen [::]:443 ssl http2;
      17. server_name my.domain.com;
      19. ssl_certificate /etc/ssl/certs/cert.crt;
      20. ssl_certificate_key /etc/ssl/priv.key;
      22. # Add headers to serve security related headers
      23. # Before enabling Strict-Transport-Security headers please read into this
      24. # topic first.
      25. # add_header Strict-Transport-Security "max-age=15768000;
      26. # includeSubDomains; preload;";
      27. #
      28. # WARNING: Only add the preload option once you read about
      29. # the consequences in https://hstspreload.org/. This option
      30. # will add the domain to a hardcoded list that is shipped
      31. # in all major browsers and getting removed from this list
      32. # could take several months.
      33. add_header X-Content-Type-Options nosniff;
      34. add_header X-XSS-Protection "1; mode=block";
      35. add_header X-Robots-Tag none;
      36. add_header X-Download-Options noopen;
      37. add_header X-Permitted-Cross-Domain-Policies none;
      39. set $socket "unix:/var/run/fpm-b4f19467-563b-4681-b8e4-582ee046726b.sock";
      41. # Path to the root of your installation
      42. root /path/to/nextcloud/;
      44. # Set HTTP Strict Transport Security (HSTS) to 365 days
      45. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
      46. ## Key Exchange Settings
      47. # Use self generated Diffie-Hellman parameter for DHE ciphersuites
      48. ssl_dhparam /etc/ssl/dhparams4096.pem;
      49. ssl_ecdh_curve secp384r1;
      50. # Session resumption
      51. ssl_session_timeout 1d;
      52. ssl_session_cache shared:SSL:50m;
      53. ssl_session_tickets off;
      54. # OCSP stapling
      55. ssl_stapling on;
      56. ssl_stapling_verify on;
      57. resolver 8.8.8.8 8.8.4.4;
      58. ssl_trusted_certificate /etc/letsencrypt/live/my.domain.com/chain.pem;
      59. # modern cipher configuration
      60. ssl_protocols TLSv1.2;
      61. ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384';
      62. ssl_prefer_server_ciphers on;
      64. location = /robots.txt {
      65. allow all;
      66. log_not_found off;
      67. access_log off;
      68. }
      70. # The following 2 rules are only needed for the user_webfinger app.
      71. # Uncomment it if you're planning to use this app.
      72. #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
      73. #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
      74. # last;
      76. location = /.well-known/carddav {
      77. return 301 $scheme://$host/remote.php/dav;
      78. }
      79. location = /.well-known/caldav {
      80. return 301 $scheme://$host/remote.php/dav;
      81. }
      83. # set max upload size
      84. client_max_body_size 512M;
      85. fastcgi_buffers 64 4K;
      87. # Enable gzip but do not remove ETag headers
      88. gzip on;
      89. gzip_vary on;
      90. gzip_comp_level 4;
      91. gzip_min_length 256;
      92. gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
      93. gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
      95. # Uncomment if your server is build with the ngx_pagespeed module
      96. # This module is currently not supported.
      97. #pagespeed off;
      99. location / {
      100. rewrite ^ /index.php$uri;
      101. }
      103. location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
      104. deny all;
      105. }
      106. location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
      107. deny all;
      108. }
      110. location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
      111. fastcgi_split_path_info ^(.+\.php)(/.*)$;
      112. include fastcgi_params;
      113. fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      114. fastcgi_param PATH_INFO $fastcgi_path_info;
      115. fastcgi_param HTTPS on;
      116. #Avoid sending the security headers twice
      117. fastcgi_param modHeadersAvailable true;
      118. fastcgi_param front_controller_active true;
      119. fastcgi_pass $socket;
      120. fastcgi_intercept_errors on;
      121. fastcgi_request_buffering off;
      122. }
      124. location ~ ^/(?:updater|ocs-provider)(?:$|/) {
      125. try_files $uri/ =404;
      126. index index.php;
      127. }
      129. # Adding the cache control header for js and css files
      130. # Make sure it is BELOW the PHP block
      131. location ~ \.(?:css|js|woff|svg|gif)$ {
      132. try_files $uri /index.php$uri$is_args$args;
      133. add_header Cache-Control "public, max-age=15778463";
      134. # Add headers to serve security related headers (It is intended to
      135. # have those duplicated to the ones above)
      136. # Before enabling Strict-Transport-Security headers please read into
      137. # this topic first.
      138. # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
      139. #
      140. # WARNING: Only add the preload option once you read about
      141. # the consequences in https://hstspreload.org/. This option
      142. # will add the domain to a hardcoded list that is shipped
      143. # in all major browsers and getting removed from this list
      144. # could take several months.
      145. add_header X-Content-Type-Options nosniff;
      146. add_header X-XSS-Protection "1; mode=block";
      147. add_header X-Robots-Tag none;
      148. add_header X-Download-Options noopen;
      149. add_header X-Permitted-Cross-Domain-Policies none;
      150. # Optional: Don't log access to assets
      151. access_log off;
      152. }
      154. location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
      155. try_files $uri /index.php$uri$is_args$args;
      156. # Optional: Don't log access to other assets
      157. access_log off;
      158. }
      159. }
      Display All

