thank you both very much! That's a good starting point. Then I will have a look at Docker and LAMP/LEMP the next days.
According to YT comments on Techno Dad Life channel he may make a video about nc and docker.
I hope he does. I am a new OpenMediaVault user and his videos have been very very helpful!
Hi Folks
New to OMV myself after running XPenology on a N54L for a while, I too have spent a few nights trying and googling some sort of guide to install NextCloud via Docker on OMV 4.
Anyone got any tips or knock up a bit of a guide? I've even left a comment for Techno Dad Life too! I just cant get it to run.
I hope he does. I am a new OpenMediaVault user and his videos have been very very helpful!
in the meantime i completely switched to netcloud. https://ownyourbits.com/nextcloudpi/very simple to install and its secure!
there i have smb,nfs, failtoban, letsencrypt....
For me and my odroid hc2 it is the best way.
Happy to install it directly if that is easier, any advice/tips?
Your guide didn't really work step by step for OMV4 & NC 13, but it is referenced in many posts from my research so good on you for your comprehensive work. The wider community has benefited greatly!!
I've managed to get it all working using a combination of sites and info, i will try and detail below, i am no expert in linux but have been a hobbyist for some time, so please feel free to correct or question anything, but this is what worked for me. Hope these breadcrumbs may help someone else.
1. Install OMV and plugins as per Techno Dad Life -
2. Install PHP7 and related packages
apt install php7.0 libapache2-mod-php7.0 php7.0-common php7.0-gd php7.0-json php7.0-mysql php7.0-curl php7.0-mbstring php7.0-intl php7.0-mcrypt php7.0-imagick php7.0-xml php7.0-zip
3. Install Nextcloud and config/prep in OMV as per section from - http://wiki.pine64.org/index.php/OpenMediaVault
4. Somewhere in the NC setup, i had to log in as admin user, but it didn't work. Tried creating a new "nextcloud" user in mysql and granted permissions, still didnt work. In the end, found somewhere to login as "omvadmin" for initial NC login when creating the databases etc. and it worked a treat.Cheers everyone, keep up the good work and communications!
3. Install Nextcloud and config/prep in OMV as per section from - http://wiki.pine64.org/index.php/OpenMediaVault4.
4. Somewhere in the NC setup, i had to log in as admin user, but it didn't work. Tried creating a new "nextcloud" user in mysql and granted permissions, still didnt work. In the end, found somewhere to login as "omvadmin" for initial NC login when creating the databases etc. and it worked a treat.Cheers everyone, keep up the good work and communications!
nice, sound good! Maybee i give it a try.
The Link has no copntent? -->There is currently no text in this page.....
I hope we will se a updated guide for OMV4 & NC 13 
I fixed the link up in my previous post, not sure where the number 4 came from at the end.
I'll paste the info below just incase.
Reference: https://forum.openmediavault.org/index.php/Thread/17738-NextCloud-Installation/
1. SSH to the device
# apt-get update
# apt-get upgrade
- Configuring openmediavault => Press [Tab] => Press [Enter] on Ok
# apt-get install php5-curl php5-gd
2. Create the Shared Folders for all your Nginx's web pages
- Name: www
- Path: www/
- Click on the ACL
- User/Groups permissions: Tick Read/Write for both www-data user and group
- Set Owner / Group to Read/Write/Execute and Others to None
3. Create the sub shared folder for your NextCloud web pages
- Name: nextcloud
- Path: www/nextcloud
- Click on the ACL
- User/Groups permissions: Tick Read/Write for both www-data user and group
- Set Owner / Group to Read/Write/Execute and Others to None
4. Go to System => Plugins => Tick openmediavault-nginx => Install
5. Services => Nginx => Settings => Enable => Save => Apply
6. Services => Nginx => Pools => Add
- Name: pool_nextcloud
- User: www-data
- Group: www-data
- Extra options: <<<Copy Texts In Between ########## Below>>>
##########
clear_env = no
env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp
##########
- Save => Apply
7. Services => Nginx => Servers => Add
- General
- Directory: nextcloud
- SSL
- Enable SSL: Enable
- Port: 91
- Certificate: <<<Select Created SSL Certificate>>>
- System => Certificates => SSL => Add => Create (Set longer "Period of validity" if you do not want to renew the certificate too frequently) => Save => Apply
- Only use SSL: Enable
- PHP
- Enable PHP: Enable
- PHP-FPM Pool: pool_nextcloud
- Extra options: <<<Copy Texts In Between ########## Below>>>
##########
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
location = /robots.txt {
log_not_found off;
allow all;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 50G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass $socket;
fastcgi_intercept_errors on;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=7200";
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}
##########
8. Go to System => Plugins => Tick openmediavault-mysql => Install
9. Services => MySQL => Enable => Save => Apply
=> Reset Password
10. Go to https://nextcloud.com/ => Download => Get Nextcloud Server => Download => Web Installer (Bottom Tab) => Download setup-nextcloud.php to your PC
11. Use FTP/SAMBA/etc to transfer setup-nextcloud.php to www/nextcloud/
12. Go to https://<<<DEVICE_IP>>>:91/setup-nextcloud.php
- Please add exception for the self-signed certificate if your browser prompt you to do so
- Next
- Dependency check: Enter a single "." => Next
- Wait until: 504 Gateway Time-out
13. Go to https://<<<DEVICE_IP>>>:91/ (Retry again if you get 404)
- Click on Storage & database => MySQL/MariaDB
- Database user: root
- Database password: <<<Password Reset On Step #10>>>
- Database name: nextcloud
- Database host: localhost
- Finish setup
14. Services => Nginx => Servers => Edit
- PHP => Default config: Disable
15. Go to https://<<<DEVICE_IP>>>:91/
16. If installation failed on step #12 onwards:
- Remove all the folders/files/hidden files in www/nextcloud/* through FTP/SAMBA/etc (Note that, removing 13,000+ files may take a while)
- Services => MySQL => SQL management site => Enable => Save => Apply => Show
- Tools => Database Manager => tick "nextcloud" and "DROP selected databases" => Submit
- Start over again from step #12
17. Setup the Dynamic DNS if you need to access your NextCloud through internet. Then, on your internet modem/router: Port Forward to the device with port 91Since update to 13.0.4 I get
X-Content-Type-Options
The X-Content-Type-Options response header forbids browsers to guess the Content-Type of a file, this prevents so called "MIME confusion attacks".
