Scripted installation of Nextcloud 28 in iocage jail 2018-03-23

[RSVP]

There were a few, but the biggest were:

• Simpler configuration file (the Apache config file for Nextcloud is at least 10x longer than the Caddy one)
• Automatic TLS setup, including getting (and renewing) certs from Let's Encrypt
  • Including a much more sensible OCSP implementation

I didn't realize at the time that I'd be dealing with "dev who's aggressively pushing users to migrate from a stable release to beta code" or "dev who would completely abandon backward compatibility in v2."

Thanks, though I'd probably be more inclined to go back to Apache if I switch away from Caddy (nice thing about git: I can pull those config files out of the history and reuse them).

I'm sure it would; acme.sh is pretty much universal. Obviously the config file would need to be set up for SSL, but given that acme.sh ought to work fine.

Tend to agree here. Counterpoints:

• Though I've said otherwise in frustration, the rework of the config files is not gratuitous. He's discussed at some length reasons why he felt he needed to make the change. I'm inclined to believe him--why put in the work to completely change the configuration format (and thereby hack off your users) if there isn't some big gain out of it?
• Nothing prevents people from using Caddy1, you just can't use his build server to build you a binary with the plugins you want. This means you need to either use someone else's binary (e.g., the FreeBSD package), or build your own from source.
  • This is, at least partially, an artifact of Caddy's having been written in Go. As I understand it, Go doesn't support plugins or modules in the way that, say, Apache does--if you want to use it, it needs to be compiled in. So I can't install Caddy and separately install the Cloudflare plugin; the Cloudflare plugin needs to be compiled into Caddy (which IMO makes "plugin" a bit of a misnomer)
  • The obvious way to deal with this, IMO, would be for the FreeBSD port to be set up in such a way that it can be built with whatever plugin(s) is(are) desired. But it isn't there yet, and it's unclear if it's going to happen at all.

Sure, that could be done, and would be relatively straightforward as far as it goes. The rc file needs to be different, but I can pull that out of the proposed FreeBSD port. The big problem is the Caddyfile, as the format is completely different. I don't doubt a reference copy will be developed fairly quickly--Nextcloud is a pretty popular package, and for all I know there may be one out there already. But that's probably the biggest piece that would be needed, aside from getting Caddy2 in the first place.

Sorry this happened to you. I do hope you abandon caddy and go anywhere else. That makes really bad precedent. Non of the scripts with caddy played friendly with my pfsense router running haproxy with ssl termiantion, not even with no cert. So a little rational self interest here. Sorry for the disappointment.

 

[ornias]

Sorry this happened to you. I do hope you abandon caddy and go anywhere else. That makes really bad precedent. Non of the scripts with caddy played friendly with my pfsense router running haproxy with ssl termiantion, not even with no cert. So a little rational self interest here. Sorry for the disappointment.

I agree, for jailman I already removed it (in dev branch) because it also didn't play nicely with reverse proxies at times... Some settings that should've fixed by problems sometimes just plainly didn't work and/or wheren't documented.

 

[danb35]

Current status:

I've created a caddyv2 branch on GitHub. That contains a combiled binary of Caddy v2.1.1 with the Cloudflare and Route53 plugins installed. I've (minimally) tested it to install and work with the self-signed cert. I expect it to work with the standalone/HTTP cert. It will not work with a DNS cert at this time. All of the sample Caddyfiles enable debugging, which means you're going to get lots of stuff spammed to your console--this will of course be disabled when I think it's ready to go to master.

Subjectively, performance seems quite a bit better on my test system. The Help is working properly, which was an issue noted under Caddy1.

Testing and suggestions for improvement are welcome. And if you can give me a good way to build it from source in the jail, with the ability to include plugins on-demand, so much the better, because I'd really rather not be distributing the binary with the script.

 

[xames]

i have a problem with my jail, i install new hdd on my freenas and i make my POOL1 (where jails and nextcloud is installed), and replicated to the new one to make backups, but after that i can't access nextcloud ip anymore, then i disconnect the new hdd and restart the freenas, but now it says me all jails corrupted. It says:

nextcloud is missing it's configuration, please destroy this jail and recreate it.

How i can resolve that because, all jails, plex, radarr etc... corrupted because of this replication.

I think i fail doing replication on the same system, but now i don't know how to revert all.

 

[ornias]

@xames this error you mention has nothing to do with this script.
Please make a seperate topic for it (it might also attract more people able to assist you with this seperate issue)

 

[danb35]

Non of the scripts with caddy played friendly with my pfsense router running haproxy with ssl termiantion, not even with no cert

You might want to try Caddyv2 with it--it seems to be working for me. Granted, I'm using OPNsense rather than pfSense, but since they're both running HAProxy, that shouldn't make a difference.

 

[NasKar]

I tried the Caddyv2 version. I'm running the NO_CERT=1 in the config as I use your reverse proxy for my ssl termination. Nextcloud doesn't work.

