Scripted installation of Nextcloud 28 in iocage jail 2018-03-23

[danb35]

can't be reached from internet.

Have you forwarded ports 80 and 443 to the Nextcloud instance?

 

[tebra]

Have you forwarded ports 80 and 443 to the Nextcloud instance?

That was my problem. I forgot about that.
In fact I was thinking that caddy will do it automatically...
Thanks

 

[danb35]

In fact I was thinking that caddy will do it automatically...

Caddy doesn't control your router, so that wouldn't be possible.

 

[listhor]

Thanks @danb35 for such a great work!
But another question is incoming, I've installed nextcloud using following settings in nextcloud-config:

Code:

JAIL_IP="172.16.0.10"
DEFAULT_GW_IP="172.16.0.1"
POOL_PATH="/mnt/all"
TIME_ZONE="Europe/Warsaw"
#SELFSIGNED_CERT=1
#HOST_NAME="next.xxxx"
HOST_NAME="next.xxxx.xx"
DNS_CERT=1
DNS_PLUGIN="ovh"
DNS_ENV="OVH_ENDPOINT=ovh-eu OVH_APPLICATION_KEY=XXXXX OVH_APPLICATION_SECRET=XXXX"
CERT_EMAIL="admin@xxx.xx"
DB_PATH="/mnt/all/DB"
FILES_PATH="/mnt/all/Pliki"

Set mode for background jobs to 'cron'
crontab: /mnt/configs/www-crontab: Permission denied
Command: crontab /mnt/configs/www-crontab failed!
Successfully removed mount from nextcloud's fstab
Installation complete!
Using your web browser, go to https://next.xxx.xx to log in
Default user is admin, password is XXXXXX

Database Information
--------------------
Database user = nextcloud
Database password = XXXXX
The MariaDB root password is XXXX

All passwords are saved in /root/nextcloud_db_password.txt

You have obtained your Let's Encrypt certificate using the staging server.
This certificate will not be trusted by your browser and will cause SSL errors
when you connect. Once you've verified that everything else is working
correctly, you should issue a trusted certificate. To do this, run:
iocage exec nextcloud /root/remove-staging.sh

And it seems like there's no any http server installed - no page gets opened and "top" command (within a jail) doesn't show neither Nginx nor apache24 process running.
Am I Missing something or have done wrong?

 

[danb35]

"top" command (within a jail) doesn't show neither Nginx nor apache24 process running.

That's entirely to be expected, as I don't use Apache or Nginx for the web server in my script--I use Caddy instead. But if it's just timing out when you try to reach it, there's a good chance it isn't running either. Make sure the Caddyfile is there (it should be at /usr/local/www/Caddyfile). Assuming it's there, check the Caddy log (/var/log/caddy.log) and see if there's anything of note there.

 

[listhor]

Make sure the Caddyfile is there (it should be at /usr/local/www/Caddyfile). Assuming it's there, check the Caddy log (/var/log/caddy.log) and see if there's anything of note there.

Content of caddy.log:

root@nextcloud:~ # cat /var/log/caddy.log
2020/03/03 11:20:00 [INFO] Caddy version: v1.0.4
2020/03/03 11:20:00 /usr/local/www/Caddyfile:9 - Error during parsing: Setting up DNS provider 'ovh': ovh: some credentials information are missing: OVH_CONSUMER_KEY
2020/03/03 11:20:00 [INFO][cache:0xc0000a8a50] Started certificate maintenance routine
2020/03/03 11:22:37 [INFO] Caddy version: v1.0.4
2020/03/03 11:22:37 /usr/local/www/Caddyfile:9 - Error during parsing: Setting up DNS provider 'ovh': ovh: some credentials information are missing: OVH_CONSUMER_KEY
2020/03/03 11:32:48 [INFO] Caddy version: v1.0.4
2020/03/03 11:32:48 /usr/local/www/Caddyfile:9 - Error during parsing: Setting up DNS provider 'ovh': ovh: some credentials information are missing: OVH_CONSUMER_KEY
2020/03/03 11:32:48 [INFO][cache:0xc0001a23c0] Started certificate maintenance routine

Seems like it's something wrong with my LE cert...

When I tried to start caddy:

Code:

root@nextcloud:~ # service caddy start
Starting caddy.

