Add Nextcloud installation script for Ubuntu 20.04
This commit is contained in:
tar
parent
377856a793
commit
c02ee5f187
|
|
@ -0,0 +1,616 @@
|
|||
#!/bin/bash
|
||||
|
||||
#############################################################
|
||||
# Author: Taryel Hlontsi, 2022
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <https://www.gnu.org/licenses/>
|
||||
#############################################################
|
||||
|
||||
|
||||
#############################################################
|
||||
# SETUP SECTION, use "sudo su -- root"
|
||||
#############################################################
|
||||
|
||||
# if set to true, ssh login only with ssh key which must(!) be configured upfront
|
||||
NO_PASSWORD_SSH=true
|
||||
|
||||
# only if new user is required (root login won't be allowed anyway)
|
||||
OS_USER="ubuntu"
|
||||
OS_USER_PASSWORD="password_goes_here"
|
||||
|
||||
# change the IP. If domain is used then set it here as the server name
|
||||
OS_SERVER_NAME="nextcloud"
|
||||
OS_IP="127.0.0.1"
|
||||
|
||||
# database setup for the nexcloud web app
|
||||
NC_DB="nextcloud"
|
||||
NC_DB_USER="nextcloud"
|
||||
NC_DB_PASSWORD="qrsE1001^00000"
|
||||
|
||||
# account to log on to the nexcloud web app
|
||||
NC_ADMIN_USER="tar"
|
||||
NC_ADMIN_PASSWORD="password_goes_here"
|
||||
|
||||
# link for nextcloud, country is for ssl certificate and fixing some warnings
|
||||
NC_DOWNLOAD_URL="https://download.nextcloud.com/server/releases/latest.zip"
|
||||
NC_COUNTRY_CODE="PL"
|
||||
|
||||
# optional, but removes some warnings in nextcloud
|
||||
PHP_TIMEZONE="Europe/Warsaw"
|
||||
|
||||
# may be left as is
|
||||
LOG_DIR="/home"
|
||||
LOG="${LOG_DIR}/log.txt"
|
||||
|
||||
#############################################################
|
||||
# HELPER FUNCTIONS
|
||||
#############################################################
|
||||
trace() {
|
||||
PURPLE='\033[1;35m'
|
||||
NC='\033[0m'
|
||||
echo -e "${PURPLE}$1${NC}"
|
||||
echo -e "TRACE:\t$1" >> $LOG
|
||||
}
|
||||
|
||||
info() {
|
||||
GREEN='\033[1;32m'
|
||||
NC='\033[0m'
|
||||
echo -e "${GREEN}$1${NC}"
|
||||
echo -e "INFO:\t$1" >> $LOG
|
||||
}
|
||||
|
||||
warn() {
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
echo -e "${YELLOW}$1${NC}"
|
||||
echo -e "WARN:\t$1" >> $LOG
|
||||
}
|
||||
|
||||
error() {
|
||||
RED='\033[1;31m'
|
||||
NC='\033[0m'
|
||||
echo -e "${RED}$1${NC}"
|
||||
echo -e "ERROR:\t$1" >> $LOG
|
||||
}
|
||||
|
||||
not_set() {
|
||||
count=$(grep -Pcx "$1" "$2")
|
||||
code=$?
|
||||
if (( $code > 0 )) || (( $count == 0 )); then
|
||||
true
|
||||
else
|
||||
false
|
||||
fi
|
||||
}
|
||||
|
||||
not_exist() {
|
||||
if test ! -f "$2"; then
|
||||
warn "file does not exist: $2"
|
||||
true
|
||||
else
|
||||
count=$(grep -Pc "$1" "$2")
|
||||
code=$?
