david/therinaldos.com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate therinaldos.com data
Build & Deploy to DigitalOcean Space / build (push) Failing after 2m38s
Details

Browse Source
This commit is contained in:
david
2024-05-05 15:50:45 -04:00
commit ef1ff240d4
23182 changed files with 3801898 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wedding-pics/core/doc/admin/_sources/ai/index.rst.txt
+115
View File
@@ -0,0 +1,115 @@
=======================
Artificial Intelligence
=======================
We strive to bring Artificial Intelligence features to Nextcloud. This section highlights these features, how they work and where to find them.
All of these features are completely optional and need to be installed via separate Nextcloud Apps.
Overview of AI features
-----------------------
.. csv-table::
:header: "Feature","App","Rating","Open source","Freely available model","Freely available training data","Privacy: Keeps data on premises"
"Smart inbox","`Mail <https://apps.nextcloud.com/apps/mail>`_","Green","Yes","Yes","Yes","Yes"
"Image object recognition","`Recognize <https://apps.nextcloud.com/apps/recognize>`_","Green","Yes","Yes","Yes","Yes"
"Image face recognition","`Recognize <https://apps.nextcloud.com/apps/recognize>`_","Green","Yes","Yes","Yes","Yes"
"Video action recognition","`Recognize <https://apps.nextcloud.com/apps/recognize>`_","Green","Yes","Yes","Yes","Yes"
"Audio music genre recognition","`Recognize <https://apps.nextcloud.com/apps/recognize>`_","Green","Yes","Yes","Yes","Yes"
"Suspicious login detection","`Suspicious Login <https://apps.nextcloud.com/apps/suspicious_login>`_","Green","Yes","Yes","Yes","Yes"
"Related resources","`Related Resources <https://apps.nextcloud.com/apps/related_resources>`_","Green","Yes","Yes","Yes","Yes"
"Recommended files","recommended_files","Green","Yes","Yes","Yes","Yes"
"Machine translation","`Translate <https://apps.nextcloud.com/apps/translate>`_","Green","Yes","Yes - Opus models by University Helsinki","Yes","Yes"
"","`LibreTranslate integration <https://apps.nextcloud.com/apps/integration_libretranslate>`_","Green","Yes","Yes - OpenNMT models","Yes","Yes"
"","`DeepL integration <https://apps.nextcloud.com/apps/integration_deepl>`_","Red","No","No","No","No"
"","`OpenAI and LocalAI integration (via OpenAI API) <https://apps.nextcloud.com/apps/integration_openai>`_","Red","No","No","No","No"
"","`OpenAI and LocalAI integration (via LocalAI) <https://apps.nextcloud.com/apps/integration_openai>`_","Green","Yes","Yes","Yes","Yes"
"Speech-To-Text","`Whisper Speech-To-Text <https://apps.nextcloud.com/apps/stt_whisper>`_","Yellow","Yes","Yes - Whisper models by OpenAI","No","Yes"
"","`OpenAI and LocalAI integration <https://apps.nextcloud.com/apps/integration_openai>`_","Yellow","Yes","Yes - Whisper models by OpenAI","No","No"
"","`Replicate integration <https://apps.nextcloud.com/apps/integration_replicate>`_","Yellow","Yes","Yes - Whisper models by OpenAI","No","No"
"Image generation","`Local Stable Diffusion <https://apps.nextcloud.com/apps/text2image_stablediffusion>`_","Yellow","Yes","Yes - StableDiffusion XL model by StabilityAI","No","Yes"
"","`OpenAI and LocalAI integration (via OpenAI API) <https://apps.nextcloud.com/apps/integration_openai>`_","Red","No","No","No","No"
"","`OpenAI and LocalAI integration (via LocalAI) <https://apps.nextcloud.com/apps/integration_openai>`_","Yellow","Yes","Yes - StableDiffusion models by StabilityAI","No","Yes"
"","`Replicate integration <https://apps.nextcloud.com/apps/integration_replicate>`_","Yellow","Yes","Yes - StableDiffusion models by StabilityAI","No","No"
"Text generation","`Local large language model (via GPT4all Falcon) <https://apps.nextcloud.com/apps/llm>`_","Green","Yes","Yes","Yes","Yes"
"","`Local large language model (via Llama 2) <https://apps.nextcloud.com/apps/llm>`_","Yellow","Yes","Yes","No","Yes"
"","`OpenAI and LocalAI integration (via OpenAI API) <https://apps.nextcloud.com/apps/integration_openai>`_","Red","No","No","No","No"
"","`OpenAI and LocalAI integration (via LocalAI) <https://apps.nextcloud.com/apps/integration_openai>`_","Green","Yes","Yes","Yes","Yes"
"Context Chat","`Nextcloud Assistant Context Chat <https://apps.nextcloud.com/apps/context_chat>`_","Yellow","Yes","Yes","No","Yes"
"","`Nextcloud Assistant Context Chat (Backend) <https://apps.nextcloud.com/apps/context_chat_backend>`_","Yellow","Yes","Yes","No","Yes"
Ethical AI Rating
-----------------
Until Hub 3, we succeeded in offering features without relying on proprietary blobs or third party services. Yet, while there is a large community developing ethical, safe and privacy-respecting technologies, there are many other relevant technologies users might want to use. We want to provide users with these cutting-edge technologies – but also be transparent. For some use cases, ChatGPT might be a reasonable solution, while for more private, professional or sensitive data, it is paramount to have a local, on-prem, open solution. To differentiate these, we developed an Ethical AI Rating.
The rating has four levels:
* Red
* Orange
* Yellow
* Green
It is based on points from these factors:
* Is the software (both for inferencing and training) under a free and open source license?
* Is the trained model freely available for self-hosting?
* Is the training data available and free to use?
If all of these points are met, we give a Green label. If none are met, it is Red. If 1 condition is met, it is Orange and if 2 conditions are met, Yellow.
Features used by other apps
---------------------------
Some of our AI features are realized as generic APIs that any app can use and any app can provide an implementation for by registering a provider. So far, these are
Machine translation, Speech-To-Text and Text processing.
Machine translation
^^^^^^^^^^^^^^^^^^^
As you can see in the table above we have multiple apps offering machine translation capabilities. Each app brings its own set of supported languages.
In downstream apps like the Text app, users can use the translation functionality regardless of which app implements it behind the scenes.
Implementing apps
~~~~~~~~~~~~~~~~~
* *Text* for offering the translation menu
* `Analytics <https://apps.nextcloud.com/apps/analytics>`_ for translating graph labels
Speech-To-Text
^^^^^^^^^^^^^^
As you can see in the table above we have multiple apps offering Speech-To-Text capabilities. In downstream apps like the Talk app, users can use the transcription functionality regardless of which app implements it behind the scenes.
Implementing apps
~~~~~~~~~~~~~~~~~
* `Speech-to-Text Helper <https://apps.nextcloud.com/apps/stt_helper>`_ for providing a Speech-To-Text smart picker
* `Talk <https://apps.nextcloud.com/apps/spreed>`_ for transcribing calls (see `Nextcloud Talk docs <https://nextcloud-talk.readthedocs.io/en/latest/settings/#app-configuration>`_ for how to enable this)
Text processing
^^^^^^^^^^^^^^^
As you can see in the table above we have multiple apps offering Text processing capabilities. In downstream apps like the Nextcloud Assistant app, users can use the text processing functionality regardless of which app implements it behind the scenes.
Implementing apps
~~~~~~~~~~~~~~~~~
* `Assistant <https://apps.nextcloud.com/apps/assistant>`_ for various tasks
* `Mail <https://apps.nextcloud.com/apps/mail>`_ for summarizing mail threads (see :ref:`the Nextcloud Mail docs<mail_thread_summary>` for how to enable this)
Image generation
^^^^^^^^^^^^^^^^
As you can see in the table above we have multiple apps offering Image generation capabilities. In downstream apps like the Text-to-Image helper app, users can use the image generation functionality regardless of which app implements it behind the scenes.
Implementing apps
~~~~~~~~~~~~~~~~~
* `Text-to-Image Helper <https://apps.nextcloud.com/apps/stt_helper>`_ for providing a Text-to-Image smart picker
Context Chat (Tech preview)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
Our Context Chat feature was introduced in Nextcloud Hub 7 (v28). It allows asking questions to the assistant related to your documents in Nextcloud. You will need to install both the context_chat app as well as the context_chat_backend External App. Be prepared that things might break or be a little rough around the edges. We look forward to your feedback!
Implementing apps
~~~~~~~~~~~~~~~~~
* `Assistant <https://apps.nextcloud.com/apps/assistant>`_ for the context chat task
wedding-pics/core/doc/admin/_sources/apps_management.rst.txt
+129
View File
@@ -0,0 +1,129 @@
===============
Apps management
===============
Nextcloud apps can enhance, customize or even restrict the features and experience
you and your users has with the Nextcloud server. Next to default enabled functions
like Files, Activity and Photos there are other apps like Calendar, Contacts,
Talk and more which are enhancing the features of your Nextcloud server.
After installing the Nextcloud server, you might want to consider about enabling,
disabling or even restricting some apps to groups depending on your and your users'
needs.
Apps
----
.. figure:: images/apps_overview.png
:alt: Apps page for enabling and disabling apps.
During the Nextcloud server installation, some apps are enabled by default.
To see which apps are enabled go to your Apps page.
Those apps are supported and developed by Nextcloud GmbH directly and
have an **Featured**-tag. See :doc:`installation/apps_supported` for a list of supported apps.
.. note:: Your Nextcloud server needs to be able to communicate with
``https://apps.nextcloud.com`` to list and download apps. Please make sure to whitelist this target in your firewall or proxy if necessary.
.. note:: To get access to work-arounds, long-term-support, priority bug fixing
and custom consulting for supported apps, contact our `sales team <https://nextcloud.com/enterprise/>`_.
.. note:: If you would like to develop your own Nextcloud app, you can find out
more information in our `developer manual <https://docs.nextcloud.com/server/latest/go.php?to=developer-manual>`_.
.. TODO ON RELEASE: Update version number above on release
All apps must be licensed under AGPLv3+ or any compatible license.
Managing apps
-------------
.. figure:: images/apps_store.png
:alt: App store page for installing, enabling and disabling apps.
You will see which apps are enabled, disabled and available. You'll also
see additional app bundles and filters, such as Customization, Security and
Monitoring for finding more apps quickly.
In the Apps page you can enable or disable applications. Some apps have
configurable options on the Apps page, such as **Enable only for specific
groups**, but mainly they are enabled or disabled here, and are configured in
your Nextcloud settings (admin and/or user-settings) or in the ``config.php``.
Click the app name to view a description of the app and any of the app settings
in the Application View field. Clicking the **Enable** button will enable the app.
If the app is not part of the Nextcloud installation, it will be downloaded from
the app store, installed and enabled.
App updates will also be offered to you on this page. Simply click on the **Update**
button to update a specific app or use the **Update all** button on top of the page to
update all apps.
.. note:: **Beta releases**: You can also install beta releases of apps directly from here by
switching your Nextcloud to the beta channel in the admin overview.
Using private API
-----------------
If private API, rather than the public APIs are used in a third-party app, the
installation fails, if ``'appcodechecker' => true,`` is set in ``config.php``.
Using custom app directories
----------------------------
Use the **apps_paths** array in ``config.php`` to set any custom apps directory
locations. The key **path** defines the absolute file system path to the app
folder. The key **url** defines the HTTP web path to that folder, starting at
the Nextcloud web root. The key **writable** indicates if a user can install apps
in that folder.
.. note:: To ensure that the default **/apps/** folder only contains apps
shipped with Nextcloud, follow this example to setup an **/apps2/** folder
which will be used to store all other apps.
::
"apps_paths" => [
[
"path" => OC::$SERVERROOT . "/apps",
"url" => "/apps",
"writable" => false,
],
[
"path" => OC::$SERVERROOT . "/apps2",
"url" => "/apps2",
"writable" => true,
],
],
.. note:: Apps paths can be located outside the server root. However, for any
**path** outside the server root, you need to create a symlink in the server
root that points **url** to **path**.
For instance, if **path** is ``/var/local/lib/nextcloud/apps``, and **url**
is ``/apps2``, then you would do this in the server root:
``ln -sf /var/local/lib/nextcloud/apps ./apps2``
Using a self hosted apps store
------------------------------
Enables the installation of apps from a self hosted apps store. Requires that at least one of the configured apps directories is writeable.
To enable a self hosted apps store:
1. Set the **appstoreenabled** parameter to "true".
This parameter is used to enable the apps store in Nextcloud.
2. Set the **appstoreurl** to the URL of your Nextcloud apps store.
This parameter is used to set the http path to your self hosted Nextcloud apps store.
::
"appstoreenabled" => true,
"appstoreurl" => "https://my.appstore.instance/v1",
By default the apps store is enabled and configured to use ``https://apps.nextcloud.com/api/v1`` as apps store url. Nextcloud will fetch ``apps.json`` and ``categories.json`` from there. To use the defaults again remove **appstoreenabled** and **appstoreurl** from the configuration.