Still is not there, running processes:

Code:

  PID USERNAME    THR PRI NICE   SIZE    RES STATE   C   TIME    WCPU COMMAND
  745 redis         4  20    0 10560K  4876K kqread  1   0:00   0.03% redis-server
87566 root          1  20    0  7924K  3200K CPU0    0   0:00   0.02% top
  836 mysql        31  20    0   574M 99732K select  3   0:00   0.01% mysqld
  749 root          1  20    0   216M 35420K kqread  5   0:00   0.00% php-fpm
87465 root          1  20    0  7488K  3724K pause   4   0:00   0.00% csh
 1096 root          1  22    0  7488K  3764K ttyin   1   0:00   0.00% csh
  759 mysql         1  52    0  7148K  2952K wait    4   0:00   0.00% sh
 1095 root          1  52    0  6948K  2852K wait    3   0:00   0.00% login
87464 root          1  52    0  6948K  2852K wait    3   0:00   0.00% login
  855 root          1  23    0  6460K  2360K nanslp  2   0:00   0.00% cron
  652 root          1  20    0  6420K  2460K select  1   0:00   0.00% syslogd
  750 www           1  52    0   216M 35444K accept  4   0:00   0.00% php-fpm
  751 www           1  52    0   216M 35444K accept  2   0:00   0.00% php-fpm

It is because of LE cert? I've reinstalled everything in web shell as root. Initially I was doing everything as sudoer from OS X terminal. BTW, is there any way to login as root from regular terminal?

 

[listhor]

I gave up generating LE cert and been trying with these settings:

JAIL_IP="172.16.0.10"
DEFAULT_GW_IP="172.16.0.1"
POOL_PATH="/mnt/all"
TIME_ZONE="Europe/Warsaw"
SELFSIGNED_CERT=1
HOST_NAME="next.xxx.xx"
CERT_EMAIL="admin@xxx.xx"
DB_PATH="/mnt/all/DB"
FILES_PATH="/mnt/all/Pliki"

Still no luck. Caddy is listed as running process but there's no response when trying to open page.
caddy.log says:

2020/03/03 14:10:13 [INFO] Serving https://next.xxx.xx
2020/03/03 14:10:13 [INFO] Serving https://172.16.0.10
2020/03/03 14:11:08 http: TLS handshake error from 172.16.4.6:56780: no certificate available for ''
2020/03/03 14:11:11 http: TLS handshake error from 172.16.4.6:56785: no certificate available for ''
2020/03/03 14:12:48 http: TLS handshake error from 172.16.4.6:56912: no certificate available for ''
2020/03/03 14:13:35 http: TLS handshake error from 172.16.4.6:56964: no certificate available for ''
2020/03/03 14:14:54 http: TLS handshake error from 172.16.4.6:57079: no certificate available for ''

Does it mean that self signed cert hasn't been generated at all?

 

[danb35]

Seems like it's something wrong with my LE cert...

The Caddy log is literally telling you exactly what the error is:

ovh: some credentials information are missing: OVH_CONSUMER_KEY

BTW, is there any way to login as root from regular terminal?

Yes, two of them: (1) log in as a regular user, then su - to become root. You'll give root's password to do this. (2) Check the "Log in as root with password" box in the SSH service options.

 

[listhor]

The Caddy log is literally telling you exactly what the error is:

Yes' I've noticed that and tried to obtain consumer key. It's not so easy as https://api.ovh.com/createToken/?GE.../domain/zone/*&DELETE=/domain/zone/*/record/* rejects my credentials. I was able to create app key and secret (it works with acme script from https://github.com/acmesh-official/acme.sh/wiki/How-to-use-OVH-domain-api installed on Synology) on https://eu.api.ovh.com/createApp/ and tried to retrieve consumer key from api console https://api.ovh.com/console/#/me/api/credential#GET. Unfortunately it doesn't work as caddy throws out API errors.
Finally, after installing self signed version I've managed to run it. The main problem was (I guess) caddy rewriting IP to address and my local DNS (pihole) couldn't resolve it. And after adding nextcloud's address to pihole, all works now.

And since JAIL_IP="172.16.0.10" variable doesn't accept "igb2|172.16.1.2" (2nd, separate NIC in different subnet) I changed manually Caddyfile

Code:

http://next.xxx.xx http://172.16.1.2 {
        redir https://next.dom.net{uri}
}

https://next.xxx.xx https://172.16.1.2 {

and used command

Code:

sudo iocage set ip4_addr="igb2|172.16.1.2/26" defaultrouter="172.16.1.1" nextcloud

to assign new IP.
Do I need to change anything else? It works now but I want to make sure myself...

 

[listhor]

And the last question, if I want to change ssl cert to LE, would I need to reinstall Nextcloud or change variables using sysrc commands?

 

[danb35]

You wouldn't need to reinstall Nextcloud, just make the appropriate changes to the Caddyfile. And if it isn't exposed to the Internet (and therefore you're using DNS validation to get the certificate), yes, you'll need to change variables (certainly caddy_env; possibly others) using sysrc.