      The post was edited 1 time, last by FixXx ().

    • I have OMV version 3.0.99 and I have followed NC installation instrustions (with variation for net install) but I am sucked on step 7, when i type in browser 192.168.1.27:81/setup-nextcloud.php i get 404 Not Found as some other users and problem havent been solved. The log error:

      2018/04/11 15:36:27 [error] 2294#0: *2004 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 192.168.1.100, server: ,request: "GET /setup-nextcloud.php HTTP/1.1", upstream: "fastcgi://unix:/run/fpm-32a2476e-7999-4df4-99b9-53432153b9b2.sock:", host: "192.168.1.27:81"

      if I use Firefox and with Qupzilla I get:

      2018/04/11 14:34:04 [crit] 2292#0: *1057 stat() "/srv/dev-disk-by-id-md-name-openmediavault-0/www/nextcloud/favicon.ico" failed (13: Permission denied), client: 192.168.1.100, server: , request: "GET /favicon.ico HTTP/1.1", host: "192.168.1.27:81", referrer: "http://192.168.1.27:81/setup-nextcloud.php"
      and
      2018/04/11 14:34:04 [error] 2292#0: *1057 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 192.168.1.100, server: , request: "GET /favicon.ico HTTP/1.1", upstream: "fastcgi://unix:/run/fpm-32a2476e-7999-4df4-99b9-53432153b9b2.sock:", host: "192.168.1.27:81", referrer: "http://192.168.1.27:81/setup-nextcloud.php"

      i have found this link which says that: To resolve "Primary script unknown" problem:

      if you see "GET /" without a correct php file name, then it's your nginx conf problem.
      if you see "GET /app.php" with 404, it means nginx is correctly passing the script file name but php-fpm failed to access this file (user "php-fpm:php-fpm" don't have access to your file, which trapped me for 3 hours)

      Knowing almost nothing about anything I went and chect processes for my OMV:
      23010 root 20 0 304272 25608 20436 S 0.0 1.3 0:00.12 php5-fpm
      23013 www-data 20 0 304224 10480 5292 S 0.0 0.5 0:00.00 php5-fpm
      23014 www-data 20 0 304224 10480 5292 S 0.0 0.5 0:00.00 php5-fpm
      23015 www-data 20 0 304224 8596 3424 S 0.0 0.4 0:00.00 php5-fpm
      23016 www-data 20 0 304224 8596 3424 S 0.0 0.4 0:00.00 php5-fpm
      23017 www-data 20 0 304224 8596 3424 S 0.0 0.4 0:00.00 php5-fpm
      23018 www-data 20 0 304224 8596 3424 S 0.0 0.4 0:00.00 php5-fpm
      23019 999 20 0 306460 19176 11508 S 0.0 0.9 0:18.31 php5-fpm
      23217 999 20 0 305928 17804 10924 S 0.0 0.9 0:00.25 php5-fpm
      23219 999 20 0 305928 17804 10924 S 0.0 0.9 0:00.26 php5-fpm

      php5-fpm has been run by 3 userrs and I dont know if it should be like that and which of them is trying to access NC folder.
      Where user 999 is openmediavault-config:x:999:openmediavault-webgui and has no access to NextCloud directory.

      This post may look unfinished, so is my NC installation.

