Example installation on Ubuntu 22.04.03 LTS with Apache2, APCu, redis and mariadb behind a NGINX proxy

saettel.beifuss0 · October 23, 2023, 12:57pm

Hi guys!
I wrote a Nextcloud installation Guide for an Ubuntu bare meta installation behind an NGINX proxy. The goal was to follow Nextclouds recommendations and pass the security scan without errors.

Would love to hear your input. Feel free to give me feedback here or open an issue here:

github.com

jameskimmel/Nextcloud_Ubuntu/blob/main/nextcloud_behind_NGINX_proxy.md

# Example installation on Ubuntu 22.04.03 LTS with Apache2, APCu, redis, and MariaDB behind an NGINX proxy, no Docker, no Snap

## Who is this for?
This is an example installation for Ubuntu users who want to host a Nextcloud instance bare metal. No Docker, no Snap.
The goal of this guide is to have **no warnings in the admin center** and the instance should get a **perfect security score** from scan.nextcloud.com. The official documentation is pretty good, but it can be a little bit overwhelming to newcomers because you need to jump from one topic to another and have to read up on multiple things. This guide should offer you a more streamlined experience.

There are some placeholder values or variables that always start with x_. You need to replace them with your data. 
This is the structure of the setup used in this guide.

![setup](https://github.com/jameskimmel/Nextcloud_Ubuntu/assets/17176225/a5aae0e5-6560-4c4f-9a6d-cf062b1fdb8b)

## Network requirements

If you want to host Nextcloud in your home and want to access it remotely or even share some files externally, there are some network requirements. 
You need a real, public routable, none Carrier-grade NAT (CG-NAT) IPv4 address. 
If you don't have a real IPv4 address, you could ask your ISP to give you one. Some ISPs will give you one for free, others charge you 5$ a month. Some call it "Gaming IP" or "NAS IP". You could also use IPv6 or a VPN instead. If you want to share files externally, only having IPv6 isn't great, since you don't know if all external users are able to use IPv6.  
You also need split DNS described in the next paragraph. 

### Split DNS or Hairpin NAT
Why is split DNS or Hairpin NAT even needed?

This file has been truncated. show original

rstolpe · July 3, 2024, 11:17am

This one is great, I’m gonna do a pull request later where I have added acme for the apache2 on the internal server when your behind nginx proxy.
It’s always good to have ssl all the way even internal.
And with Let’s encrypt it’s easy and if your using wildcard cert it’s even easier as then you don’t need a internal CA and your internal page will not throw SSL warnings for iPhones etc.

saettel.beifuss0 · July 5, 2024, 6:00am

Thank you for your contribution on Github!

Hmm… since the Proxy and the Nextcloud host are the two only hosts in their own VLAN, I never really thought about using SSL internally. Is that not a wast of resources, without any real benefit?

Unfortunately I can’t use wildcard certs.

I solve that in two ways. First of all, I use IPv6. But the macOS desktop client sometimes does not happy eyeball when the laptop wakes from sleep and tries to use IPv4 instead. Then it takes some time for the client to retest connectivity and it shows as offline.
That problem I solve by using hairpin NAT for IPv4.

rstolpe · July 5, 2024, 6:47am

Using let’s encrypt will not take any resources. If you own your own domain you can use the wildcard certificate and then you don’t need an internal CA.
It’s just a crone job that will renew it when needed.
I was thinking to use acme in the guide.

It’s not mandatory ofc you can still use a self signed certificate but
macOS and iOS is a headache to use against servers with self signed certificates.

I’ll try to write it during this weekend, had the flue this week, so typical as it was my last week on my vacation this year.

saettel.beifuss0 · July 5, 2024, 9:16am

The internal traffic will be encrypted ant thous use resources, right?

True, but since my DNS provider is unsupported, manual seems too much of a hassle compared to normal certs.

I don’t need an internal CA. With IPv6 and hairpin NAT, traffic gets to the right place (the proxy not the nextcloud host) to begin with, so no internal certs needed. Yeah, Safari is annoying for not accepting internal certs that are over one year valid.

system · October 3, 2024, 9:17am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.