Scripted installation of Nextcloud 28 in iocage jail 2018-03-23

[RSVP]

I just used this guide, up to the SSL part https://www.samueldowling.com/2018/...n-freenas-iocage-jail-with-hardened-security/. I used Acme and Haproxy on my pfsense to handle wildcard cert and redirects. In cloudflare, I have 1 A record and the sub domains are CNAME.

I will give it a go. Thanks mate.

 

[gdog0]

I will give it a go. Thanks mate.

This was helpful too https://youtu.be/FWodNSZXcXs

 

[RSVP]

This was helpful too https://youtu.be/FWodNSZXcXs

Yes this is exactly how mine is set up. Works great. I just cant figure out how to get any of these caddy install jobs to work after forwarding 80,443 back to my haproxy alias. It just breaks caddy. Is this what your experience is too? Be great if there was a script option that just skips all the configuring of host name. Not really sure what the issue is.

 

[gdog0]

Yes this is exactly how mine is set up. Works great. I just can't figure out how to get any of these caddy install jobs to work after forwarding 80,443 back to my haproxy alias. It just breaks caddy. Is this what your experience is too? Be great if there was a script option that just skips all the configuring of host name. Not really sure what the issue is.

I didn't use a script to install Nextcloud, just followed the directions I linked above and stopped before any of the SSL stuff. So, I don't have Caddy in my mix.

 

[Bruce Wilfong]

Starting my new install of nextcloud and it was suggested I post my progress.

FreeNAS-11.3-U1
pool = /tank

I have an AT&T ISP so, not static.

I have followed the recommendation form here: https://github.com/danb35/freenas-iocage-nextcloud

I register a domain with EasyDNS.com, then setup a Cloudflare account and updated EasyDNS.com with Cloudflares DNS servers.
I am using pfsense as a router and setup DDNS under Services/Dynamic DNS/Dynamic Clients. (this was a pain).

Using Cloudflare, Hostname is @, I did enable wildcards, unchecked proxy, user name is the signup email and password is your Global API Key.

I create the two recommeded dataset in my main pool (/tank). I created from the GUI files and db. Additionally changed record size in db to 16K (was 128K)

Question: Do these need permissions set ?

I have downloaded the script and edited the config file:
JAIL_IP="192.168.1.27"
DEFAULT_GW_IP="192.168.1.1"
POOL_PATH="/mnt/tank"
TIME_ZONE="America/Los_Angeles"
HOST_NAME="homelanddz.com"
DNS_CERT=1
CERT_EMAIL="cert@homelanddz.com"
DNS_PLUGIN="cloudflare"
DNS_ENV="CLOUDFLARE_EMAIL=xxxxxx@gmail.com CLOUDFLARE_API_KEY=*********"

Question do I need to include, DB_PATH, FILES_PATH, CONFIG_PATH and PORTS_PATH since I created the files and db in my main pool or will this not see them ?

Since I am using DNS_CERT I am NOT doing any port forwarding in pfsense, correct ?

Question: Also does anyone know where and how to configure my HOST_NAME in pfsense, it is recommended to do this since it "resolves to your jail from inside your network"

 

[Redcoat]

Question: Also does anyone know where and how to configure my HOST_NAME in pfsense, it is recommended to do this since it "resolves to your jail from inside your network"

Yes, in the DNS Resolver configuration, bottom of the page.

 

[Basil Hendroff]

Question: Do these need permissions set ?

I don't recall doing anything special here, so, probably no.

Question do I need to include, DB_PATH, FILES_PATH, CONFIG_PATH and PORTS_PATH since I created the files and db in my main pool or will this not see them ?

If the locations don't match the defaults, then probably yes for DB_PATH and FILES_PATH at least. Alternatively, move the datasets to match the defaults the script uses. Post #1219 above may be helpful.

 

[Basil Hendroff]

@danb35 I notice the latest script now includes a CONFIG_PATH. As I ran the previous version of this script, can you please briefly indicate what I need to do retrospectively to take advantage of this change?