|
||||
if (( $code > 0 )) || (( $count == 0 )); then
|
||||
true
|
||||
else
|
||||
false
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure() {
|
||||
if not_exist "$1" "$3"; then
|
||||
warn "setting \"$1\" is not in the file, thus won't be changed"
|
||||
false
|
||||
else
|
||||
if not_set "$2" "$3"; then
|
||||
sed -i "s~.*${1}.*~${2}~gi" "$3" &&
|
||||
trace "\"$1\" set to \"$2\"" &&
|
||||
true
|
||||
else
|
||||
warn "\"$2\" already set in \"$3\""
|
||||
false
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configured() {
|
||||
count=$(grep -Pcx "$1" "$2")
|
||||
if (( $? > 0 )) || (( $count == 0 )); then
|
||||
false
|
||||
else
|
||||
true
|
||||
fi
|
||||
}
|
||||
|
||||
insert_before() {
|
||||
if not_set "$2" "$3"; then
|
||||
sed -i "\~.*${1}.*~i ${2}" "$3" &&
|
||||
trace "\"$1\" set to \"$2\"" &&
|
||||
true
|
||||
else
|
||||
warn "\"$2\" already set in \"$3\""
|
||||
false
|
||||
fi
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 1 - ADD USER
|
||||
#############################################################
|
||||
add_user() {
|
||||
info "STEP 1 Adding a user"
|
||||
|
||||
adduser --disabled-password --gecos "" $OS_USER
|
||||
chpasswd <<<"${OS_USER}:${OS_USER_PASSWORD}"
|
||||
usermod -aG sudo $OS_USER
|
||||
|
||||
info "STEP 1 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 2 - CHANGE SERVER NAME
|
||||
#############################################################
|
||||
change_servername() {
|
||||
info "STEP 2 Changing server name"
|
||||
|
||||
echo $OS_SERVER_NAME > /etc/hostname
|
||||
hostentry="127.0.1.1\t${OS_SERVER_NAME}"
|
||||
if not_set "$hostentry" "/etc/hostname"; then
|
||||
echo -e "$hostentry" >> /etc/hosts
|
||||
else
|
||||
trace "\"$hostentry\" already set in \"/etc/hosts\""
|
||||
fi
|
||||
|
||||
info "STEP 2 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 3 - INSTALL MARIADB
|
||||
#############################################################
|
||||
install_mariadb() {
|
||||
info "STEP 3 Installing Maria DB"
|
||||
|
||||
apt install -y mariadb-server
|
||||
systemctl --quiet is-active mariadb || systemctl start mariadb
|
||||
systemctl --quiet is-enabled mariadb || systemctl enable mariadb
|
||||
|
||||
mysql -u root <<EOF
|
||||
CREATE DATABASE IF NOT EXISTS ${NC_DB};
|
||||
GRANT ALL PRIVILEGES ON ${NC_DB}.* TO '${NC_DB_USER}'@'localhost' IDENTIFIED BY '${NC_DB_PASSWORD}';
|
||||
DROP DATABASE IF EXISTS test;
|
||||
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
|
||||
DELETE FROM mysql.user WHERE User='';
|
||||
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
|
||||
ALTER USER 'root'@'localhost' IDENTIFIED BY '${NC_DB_PASSWORD}';
|
||||
FLUSH PRIVILEGES;
|
||||
EOF
|
||||
|
||||
test $? -eq 0 || error "Something went bananas. Maybe DB has already been set up"
|
||||
|
||||
mysql -u root -p${NC_DB_PASSWORD} -h localhost <<EOF
|
||||
SHOW DATABASES;
|
||||
SELECT User FROM mysql.user;
|
||||
EOF
|
||||
|
||||
info "STEP 3 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 4 - INSTALL PHP AND APACHE WEB SERVER
|
||||
#############################################################
|
||||
install_php_and_apache() {
|
||||
info "STEP 4 Installing PHP and Apache2"
|
||||
|
||||
apt install -y apache2 php php-apcu php-bcmath php-cli php-common php-curl php-gd php-gmp php-imagick php-intl php-mbstring php-mysql php-zip php-xml
|
||||
systemctl --quiet is-active apache2 || systemctl start apache2
|
||||
systemctl --quiet is-enabled apache2 || systemctl enable apache2
|
||||
|
||||
apt -y install libmagickcore-6.q16-6-extra
|
||||
|
||||
info "STEP 4 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 5 - SET UP PHP
|
||||
#############################################################
|
||||
setup_php() {
|
||||
