Prehistory:
A long time ago (about 1.5 years ago), a genius person installed and configured a cloud service for employees based on nextcloud. All this was done on a cluster machine with Windows Server 2016 in a hyper-v virtual machine running CentOS 8 (more details below). The genius person quit his job six months ago and doesn’t remember what and how he configured it, but everything worked, everyone was fine with it and this service would have been left alone if the organization hadn’t decided to upgrade the forest and domain to Windows Server 2019. And then I come into the game and… break everything
How it all started and symptoms:
The server decided to install on a clean machine, but first it was necessary to move all the virtual machines by exporting-import. And so, turned off the VM, exported it, transferred it, then import with registration on another machine, also under the control of the Windows Server 2016. As a result after start - instead of the site “share.OUR_SITE.ru” (xxx.xxx.xxx.xx7) opens just “OUR_SITE.ru”, which has indirect relation to nexcloud and is on another server xxx.xxx.xxx.xx8, and the site is not accessible from external network. When opening from local IP address of virtual machine with nextcloud the same story.
I deleted the imported machine in Hyper-V of the second server, started it again on the original - the problem remained. I check it at night after a lot of tinkering at work - it already gives the following error
Internal Server Error
The server encountered an internal error and was unable to complete your request.
Please contact the server administrator if this error reappears multiple times, please include the technical details below in your report.
More details can be found in the server log.
When trying to access the site by url via CURL from the virtual machine itself, it refers to the correct IP xxx.xxx.xxx.xx7 (“share.OUR_SITE.ru”)
Спойлер
If the same operation is performed for the local IP of the virtual machine 192.168.10.55, then the reference is to the wrong IP xxx.xxx.xxx.xx8 (other machine with “OUR_SITE.ru”)
Configuration:
OS: CentOS 8
Web-server: Nginx 1.14.1
DB: PostgreSQL 10.14 (without postgre-server for some reason )
PHP: php-fpm 7.3.24 (php php-fpm php-cli php-pgsql php-process php-imagick php-zip php-bcmath php-apcu php-igbinary php-xml php-mbstring php-gd php-ldap php-imap php-smbclient php-gmp php-intl php-crypto)
Nextcloud: 20.0.0
Caching is not enabled as far as I understand, since only php-pecl-acpu is installed
Configuration files:
/etc/nginx/nginx.conf
Спойлер
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] “$request” ’
'$status $body_bytes_sent “$http_referer” ’
‘"$http_user_agent" “$http_x_forwarded_for”’;
access_log /var/log/nginx/access.log main;
client_max_body_size 4096M;
server_tokens off;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
/etc/nginx/conf.d/share.OUR_SITE.ru.conf
Спойлер
server {
listen 80;
listen [::]:80;
server_name 192.168.10.55 share.OUR_SITE.ru;
root /var/www/nextcloud;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Frame-Options "SAMEORIGIN";
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
#fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass unix:/run/php-fpm/www.sock;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
location ~ \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=15778463";
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
}
location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
access_log off;
}
}
/var/www/nextcloud/config/config.php
Спойлер
<?php $CONFIG = array ( 'instanceid' => 'АйДи', 'passwordsalt' => 'ПАРОЛЬ', 'secret' => 'СЕКРЕТ', 'trusted_domains' => array ( 0 => '192.168.10.55', ), 'trusted_proxies' => array ( 0 => '10.0.1.1', ), 'enable_previews' => true, 'enabledPreviewProviders' => array ( 0 => 'OC\\Preview\\TXT', 1 => 'OC\\Preview\\MarkDown', 2 => 'OC\\Preview\\OpenDocument', 3 => 'OC\\Preview\\PDF', 4 => 'OC\\Preview\\MSOffice2003', 5 => 'OC\\Preview\\MSOfficeDoc', 6 => 'OC\\Preview\\PDF', 7 => 'OC\\Preview\\Image', 8 => 'OC\\Preview\\Photoshop', 9 => 'OC\\Preview\\TIFF', 10 => 'OC\\Preview\\SVG', 11 => 'OC\\Preview\\Font', 12 => 'OC\\Preview\\MP3', 13 => 'OC\\Preview\\Movie', 14 => 'OC\\Preview\\MKV', 15 => 'OC\\Preview\\MP4', 16 => 'OC\\Preview\\AVI', ), 'overwritehost' => 'share.OUR_SITE.ru', 'overwriteprotocol' => 'https', 'overwritewebroot' => '', 'overwritecondaddr' => '^10\\.0\\.1\\.1$', 'datadirectory' => '/var/www/nextcloud/data', 'dbtype' => 'pgsql', 'version' => '20.0.0.9', 'overwrite.cli.url' => 'http://192.168.10.55', 'dbname' => 'nextcloud', 'dbhost' => '192.168.10.4:5432', 'dbport' => '', 'dbtableprefix' => 'oc_', 'dbuser' => 'nextcloud', 'dbpassword' => 'ПАРОЛЬ', 'installed' => true, 'maintenance' => false, 'mail_from_address' => 'share', 'mail_smtpmode' => 'smtp', 'mail_sendmailmode' => 'smtp', 'mail_domain' => 'OUR_SITE.ru', 'mail_smtpauthtype' => 'LOGIN', 'mail_smtphost' => '192.168.10.9', 'mail_smtpport' => '25', 'memcache.local' => '\\OC\\Memcache\\APCu', 'ldapIgnoreNamingRules' => false, 'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory', 'mail_smtpauth' => 1, 'mail_smtpname' => 'СМТРИМЯ', 'mail_smtppassword' => 'СМТРПАРОЛЬ', );/etc/php.ini /etc/php-fpm.conf (These two have slight changes )
/etc/php-fpm.d/www.conf (here only the user has been changed from the default “apache” to “nginx”)