I also notice from post #1245 above, that users of the script are addressing Prerequisites (Other) in the most up-to-date instructions first and then realising further down in the Installation that there is a mismatch between default locations and where they may have placed the files and db datasets in their pool. I wonder if the instruction should be modified slightly to avoid the scenario, that @Bruce Wilfong experienced, occurring again for others intending to use the script.

 

[Bruce Wilfong]

@danb35 I notice the latest script now includes a CONFIG_PATH....

For most of my other iocages I use /mnt/apps/{jail} for all my config files, I think I am going to put it there. Might also put the ports there also.

My new config file would look like this:
JAIL_IP="192.168.1.27"
DEFAULT_GW_IP="192.168.1.1"
POOL_PATH="/mnt/tank"
TIME_ZONE="America/Los_Angeles"
HOST_NAME="homelanddz.com"
DNS_CERT=1
CERT_EMAIL="cert@homelanddz.com"
DNS_PLUGIN="cloudflare"
DNS_ENV="CLOUDFLARE_EMAIL=xxx@gmail.com CLOUDFLARE_API_KEY=**************"
DB_PATH="/mnt/tank/db"
FILES_PATH="/mnt/tank/files"
CONFIG_PATH="/mnt/tank/apps/nextcloud/config"
PORTS_PATH="/mnt/tank/apps/nextcloud/ports"

 

[Basil Hendroff]

For most of my other iocages I use /mnt/apps/{jail} for all my config files, I think I am going to put it there. Might also put the ports there also.

Likewise, though I like to include everything to do with Nextcloud under its own parent root.

 

[Bruce Wilfong]

yeah that might be a better idea.

 

[Bruce Wilfong]

Yes, in the DNS Resolver configuration, bottom of the page.

Thanks.

Am I suppose to use Host Overides or the Domain Overides.

This is my setup on cloudflare:

Since I dont have a Host Name I am assuming I lead this blank ? However can I use cloud ? Also assuming the 'IP to return for host' is my internal nextcloud jail ?

THanks

 

[Redcoat]

I don't know how this works without a name for the host within the parent domain of the host...

 

[Bruce Wilfong]

I dont have a host so I left it blank, the registered domain name is just homelanddz.com

 

[Bruce Wilfong]

ran the script, did not seem to work, I am unable to get to the wan (https://homelanddz.com) or the lan side (192.168.1.27).

got a ton of these errors:
The current PHP memory limit is below the recommended value of 512MB.

Says it works:
Default module: OC_DEFAULT_MODULE
Encryption disabled
Set mode for background jobs to 'cron'
crontab: /mnt/includes/www-crontab: Permission denied
Command: crontab /mnt/includes/www-crontab failed!
Successfully removed mount from nextcloud's fstab
Installation complete!
Using your web browser, go to https://homelanddz.com to log in
Default user is admin, password is lNi******


Not sure where to go from here ???

 

[Basil Hendroff]

This is my setup on cloudflare:

Sorry, not familiar with pfsense, but I get the feeling your Cloudflare records are not set up correctly for DDNS. Refer to this Cloudflare article. A search of the web for ddns pfsense cloudflare also brings up lots of helpful resources.

 

[Bruce Wilfong]

your probably correct, however, should I still be able to go to the jail IP ?

 

[Basil Hendroff]

your probably correct, however, should I still be able to go to the jail IP ?

Again, I'm not familiar with pfsense. I'm assuming you're using it as your local DNS resolver. It also needs to be configured correctly.

 

[Bruce Wilfong]

update: I had the incorrect email address in the config file. Will try again

 

[Bruce Wilfong]

Everything seems to be working. I believe my problem was in DNS-O-Matic which seems is really OpenDNS. I had an old DNS from some netgear router. I removed that, and in pfsense changed my DDNS from Cloudflare to OpenDNS and it seemed to work.

Now I have one issue in NextCloud, thinking about just blowing the jail away and reinstalling now that I think I have everyhing set, unless someone know of a fix.

Any ideas ?