info "STEP 5 Setting up PHP"
|
||||
|
||||
phpenmod bcmath gmp imagick intl
|
||||
|
||||
PHP_VERSION=$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')
|
||||
PHP_INI="/etc/php/${PHP_VERSION}/apache2/php.ini"
|
||||
|
||||
trace "PHP version detected: ${PHP_VERSION}"
|
||||
trace "PHP timezone: ${PHP_TIMEZONE}"
|
||||
trace "configuring ${PHP_INI}"
|
||||
|
||||
configure 'memory_limit =' 'memory_limit = 512M' $PHP_INI
|
||||
configure 'upload_max_filesize =' 'upload_max_filesize = 256M' $PHP_INI
|
||||
configure 'max_execution_time =' 'max_execution_time = 360' $PHP_INI
|
||||
configure 'post_max_size =' 'post_max_size = 256M' $PHP_INI
|
||||
configure 'date.timezone =' "date.timezone = ${PHP_TIMEZONE}" $PHP_INI
|
||||
configure 'opcache.enable=' 'opcache.enable=1' $PHP_INI
|
||||
configure 'opcache.interned_strings_buffer=' 'opcache.interned_strings_buffer=8' $PHP_INI
|
||||
configure 'opcache.max_accelerated_files=' 'opcache.max_accelerated_files=10000' $PHP_INI
|
||||
configure 'opcache.memory_consumption=' 'opcache.memory_consumption=128' $PHP_INI
|
||||
configure 'opcache.save_comments=' 'opcache.save_comments=1' $PHP_INI
|
||||
configure 'opcache.revalidate_freq=' 'opcache.revalidate_freq=3' $PHP_INI
|
||||
|
||||
systemctl restart apache2
|
||||
|
||||
info "STEP 5 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 6 - DOWNLOAD NEXTCLOUD
|
||||
#############################################################
|
||||
download_nextcloud() {
|
||||
info "STEP 6 Downloading and installing NEXTCLOUD"
|
||||
|
||||
apt install -y unzip
|
||||
apt install -y wget
|
||||
|
||||
trace "Downloading nextcloud from ${NC_DOWNLOAD_URL}"
|
||||
wget --continue $NC_DOWNLOAD_URL --output-document nc.zip
|
||||
trace "Extracting zip archive..."
|
||||
unzip -qq nc.zip
|
||||
rm nc.zip
|
||||
sudo chown -R www-data:www-data nextcloud/
|
||||
|
||||
trace "Moving extracted nextcloud to /var/www/"
|
||||
mv nextcloud/ /var/www/${OS_SERVER_NAME}
|
||||
|
||||
trace "Disabling default apache site 000-default.conf"
|
||||
a2dissite 000-default.conf
|
||||
|
||||
trace "Creating a new site config for apache"
|
||||
CFG_NAME="/etc/apache2/sites-available/${OS_SERVER_NAME}.conf"
|
||||
cat <<EOF > ${CFG_NAME}
|
||||
<VirtualHost *:80>
|
||||
DocumentRoot "/var/www/${OS_SERVER_NAME}"
|
||||
ServerName ${OS_SERVER_NAME}
|
||||
|
||||
<Directory "/var/www/${OS_SERVER_NAME}/">
|
||||
Options MultiViews FollowSymlinks
|
||||
AllowOverride All
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
|
||||
TransferLog /var/log/apache2/${OS_SERVER_NAME}_access.log
|
||||
ErrorLog /var/log/apache2/${OS_SERVER_NAME}_error.log
|
||||
|
||||
</VirtualHost>
|
||||
EOF
|
||||
|
||||
trace "Apache config created: ${CFG_NAME}. Enabling it"
|
||||
a2ensite "${OS_SERVER_NAME}.conf"
|
||||
a2enmod dir env headers mime rewrite ssl
|
||||
systemctl restart apache2
|
||||
|
||||
info "STEP 6 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 7 - SET UP NEXTCLOUD
|
||||
#############################################################
|
||||
setup_nextcloud() {
|
||||
info "STEP 7 Setting up NEXTCLOUD"
|
||||
|
||||
USER='www-data'
|
||||
NC_CONFIG="/var/www/${OS_SERVER_NAME}/config/config.php"
|
||||
|
||||
trace "setting up ${NC_CONFIG}"
|
||||
|
||||
cd "/var/www/${OS_SERVER_NAME}/"
|
||||
|
||||
sudo -u www-data php occ maintenance:install \
|
||||
--database "mysql" \
|
||||
--database-name "${NC_DB}" \
|
||||
--database-user "${NC_DB_USER}" \
|
||||
--database-pass "${NC_DB_PASSWORD}" \
|
||||
--database-host "localhost" \
|
||||
--data-dir "/var/www/${OS_SERVER_NAME}/data" \
|
||||
--admin-user "${NC_ADMIN_USER}" \
|
||||
--admin-pass "${NC_ADMIN_PASSWORD}"
|
||||
|
||||
trace "Nextcloud config creation result (0 means OK): $?"