Example: If ``categories.json`` is available at ``https://apps.nextcloud.com/api/v1/categories.json`` the apps store url is ``https://apps.nextcloud.com/api/v1``.
wedding-pics/core/doc/admin/_sources/configuration_database/bigint_identifiers.rst.txt
+27
View File
@@ -0,0 +1,27 @@
==========================
BigInt (64bit) identifiers
==========================
Nextcloud uses big integers to store identifiers and auto-increment keys in the database.
Because changing columns on huge tables can take quite a while (up to hours or days)
depending on the number of files in the Nextcloud instance, this migration on the filecache
and activity table has to be triggered manually by a console command.
The command can safely be executed. It will show a success message when there is nothing to do::
sudo -u www-data php occ db:convert-filecache-bigint
All tables already up to date!
or otherwise ask for confirmation, before performing the heavy actions::
sudo -u www-data php occ db:convert-filecache-bigint
This can take up to hours, depending on the number of files in your instance!
Continue with the conversion (y/n)? [n]
to suppress the confirmation message append ``--no-interaction`` to the argument list::
sudo -u www-data php occ db:convert-filecache-bigint --no-interaction
.. note:: Similar to a normal update, you should shutdown your Apache or nginx server or enable maintenance
mode before running the command to avoid issues with your sync clients.
wedding-pics/core/doc/admin/_sources/configuration_database/db_conversion.rst.txt
+75
View File
@@ -0,0 +1,75 @@
========================
Converting database type
========================
You can convert a SQLite database to a better performing MySQL, MariaDB or
PostgreSQL database with the Nextcloud command line tool. SQLite is good for
testing and simple single-user Nextcloud servers, but it does not scale for
multiple-user production servers.
Run the conversion
------------------
First set up the new database, here called "new_db_name".
In Nextcloud root folder call
::
php occ db:convert-type [options] type username hostname database
The Options
* ``--port="3306"`` the database port (optional)
* ``--password="mysql_user_password"`` password for the new database. If omitted the tool will ask you (optional)
* ``--clear-schema`` clear schema (optional)
* ``--all-apps`` by default, tables for enabled apps are converted, use to convert also tables of deactivated apps (optional)
* ``-n, --no-interaction`` do not ask any interactive question
*Note:* The converter searches for apps in your configured app folders and uses
the schema definitions in the apps to create the new table. So tables of removed
apps will not be converted even with option ``--all-apps``
For example
::
php occ db:convert-type --all-apps mysql oc_mysql_user 127.0.0.1 new_db_name
To successfully proceed with the conversion, you must type ``yes`` when prompted
with the question ``Continue with the conversion?``
On success the converter will automatically configure the new database in your
Nextcloud config ``config.php``.
Inconvertible tables
--------------------
If you updated your Nextcloud instance, there might be remnants of old tables
which are not used any more. The updater will tell you which ones these are.
::
The following tables will not be converted:
oc_permissions
...
You can ignore these tables.
Here is a list of known old tables:
* oc_calendar_calendars
* oc_calendar_objects
* oc_calendar_share_calendar
* oc_calendar_share_event
* oc_fscache
* oc_log
* oc_media_albums
* oc_media_artists
* oc_media_sessions
* oc_media_songs
* oc_media_users
* oc_permissions
* oc_privatedata - this table was later added again by the app `privatedata` (https://apps.nextcloud.com/apps/privatedata) and is safe to be removed if that app is not enabled
* oc_queuedtasks
* oc_sharing
wedding-pics/core/doc/admin/_sources/configuration_database/index.rst.txt
+12
View File
@@ -0,0 +1,12 @@
======================
Database configuration
======================
.. toctree::
:maxdepth: 2
db_conversion
linux_database_configuration
mysql_4byte_support
bigint_identifiers
splitting
wedding-pics/core/doc/admin/_sources/configuration_database/linux_database_configuration.rst.txt
+393
View File
@@ -0,0 +1,393 @@
======================
Database configuration
======================
Nextcloud requires a database in which administrative data is stored. The following databases are currently supported:
* `MySQL <https://www.mysql.com/>`_ / `MariaDB <https://mariadb.org/>`_
* `PostgreSQL <https://www.postgresql.org/>`_
* `Oracle <http://www.oracle.com/>`_
The MySQL or MariaDB databases are the recommended database engines.
Requirements
------------
Choosing to use MySQL / MariaDB, PostgreSQL, or Oracle as your database
requires that you install and set up the server software first.
.. note:: The steps for configuring a third party database are beyond the
scope of this document. Please refer to the documentation for your specific
database choice for instructions.
.. _db-transaction-label:
Database "READ COMMITTED" transaction isolation level
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
As discussed above Nextcloud is using the ``TRANSACTION_READ_COMMITTED`` transaction isolation
level. Some database configurations are enforcing other transaction isolation levels. To avoid
data loss under high load scenarios (e.g. by using the sync client with many clients/users and
many parallel operations) you need to configure the transaction isolation level accordingly.
Please refer to the `MySQL manual <https://dev.mysql.com/doc/refman/5.7/en/set-transaction.html>`_
for detailed information.
Parameters
----------
For setting up Nextcloud to use any database, use the instructions in :doc:`../installation/installation_wizard`. You should not have to edit the respective values in the :file:`config/config.php`. However, in special cases (for example, if you want to connect your Nextcloud instance to a database created by a previous installation of Nextcloud), some modification might be required.
Configuring a MySQL or MariaDB database
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you decide to use a MySQL or MariaDB database, ensure the following:
* The transaction isolation level is set to "READ-COMMITTED" in your MariaDB server configuration :file:`/etc/mysql/my.cnf` to persist even after a restart of your database server.
Verify the **transaction_isolation** and **binlog_format**:
::
[mysqld]
...
transaction_isolation = READ-COMMITTED
binlog_format = ROW
...
Your :file:`/etc/mysql/my.cnf` could look like this:
::
[server]
skip_name_resolve = 1
innodb_buffer_pool_size = 128M
innodb_buffer_pool_instances = 1
innodb_flush_log_at_trx_commit = 2
innodb_log_buffer_size = 32M
innodb_max_dirty_pages_pct = 90
query_cache_type = 1
query_cache_limit = 2M
query_cache_min_res_unit = 2k
query_cache_size = 64M
tmp_table_size= 64M
max_heap_table_size= 64M
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 1
[client-server]
!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mariadb.conf.d/
[client]
default-character-set = utf8mb4
[mysqld]
character_set_server = utf8mb4
collation_server = utf8mb4_general_ci
transaction_isolation = READ-COMMITTED
binlog_format = ROW
innodb_large_prefix=on
innodb_file_format=barracuda
innodb_file_per_table=1
Please refer to the `page in the MySQL manual <https://mariadb.com/kb/en/library/set-transaction/#read-committed>`_.
* That you have installed and enabled the pdo_mysql extension in PHP
* That the **mysql.default_socket** points to the correct socket (if the database runs on the same server as Nextcloud).
.. note:: MariaDB is backwards compatible with MySQL. All instructions work for both. You will not need to replace mysql with anything.
The PHP configuration in :file:`/etc/php7/conf.d/mysql.ini` could look like this:
::
# configuration for PHP MySQL module
extension=pdo_mysql.so
[mysql]
mysql.allow_local_infile=On
mysql.allow_persistent=On
mysql.cache_size=2000
mysql.max_persistent=-1
mysql.max_links=-1
mysql.default_port=
mysql.default_socket=/var/lib/mysql/mysql.sock # Debian squeeze: /var/run/mysqld/mysqld.sock
mysql.default_host=
mysql.default_user=
mysql.default_password=
mysql.connect_timeout=60
mysql.trace_mode=Off
Now you need to create a database user and the database itself by using the
MySQL command line interface. The database tables will be created by Nextcloud
when you login for the first time.
To start the MySQL command line mode use::
mysql -uroot -p
When using MariaDB use::
mariadb -uroot -p
Then a **mysql>** or **MariaDB [root]>** prompt will appear. Now enter the following lines and confirm them with the enter key:
::
CREATE USER 'username'@'localhost' IDENTIFIED BY 'password';
CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
GRANT ALL PRIVILEGES on nextcloud.* to 'username'@'localhost';
You can quit the prompt by entering::
quit;
A Nextcloud instance configured with MySQL would contain the hostname on which
the database is running, a valid username and password to access it, and the
name of the database. The :file:`config/config.php` as created by the
:doc:`../installation/installation_wizard` would therefore contain entries like
this:
::
<?php
"dbtype" => "mysql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpassword" => "password",
"dbhost" => "localhost",
"dbtableprefix" => "oc_",
In case of UTF8MB4 you will also find::
"mysql.utf8mb4" => true,
SSL for MySQL Database
^^^^^^^^^^^^^^^^^^^^^^
Enabling SSL is only necessary if your database does not reside on the same server as your Nextcloud instance.
If you do not connect over localhost and need to allow remote connections then you should enable SSL.
This just covers the SSL database configuration on the Nextcloud server. First you need to configure your database server accordingly.
::
'dbdriveroptions' => [
\PDO::MYSQL_ATTR_SSL_KEY => '/../ssl-key.pem',
\PDO::MYSQL_ATTR_SSL_CERT => '/../ssl-cert.pem',
\PDO::MYSQL_ATTR_SSL_CA => '/../ca-cert.pem',
\PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true,
],
Adjust the paths to the pem files for your environment.
PostgreSQL database
^^^^^^^^^^^^^^^^^^^
In order to run Nextcloud securely on PostgreSQL, it is assumed that only
Nextcloud uses this database and thus only one user accesses the database.
For further services and users, we recommend to create a separate
database or PostgreSQL instance.
If you decide to use a PostgreSQL database make sure that you have installed
and enabled the PostgreSQL extension in PHP. The PHP configuration in :file:`/etc/php7/conf.d/pgsql.ini` could look
like this:
::
# configuration for PHP PostgreSQL module
extension=pdo_pgsql.so
extension=pgsql.so
[PostgresSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0
The default configuration for PostgreSQL (at least in Ubuntu 14.04) is to use the peer authentication method. Check :file:`/etc/postgresql/9.3/main/pg_hba.conf` to find out which authentication method is used in your setup.
To start the postgres command line mode use::
sudo -u postgres psql -d template1
Then a **template1=#** prompt will appear. Now enter the following lines and confirm them with the enter key:
::
CREATE USER username CREATEDB;
CREATE DATABASE nextcloud OWNER username TEMPLATE template0 ENCODING 'UTF8';
GRANT CREATE ON SCHEMA public TO username;
You can quit the prompt by entering::
\q
A Nextcloud instance configured with PostgreSQL would contain the path to the socket on
which the database is running as the hostname, the system username the PHP process is using,
and an empty password to access it, and the name of the database. The :file:`config/config.php` as
created by the :doc:`../installation/installation_wizard` would therefore contain entries like
this:
::
<?php
"dbtype" => "pgsql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpassword" => "",
"dbhost" => "/var/run/postgresql",
"dbtableprefix" => "oc_",
.. note:: The host actually points to the socket that is used to connect to the database. Using localhost here will not work if postgreSQL is configured to use peer authentication. Also note that no password is specified, because this authentication method doesn't use a password.
If you use another authentication method (not peer), you'll need to use the following steps to get the database setup:
Now you need to create a database user and the database itself by using the
PostgreSQL command line interface. The database tables will be created by
Nextcloud when you login for the first time.
To start the postgres command line mode use::
psql -hlocalhost -Upostgres
Then a **postgres=#** prompt will appear. Now enter the following lines and confirm them with the enter key:
::
CREATE USER username WITH PASSWORD 'password' CREATEDB;
CREATE DATABASE nextcloud TEMPLATE template0 ENCODING 'UTF8';
ALTER DATABASE nextcloud OWNER TO username;
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO username;
GRANT ALL PRIVILEGES ON SCHEMA public TO username;
You can quit the prompt by entering::
\q
A Nextcloud instance configured with PostgreSQL would contain the hostname on
which the database is running, a valid username and password to access it, and
the name of the database. The :file:`config/config.php` as created by the
:doc:`../installation/installation_wizard` would therefore contain entries like
this:
::
<?php
"dbtype" => "pgsql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpassword" => "password",
"dbhost" => "localhost",
"dbtableprefix" => "oc_",
.. _db-troubleshooting-label:
Troubleshooting
---------------
How to work around "general error: 2006 MySQL server has gone away"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The database request takes too long and therefore the MySQL server times out. It's
also possible that the server is dropping a packet that is too large. Please
refer to the manual of your database for how to raise the configuration options
``wait_timeout`` and/or ``max_allowed_packet``.
Some shared hosters are not allowing the access to these config options. For such
systems Nextcloud is providing a ``dbdriveroptions`` configuration option within your
:file:`config/config.php` where you can pass such options to the database driver.
Please refer to :doc:`../configuration_server/config_sample_php_parameters` for an example.
How can I find out if my MySQL/PostgreSQL server is reachable?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To check the server's network availability, use the ping command on
the server's host name (db.server.com in this example)::
ping db.server.com
::
PING db.server.com (ip-address) 56(84) bytes of data.