 

[retoucher]

I have a 3 year old instance of the Nextcloud in jail (not a plugin) for a small studio group. Currently on 18.0.1. I am told by the parent company IT dept. that my Apache and PHP need upgrades due to vulnerabilities. Need >=2.4.39 Apache and >=7.2.13 PHP. I am not an expert and running pkg update && pkg upgrade tells me there are no updates. Running Freenas 11.3 and jail 11.3.

Is this a case of the wrong repo being queried for updates? How do I change?
Also can I just install in new, fresh jail and reuse my existing datasets (db and files)?

 

[mapcevn]

Issue#1: "Error when assembling chunks, status code 504" using browser (Edge,Chrome,Firefox)
Though the error happened, but surprisingly, it managed to show up in the upload folder eventually!!! However, the error msg still happens. I think this relates to the issue #2 below.

Issue #2: Error uploading large file from my iPhone and the Nextcloud desktop client, it goes again and again trying to upload the file, but failed.

Problem happening with a test file of 1.8GB. Smaller files about 500-700 MB work fine.

I went through the painful trial-and-error process putting the damned "timeouts 3600", "timeouts 3600s", "timeout 3600", ""timeout = 3600" etc in various locations ie caddyfile, php.ini, .user.ini, config.php, php.conf to fix the above issues but no luck. Either this crashed the nextcloud, or no effect at all.

Dan - you mentioned somewhere in this topic that you are able to upload files of 15GB without any issue, hence I think you may know the clue how to sort out this timeout issue?

My system:
FreeNAS-11.3-U1, Xeon E5-1410, RAM 48GB, Pool 2TB
Nextcloud in a jail installed by Dan's script. The Nextcloud is behind HAProxy within a dedicated pfSense box. The SSL is terminated at HAProxy. The Pfsense box with Intel i5-4570, RAM 8GB, Broadcom 4-port GB NIC card

 

[danb35]

"timeouts 3600", "timeouts 3600s"

The timeouts are already set in the Caddyfile in the current version of the script, and it's been this way since not too long after that discussion up-thread took place.

The Nextcloud is behind HAProxy within a dedicated pfSense box.

Since my testing involved a direct connection to Nextcloud on my LAN, this strikes me as the obvious source of the problem. Are you able to connect directly to Nextcloud on your LAN, without involving the HAProxy instance? If so, are you able to upload the test file with such a connection?

 

[RSVP]

Finally have been trying this script after many headaches with warden, then iocage installs. The product sounds great, but never a fully functioning version. I hope to change that. So thanks for another option. Unfortunately, despite my tweaking of my config I still can't successfully install. My latest attempt doesnt even pass your checks in your script. It fails the check for DNS_CERT=1 & DNS_PLUGIN:.. I get the message it failed. Not a supported plugin go read etc. Not exactly sure how I can be failing... Thanks for the help

 

[listhor]

My latest attempt doesnt even pass your checks in your script. It fails the check for DNS_CERT=1 & DNS_PLUGIN:.. I get the message it failed. Not a supported plugin go read etc. Not exactly sure how I can be failing... Thanks for the help

Double check plugin’s name and its variables. In my case it was “ovh” but I couldn’t get correct consumer key variable... So I’ve ended up using acme script (also @danb35 ) for FreeNAS only (wildcard cert) and mounting cert files in nextcloud and also in iredmail iocages. I use cron to copy cert files to dedicated folder (mounted source) and change their names on daily basis....

 

[listhor]

Question about onlyoffice document server. As its plugin version doesn’t work on FreeBSD I run it in Docker container with self signed certificate (config.php amended). I’ve got onlyoffice confirmation page opened so server works. When configuring nextcloud plug-in (document server’s address) all is ok and saved.
But when I try to open document in Nextcloud, I receive only pop up message saying that document server is not available. There’s nothing in log about it. What’s wrong?

 

[RSVP]

Double check plugin’s name and its variables. In my case it was “ovh” but I couldn’t get correct consumer key variable... So I’ve ended up using acme script (also @danb35 ) for FreeNAS only (wildcard cert) and mounting cert files in nextcloud and also in iredmail iocages. I use cron to copy cert files to dedicated folder (mounted source) and change their names on daily basis....

it is godaddy.

 

[danb35]

Not exactly sure how I can be failing.

What exactly is in your nextcloud-config file (masking credentials and other sensitive information), and what exactly does the error say?

 

[listhor]

it is godaddy.

Maybe read https://github.com/acmesh-official/acme.sh/wiki/dnsapi, have you seen it?