      The post was edited 1 time, last by kole ().

    • It's in the config.php in your NextCloud dir.

      Source Code

      1. 'trusted_domains' =>
      3. array (
      5. 0 => '192.168.1.12',
      7. 1 => 'abc.dfe.com',
      9. 2 => 'localhost',
      11. ),
      13. 'datadirectory' => '/srv/dev-disk-by-label-Data/www/nextcloud/data',
      15. 'overwrite.cli.url' => 'https://abc.dfe.com',
      Display All
      OMV v4.0
      Asus Z97-A/3.1; i3-4370
      32GB RAM Corsair Vengeance Pro
      4x3TB RAID10

    • tinh_x7 wrote:

      It's in the config.php in your NextCloud dir.

      Source Code

      1. 'trusted_domains' =>
      3. array (
      5. 0 => '192.168.1.12',
      7. 1 => 'abc.dfe.com',
      9. 2 => 'localhost',
      11. ),
      13. 'datadirectory' => '/srv/dev-disk-by-label-Data/www/nextcloud/data',
      15. 'overwrite.cli.url' => 'https://abc.dfe.com',
      Display All
      I've tried so, but it doesn't work. In my opinion the port on which nc is listening to must be mentioned as well?

    • Stramm wrote:

      wouterve wrote:

      How could you point to nextcloud through an addition to your url?

      Eg:
      openmediavault: domain.com (port 443)
      nextcloud: domain.com/nextcloud (port 8443)

      (not sure whether separate ports are necessary but I think so)
      You change the port in the nginx config (nginx plugin -> server tab)
      Could you be more precise? I see you can choose between 'port based' or 'name based', should i choose the latter and give it the name "nextcloud"?

    • New

      I'm receiving this error upon enabling ssl:

      Display Spoiler

      Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C; nginx -t 2>&1' with exit code '1': nginx: [warn] server name "mydomain/cloud" has suspicious symbols in /etc/nginx/sites-enabled/zzz-omv-nginx:6 nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/private/openmediavault-9ce86383-82b4-4302-bde6-898b8c32e30d.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) nginx: configuration file /etc/nginx/nginx.conf test failed
      ut #0: exception 'OMV\ExecException' with message 'Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C; nginx -t 2>&1' with exit code '1': nginx: [warn] server name "mydomain/cloud" has suspicious symbols in /etc/nginx/sites-enabled/zzz-omv-nginx:6 nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/private/openmediavault-9ce86383-82b4-4302-bde6-898b8c32e30d.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) nginx: configuration file /etc/nginx/nginx.conf test failed' in /usr/share/php/openmediavault/system/process.inc:175 Stack trace: #0 /usr/share/openmediavault/engined/module/webserver.inc(40): OMV\System\Process->execute() #1 /usr/share/openmediavault/engined/rpc/config.inc(168): OMVModuleNginxAbstract->applyConfig() #2 [internal function]: OMVRpcServiceConfig->applyChanges(Array, Array) #3 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array(Array, Array) #4 /usr/share/php/openmediavault/rpc/serviceabstract.inc(150): OMV\Rpc\ServiceAbstract->callMethod('applyChanges', Array, Array) #5 /usr/share/php/openmediavault/rpc/serviceabstract.inc(528): OMV\Rpc\ServiceAbstract->OMV\Rpc\{closure}('/tmp/bgstatusfD...', '/tmp/bgoutput5O...') #6 /usr/share/php/openmediavault/rpc/serviceabstract.inc(151): OMV\Rpc\ServiceAbstract->execBgProc(Object(Closure)) #7 /usr/share/openmediavault/engined/rpc/config.inc(213): OMV\Rpc\ServiceAbstract->callMethodBg('applyChanges', Array, Array) #8 [internal function]: OMVRpcServiceConfig->applyChangesBg(Array, Array) #9 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array(Array, Array) #10 /usr/share/php/openmediavault/rpc/rpc.inc(86): OMV\Rpc\ServiceAbstract->callMethod('applyChangesBg', Array, Array) #11 /usr/sbin/omv-engined(536): OMV\Rpc\Rpc::call('Config', 'applyChangesBg', Array, Array, 1) #12 {main}

    • Users Online 7

      7 Guests