X-XSS-Protection
The X-XSS-Protection response header prevents browsers from loading a page when they detect a reflected Cross-Site Scripting attack. While not really required anymore for up-to-date browsers this is a decent security hardening for older browsers.
X-Download-Options
The X-Download-Options response header instructs Internet Explorer not to open the file directly but to offer it for download first. This mitigates some potential Social Engineering attacks.
X-Permitted-Cross-Domain-Policies
The X-Permitted-Cross-Domain-Policies response header instructs Adobe software on how to handle cross-domain policies. This provides a decent security hardening as it restricts Adobe Flash Player's access to data.
by security-check of nextcloud. My nginx-setting looks like this:
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
location = /robots.txt {
log_not_found off;
allow all;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 50G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
fastcgi_intercept_errors on;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=7200";
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}all the headers the security scan claims not to be set are set, so whats wrong with it?
have you tried to change
fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;to
fastcgi_pass $socket;here's my working version:
you need to adapt server_name to your domain. And in contraty to your settings gzip is enabled.
server_name your.domain.name;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 10G;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass $socket;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~ \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=15778463";
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
# add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}By default, Nextcloud version 13.x already setup it's security configuration in .htaccess and php.
So check your header security options with a web developer tool or by using an online service such as https://tools.geekflare.com/tools/x-frame-options-test and check if you get something like x-frame-options SAMEORIGIN, SAMEORIGIN
If so, the directive was setup twice and you have to remove it from your site Nginx configuration, just put an # at the begging of the script above...
Bye
Random post here...lol.. I cant be bothered going back through all the pages...lol
I have a working installation of Nextcloud in Nginx on omv3 and omv4. I had to fix the Extra Options code.
From memory I had to remove the line below as its listed twice.
add_header X-Frame-Options "SAMEORIGIN";
I think there was some other things I fixed too, it was a while ago..lol
Let me know if anyone would like me to post some of my notes/fixes.
Baldman
Removing
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";from the top of my configuration gives me a positive check on nextcloud security scan online, but my nextcloud instace now complains the missing headers. So which one is right? What would be the correct setting?
have you tried my version? Do you get same results with it? I've taken it from the official NC 13.0 instructions.
Hey guys,
the tutorial is great, it's actually all I need for my personal use as a newbie on all of this, thanks to all who put so much effort in that and in answering all these questions.
I hope you can help me too finding the root problem, I can't get NC setup starting. I followed the tutorial here, but NC setup won't start, it shows me:
404 Not Found
nginx/1.10.3
The error message I get, I couldn't copy from OMV GUI (how is that done?). So here is one of the errors in the log from nginx - servers:
Repro steps:
- OMV 4.1.3 installed, is now updated to 4.1.8.2-1
- OMV port: 80, no SSL activated yet, so no certificates and stuff
- followed the tutorial
- did it over and over, activated nginx first, then did the configurations of pool and server
- nginx port: 90, no SSL activated
Questions:
- the sharedfolders config done as told in 1c of the tutorial leads to weird looking path in nginx - servers - path field. Is that correct and intended by the tutorial? Because I always read about "media/..." but I cant't find that on my OMV.
- if not correct, where could I do a different setup?
thanks a lot, for helping me troubleshooting this.
cheers!
hello,
I think that error meant incorrect socket or PHP-FPM option.
Double check your socket setting in the vhost config.
Try this:
Replace fastcgi_pass $socket with fastcgi_pass /run/php/php7.0-fpm.sock;
service nginx restart
service php7.0-fpm restart
Regarding the NC installation path: '/media' is for OMV3.
OMV4 is like your screenshot: /srv/dev-disk-by-label....
I can't update the tutorial due to the long instructions.
Regarding the NC installation path: '/media' is for OMV3.
OMV4 is like your screenshot: /srv/dev-disk-by-label....
Wow, great to hear, so that at least this is correct.
I fiddled around in this Q&A and found one of your posts, saying to try the owncloud configuration. With that configuration in place, I can call the NC setup.
Is that explainable? 
Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!