yum install -y wget unzip bzip2 vim lrzsz screen<\/p>\n\n\n\n
yum install -y mariadb mariadb-server mariadb-devel
systemctl enable mariadb.service
systemctl daemon-reload<\/p>\n\n\n\n
mkdir \/etc\/systemd\/system\/mariadb.service.d
cat > \/etc\/systemd\/system\/mariadb.service.d\/limits.conf <<EOF
[Service]
LimitNOFILE=10000<\/p>\n\n\n\n
EOF<\/p>\n\n\n\n
mkdir -p \/data\/database\/mysql
chown mysql:mysql \/data\/database\/mysql
sed -i “\/datadir\/c datadir=\/data\/database\/mysql” \/etc\/my.cnf
sed -i “\/instructions\/a long_query_time=10” \/etc\/my.cnf
sed -i “\/instructions\/a slow_query_log=1” \/etc\/my.cnf
sed -i “\/instructions\/a innodb_file_per_table=1” \/etc\/my.cnf
sed -i “\/instructions\/a max_connections=5000” \/etc\/my.cnf
sed -i “\/instructions\/a max_allowed_packet=1024M” \/etc\/my.cnf
sed -i “\/instructions\/a collation-server = utf8_general_ci” \/etc\/my.cnf
sed -i “\/instructions\/a character-set-server = utf8” \/etc\/my.cnf<\/p>\n\n\n\n
systemctl start mariadb.service
tr -dc A-Za-z0-9 < \/dev\/urandom | head -c 16 | xargs > \/data\/mysql_root<\/p>\n\n\n\n
mysql -uroot -e “delete from mysql.user where user=”;update mysql.user set password=password(‘`cat \/data\/mysql_root`’) where user=’root’;FLUSH PRIVILEGES;”<\/p>\n\n\n\n
rpm -ivh https:\/\/mirrors.aliyun.com\/epel\/epel-release-latest-7.noarch.rpm
yum install -y nginx<\/p>\n\n\n\n
rpm -Uvh https:\/\/mirror.webtatic.com\/yum\/el7\/webtatic-release.rpm
yum install -y php72w-devel php72w-pear php72w-pecl php72w-gd php72w-opcache php72w-cli php72w-pdo php72w-process php72w-pecl-apcu php72w-mcrypt php72w-mysql php72w-fpm php72w-pecl-memcached php72w-common php72w-xml php72w-mbstring php72w-pecl-igbinary php72w-json php72w-pecl-imagick* php72w-xml php72w-cli php72w-gd php72w-intl php72w-mbstring php72w-process php72w-pecl-zip
#yum install -y php72w-pecl-redis5 redis libsmbclient libsmbclient-devel<\/p>\n\n\n\n
mysql -u root -p`cat \/data\/mysql_root`
create database nextcloud_db;
grant all privileges on nextcloud_db.* to nextcloud@localhost identified by ‘passwd’;
flush privileges;<\/p>\n\n\n\n
mkdir -p \/etc\/nginx\/cert\/
cd \/etc\/nginx\/cert\/
openssl req -new -x509 -days 365 -nodes -out \/etc\/nginx\/cert\/nextcloud.crt -keyout \/etc\/nginx\/cert\/nextcloud.key
chmod 600 \/etc\/nginx\/cert\/*
chmod 700 \/etc\/nginx\/cert<\/p>\n\n\n\n
mkdir \/data\/web\/
cd \/data\/web\/
wget https:\/\/download.nextcloud.com\/server\/releases\/nextcloud-18.0.3.tar.bz2
tar jxf nextcloud-18.0.3.tar.bz2
chown nginx:nginx -R nextcloud\/
cd \/data\/web\/nextcloud<\/p>\n\n\n\n
vim \/etc\/php-fpm.d\/www.conf
user = nginx \/\/\u5c06\u7528\u6237\u548c\u7ec4\u90fd\u6539\u4e3anginx
group = nginx
listen = 127.0.0.1:9000
env[HOSTNAME] = $HOSTNAME \/\/\u5c06\u4ee5\u4e0b\u51e0\u884c\uff0c\u53bb\u6389\u6ce8\u91ca
env[PATH] = \/usr\/local\/bin:\/usr\/bin:\/bin
env[TMP] = \/tmp
env[TMPDIR] = \/tmp
env[TEMP] = \/tmp<\/p>\n\n\n\n
mkdir -p \/var\/lib\/php\/session
mkdir \/var\/lib\/php\/wsdlcache
chown nginx:nginx -R \/var\/lib\/php\/session
chown nginx:nginx -R \/var\/lib\/php\/wsdlcache<\/p>\n\n\n\n
cd \/etc\/nginx\/conf.d\/<\/p>\n\n\n\n
cat > nextcloud.conf << EOF
upstream php-handler {
server 127.0.0.1:9000;
#server unix:\/var\/run\/php5-fpm.sock;
}<\/p>\n\n\n\n
server {
listen 80;
server_name localhost;
# enforce https
rewrite ^(.*)$ https:\/\/$host$1 permanent;
}<\/p>\n\n\n\n
server {
listen 443 ssl;
server_name localhost;<\/p>\n\n\n\n
ssl_certificate \/etc\/nginx\/cert\/nextcloud.crt;