|
||||
|
||||
configure ';' " 'memcache.local' => '\\\OC\\\Memcache\\\APCu'," $NC_CONFIG && \
|
||||
echo " 'default_phone_region' => '${NC_COUNTRY_CODE}'," >> $NC_CONFIG && \
|
||||
echo ');' >> $NC_CONFIG
|
||||
|
||||
if configured "\t2 => '${OS_IP}'," $NC_CONFIG; then
|
||||
warn "Trusted domains were already configured"
|
||||
else
|
||||
configure "0 => 'localhost'," "\t0 => 'localhost',\n\t1 => '${OS_SERVER_NAME}',\n\t2 => '${OS_IP}'," $NC_CONFIG
|
||||
trace "Trusted domains were set in ${NC_CONFIG}"
|
||||
fi
|
||||
|
||||
sudo chmod 660 $NC_CONFIG
|
||||
trace "Changed mod of ${NC_CONFIG}"
|
||||
|
||||
trace "Setting up a cron job for cron.php"
|
||||
|
||||
cat <<EOF > /etc/systemd/system/nextcloudcron.service
|
||||
[Unit]
|
||||
Description=Nextcloud cron.php job
|
||||
|
||||
[Service]
|
||||
User=${USER}
|
||||
ExecStart=/usr/bin/php -f /var/www/${OS_SERVER_NAME}/cron.php --define apc.enable_cli=1
|
||||
KillMode=process
|
||||
EOF
|
||||
|
||||
cat <<EOF > /etc/systemd/system/nextcloudcron.timer
|
||||
[Unit]
|
||||
Description=Run Nextcloud cron.php every 5 minutes
|
||||
|
||||
[Timer]
|
||||
OnBootSec=5min
|
||||
OnUnitActiveSec=5min
|
||||
Unit=nextcloudcron.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
EOF
|
||||
|
||||
systemctl enable --now nextcloudcron.timer
|
||||
|
||||
# alternative approach is to setup a crontab:
|
||||
#CRONTAB="/var/spool/cron/crontabs/${USER}"
|
||||
#echo "*/5 * * * * php -f /var/www/${OS_SERVER_NAME}/cron.php" >> $CRONTAB
|
||||
#sudo chmod 600 $CRONTAB
|
||||
#sudo chown $USER:$USER $CRONTAB
|
||||
|
||||
# to delete the crontab:
|
||||
# crontab -r -u www-data
|
||||
|
||||
info "STEP 7 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 8 - INSTALL SELF-SIGNED SSL CERTIFICATE
|
||||
#############################################################
|
||||
use_selfsigned_ssl_certificate() {
|
||||
info "STEP 8.1 Configuring a self-signed SSL certificate"
|
||||
|
||||
KEY="/etc/ssl/private/apache.key"
|
||||
CRT="/etc/ssl/certs/apache.crt"
|
||||
APACHE_SSL_CFG="/etc/apache2/sites-available/default-ssl.conf"
|
||||
|
||||
openssl req -x509 \
|
||||
-nodes \
|
||||
-days 2048 \
|
||||
-newkey rsa:2048 \
|
||||
-keyout $KEY \
|
||||
-out $CRT \
|
||||
-subj "/C=${NC_COUNTRY_CODE}/ST=${NC_COUNTRY_CODE}/L=${NC_COUNTRY_CODE}/O=E Corp/OU=IT/CN=${OS_SERVER_NAME}/emailAddress=info@example.com"
|
||||
|
||||
trace "SSH key created at: ${KEY}"
|
||||
trace "Certificate created at: ${CRT}"
|
||||
|
||||
CFG_NAME="/etc/apache2/sites-available/${OS_SERVER_NAME}-ssl.conf"
|
||||
cat <<EOF > ${CFG_NAME}
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost *:443>
|
||||
DocumentRoot "/var/www/${OS_SERVER_NAME}"
|
||||
ServerName $OS_SERVER_NAME
|
||||
SSLEngine on
|
||||
|
||||
<IfModule mod_headers.c>
|
||||
Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
|
||||
</IfModule>
|
||||
|
||||
<Directory "/var/www/${OS_SERVER_NAME}/">
|
||||
Options MultiViews FollowSymlinks
|
||||
AllowOverride All
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
|
||||
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
||||
SSLOptions +StdEnvVars
|
||||
</FilesMatch>
|
||||
<Directory /usr/lib/cgi-bin>
|
||||
SSLOptions +StdEnvVars
|
||||
</Directory>
|
||||
|
||||
TransferLog /var/log/apache2/${OS_SERVER_NAME}_access.log
|
||||
ErrorLog /var/log/apache2/${OS_SERVER_NAME}_error.log
|
||||
|
||||
SSLCertificateFile ${CRT}
|
||||
SSLCertificateKeyFile ${KEY}
|
||||
|
||||
SSLProtocol -all +TLSv1.2 +TLSv1.3
|
||||
SSLHonorCipherOrder on
|
||||
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM
|
||||
SSLCompression off
|
||||
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
EOF
|
||||
trace "New config for site created: ${CFG_NAME}. Enabling it"
|
||||
|
||||
a2ensite "${OS_SERVER_NAME}-ssl.conf"
|
||||
|
||||
trace "Setting up auto-redirect to HTTPS..."