64 bytes from your-server.local.lan (192.168.1.10): icmp_req=1 ttl=64 time=3.64 ms
64 bytes from your-server.local.lan (192.168.1.10): icmp_req=2 ttl=64 time=0.055 ms
64 bytes from your-server.local.lan (192.168.1.10): icmp_req=3 ttl=64 time=0.062 ms
For a more detailed check whether the access to the database server software
itself works correctly, see the next question.
How can I find out if a created user can access a database?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The easiest way to test if a database is accessible is by starting the
command line interface:
**MySQL**:
Assuming the database server is installed on the same system you're running
the command from, use::
mysql -uUSERNAME -p
To access a MySQL installation on a different machine, add the -h option with
the respective host name::
mysql -uUSERNAME -p -h HOSTNAME
::
mysql> SHOW VARIABLES LIKE "version";
+---------------+--------+
| Variable_name | Value |
+---------------+--------+
| version | 8.0.22 |
+---------------+--------+
1 row in set (0.00 sec)
mysql> quit
**PostgreSQL**:
Assuming the database server is installed on the same system you're running
the command from, use::
psql -Uusername -dnextcloud
To access a PostgreSQL installation on a different machine, add the -h option with
the respective host name::
psql -Uusername -dnextcloud -h HOSTNAME
::
postgres=# SELECT version();
PostgreSQL 8.4.12 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 4.1.3 20080704 (prerelease), 32-bit
(1 row)
postgres=# \q
Useful SQL commands
^^^^^^^^^^^^^^^^^^^
**Show Database Users**::
MySQL : SELECT User,Host FROM mysql.user;
PostgreSQL: SELECT * FROM pg_user;
**Show available Databases**::
MySQL : SHOW DATABASES;
PostgreSQL: \l
**Show Nextcloud Tables in Database**::
MySQL : USE nextcloud; SHOW TABLES;
PostgreSQL: \c nextcloud; \d
**Quit Database**::
MySQL : quit
PostgreSQL: \q
wedding-pics/core/doc/admin/_sources/configuration_database/mysql_4byte_support.rst.txt
+74
View File
@@ -0,0 +1,74 @@
=============================
Enabling MySQL 4-byte support
=============================
.. note::
Be sure to backup your database before performing this database upgrade.
In order to use Emojis (textbased smilies) on your Nextcloud server with a MySQL database, the
installation needs to be tweaked a bit.
.. warning::
This manual only covers MySQL 8 or newer and MariaDB 10.2 or newer.
If you use MariaDB 10.2, please check
`this older version <https://docs.nextcloud.com/server/20/admin_manual/configuration_database/mysql_4byte_support.html#mariadb-10-2-or-earlier>`_
of the documentation. If you use an older version of MySQL or MariaDB, please note that they are no longer supported
by the current Nextcloud version.
1. Make sure the following InnoDB settings are set on your MySQL server::
[mysqld]
innodb_file_per_table=1
2. Restart the MySQL server in case you changed the configuration in step 1.
You can then verify that the change worked:
.. code-block:: sql
SHOW VARIABLES LIKE 'innodb_file_per_table';
The result should look like this::
mysql> SHOW VARIABLES LIKE 'innodb_file_per_table';
+-----------------------+-------+
| Variable_name | Value |
+-----------------------+-------+
| innodb_file_per_table | ON |
+-----------------------+-------+
1 row in set (0.00 sec)
3. Open a shell, change dir (adjust ``/var/www/nextcloud`` to your nextcloud location if needed), and put your nextcloud instance in maintenance mode, if it isn't already::
$ cd /var/www/nextcloud
$ sudo -u www-data php occ maintenance:mode --on
4. Change your databases character set and collation:
.. code-block:: sql
ALTER DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
5. Set the ``mysql.utf8mb4`` config to true in your config.php::
$ sudo -u www-data php occ config:system:set mysql.utf8mb4 --type boolean --value="true"
6. Convert all existing tables to the new collation by running the repair step::
$ sudo -u www-data php occ maintenance:repair
.. note::
This will also change the `ROW_FORMAT` to `DYNAMIC` for your tables.
7. Disable maintenance mode::
$ sudo -u www-data php occ maintenance:mode --off
Now you should be able to use Emojis in your file names, calendar events, comments and many more.
.. note::
Also make sure your backup strategy still work. If you use ``mysqldump`` make sure to add the ``--default-character-set=utf8mb4`` option. Otherwise your backups are broken and restoring them will result in ``?`` instead of the emojis, making files inaccessible.
wedding-pics/core/doc/admin/_sources/configuration_database/splitting.rst.txt
+67
View File
@@ -0,0 +1,67 @@
===================
Splitting databases
===================
.. warning::
This is still proof-of-concept level. Use with care.
In order to scale at some point it might make sense to split out some tables or apps
which allow it as they might be better off with a different replication methods, etc.
A first attempt we do right now with the activity table. In order to make use of this,
the app/table needs to match the following criteria:
* No other apps are allowed to have queries directly to the table
* No JOINs are performed between this table and any other tables not on this new separate connection
* The app needs to support a connection parameter prefix
In case of the activity app the prefix is ``activity_``. If a database config is not
specified it falls back to the normal database configuration option for this value:
* ``activity_dbuser`` falling back to ``dbuser``
* ``activity_dbpassword`` falling back to ``dbpassword``
* ``activity_dbname`` falling back to ``dbname``
* ``activity_dbhost`` falling back to ``dbhost``
* ``activity_dbport`` falling back to ``dbport``
* ``activity_dbdriveroptions`` falling back to ``dbdriveroptions``
.. note::
It is not possible to use a different database type (SQLite, MySQL, PostrgreSQL, Oracle)
for a split database. Also in case of MySQL and MariaDB the utf8mb4 option needs to be
the same on both databases.
Initial splitting
-----------------
For the initial split the affected tables have to be copied over to the new database,
in case of the activity app these are:
* ``oc_activity``
* ``oc_activity_mq``
1. Enable maintenance mode
2. Make sure optional database changes are applied:
1. ``occ db:convert-mysql-charset``
2. ``occ db:convert-filecache-bigint``
3. ``occ db:add-missing-columns``
4. ``occ db:add-missing-indices``
5. ``occ db:add-missing-primary-keys``
3. Specify the desired configuration values
4. Copy the 2 tables to the new database
5. Disable maintenance mode
Migrations on updates
---------------------
We will try to avoid migrations on those tables in the future, but it might be necessary at some point.
We hope to have a dedicated plan by the time this happens. For now a potential way would be:
1. Enable maintenance mode
2. Update as usual
3. Execute manual queries for schema changes provided by the app authors
4. Execute manual queries for data changes provided by the app authors
5. Disable maintenance mode
wedding-pics/core/doc/admin/_sources/configuration_files/big_file_upload_configuration.rst.txt
+183
View File
@@ -0,0 +1,183 @@
===========================
Uploading big files > 512MB
===========================
The default maximum file size for uploads is 512MB. You can increase this
limit up to what your filesystem and operating system allows. There are certain
hard limits that cannot be exceeded:
* < 2GB on 32Bit OS-architecture
* < 2GB with IE6 - IE8
* < 4GB with IE9 - IE11
64-bit filesystems have much higher limits; consult the documentation for your
filesystem.
.. note:: The Nextcloud sync client is not affected by these upload limits
as it is uploading files in smaller chunks. See `Client documentation <https://docs.nextcloud.com/desktop/latest/advancedusage.html>`_
for more information on configuration options.
System configuration
--------------------
* Make sure that the latest version of PHP is installed
* Disable user quotas, which makes them unlimited
* Your temp file or partition has to be big enough to hold multiple
parallel uploads from multiple users; e.g. if the max upload size is 10GB and
the average number of users uploading at the same time is 100: temp space has
to hold at least 10x100 GB
Configuring your Web server
---------------------------
.. note:: Nextcloud comes with its own ``nextcloud/.htaccess`` file. Because ``php-fpm``
can't read PHP settings in ``.htaccess`` these settings must be set in the
``nextcloud/.user.ini`` file.
Set the following two parameters inside the corresponding php.ini file (see the
**Loaded Configuration File** section of :ref:`label-phpinfo` to find your
relevant php.ini files) ::
php_value upload_max_filesize 16G
php_value post_max_size 16G
The ``upload_max_filesize`` and ``post_max_size`` settings may not apply to file uploads
through WebDAV single file PUT requests or `Chunked file uploads
<https://docs.nextcloud.com/server/latest/developer_manual/client_apis/WebDAV/chunking.html>`_
For those, PHP and webserver timeouts are the limiting factor on the upload size.
.. TODO ON RELEASE: Update version number above on release
Adjust these values for your needs. If you see PHP timeouts in your logfiles,
increase the timeout values, which are in seconds::
php_value max_input_time 3600
php_value max_execution_time 3600
The `mod_reqtimeout <https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html>`_
Apache module could also stop large uploads from completing. If you're using this
module and getting failed uploads of large files either disable it in your Apache
config or raise the configured ``RequestReadTimeout`` timeouts.
There are also several other configuration options in your Web server config which
could prevent the upload of larger files. Please see the manual of your Web server
for how to configure those values correctly:
Apache
^^^^^^
* `LimitRequestBody <https://httpd.apache.org/docs/current/en/mod/core.html#limitrequestbody>`_ (In Apache HTTP Server <=2.4.53 this defaulted to unlimited, but now defaults to 1 GiB. The new default limits uploads from non-chunking clients to 1 GiB. If this is a concern in your environment, override the new default by either manually setting it to ``0`` or to a value similar to that used for your local environment's PHP ``upload_max_filesize / post_max_size / memory_limit`` parameters.)
* `SSLRenegBufferSize <https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslrenegbuffersize>`_
* `Timeout <https://httpd.apache.org/docs/current/mod/core.html#timeout>`_
Apache with mod_fcgid
^^^^^^^^^^^^^^^^^^^^^
* `FcgidMaxRequestInMem <https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html#fcgidmaxrequestinmem>`_
* `FcgidMaxRequestLen <https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html#fcgidmaxrequestlen>`_
.. note:: If you are using Apache/2.4 with mod_fcgid, as of February/March 2016,
``FcgidMaxRequestInMem`` still needs to be significantly increased from its default value
to avoid the occurrence of segmentation faults when uploading big files. This is not a regular
setting but serves as a workaround for `Apache with mod_fcgid bug #51747 <https://bz.apache.org/bugzilla/show_bug.cgi?id=51747>`_.
Setting ``FcgidMaxRequestInMem`` significantly higher than normal may no longer be
necessary, once bug #51747 is fixed.
Apache with mod_proxy_fcgi
^^^^^^^^^^^^^^^^^^^^^^^^^^
* `ProxyTimeout <https://httpd.apache.org/docs/current/mod/mod_proxy.html#proxytimeout>`_
nginx
^^^^^
* `client_max_body_size <https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size>`_
* `fastcgi_read_timeout <https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_read_timeout>`_
* `client_body_temp_path <https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_temp_path>`_
Since nginx 1.7.11 a new config option `fastcgi_request_buffering
<https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_request_buffering>`_
is available. Setting this option to ``fastcgi_request_buffering off;`` in your nginx config
might help with timeouts during the upload. Furthermore it helps if you're running out of
disc space on the tmp partition of your system.
.. note:: Make sure that ``client_body_temp_path`` points to a partition with
adequate space for your upload file size, and on the same partition as
the ``upload_tmp_dir`` or ``tempdirectory`` (see below). For optimal
performance, place these on a separate hard drive that is dedicated to
swap and temp storage.
If your site is behind a nginx frontend (for example a loadbalancer):
By default, downloads will be limited to 1GB due to ``proxy_buffering`` and ``proxy_max_temp_file_size`` on the frontend.
* If you can access the frontend's configuration, disable `proxy_buffering <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering>`_ or increase `proxy_max_temp_file_size <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_max_temp_file_size>`_ from the default 1GB.
* If you do not have access to the frontend, set the `X-Accel-Buffering <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering>`_ header to ``add_header X-Accel-Buffering no;`` on your backend server.
Configuring PHP
---------------
If you don't want to use the Nextcloud ``.htaccess`` or ``.user.ini`` file, you may
configure PHP instead. Make sure to comment out any lines ``.htaccess``
pertaining to upload size, if you entered any.
If you are running Nextcloud on a 32-bit system, any ``open_basedir`` directive
in your ``php.ini`` file needs to be commented out.
Set the following two parameters inside ``php.ini``, using your own desired
file size values::
upload_max_filesize = 16G
post_max_size = 16G
Tell PHP which temp directory you want it to use::
upload_tmp_dir = /var/big_temp_file/
**Output Buffering** must be turned off in ``.htaccess`` or ``.user.ini`` or ``php.ini``, or PHP
will return memory-related errors:
* ``output_buffering = 0``
Configuring Nextcloud
---------------------
As an alternative to the ``upload_tmp_dir`` of PHP (e.g. if you don't have access to your
``php.ini``) you can also configure a temporary location for uploaded files by using the
``tempdirectory`` setting in your ``config.php`` (See :doc:`../configuration_server/config_sample_php_parameters`).