Code:

service caddy restart
2020/07/25 21:22:47.495    WARN    failed using API to stop instance    {"error": "performing request: Post \"http://localhost:2019/stop\": dial tcp [::1]:2019: connect: connection refused"}
stop: performing request: Post "http://localhost:2019/stop": dial tcp [::1]:2019: connect: connection refused

During the install I don't remember this error

Code:

gpg: Warning: using insecure memory!
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key D75899B9A724937A: public key "Nextcloud Security security@nextcloud.com" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: Warning: using insecure memory!
gpg: assuming signed data in '/tmp/latest-19.tar.bz2'
gpg: Signature made Wed Jul 15 16:31:24 2020 EDT
gpg: using RSA key D75899B9A724937A
gpg: Good signature from "Nextcloud Security security@nextcloud.com" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2880 6A87 8AE4 23A2 8372 792E D758 99B9 A724 937A

 

[ornias]

During the install I don't remember this error

Code:

gpg: Warning: using insecure memory!
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key D75899B9A724937A: public key "Nextcloud Security security@nextcloud.com" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: Warning: using insecure memory!
gpg: assuming signed data in '/tmp/latest-19.tar.bz2'
gpg: Signature made Wed Jul 15 16:31:24 2020 EDT
gpg: using RSA key D75899B9A724937A
gpg: Good signature from "Nextcloud Security security@nextcloud.com" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2880 6A87 8AE4 23A2 8372 792E D758 99B9 A724 937A

Don't worry, it was there already... (at least in a less verbose format)

 

[danb35]

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

That isn't a problem, and it's been there for as long as I've been doing the gpg signature checking.

On the issue of Nextcloud itself, is caddy running? Try service caddy status; if it isn't, service caddy start.

 

[NasKar]

That isn't a problem, and it's been there for as long as I've been doing the gpg signature checking.

On the issue of Nextcloud itself, is caddy running? Try service caddy status; if it isn't, service caddy start.

Caddy isn't working with service caddy restart but does start with service caddy start. After that I'm getting mult copies of this

Code:

service caddy status
caddy is running as pid 22558.
root@nextcloud:~ # 2020/07/25 21:47:38.426    INFO    http.log.access    handled request    {"request": {"method": "GET", "uri": "/ocs/v2.php/apps/notifications/api/v2/notifications", "proto": "HTTP/1.1", "remote_addr": "192.168.5.30:14631", "host": "192.168.5.84", "headers": {"Connection": ["keep-alive"], "Accept": ["application/json, text/plain, */*"], "User-Agent": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36"], "Cookie": ["oc_sessionPassphrase=9sKDqDCJ5Ibmzxqs%2FPYNm0Y%2BsE7cDZ8KunMjW6c4MrHXf8wV1xq%2F4cwJQxIZvZZJ0ftQ2mhwqj4TEMDvSud8iC9brF3kxmlBzSaVfnT3320oFnbjK75iPqh4OBLABO25; nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; ocyjeldkvcbr=e1bfqprvm5ttf36gj9v703sd53; ocqo60ssr3j0=g6tdfl2q22dbrvbi0tmfgiraha; ockgp0q3yn1d=32fr23qsecbhkrl0m6180nk4ai; nc_username=admin; ocysj8bwst5n=9g54cusni5ticgjungc0rc74e4; nc_token=nrUj%2F1CaU50%2FI7o1K%2B8v28ypNelz4HPY; nc_session_id=9g54cusni5ticgjungc0rc74e4"], "Accept-Encoding": ["gzip, deflate"], "Accept-Language": ["en-US,en;q=0.9"], "Cache-Control": ["max-age=0"], "Requesttoken": ["S16/RzWqCduioSLOk/bPFXCHY25h3cz8/8oM+vjyAQc=:Oyr0N3z7MPDuihG2y6L4IwbgJCsCr5i1lJ1vzZyoQHU="], "If-None-Match": ["e6b024e8c6a26856095b0fcc8cf2b1b0"]}}, "common_log": "192.168.5.30 - - [25/Jul/2020:17:47:38 -0400] \"GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/1.1\" 0 0", "duration": 0.000006868, "size": 0, "status": 0, "resp_headers": {"Server": ["Caddy"]}}

 

[danb35]

After that I'm getting mult copies of this

As I said, I've enabled debug mode in the Caddyfiles, which means you're going to get lots of console spam. Is the Nextcloud installation working now that caddy's running?

 

[NasKar]

No. the jail is up and caddy is running. BTW I did a reinstall with my existing nextcloud data. Sorry I didn't realize what console spam was.

 

[NasKar]

BTW the caddy service doesn't survive a jail restart. You have to start caddy again but nextcloud doesn't work.

 

[xames]

This step not working how to?

one called db, which will store the SQL database. For optimal performance, set the record size of the dbdataset to 16 KB (under Advanced Settings in the FreeNAS web GUI). It's also recommended to cache only metadata on the db dataset; you can do this by running zfs set primarycache=metadata poolname/db

And that is not true, the directory created in pool/iocage/jails! If i create a POOL1\nextcloud and inside this the files, themes etc... where is installed in iocage or in POOL1\nextcloud?

If these are not present, a directory /nextcloud will be created in $POOL_PATH

 

[xames]

Command: bash -s personal tls.dns.cloudflare failed!
Failed to download/install Caddy.

 

[Basil Hendroff]

Command: bash -s personal tls.dns.cloudflare failed!
Failed to download/install Caddy.

Yup. The v1 build server is no longer available.

 

[xames]

And then i have to git clone the new version of script to work again? or how? Same process of cloudflare, dns, etc...

JAIL_INTERFACES not set, defaulting to: vnet0:bridge0
Sorry, DNS validation is temporarily unavailable due to
decisions of the upstream Caddy maintainer.

I have all working but a replication stuff make me the nextcloud corrupted, how i reinstall now without caddy, with secure mode?

Thanks.

 

[xames]

I disable DNS cert, now this:

RELEASE: 12.1-RELEASE not found!
Failed to create jail

My nextcloud jail is working fine yesterday in this TrueNas version before corrupted due to replication problem, why i can't install now?

 

[danb35]

BTW the caddy service doesn't survive a jail restart. You have to start caddy again but nextcloud doesn't work.

Yeah, I'm noticing that myself. Don't have the reason tracked down yet, though.

 

[xames]

Then i have to wait to try install again? Thanks.