|
||||
|
||||
CFG_NAME="/etc/apache2/sites-available/${OS_SERVER_NAME}.conf"
|
||||
if configured ' RewriteEngine on' $CFG_NAME; then
|
||||
warn 'HTTPS redirection was already set up'
|
||||
else
|
||||
configure "ServerName ${OS_SERVER_NAME}" \
|
||||
" ServerName ${OS_SERVER_NAME}\n RewriteEngine on\n RewriteCond %{HTTPS} !=on\n RewriteRule ^(.*)$ https://%{HTTP_HOST} [R=301,L]" \
|
||||
$CFG_NAME
|
||||
trace "Entries added to ${CFG_NAME} to redirect all requests to HTTPS"
|
||||
fi
|
||||
|
||||
systemctl restart apache2
|
||||
|
||||
info "STEP 8.1 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 9 - SET AUTOUPDATES FOR THE SERVER
|
||||
#############################################################
|
||||
set_autoupdates() {
|
||||
info "STEP 9 Setting up autoupdates (unattended-updates)"
|
||||
|
||||
apt install -y unattended-upgrades
|
||||
export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true
|
||||
dpkg-reconfigure --priority=low unattended-upgrades
|
||||
UNT_CFG="/etc/apt/apt.conf.d/50unattended-upgrades"
|
||||
UNT_CFG_BACK="${LOG_DIR}/50unattended-upgrades.backup"
|
||||
|
||||
trace "Going to rewrite ${UNT_CFG}"
|
||||
trace "Backup will be here: ${UNT_CFG_BACK}"
|
||||
|
||||
if test -f "$UNT_CFG_BACK"; then
|
||||
warn "unattended updates config backup is already there!"
|
||||
else
|
||||
cp $UNT_CFG $UNT_CFG_BACK
|
||||
cat <<'EOF' > ${UNT_CFG}
|
||||
Unattended-Upgrade::Allowed-Origins {
|
||||
"${distro_id}:${distro_codename}";
|
||||
"${distro_id}:${distro_codename}-security";
|
||||
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
||||
"${distro_id}ESM:${distro_codename}-infra-security";
|
||||
};
|
||||
|
||||
Unattended-Upgrade::Package-Blacklist {
|
||||
};
|
||||
|
||||
Unattended-Upgrade::DevRelease "auto";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
||||
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||
Unattended-Upgrade::Automatic-Reboot "true";
|
||||
Unattended-Upgrade::Automatic-Reboot-Time "05:00";
|
||||
EOF
|
||||
fi
|
||||
|
||||
info "STEP 9 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# 10 - ADDITIONAL SECURITY FOR THE SERVER
|
||||
#############################################################
|
||||
secure_server() {
|
||||
info "STEP 10 Securing the server"
|
||||
|
||||
trace "Installing openssh server..."