If you have configured the ``session_lifetime`` setting in your ``config.php``
(See :doc:`../configuration_server/config_sample_php_parameters`) file then
make sure it is not too
low. This setting needs to be configured to at least the time (in seconds) that
the longest upload will take. If unsure remove this completely from your
configuration to reset it to the default shown in the ``config.sample.php``.
Adjust chunk size on Nextcloud side
-----------------------------------
For upload performance improvements in environments with high upload bandwidth, the server's upload chunk size may be adjusted::
sudo -u www-data php occ config:app:set files max_chunk_size --value 20971520
Put in a value in bytes (in this example, 20MB). Set ``--value 0`` for no chunking at all.
Default is 10485760 (10 MiB).
.. note:: Changing ``max_chunk_size`` will not have any performance impact on files uploaded through File Drop shares as unauthenticated file uploads are not chunked.
Large file upload on object storage
-----------------------------------
`Chunked file uploads <https://docs.nextcloud.com/server/latest/developer_manual/client_apis/WebDAV/chunking.html>`_
do have a larger space consumption on the temporary folder when processing those uploads
on object storage as the individual chunks get downloaded from the storage and will be assembled
to the actual file on the Nextcloud servers temporary directory. It is recommended to increase
the size of your temp directory accordingly and also ensure that request timeouts are high
enough for PHP, webservers or any load balancers involved.
Federated Cloud Sharing
-----------------------
If you are using `Federated Cloud Sharing <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/federated_cloud_sharing_configuration.html>`_ and want to share large files, you can increase the timeout values for requests to the federated servers.
Therefore, you can set ``davstorage.request_timeout`` in your ``config.php``. The default value is 30 seconds.
.. TODO ON RELEASE: Update version number above on release
wedding-pics/core/doc/admin/_sources/configuration_files/default_files_configuration.rst.txt
+42
View File
@@ -0,0 +1,42 @@
=======================
Providing default files
=======================
You may distribute a set of default files and folders to all users by placing
them in directory that is readable by the webserver user. This allows you to
overwrite the files that are shipped by default with Nextcloud in
``core/skeleton``. That custom directory should then be configured in the
``config.php`` via the configuration option ``skeletondirectory`` (see
:doc:`../configuration_server/config_sample_php_parameters`). Leave
empty to not copy any skeleton files.
These files will be copied only to new users after their initial login, and
existing users will not see files that are added to this directory after their
first login. The files in the ``skeleton`` directory are copied into the
users data directories, so they may change and delete the files without
affecting the originals.
This screenshot shows a set of photos in the ``skeleton`` directory.
.. image:: ../images/skeleton-files.png
They appear on the user's Nextcloud Files page just like any other files.
.. image:: ../images/skeleton-files1.png
.. note:: Overwriting the files in ``core/skeleton`` is not recommended,
because those changes will be overwritten on the next update of the Nextcloud
server.
Default file templates
----------------------
The default path for user templates is at ``/Templates`` (translated in the user's language).
If you need to override this path for all users, you can set
::
occ config:app:set core defaultTemplateDirectory --value="CustomPath"
This will only apply to new users.
wedding-pics/core/doc/admin/_sources/configuration_files/encryption_configuration.rst.txt
+332
View File
@@ -0,0 +1,332 @@
========================
Encryption configuration
========================
The primary purpose of the Nextcloud server-side encryption is to protect users'
files on remote storage, such as Dropbox and Google Drive, and to do it easily
and seamlessly from within Nextcloud.
Server-side encryption separates encryption of local and remote storage.
This allows you to encrypt remote storage, such as Dropbox and
Google, without having to also encrypt your home storage on your Nextcloud
server (en- or disable the checkbox "enabling encryption on your home
storage" in the **Server-side encryption** section of your Admin page.)
.. note:: Nextcloud supports Authenticated Encryption for all
newly encrypted files. See https://hackerone.com/reports/108082 for more
technical information about the impact.
For maximum security make sure to configure external storage with "Check for
changes: Never". This will let Nextcloud ignore new files not added via Nextcloud,
so a malicious external storage administrator could not add new files to the
storage without your knowledge. Of course, this is not wise if your external
storage is subject to legitimate external changes.
Nextcloud server-side encryption encrypts files stored on the Nextcloud server,
and files on remote storage that is connected to your Nextcloud server.
Encryption and decryption are performed on the Nextcloud server. All files sent
to remote storage will be encrypted by the Nextcloud server, and upon retrieval,
decrypted before serving them to you and anyone you have shared them with.
.. note:: Encrypting files increases their size by roughly 35%, so you must
take this into account when you are provisioning storage and setting
storage quotas. User's quotas are based on the unencrypted file size, and
not the encrypted file size.
When files on external storage are encrypted in Nextcloud, you cannot share them
directly from the external storage services, but only through Nextcloud sharing
because the key to decrypt the data never leaves the Nextcloud server.
Nextcloud's server-side encryption generates a strong encryption key, which is
unlocked by user's passwords. Your users don't need to track an extra
password, but simply log in as they normally do. It encrypts only the contents
of files, and not filenames and directory structures.
You should regularly backup all encryption keys to prevent permanent data loss.
The encryption keys are stored in the following directories:
``data/<user>/files_encryption``
Users' private keys and all other keys necessary to decrypt the users' files
``data/files_encryption``
private keys and all other keys necessary to decrypt the files stored on a
system wide external storage
When encryption is enabled, all files are encrypted and decrypted by the
Nextcloud application, and stored encrypted on your remote storage.
This protects your data on externally hosted storage. The Nextcloud
admin and the storage admin will see only encrypted files when browsing backend
storage.
.. warning:: Encryption keys are stored only on the Nextcloud server, eliminating
exposure of your data to third-party storage providers. The encryption app
does **not** protect your data if your Nextcloud server is compromised, and it
does not prevent Nextcloud administrators from reading user's files. This
would require client-side encryption, which this app does not provide. If
your Nextcloud server is not connected to any external storage services then
it is better to use other encryption tools, such as file-level or
whole-disk encryption.
Note also that SSL terminates at or before Apache on the Nextcloud server, and
all files will exist in an unencrypted state between the SSL connection
termination and the Nextcloud code that encrypts and decrypts files. This is
also potentially exploitable by anyone with administrator access to your
server. Read `How Nextcloud uses encryption to protect your data
<https://nextcloud.com/blog/encryption-in-nextcloud/>`_ for more information.
Before enabling encryption
--------------------------
Plan very carefully before enabling encryption because it is not reversible via
the Nextcloud Web interface. If you lose your encryption keys your files are not
recoverable. Always have backups of your encryption keys stored in a safe
location, and consider enabling all recovery options.
You have more options via the ``occ`` command (see :ref:`occ_encryption_label`)
.. _enable_encryption_label:
Enabling encryption
-------------------
Nextcloud encryption consists of two parts. The base encryption system is
enabled and disabled on your Admin page. First you must enable this, and then
select an encryption module to load. Currently the only available encryption
module is the Nextcloud Default Encryption Module.
First go to the **Server-side encryption** section of your Admin page and check
**Enable server-side encryption**. You have one last chance to change your mind.
.. figure:: images/encryption3.png
After clicking the **Enable Encryption** button you see the message "No
encryption module loaded, please load a encryption module in the app menu", so
go to your Apps page to enable the Nextcloud Default Encryption Module.
.. figure:: images/encryption1.png
Return to your Admin page to see the Nextcloud Default Encryption
Module added to the module selector, and automatically selected. Now you must
log out and then log back in to initialize your encryption keys.
.. figure:: images/encryption14.png
When you log back in, there is a checkbox for enabling encryption on your home
storage. This is checked by default. Un-check to avoid encrypting your home
storage.
.. figure:: images/encryption15.png
Sharing encrypted files
-----------------------
After encryption is enabled your users must also log out and log back in to
generate their personal encryption keys. They will see a yellow warning banner
that says "Encryption App is enabled but your keys are not initialized, please
log-out and log-in again."
Share owners may need to re-share files after encryption is enabled; users
trying to access the share will see a message advising them to ask the share
owner to re-share the file with them. For individual shares, un-share and
re-share the file. For group shares, share with any individuals who can't access
the share. This updates the encryption, and then the share owner can remove the
individual shares.
.. figure:: images/encryption9.png
Encrypting external mountpoints
-------------------------------
You and your users can encrypt individual external mountpoints. You must have
external storage enabled on your Admin page, and enabled for your users.
Encryption settings can be configured in the mount options for an external
storage mount, see :ref:`external_storage_mount_options_label`
(:doc:`external_storage_configuration_gui`)
.. _enable-file-recovery-key:
Enabling users file recovery keys
---------------------------------
If you lose your Nextcloud password, then you lose access to your encrypted
files. If one of your users loses their Nextcloud password their files are
unrecoverable. You cannot reset their password in the normal way; you'll see a
yellow banner warning "Please provide an admin recovery password, otherwise all
user data will be lost".
To avoid all this, create a Recovery Key. Go to the Encryption section of your
Admin page and set a recovery key password.
.. figure:: images/encryption10.png
Then your users have the option of enabling password recovery on their Personal
pages. If they do not do this, then the Recovery Key won't work for them.
.. figure:: images/encryption7.png
For users who have enabled password recovery, give them a new password and
recover access to their encrypted files by supplying the Recovery Key on the
Users page.
.. figure:: images/encryption8.png
You may change your Recovery Key password.
.. figure:: images/encryption12.png
.. _occ_encryption_label:
occ encryption commands
-----------------------
If you have shell access you may use the ``occ`` command to perform encryption
operations, and you have additional options such as decryption and creating a
single master encryption key. See :ref:`encryption_label` for detailed
instructions on using ``occ``.
Get the current status of encryption and the loaded encryption module::
occ encryption:status
- enabled: false
- defaultModule: OC_DEFAULT_MODULE
This is equivalent to checking **Enable server-side encryption** on your Admin
page::
occ encryption:enable
Encryption enabled
Default module: OC_DEFAULT_MODULE
List the available encryption modules::
occ encryption:list-modules
- OC_DEFAULT_MODULE: Default encryption module [default*]
Select a different default Encryption module (currently the only available
module is OC_DEFAULT_MODULE)::
occ encryption:set-default-module [Module ID].
The [module ID] is taken from the ``encryption:list-modules`` command.
Encrypt all data files for all users. For performance reasons, when you enable
encryption on a Nextcloud server only new and changed files are encrypted. This
command gives you the option to encrypt all files.
Run ``occ``::
occ encryption:encrypt-all
You are about to start to encrypt all files stored in your Nextcloud.
It will depend on the encryption module you use which files get encrypted.
Depending on the number and size of your files this can take some time.
Please make sure that no users access their files during this process!
Do you really want to continue? (y/n)
When you type ``y`` it creates a key pair for each of your users, and then
encrypts their files, displaying progress until all user files are encrypted.
Decrypt all user data files, or optionally a single user::
occ encryption:decrypt-all [username]
View current location of keys::
occ encryption:show-key-storage-root
Current key storage root: default storage location (data/)
Move keys to a different folder, either locally or on a different server.
The folder must already exist, be owned by root and your HTTP group, and be
restricted to root and your HTTP group. Further the folder needs to be located
somewhere in your Nextcloud data folder, either physically, or as a mount.
This example is for Ubuntu Linux. Note that the new folder is relative to your ``occ`` directory::
cd /your/nextcloud/data
mkdir keys
chown -R root:www-data keys
chmod -R 0770 keys
occ encryption:change-key-storage-root keys
Start to move keys:
4 [============================]
Key storage root successfully changed to keys
Create a new master key. Use this when you have a single-sign on
infrastructure. Use this only on fresh installations with no existing data, or
on systems where encryption has not already been enabled. It is not possible to
disable it::
occ encryption:enable-master-key
Fix Bad signature errors::
occ encryption:fix-encrypted-version --all
occ encryption:fix-encrypted-version <userid>
occ encryption:fix-encrypted-version <userid> -p <path>
Fix key not found errors::
occ encryption:fix-key-location <userid>
.. _occ_disable_encryption_label:
Disabling encryption
--------------------
You may disable encryption only with ``occ``. Make sure you have backups of all
encryption keys, including users'.
Disable your encryption module with this command::
occ encryption:decrypt-all
It will put your server into maintenance mode and back.
It also takes care of disabling encryption when all files have been decrypted.
If the command is aborted some files have been decrypted and others are still encrypted.
In this case the command will keep the encryption turned on
and Nextcloud can handle this situation fine.
You can proceed decrypting the remaining files by calling the command again
once the problems that caused the abortion have been resolved.
.. warning:: Disabling encryption without decrypting all the files will lead to decryption errors in the future as this state causes unpredictable behaviors.
.. note:: The ``occ encryption:decrypt-all`` can take a lot of time. You can run one user at a time like so: ``occ encryption:decrypt-all <user-id>``.
Files not encrypted
-------------------
Only the data in the files in ``data/user/files`` are encrypted, and not the
filenames or folder structures. These files are never encrypted:
- Existing files in the trash bin & Versions. Only new and changed files after
encryption is enabled are encrypted.