ssl_certificate_key \/etc\/nginx\/cert\/nextcloud.key;<\/p>\n\n\n\n
# Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this
# topic first.
add_header Strict-Transport-Security “max-age=15768000;
includeSubDomains; preload;”;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options “SAMEORIGIN”;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;<\/p>\n\n\n\n
# Path to the root of your installation
root \/data\/web\/nextcloud;<\/p>\n\n\n\n
location = \/robots.txt {
allow all;
log_not_found off;
access_log off;
}<\/p>\n\n\n\n
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you’re planning to use this app.
#rewrite ^\/.well-known\/host-meta \/public.php?service=host-meta last;
#rewrite ^\/.well-known\/host-meta.json \/public.php?service=host-meta-json
# last;<\/p>\n\n\n\n
location = \/.well-known\/carddav {
return 301 $scheme:\/\/$host\/remote.php\/dav;
}
location = \/.well-known\/caldav {
return 301 $scheme:\/\/$host\/remote.php\/dav;
}<\/p>\n\n\n\n
# set max upload size
client_max_body_size 10240M; # \u4e0a\u4f20\u6587\u4ef6\u6700\u5927\u9650\u5236\uff0cphp.ini\u4e2d\u4e5f\u8981\u4fee\u6539\uff0c\u6700\u540e\u4f18\u5316\u65f6\u4f1a\u63d0\u53ca\u3002
fastcgi_buffers 64 4K;<\/p>\n\n\n\n
# Disable gzip to avoid the removal of the ETag header
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application\/atom+xml application\/javascript application\/json application\/ld+json application\/manifest+json application\/rss+xml application\/vnd.geo+json application\/vnd.ms-fontobject application\/x-font-ttf application\/x-web-app-manifest+json application\/xhtml+xml application\/xml font\/opentype image\/bmp image\/svg+xml image\/x-icon text\/cache-manifest text\/css text\/plain text\/vcard text\/vnd.rim.location.xloc text\/vtt text\/x-component text\/x-cross-domain-policy;<\/p>\n\n\n\n
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;<\/p>\n\n\n\n
location \/ {
rewrite ^ \/index.php$uri;
}<\/p>\n\n\n\n
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
deny all;
}
location ~ ^\/(?:\\.|autotest|occ|issue|indie|db_|console) {
deny all;
}<\/p>\n\n\n\n
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|core\/templates\/40[34])\\.php(?:$|\/) {
include fastcgi_params;
fastcgi_split_path_info ^(.+\\.php)(\/.*)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}<\/p>\n\n\n\n
location ~ ^\/(?:updater|ocs-provider)(?:$|\/) {
try_files $uri\/ =404;
index index.php;
}<\/p>\n\n\n\n
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \\.(?:css|js)$ {
try_files $uri \/index.php$uri$is_args$args;
add_header Cache-Control “public, max-age=7200”;
# Add headers to serve security related headers (It is intended to
# have those duplicated to the ones above)
# Before enabling Strict-Transport-Security headers please read into
# this topic first.
add_header Strict-Transport-Security “max-age=15768000;includeSubDomains; preload;”;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options “SAMEORIGIN”;
add_header X-XSS-Protection “1; mode=block”;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don’t log access to assets
access_log off;
}<\/p>\n\n\n\n
location ~* \\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
try_files $uri \/index.php$uri$is_args$args;
# Optional: Don’t log access to other assets
access_log off;
}
}
EOF<\/p>\n\n\n\n
systemctl restart nginx
systemctl restart php-fpm<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"