|
||||
apt install -y openssh-server
|
||||
systemctl --quiet is-active sshd || systemctl start sshd
|
||||
systemctl --quiet is-enabled sshd || systemctl enable sshd
|
||||
|
||||
SSH_CFG="/etc/ssh/sshd_config"
|
||||
SSH_CFG_BACK="${LOG_DIR}/sshd_config.backup"
|
||||
|
||||
trace "Going to rewrite ${SSH_CFG}"
|
||||
trace "Backup will be here: ${SSH_CFG_BACK}"
|
||||
|
||||
if test -f "$SSH_CFG_BACK"; then
|
||||
warn "SSH config backup is already there!"
|
||||
else
|
||||
cp $SSH_CFG $SSH_CFG_BACK
|
||||
cat <<EOF > ${SSH_CFG}
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
PermitRootLogin no
|
||||
ChallengeResponseAuthentication no
|
||||
UsePAM yes
|
||||
X11Forwarding yes
|
||||
PrintMotd no
|
||||
AcceptEnv LANG LC_*
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
EOF
|
||||
if $NO_PASSWORD_SSH; then
|
||||
info "Disabling SSH with password completely!"
|
||||
echo 'PasswordAuthentication no' >> $SSH_CFG
|
||||
fi
|
||||
fi
|
||||
|
||||
trace "Installing fail2ban..."
|
||||
apt install -y fail2ban
|
||||
systemctl --quiet is-active fail2ban || systemctl start fail2ban
|
||||
systemctl --quiet is-enabled fail2ban || systemctl enable fail2ban
|
||||
fail2ban-client status
|
||||
F2B_CFG_ORIG="/etc/fail2ban/jail.conf"
|
||||
F2B_CFG_COPY="/etc/fail2ban/jail.local"
|
||||
if test -f "$F2B_CFG_COPY"; then
|
||||
warn "Fail2ban was already set up"
|
||||
else
|
||||
cp $F2B_CFG_ORIG $F2B_CFG_COPY
|
||||
trace "Setting up ${F2B_CFG_COPY}"
|
||||
configure 'bantime = 10m' 'bantime = 60m' $F2B_CFG_COPY
|
||||
configure 'maxretry = 5' 'maxretry = 20' $F2B_CFG_COPY
|
||||
fi
|
||||
|
||||
trace "Configuring ufw..."
|
||||
ufw --force enable
|
||||
ufw allow 'Apache Full'
|
||||
ufw allow 'OpenSSH'
|
||||
ufw status
|
||||
|
||||
info "STEP 10 done"
|
||||
}
|
||||
|
||||
#############################################################
|
||||
# RUN SECTION
|
||||
#############################################################
|
||||
user=$(whoami)
|
||||
if [ $user != root ]; then
|
||||
error "You are using a non-privileged account"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo $(date +'%Y-%m-%d %H:%M') > $LOG
|
||||
|
||||
info "Hiya!"
|
||||
|
||||
apt update
|
||||
apt upgrade -y
|
||||
#add_user
|
||||
change_servername
|
||||
install_mariadb
|
||||
install_php_and_apache
|
||||
setup_php
|
||||
download_nextcloud
|
||||
setup_nextcloud
|
||||
use_selfsigned_ssl_certificate
|
||||
set_autoupdates
|
||||
secure_server
|
||||
|
||||
info "Don't forget to reboot"
|
||||
info "Bye!"
|
||||
|
||||
exit 0
|
||||
|
||||
# if domain name is available, SSL cert can be verified by Lets encrypt:
|
||||
# sudo snap install core; sudo snap refresh core
|
||||
# sudo snap install --classic certbot
|
||||
# sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
||||
# sudo certbot certonly --apache
|
||||
# sudo certbot renew --dry-run
|
||||
# disable current ssl site in apache
|
||||
# create new ssl config based on old one, replace certificates and ServerName (here: /etc/apache2/sites-available/)
|
||||
# optional: replace ServerName in the http config as well
|
||||
# and a new domain name to the trusted_domains section in NC's config.php (here: /var/www/nextcloud/config/)
|
||||
# sudo systemctl restart apache2
|
||||
|
||||
# do not change ownership of /var/www/nextcloud, it should be owned by www-data
|
||||
# sometimes login page cannot be started after a fresh install
|
||||
# then try to run again:
|
||||
# sudo chown -R www-data:www-data /var/www/nextcloud
|
||||
# btw log is here: sudo vim /var/www/nextcloud/data/nextcloud.log
|
||||
Loading…
Reference in New Issue