- Existing files in Versions
- Image thumbnails from the Gallery app
- Previews from the Files app
- The search index from the full text search app
- Third-party app data
There may be other files that are not encrypted; only files that are exposed to
third-party storage providers are guaranteed to be encrypted.
LDAP and other external user back-ends
--------------------------------------
If you use an external user back-end, such as an LDAP or Samba server, and you
change a user's password on the back-end, the user will be prompted to change
their Nextcloud login to match on their next Nextcloud login. The user will need
both their old and new passwords to do this. If you have enabled the Recovery
Key then you can change a user's password in the Nextcloud Users panel to match
their back-end password, and then, of course, notify the user and give them
their new password.
Troubleshooting
---------------
Invalid private key for encryption app
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This `issue <https://github.com/nextcloud/server/issues/8546>`_ is being worked
on. In the meantime there is a
`workaround <https://github.com/nextcloud/server/issues/8546#issuecomment-514139714>`_
which unfortunately is only suitable for administrators comfortable with the
command line.
wedding-pics/core/doc/admin/_sources/configuration_files/encryption_details.rst.txt
+360
View File
@@ -0,0 +1,360 @@
==================
Encryption details
==================
This document - provided by `SysEleven <https://syseleven.de>`_ - describes the server-side encryption scheme implemented by Nextcloud's default encryption module. This includes:
- the encryption and signature of files with a master key.
- the encryption and signature of files with a public sharing key.
- the encryption and signature of files with a recovery key.
- the encryption and signature of files with a user key.
These conventions apply throughout this document:
- Given file paths in this document are relative to the Nextcloud data directory that can be retrieved as ``datadirectory`` from the ``config.php``.
- Placeholders are denoted as ``$variable``. The variable has to be replaced with the appropriate information.
- Static strings are denoted as ``"some string"``.
- The concatenation of strings is denoted as ``$variable."some string"``.
.. note:: However, files that have been encrypted in Nextcloud versions 15 and lower may have slightly different structures.
Key type: master key
--------------------
This is the default encryption mode in Nextcloud. With master key encryption enabled there is one central key that is used to secure the files handled by Nextcloud. The master key is protected by a password that can be generated by the server administrator. The advantage of the master key encryption is that the encryption is transparent to the users but has the disadvantage that the server administrator is able to decrypt user files without knowing any user password.
Key type: public sharing key
----------------------------
The public sharing key is used to secure files that have been publicly shared. The public sharing key is protected by a password that can be generated by the server administrator. The advantage of the public sharing key is that it is independent of the selected encryption mode so that Nextcloud is able to provide publicly shared files to outside parties.
Key type: recovery key
----------------------
The recovery key is used to provide a restore mechanism in cases where the user key encryption is enabled, where the administrator has enabled the recovery key feature and the user has opted into using the recovery key feature. The recovery key can then be used to restore files when users have lost their passwords. The recovery key is protected by a recovery password that the server administrator should store securely. The advantage of the recovery key is that files can be recovered but has the disadvantage that the server administrator is able to decrypt user files without knowing any user password.
Key type: user key
------------------
User key encryption needs to be explicitly activated by calling ``./occ encryption:disable-master-key``. In older versions of Nextcloud this had been enabled by default.
With user key encryption enabled all users have their own user keys that are used to secure the files handled by Nextcloud. The user keys are protected by the user passwords. The advantage is that the server administrator is not able to decrypt user files without knowing any user password - unless the file is publicly shared or a recovery key is defined - but has the disadvantage that files are permanently lost if the users forget their user passwords - unless the files are (publicly) shared or a recovery key is defined.
.. note:: This method cannot be used with SAML authentication, because Nextcloud does not get a hold of any credentials whatsoever and therefore cannot use any users' passwords for encryption.
.. _file_type_public_key_file_label:
File type: public key file
--------------------------
Public key files contain RSA public keys that are used to encrypt/seal the share key files.
File format
^^^^^^^^^^^
Public key files are stored in PEM format.
File locations
^^^^^^^^^^^^^^
The locations of public key files depend on their key type:
- master public key: ``"files_encryption/OC_DEFAULT_MODULE/master_".$random.".publicKey"``
- public sharing public key: ``"files_encryption/OC_DEFAULT_MODULE/pubShare_".$random.".publicKey"``
- recovery public key: ``"files_encryption/OC_DEFAULT_MODULE/recoveryKey_".$random.".publicKey"``
- user public key: ``$username."/files_encryption/OC_DEFAULT_MODULE/".$username.".publicKey"``
.. _file_type_private_key_file_label:
File type: private key file
---------------------------
Private key files contain RSA private keys that are used to decrypt/unseal the share key files. The RSA private key is encrypted and signed with a password and stored in a format that is specific to the Nextcloud encryption module.
File format
^^^^^^^^^^^
The RSA private key that is represented in PEM format is encrypted and Base64 encoded (denoted as ``$encryption``). For the encryption an initialization vector of 16 bytes is selected (denoted as ``$iv``). Furthermore a hexadecimally encoded message authentication code of 64 bytes is calculated (denoted as ``$signature``). The resulting file contains::
"HBEGIN:cipher:AES-256-CTR:keyFormat:hash:HEND".
$encrypted."00iv00".$iv."00sig00".$signature."xxx"
File locations
^^^^^^^^^^^^^^
The locations of private key files depend on their key type:
- master private key: ``"files_encryption/OC_DEFAULT_MODULE/master_".$random.".privateKey"``
- public sharing private key: ``"files_encryption/OC_DEFAULT_MODULE/pubShare_".$random.".privateKey"``
- recovery private key: ``"files_encryption/OC_DEFAULT_MODULE/recoveryKey_".$random.".privateKey"``
- user private key: ``$username."/files_encryption/OC_DEFAULT_MODULE/".$username.".privateKey"``
.. _file_type_share_key_file_label:
File type: share key file
-------------------------
Share key files contain so-called envelope keys that are needed to decrypt the file key files. The envelope keys are created by ``openssl_seal()`` during the encryption and are needed for ``openssl_open()`` during the decryption. The envelope keys are encrypted with the public keys of the recipients that are allowed to read the actual files.
File format
^^^^^^^^^^^
The envelope keys are stored in binary format.
File locations
^^^^^^^^^^^^^^
The locations of share key files depend on the type of the encrypted file:
- regular file: ``$username."/files_encryption/keys/files/".$filename."/OC_DEFAULT_MODULE/".$recipient.".shareKey"``
- version file: *version files use the same location for the share key file as their regular file*
- trashed file: ``$username."/files_encryption/keys/files_trashbin/files/".$filename.".d".$timestamp."/OC_DEFAULT_MODULE/".$recipient.".shareKey"``
- trashed version file: *trashed version files use the same location for the share key file as their trashed file*
.. _file_type_file_key_file_label:
File type: file key file
------------------------
File key files contain symmetric keys used to encrypt the actual files. The file keys consist of 32 random bytes and are encrypted/sealed with the envelope keys stored in the share key files.
File format
^^^^^^^^^^^
The file keys are stored in binary format.
File locations
^^^^^^^^^^^^^^
The locations of the file key files depend on the type of the encrypted file:
- regular file: ``$username."/files_encryption/keys/files/".$filename."/OC_DEFAULT_MODULE/fileKey"``
- version file: *version files use the same location for the file key file as their regular file*
- trashed file: ``$username."/files_encryption/keys/files_trashbin/files/".$filename.".d".$delete_timestamp."/OC_DEFAULT_MODULE/fileKey"``
- trashed version file: *trashed version files use the same location for the file key file as their trashed file*
.. _file_type_file_label:
File type: file
---------------
Files contain the actual file content. The file content is encrypted and signed with a password and stored in a format that is specific to the Nextcloud encryption module.
File format
^^^^^^^^^^^
The file content is split into blocks of 6072 bytes. Each block is encrypted and Base64 encoded (denoted as ``$encryption[0..$n]``). For the encryption an initialization vector of 16 bytes is selected for each block (denoted as ``$iv[0..$n]``). Furthermore a hexadecimally encoded message authentication code of 64 bytes is calculated of each block (denoted as ``$signature[0..$n]``). An encrypted block has a total size of 8192 bytes (8096 bytes for ``$encrypted[]``, 6 bytes for ``"00iv00"``, 16 bytes for ``$iv[]``, 7 bytes for ``"00sig00"``, 64 bytes for ``$signature[]`` and 3 bytes for ``"xxx"``). Only the last encrypted block may be shorter. The header of the encrypted file is padded with 8147 bytes of ``"-"`` (denoted as ``$padding``) to a total of 8192 bytes. The resulting file contains::
"HBEGIN:cipher:AES-256-CTR:keyFormat:hash:HEND".$padding.
$encrypted[0]."00iv00".$iv[0]."00sig00".$signature[0]."xxx".
$encrypted[1]."00iv00".$iv[1]."00sig00".$signature[1]."xxx".
$encrypted[2]."00iv00".$iv[2]."00sig00".$signature[2]."xxx".
[...]
$encrypted[$n]."00iv00".$iv[$n]."00sig00".$signature[$n]."xxx"
File locations
^^^^^^^^^^^^^^
The locations of the files depend on the type of the encrypted file:
- regular file: ``$username."/files/".$filename``
- version file: ``$username."/files_versions/".$filename.".v".$version_timestamp``
- trashed file: ``$username."/files_trashbin/files/".$filename.".d".$delete_timestamp``
- trashed version file: ``$username."/files_trashbin/versions/".$filename.".v".$version_timestamp.".d".$delete_timestamp``
Key generation: generate the key pair
-------------------------------------
The key pair has to be generated with the ``openssl_pkey_new()`` function. Then the private key and public key are extracted from the the key resource with the ``openssl_pkey_export()`` function.
Key generation: store the public key
------------------------------------
The public key is written to the ``$username.".publicKey"`` file as documented in :ref:`file_type_public_key_file_label`.
Key generation: store the private key
-------------------------------------
Derive the encryption key
^^^^^^^^^^^^^^^^^^^^^^^^^
The salt for the encryption key is derived by creating a raw SHA256 hash of ``$uid.$instanceId.$instanceSecret`` with the ``hash()`` function. ``$instanceId`` can be retrieved as ``instanceid`` from the ``config.php``. ``$instanceSecret`` can be retrieved as ``secret`` from the ``config.php``.
The encryption key is then derived by creating a raw SHA256-PBKDF2 hash of the password with the salt, 100.000 rounds and (by default) with a target size of 32 bytes (as required for AES-256-CTR) with the ``hash_hmac()`` function (denoted as ``$passphrase``).
The used password depends on the key type:
- master private key: use ``secret`` from the ``config.php``
- public sharing private key: use an empty password
- recovery private key: use the recovery password
- user private key: use the user password
Encrypt the private key
^^^^^^^^^^^^^^^^^^^^^^^
The initialization vector is generated as a random string of 16 bytes with the ``random_bytes()`` function (denoted as ``$iv``). The private key is (by default) AES-256-CTR encrypted with the ``$iv`` and the ``$passphrase`` with the ``openssl_encrypt()`` function and returned as Base64 encoded without zero-padding (denoted as ``$encrypted``).
Sign the private key
^^^^^^^^^^^^^^^^^^^^
The message authentication key is derived by creating a raw SHA512 hash of ``$passphrase.$version.$position."a"`` with the ``hash()`` function.
- ``$version`` is always ``"0"``.
- ``$position`` is always ``"0"``.
The signature is then derived by creating a hexadecimally encoded SHA256-HMAC of ``$encrypted`` and the message authentication key with the ``hash_hmac()`` function (denoted as ``$signature``).
Store the private key
^^^^^^^^^^^^^^^^^^^^^
The private key is written to the ``$username.".privateKey"`` file with the derived ``$encrypted``, ``$iv`` and ``$signature`` as documented in :ref:`file_type_private_key_file_label`.
Encryption: generate the file key
---------------------------------
Generate the file key
^^^^^^^^^^^^^^^^^^^^^
The file key is generated as a random string of 32 bytes with the ``random_bytes()`` function (denoted as ``$filekey``).
Read the public key
^^^^^^^^^^^^^^^^^^^
The public keys of the recipients are read from the ``$username.".publicKey"`` files as documented in :ref:`file_type_public_key_file_label`.
Encrypt/seal the file key
^^^^^^^^^^^^^^^^^^^^^^^^^
The file key is encrypted/sealed with the ``openssl_seal()`` function with the public keys. This returns the encrypted file key and the encrypted envelope keys for the recipients.
Store the file key
^^^^^^^^^^^^^^^^^^
The encrypted file key is stored in the ``"fileKey"`` file as documented in :ref:`file_type_file_key_file_label`.
Store the envelope keys
^^^^^^^^^^^^^^^^^^^^^^^
The encrypted envelope keys for the recipients are stored in the ``$username.".shareKey"`` files as documented in :ref:`file_type_share_key_file_label`.
Encryption: encrypt the file
----------------------------
Split the file
^^^^^^^^^^^^^^
The file is split into 6072 bytes sized blocks. Only the last encrypted block may be shorter. Each block is referenced by its zero-based index within the file (denoted as ``$position``).
Encrypt the blocks
^^^^^^^^^^^^^^^^^^
For each block the initialization vector is generated as a random string of 16 bytes with the ``random_bytes()`` function (denoted as ``$iv[$position]``). The block is (by default) AES-256-CTR encrypted with the ``$iv[$position]`` and the ``$filekey`` with the ``openssl_encrypt()`` function and returned as Base64 encoded without zero-padding (denoted as ``$encrypted[$position]``).
Sign the blocks
^^^^^^^^^^^^^^^
The message authentication key is derived by creating a raw SHA512 hash of ``$filekey.$version.$position."a"`` with the ``hash()`` function.
- ``$version`` is the ``encrypted`` value that can be retrieved from the ``oc_filecache`` table in the database and must not be zero. Take into account that a file in the ``oc_filecache`` table is identified by its ``path`` value as well as its ``storage`` value which references the ``numeric_id`` field in the ``oc_storages`` table. Including ``$version`` into the message authentication key prevents blocks from being swapped between different versions of the same file.
- ``$position`` is the index of the current block starting at ``"0"`` and is appended with ``"end"`` for the last block of the file. Including ``$position`` into the message authentication key prevents blocks from being swapped within the same file. Furthermore, adding ``"end"`` to the message authentication key of the last block prevents file truncation attacks.
The signature is then derived by creating a hexadecimally encoded SHA256-HMAC of ``$encrypted[$position]`` and the message authentication key with the ``hash_hmac()`` function (denoted as ``$signature[$position]``).
Store the file
^^^^^^^^^^^^^^
The encrypted file is written to the file with the derived ``$encrypted[0..$n]``, ``$iv[0..$n]`` and ``$signature[0..$n]`` as documented in :ref:`file_type_file_label`.
Decryption: read the private key
--------------------------------
Read the private key file
^^^^^^^^^^^^^^^^^^^^^^^^^
The private key is read from the ``$username.".privateKey"`` file and the values ``$encrypted``, ``$iv`` and ``$signature`` are parsed as documented in :ref:`file_type_private_key_file_label`.
Derive the decryption key
^^^^^^^^^^^^^^^^^^^^^^^^^
The salt for the decryption key is derived by creating a raw SHA256 hash of ``$uid.$instanceId.$instanceSecret`` with the ``hash()`` function. ``$instanceId`` can be retrieved as ``instanceid`` from the ``config.php``. ``$instanceSecret`` can be retrieved as ``secret`` from the ``config.php``.
The decryption key is then derived by creating a raw SHA256-PBKDF2 hash of the password with the salt, 100.000 rounds and (by default) with a target size of 32 bytes (as required for AES-256-CTR) with the ``hash_hmac()`` function (denoted as ``$passphrase``).
The used password depends on the key type:
- master private key: use ``secret`` from the ``config.php``
- public sharing private key: use an empty password
- recovery private key: use the recovery password
- user private key: use the user password
Check the signature
^^^^^^^^^^^^^^^^^^^
The message authentication key is derived by creating a raw SHA512 hash of ``$passphrase.$version.$position."a"`` with the ``hash()`` function.
- ``$version`` is always ``"0"``.
- ``$position`` is always ``"0"``.
The signature is then derived by creating a hexadecimally encoded SHA256-HMAC of ``$encrypted`` and the message authentication key with the ``hash_hmac()`` function. Only proceed when the derived signature is equal to `$signature` which is checked with the ``hash_equals()`` function.
Decrypt the private key
^^^^^^^^^^^^^^^^^^^^^^^
The private key is (by default) AES-256-CTR decrypted with the ``$iv`` and the ``$passphrase`` with the ``openssl_decrypt()`` function.
Decryption: read the file key
-----------------------------
Read the file key
^^^^^^^^^^^^^^^^^
The encrypted file key is read from the ``"fileKey"`` file as documented in :ref:`file_type_file_key_file_label`.
Read the envelope key
^^^^^^^^^^^^^^^^^^^^^
The encrypted envelope key for the recipient is read from the ``$username.".shareKey"`` file as documented in :ref:`file_type_share_key_file_label`.
Decrypt/unseal the file key
^^^^^^^^^^^^^^^^^^^^^^^^^^^
The encrypted file key is decrypted/unsealed with the ``openssl_open()`` function with the private key and encrypted envelope key for the recipient (denoted as ``$filekey``).
Decryption: decrypt the file
----------------------------
Split the file
^^^^^^^^^^^^^^
The encrypted file is split into a 8192 bytes sized header and one or more 8192 bytes sized blocks. Only the last encrypted block may be shorter. Each block is referenced by its zero-based index within the file (denoted as ``$position``). The values ``$encrypted[0..$n]``, ``$iv[0..$n]`` and ``$signature[0..$n]`` are parsed as documented in :ref:`file_type_file_label`.
Check the block signatures
^^^^^^^^^^^^^^^^^^^^^^^^^^
The message authentication key is derived by creating a raw SHA512 hash of ``$filekey.$version.$position."a"`` with the ``hash()`` function.
- ``$version`` is the ``encrypted`` value that can be retrieved from the ``oc_filecache`` table in the database and must not be zero. Take into account that a file in the ``oc_filecache`` table is identified by its ``path`` value as well as its ``storage`` value which references the ``numeric_id`` field in the ``oc_storages`` table. Including ``$version`` into the message authentication key prevents blocks from being swapped between different versions of the same file.
- ``$position`` is the index of the current block starting at ``"0"`` and is appended with ``"end"`` for the last block of the file. Including ``$position`` into the message authentication key prevents blocks from being swapped within the same file. Furthermore, adding ``"end"`` to the message authentication key of the last block prevents file truncation attacks.
The signature is then derived by creating a hexadecimally encoded SHA256-HMAC of ``$encrypted[$position]`` and the message authentication key with the ``hash_hmac()`` function. Only proceed when the derived signature is equal to ``$signature[$position]`` which is checked with the ``hash_equals()`` function.
Decrypt the blocks
^^^^^^^^^^^^^^^^^^
Each block is (by default) AES-256-CTR decrypted with the ``$iv[$position]`` and the ``$filekey`` with the ``openssl_decrypt()`` function.
Sources
-------
- `nextcloud-tools repository on GitHub <https://github.com/syseleven/nextcloud-tools>`_
- `Nextcloud Encryption Configuration documentation <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html>`_
- `Nextcloud Help response concering the usage of version information <https://help.nextcloud.com/t/allow-file-decryption-with-only-the-files-keys-and-passwords/436/12>`_
- `Sourcecode: Creation of the Message Authentication Code <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L504>`_
- `Sourcecode: Derivation of the Encryption Key <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L346>`_
- `Sourcecode: Encryption of the File <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L234>`_
- `Sourcecode: Encryption/Sealing of the File Key <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L686>`_
- `Sourcecode: Extraction of the Private and Public Key <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L124>`_
- `Sourcecode: Generation of the File Key <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L645>`_
- `Sourcecode: Generation of the Initialization Vector <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L634>`_
- `Sourcecode: Generation of a Key Pair <https://github.com/nextcloud/server/blob/a374d8837d6de459500e619cf608e0721ea14574/apps/encryption/lib/Crypto/Crypt.php#L153>`_
.. TODO ON RELEASE: Update version number above on release
wedding-pics/core/doc/admin/_sources/configuration_files/encryption_migration.rst.txt
+23
View File
@@ -0,0 +1,23 @@
====================
Encryption migration
====================
Encryption format
-----------------
Nextcloud still supports the legacy encryption scheme used for server side encryption where the encrypted files did not contain header information. This may still be used for installations that still have encrypted files from <= ownCloud 6. Files will be updated to the new encryption format once they are written again. However it is recommended to check if you have to still support this scheme.
Starting with version 20 for new installations the legacy encryption will be off by default.
However if you are upgrading there is a migration path to check if you can disable legacy encryption.
Checking for old files
^^^^^^^^^^^^^^^^^^^^^^
On the command line run:
occ encryption:scan:legacy-format
The command will tell you if you can remove the legacy encryption mode.
If so set the `encryption.legacy_format_support` in your config.php to 'false'.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/amazons3.rst.txt
+51
View File
@@ -0,0 +1,51 @@
=========
Amazon S3
=========
To connect an Amazon S3 (or compatible) bucket to Nextcloud you will need to know your:
- S3 bucket name
- S3 access key ID
- S3 secret access key
- S3 region (if Amazon hosted) or S3 hostname (if non-Amazon hosted) [Note: If specifying a hostname, use the generic S3 endpoint hostname, **not** the hostname that contains your bucket name]
In the **Folder name** field enter a folder name to use as the local mountpoint for this
external storage. If this does not exist it will be created.
In the **External storage** field select **Amazon S3**.
In the **Authentication** field select **Access key**.
In the **Bucket** field enter your *S3 bucket name*. [Note: Even if non-Amazon hosted, bucket names must meet AWS S3 naming requirements regardless of what your S3 provider/platform considers acceptable - i.e. no underscores]
In the **Access key** field enter your *S3 access key ID*.
In the **Secret key** field enter your *S3 access key*.
**If you are using Amazon S3:** the :code:`Region` parameter is required unless you're happy with
the default of :code:`eu-west-1` (which will be used if you don't specify anything). There is no
need to override the :code:`Hostname` or :code:`Port`. And :code:`Storage Class` only needs to be
modified if you're using a different configuration at AWS. Lastly, :code:`Enable Path Style` is
rarely required with Amazon, but some legacy Amazon datacenters may require it. Leave
:code:`Legacy (v2) authentication` unselected.
**If you using a non-Amazon hosted S3 store:** you will need to set the :code:`Hostname`
parameter (and can ignore the :code:`Region` parameter). You may need to enable :code:`Enable Path Style`
if your non-Amazon S3 store does *not* support requests like :code:`https://bucket.hostname.domain/`.
Setting :code:`Enable Path Style` to true configures the S3 client to make requests like
:code:`https://hostname.domain/bucket` instead. It's rare to need :code:`Legacy (v2) authentication`, but
enable it if your in-house object store or service provider requires it over the default (v4) authentication.
In the **Available for** field enter the users or groups who you want to give
access your S3 mount.
The ``Enable SSL`` checkbox enables HTTPS connections and generally preferred. It is the default unless
you disable it here.
.. figure:: images/amazons3.png
:alt:
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/auth_mechanisms.rst.txt
+91
View File
@@ -0,0 +1,91 @@
==========================================
External Storage authentication mechanisms
==========================================
Nextcloud storage backends accept one or more authentication schemes such as
passwords, OAuth, or token-based, to name a few examples. Each authentication
scheme may be implemented by combining multiple authentication mechanisms. Different
mechanisms require different configuration parameters, depending on their
behavior.
.. figure:: images/authentication-types.png
:alt: Authentication types
Special mechanisms
------------------
The **None** authentication mechanism requires no configuration parameters, and
is used when a backend requires no authentication.
The **Built-in** authentication mechanism itself requires no configuration
parameters, but is used as a placeholder for legacy storages that have not been
migrated to the new system and do not take advantage of generic authentication
mechanisms. The authentication parameters are provided directly by the backend.
Password-based mechanisms
-------------------------
The **Username and password** mechanism requires a manually-defined username and
password. These get passed directly to the backend and are specified during the
setup of the mount point.
The **Log-in credentials, save in session** mechanism uses the Nextcloud login
credentials of the user to connect to the storage. These are not stored anywhere
on the server, but rather in the user session, giving increased security.
This method has some important drawbacks, since Nextcloud has no access to the storage
credentials and therefore cannot perform any background tasks on the storage:
* Sharing is disabled
* Background file scanning does not work
* Background versions expiration does not work
* Desktop and mobile clients that use tokens to authenticate can not access those shares
* Other services that might request the file through a different request like Collabora Online or OnlyOffice will not be able to open files from that storage
* The method cannot be used with SAML/SSO authentication, because Nextcloud does not get a hold of any credentials whatsoever
The **Log-in credentials, save in database** mechanism uses the Nextcloud login
credentials of the user to connect to the storage. These are stored in the
database encrypted with the shared secret. This allows to share files from
within this mount point.
* The method cannot be used with SAML/SSO authentication, because Nextcloud does not get a hold of any credentials whatsoever
The **User entered, store in database** mechanism work in the same way as the
"Username and password" mechanism but the credentials need to be specified by
each user individually. Before the first access to that mount point the user
will be prompted to enter the credentials.
The **Global credentials** mechanism uses the general input field for "Global
credentials" in the external storage settings section as source for the
credentials instead of individual credentials for a mount point.
:ref:`Considerations for shared storage <considerations_for_shared_storage_label>`
Public-key mechanisms
---------------------
Currently only the RSA mechanism is implemented, where a public/private
keypair is generated by Nextcloud and the public half shown in the GUI. The keys
are generated in the SSH format, and are currently 1024 bits in length. Keys
can be regenerated with a button in the GUI.
After generating your keys, you need to copy your new public key to the
destination server to ``.ssh/authorized_keys``.
See :doc:`./sftp` for additional information on how to set up certificate based authentication on SFTP.
.. figure:: images/auth_rsa.png
:alt: Form on admin page for generating RSA keys.
.. _considerations_for_shared_storage_label:
Considerations for shared storage
---------------------------------
Every external storage, which is using user specific authentication, is connected individually.
Even if several users connect to the same folder, the files are regarded as separate files per user.
Nextcloud can not recognize if two users access the very same file if they follow individual connections.
This has an influence on e.g. file locking as a locked individual file is not shown as locked to other users or users cannot collaboratively edit documents.
If collaborative working on external storage is required, the authentication "Global credentials" has to be used.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/ftp.rst.txt
+35
View File
@@ -0,0 +1,35 @@
========
FTP/FTPS
========
To connect to an FTP server, you will need:
* A folder name for your local mountpoint; the folder will be created if it
does not exist
* The URL of the FTP server
* Port number (default: 21)
* FTP server username and password
* Remote Subfolder, the FTP directory to mount in Nextcloud. Nextcloud defaults
to the root directory. If you specify a subfolder you must leave
off the leading slash. For example, ``public_html/images``
Your new mountpoint is available to all users by default, and you may restrict
access by entering specific users or groups in the **Available for** field.
Optionally, Nextcloud can use FTPS (FTP over SSL) by checking **Secure ftps://**.
This requires additional configuration with your root certificate if the FTP
server uses a self-signed certificate.
.. figure:: images/ftp.png
:alt: Nextcloud GUI FTP configuration.
.. note:: The external storage ``FTP/FTPS`` needs the ``allow_url_fopen`` PHP
setting to be set to ``1``. When having connection problems make sure that it
is not set to ``0`` in your ``php.ini``. See :ref:`label-phpinfo` to learn
how to find the right ``php.ini`` file to edit.
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
FTP uses the password authentication scheme; see :doc:`auth_mechanisms` for
more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/local.rst.txt
+38
View File
@@ -0,0 +1,38 @@
=====
Local
=====
Local storages provide access to any directory on the Nextcloud server. Since
this is a significant security risk, Local storage can only be configured in
the Nextcloud admin settings. Non-admin users cannot create Local storage
mounts.
Use this to mount any directory on your Nextcloud server that is outside
of your Nextcloud ``data/`` directory. This directory must be readable and
writable by your HTTP server user. These ownership and permission examples
are on Ubuntu Linux::
sudo chown -R www-data:www-data /path/to/localdir
sudo chmod -R 0750 /path/to/localdir
Important: If you use consecutive commands, make sure, you are user ``www-data``::
sudo -u www-data bash
cd /path/to/localdir
mkdir data
In the **Folder name** field enter the folder name that you want to appear on
your Nextcloud Files page.
In the **Configuration** field enter the full filepath of the directory you
want to mount.
In the **Available for** field enter the users or groups who have permission to
access the mount. By default all users have access.
.. figure:: images/local.png
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/nextcloud.rst.txt
+17
View File
@@ -0,0 +1,17 @@
=========
Nextcloud
=========
A Nextcloud storage is a specialized :doc:`webdav` storage, with optimizations
for Nextcloud-Nextcloud communication. See the :doc:`webdav` documentation to
learn how to configure a Nextcloud external storage.
When filling in the **URL** field, use the path to the root of the Nextcloud
installation, rather than the path to the WebDAV endpoint. So, for a server at
``https://example.com/nextcloud``, use ``https://example.com/nextcloud`` and not
``https://example.com/nextcloud/remote.php/dav``.
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/openstack.rst.txt
+44
View File
@@ -0,0 +1,44 @@
========================
OpenStack Object Storage
========================
OpenStack Object Storage is used to connect to an OpenStack Swift server, or to
Rackspace. Two authentication mechanisms are available: one is the generic
OpenStack mechanism, and the other is used exclusively for Rackspace, a provider
of object storage that uses the OpenStack Swift protocol.
The OpenStack authentication mechanism uses the OpenStack Keystone v2
protocol. Your Nextcloud configuration needs:
* **Bucket**. This is user-defined; think of it as a subdirectory of your total
storage. The bucket will be created if it does not exist.
* **Username** of your account.
* **Password** of your account.
* **Tenant name** of your account. (A tenant is similar to a user group.)
* **Identity Endpoint URL**, the URL to log in to your OpenStack account.
.. figure:: images/openstack.png
:alt: Openstack configuration.
The Rackspace authentication mechanism requires:
* **Bucket**
* **Username**
* **API key**.
You must also enter the term **cloudFiles** in the **Service name** field.
.. figure:: images/rackspace.png
:alt: Openstack configuration.
It may be necessary to specify a **Region**. Your region should be named in
your account information, and you can read about Rackspace regions at
`About Regions <https://support.rackspace.com/how-to/about-regions/>`_.
The timeout of HTTP requests is set in the **Request timeout** field, in
seconds.
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/sftp.rst.txt
+28
View File
@@ -0,0 +1,28 @@
====
SFTP
====
Nextcloud's SFTP (SSH File Transfer Protocol) backend supports both password and
public key authentication.
The **Host** field is required; a port can be specified as part of the **Host**
field in the following format: ``hostname.domain:port``. The default port is 22
(SSH).
For public key authentication, you can generate a public/private key pair from
your **SFTP with secret key login** configuration.
.. figure:: images/auth_mechanism.png
:alt: Generating an RSA key pair in the SFTP configuration.
After generating your keys, you need to copy your new public key to the
destination server to ``.ssh/authorized_keys``. Nextcloud will then use its
private key to authenticate to the SFTP server.
The default **Remote Subfolder** is the root directory (``/``) of the remote
SFTP server, and you may enter any directory you wish.
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/smb.rst.txt
+92
View File
@@ -0,0 +1,92 @@
========
SMB/CIFS
========
Nextcloud can connect to Windows file servers or other SMB-compatible servers
with the SMB/CIFS backend.
.. note:: The SMB/CIFS backend requires ``smbclient`` or
the PHP smbclient module to be installed on the Nextcloud server. The PHP
smbclient module is preferred, but either will work. These
should be included in any Linux distribution. (See `PECL smbclient
<https://pecl.php.net/package/smbclient>`_ if your distro does not include
them.)
You need the following information:
* Folder name for your local mountpoint.
* Host: The URL of the Samba server.
* Username: The username or ``domain\username`` (see below) used to login to the Samba
server.
* Password: the password to login to the Samba server.
* Share: The share on the Samba server to mount.
* Remote Subfolder: The remote subfolder inside the Samba share to mount
(optional, defaults to /). To assign the Nextcloud logon username
automatically to the subfolder, use ``$user`` instead of a particular
subfolder name.
* And finally, the Nextcloud users and groups who get access to the share.
Optionally, you can specify a ``Domain``. This is useful in
cases where the
SMB server requires a domain and a username, and an advanced authentication
mechanism like session credentials is used so that the username cannot be
modified. This is concatenated with the username, so the backend gets
``domain\username``
.. note:: For improved reliability and performance, we recommended installing
``libsmbclient-php``, a native PHP module for connecting to
SMB servers.
.. figure:: images/smb.png
:alt: Samba external storage configuration.
:scale: 75%
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
SMB update notifications
------------------------
Nextcloud can use smb update notifications to
listen for changes made to a configured SMB/CIFS storage and detect external
changes made to the storage in near real-time.
.. note:: Due to limitations of linux based SMB servers, this feature only works
reliably on Windows SMB servers.
.. note:: Using update notifications requires ``smbclient`` 4.x or newer.
Due to limitations with the smbclient PHP module, the ``smbclient`` binary
is required even when using the PHP module.
To start listening to update notifications, start the ``occ`` command like this::
occ files_external:notify <mount_id>
You can find the mount id for a specific storage using ``occ files_external:list``
On default this command shows no output, can you see the list of detected changes by
passing the ``-v`` option to the command.
SMB authentication
^^^^^^^^^^^^^^^^^^
Update notifications are not supported when using 'Login credentials, save in session' authentication.
Using update notifications is only supported with 'Login credentials, save in database'.
Even when using 'Login credentials, save in database' or 'User entered, stored in database' authentication the notify process
can not use the credentials saved to attach to the smb shares because the notify process does not run in the context of a specific user
in those cases you can provide the username and password using the ``--username`` and ``--password`` arguments.
Decrease sync delay
^^^^^^^^^^^^^^^^^^^
Any updates detected by the notify command will only be synced to the client after the Nextcloud cron job has been executed
(usually every 15 minutes). If this interval is too high for your use case, you can decrease it by running ``occ files:scan --unscanned --all``
at the desired interval. Note that this might increase the server load and you'll need to ensure that there is no overlap between runs.
Hidden files upload failure or not shown
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you have the configuration ``hide dot files = Yes``, you will not be able to upload a hidden file (dot file) nor will you be able to show hidden files on your filelist (even if the 'show hidden file' option is checked on the nextcloud settings.
Make sure you have the following option in your configuration: ``hide dot files = No``
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage/webdav.rst.txt
+29
View File
@@ -0,0 +1,29 @@
======
WebDAV
======
Use this backend to mount a directory from any WebDAV server, or another
Nextcloud server.
You need the following information:
* Folder name: The name of your local mountpoint.
* The URL of the WebDAV or Nextcloud server.
* Username and password for the remote server
* Secure https://: We always recommend https:// for security, though you can
leave this unchecked for http://.
Optionally, a ``Remote Subfolder`` can be specified to change the destination
directory. The default is to use the whole root.
.. figure:: images/webdav.png
:alt: Webdav configuration form.
.. Note:: CPanel users should install `Web Disk
<https://documentation.cpanel.net/display/ALD/Web+Disk>`_ to enable WebDAV
functionality.
See :doc:`../external_storage_configuration_gui` for additional mount
options and information.
See :doc:`auth_mechanisms` for more information on authentication schemes.
wedding-pics/core/doc/admin/_sources/configuration_files/external_storage_configuration_gui.rst.txt
+164
View File
@@ -0,0 +1,164 @@
==================================
Configuring External Storage (GUI)
==================================
The External Storage Support application enables you to mount external storage
services and devices as secondary Nextcloud storage devices. You may also allow
users to mount their own external storage services.
For configuration of external storages via occ command, see :ref:`occ documentation <files_external_label>`.
Enabling External Storage Support
---------------------------------
The External storage support application is enabled on your Apps page.
.. figure:: external_storage/images/enable-app.png
:alt: Enable external storage on your Apps page.
Storage configuration
---------------------
To access the settings for configuring external storage mounts, click on your Profile icon
in the top right and select settings from the dropdown. On the left side under Administration
select External Storage.
To create a new external storage mount, select an available backend from the
dropdown **Add storage**. Each backend has different required options, which
are configured in the configuration fields.
.. figure:: external_storage/images/add_storage.png
Each backend may also accept multiple authentication methods. These are selected
with the dropdown under **Authentication**. Different backends support different
authentication mechanisms; some specific to the backend, others are more
generic. See :doc:`external_storage/auth_mechanisms` for more detailed
information.
When you select an authentication mechanism, the configuration fields change as
appropriate for the mechanism. The SFTP backend, for one example, supports
**username and password**, **Log-in credentials, save in session**, and **RSA
public key**.
.. figure:: external_storage/images/auth_mechanism.png
:alt: An SFTP configuration example.
Required fields are marked with a red border. When all required fields are
filled, the storage is automatically saved. A green dot next to the storage row
indicates the storage is ready for use. A red or yellow icon indicates
that Nextcloud could not connect to the external storage, so you need to
re-check your configuration and network availability.
If there is an error on the storage, it will be marked as unavailable for ten
minutes. To re-check it, click the colored icon or reload your Admin page.
Usage of variables for mount paths
----------------------------------
The external storage mounting mechanism accepts variables in the mount path.
Use ``$user`` for automatic substitution with the logged in user's username.
Use ``$home`` for automatic substitution with a configurable home directory variable
(requires LDAP, see :ref:`LDAP_Special_Attributes` in the LDAP configuration documentation for details)
In the following example, the mount point for a logged in user "alice" would substitute
to ``/opt/userDirectories/alice/myPictures``.
.. figure:: external_storage/images/externalStorages_variables.png
:alt: External storage user variable substitution
User and group permissions
--------------------------
A storage configured in a user's Personal settings is available only to the user
that created it. A storage configured in the Admin settings is available to
all users by default, and it can be restricted to specific users and groups in
the **Available for** field.
.. figure:: external_storage/images/applicable.png
:alt: User and groups selector
.. _external_storage_mount_options_label:
Mount options
-------------
The Overflow menu (three dots) exposes the settings and trashcan. Click the trashcan to delete the
mountpoint. The settings button allows you to configure each storage mount
individually with the following options:
* Encryption
* Previews
* Enable Sharing
* Filesystem check frequency (Never, Once per direct access)
* Mac NFD Compatability
* Read Only
The **Encryption** checkbox is visible only when the Encryption app is enabled. Note that server-side
encryption is not available for other Nextcloud servers used as external storage.
**Enable Sharing** allows the Nextcloud admin to enable or disable sharing on individual mountpoints.
When sharing is disabled the shares are retained internally, so that you can re-enable sharing
and the previous shares become available again. Sharing is disabled by default.
.. figure:: external_storage/images/mount_options.png
:alt: Additional mount options exposed on mouseover.
Using self-signed certificates
------------------------------
When using self-signed certificates for external storage mounts the certificate
must be imported into the personal settings of the user. Please refer to
`Nextcloud HTTPS External Mount
<https://ownclouden.blogspot.de/2014/11/owncloud-https-external-mount.html>`_
for more information.
Available storage backends
--------------------------
The following backends are provided by the external storages app.
.. toctree::
:maxdepth: 1
external_storage/amazons3
external_storage/ftp
external_storage/local
external_storage/nextcloud
external_storage/openstack
external_storage/sftp
external_storage/smb
external_storage/webdav
.. note:: A non-blocking or correctly configured SELinux setup is needed
for these backends to work. Please refer to the :ref:`selinux-config-label`.
Allow users to mount external Storage
-------------------------------------
Check **Enable User External Storage** to allow your users to mount their own
external storage services, and check the backends you want to allow. Beware, as
this allows a user to make potentially arbitrary connections to other services
on your network!
.. figure:: external_storage/images/user_mounts.png
:alt: Checkboxes to allow users to mount external storage services.
Adding files to external storages
---------------------------------
We recommend configuring the background job **Webcron** or
**Cron** (see :doc:`../configuration_server/background_jobs_configuration`)
to enable Nextcloud to automatically detect files added to your external
storages.
Nextcloud may not always be able to find out what has been
changed remotely (files changed without going through Nextcloud), especially
when it's very deep in the folder hierarchy of the external storage.
You might need to setup a cron job that runs ``sudo -u www-data php occ files:scan --all``
(or replace ``--all`` with the user name, see also :doc:`../configuration_server/occ_command`)
to trigger a rescan of the user's files periodically (for example every 15 minutes), which includes
the mounted external storage.
wedding-pics/core/doc/admin/_sources/configuration_files/federated_cloud_sharing_configuration.rst.txt
+126
View File
@@ -0,0 +1,126 @@
==============================
Configuring Federation Sharing
==============================
Federated Cloud Sharing is now managed by the Federation app (9.0+), and is
now called Federation sharing. When you enable the Federation app you can
easily and securely link file shares between Nextcloud servers, in effect
creating a cloud of Nextclouds.
.. _label-direct-share-link:
Creating a new Federation Share
-------------------------------
Follow these steps to create a new Federation share between two Nextcloud
servers. This requires no action by the user on the remote server; all it takes
is a few steps on the originating server.
1. Enable the Federation app.
2. Go to your Nextcloud Admin page and scroll to the Sharing
section. Verify that **Allow users on this server to send shares to other
servers** and **Allow users on this server to receive shares from other
servers** are enabled.
3. Now go to the Federation section. The Federation app supports creating a
list of trusted Nextcloud servers, which allows the trusted servers to
exchange user directories and auto-complete the names of external users when
you create shares.
.. figure:: images/federation-0.png
4. Now go to your Files page and select a folder to share. Click the share
icon, and then enter the username and URL of the user on the remote Nextcloud
server. In this example, that is ``freda@https://example.com/nextcloud``.
When Nextcloud verifies the link, it displays it with the **(remote)** label.
Click on this label to establish the link.
.. figure:: images/federation-2.png
5. When the link is successfully completed, you have a single share option,
and that is **can edit**.
.. figure:: images/federation-3.png
You may disconnect the share at any time by clicking the trash can icon.
Configuring trusted Nextcloud servers
-------------------------------------
You may create a list of trusted Nextcloud servers for Federation sharing. This
allows your linked Nextcloud servers to share user directories, and to auto-fill
user names in share dialogs.
You may also enter Nextcloud server URLs in the **Add Nextcloud Server** field.
A red light means the connection failed. The yellow light indicates a successful
connection, with no user names exchanged. The green light indicates a successful
connection with user names exchanged.
The prerequisiste for a green status is that the trusted servers were maintained
in both interacting Nextcloud servers.
Additionally ``occ federation:sync-addressbooks`` must have been executed (part of
cron job list).
.. figure:: images/federation-1.png
.. _label-public-link-share:
Creating Federation Shares via public Link Share
------------------------------------------------
Check the ``Share link`` entry to expose more sharing options (which are
described more fully in :doc:`file_sharing_configuration`). You may create a
Federation share by allowing Nextcloud to create a public link for you, and then
email it to the person you want to create the share with.
.. figure:: images/create_public_share-6.png
You may optionally set a password and expiration date on it. When your recipient
receives your email they must click the link, or copy it to a Web
browser. They will see a page displaying a thumbnail of the file, with a button
to **Add to your Nextcloud**.
.. figure:: images/create_public_share-8.png
Your recipient should click the **Add to your Nextcloud** button. On the next
screen your recipient needs to enter the URL to their Nextcloud
server, and then press the return key.
.. figure:: images/create_public_share-9.png
Your recipient has to take one more step, and that is to confirm creating the
federated cloud share link by clicking the **Accept** button.
.. figure:: images/create_public_share-10.png
Un-check the ``Share link`` checkbox to disable any federated cloud share
created this way.
Configuration tips
------------------
The Sharing section on your Admin page allows you to control how your users
manage federated cloud shares:
* Check ``Enforce password protection`` to require passwords on link shares.
* Check ``Set default expiration date`` to require an expiration date on link
shares.
* Check ``Allow public uploads`` to allow two-way file sharing.
* If you encounter timeouts for downloading or uploading large files, you can use the option ``davstorage.request_timeout`` in your ``config.php`` to increase the timeout. The default value is 30 seconds.
Your Apache Web server must have ``mod_rewrite`` enabled, and you must have
``trusted_domains`` correctly configured in ``config.php`` to allow external
connections (see :doc:`../installation/installation_wizard`). Consider also
enabling SSL to encrypt all traffic between your servers .
Your Nextcloud server creates the share link from the URL that you used to log
into the server, so make sure that you log into your server using a URL that is
accessible to your users. For example, if you log in via its LAN IP address,
such as ``http://192.168.10.50``, then your share URL will be something like
``http://192.168.10.50/nextcloud/index.php/s/jWfCfTVztGlWTJe``, which is not
accessible outside of your LAN. This also applies to using the server name; for
access outside of your LAN you need to use a fully-qualified domain name such as
``http://myserver.example.com``, rather than ``http://myserver``.
wedding-pics/core/doc/admin/_sources/configuration_files/file_sharing_configuration.rst.txt
+171
View File
@@ -0,0 +1,171 @@
.. _file-sharing-configuration:
============
File Sharing
============
Nextcloud users can share files with their Nextcloud groups and other users on
the same Nextcloud server, with Nextcloud users on :doc:`other Nextcloud servers <federated_cloud_sharing_configuration>`, and create public shares for people who are not
Nextcloud users. You have control of a number of user permissions on file shares.
Configure your sharing policy on your Admin page in the Sharing section.
.. figure:: images/sharing-files-1.png
* Check ``Allow apps to use the Share API`` to enable users to share files. If
this is not checked, no users can create file shares.
* Check ``Allow resharing`` to enable users to re-share files shared with them.
* Check ``Allow sharing with groups`` to enable users to share with groups.
* Check ``Restrict users to only share with users in their groups`` to confine
sharing within group memberships.
.. note:: This setting does not apply to the Federated Cloud sharing
feature. If :doc:`Federated Cloud Sharing
<federated_cloud_sharing_configuration>` is
enabled, users can still share items with any users on any instances
(including the one they are on) via a remote share.
* Check ``Allow users to share via link and email`` to enable creating public shares for
people who are not Nextcloud users via hyperlink.
* Check ``Allow public uploads`` to allow anyone to upload files to public shares.
* Check ``Always ask for a password`` to proactively ask a user to set a password
for a share link.
* Check ``Enforce password protection`` to force users to set a password on all
public share links. This does not apply to local user and group shares.
* Add groups to ``Exclude groups from creating link shares`` to no apply the settings
for that groups.
* Check ``Exclude groups from sharing`` to prevent members of specific groups
from creating any file shares in those groups. When you check this, you'll
get a dropdown list of all your groups to choose from. Type any group name to search for.
Members of excluded groups can still receive shares, but not create any.
* Check ``Set default expiration date for shares`` to set a default expiration date
on local user and group shares.
* Check ``Enforce expiration date`` to always enforce the configured expiration date
on local user and group shares.
.. note:: Users will not be able to set the expiration date further
in the future than the enforced expiration date, although they
will be able to set a more recent date.
Also note that users will be able to update the expiration date again at
a later point. The expiration date is based on the current date and not on the share
creation date. The user will be able to extend the expiration date again whenever a
previous expiration date is close to be reached.
* Check ``Set default expiration date for shares via link or email`` to set a default expiration date on
public shares.
* Check ``Enforce expiration date`` to always enforce the configured expiration date
on public shares.
.. note:: Users will not be able to set the expiration date further
in the future than the enforced expiration date, although they
will be able to set a more recent date.
Also note that users will be able to update the expiration date again at
a later point. The expiration date is based on the current date and not on the share
creation date. The user will be able to extend the expiration date again whenever a
previous expiration date is close to be reached.
* Check ``Allow username autocompletion in share dialog and allow access to the system address book`` to enable
auto-completion of Nextcloud usernames and list the system address book as resource when syncing contacts with CardDAV.
* Check ``Allow username autocompletion to users within the same groups and limit system address books to users in the same groups`` to limit
username autocompletion to users from within the same groups as the share owner.
* Check ``Allow username autocompletion to users based on phone number integration`` to limit
username autocompletion to users when the share owner has synced their phone address book via the Nextcloud Talk mobile clients and it contained the phone number the user configured in their profile.
* Check ``Allow autocompletion when entering the full name or email address (ignoring missing phonebook match and being in the same group)``
to show despite of the previous restrictions a user suggestion, when the complete display name or user id was typed.
* Check ``Show disclaimer text on the public link upload page`` to set and show
a disclaimer text on public links with hidden file lists. If you enable this feature a text input will be shown to input the disclaimer text.
With ``Default share permissions`` you are able to set the default permissions
for user-shares (``Create``, ``Change``, ``Delete`` and ``Reshare``) without
forcing them.
.. note:: Nextcloud does not preserve the mtime (modification time) of
directories, though it does update the mtimes on files. See
`Wrong folder date when syncing
<https://github.com/owncloud/core/issues/7009>`_ for discussion of this.
.. note:: There are more sharing options on config.php level available:
`Configuration Parameters <https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#sharing>`_
.. TODO ON RELEASE: Update version number above on release
.. _transfer_userfiles_label:
Distinguish between max expiration date and default expiration date
-------------------------------------------------------------------
The expiration date which can be set and enforced in the settings above are the hard limit and the
default value at the same time. Sometimes admins want to have a moderate default expire date,
for example 7 days but make sure that the user can't extend it to more than 14 days.
In order to do so, set a enforced expiration date in the settings as described above
and set the default value to something below the maximal possible expiration date with the following
OCC commands::
occ config:app:set --value <DAYS> core internal_defaultExpDays
occ config:app:set --value <DAYS> core link_defaultExpDays
Get a notification before a share expires
-----------------------------------------
Users can get a notification before a share expires. In order to do so a cronjob need to be
configured which calls the following OCC command once a day::
occ sharing:expiration-notification
A notification will be send for all shares which expire within the next 24 hours.
Transferring files to another user
----------------------------------
You may transfer files from one user to another with ``occ``. This is useful
when you have to remove a user. Be sure to transfer the files before you delete
the user! This transfers all files from user1 to user2, and the shares and
metadata info associated with those files (shares, tags, comments, etc).
Trashbin contents are not transferred::
occ files:transfer-ownership user1 user2
(See :doc:`../configuration_server/occ_command` for a complete ``occ``
reference.)
Users may also transfer files or folders selectively by themselves.
See `user documentation <https://docs.nextcloud.com/server/latest/user_manual/en/files/transfer_ownership.html>`_ for details.
.. TODO ON RELEASE: Update version number above on release
Creating persistent file Shares
-------------------------------
When a user is deleted, their files are also deleted. As you can imagine, this
is a problem if they created file shares that need to be preserved, because
these disappear as well. In Nextcloud files are tied to their owners, so
whatever happens to the file owner also happens to the files.
One solution is to create persistent shares for your users. You can retain
ownership of them, or you could create a special user for the purpose of
establishing permanent file shares. Simply create a shared folder in the usual
way, and share it with the users or groups who need to use it. Set the
appropriate permissions on it, and then no matter which users come and go, the
file shares will remain. Because all files added to the share, or edited in it,
automatically become owned by the owner of the share regardless of who adds or
edits them.
Using File Drop Share links
------------------------------
Using a File Drop Share allows users to upload files to Nextcloud through an unauthenticated session.
File Drop Share links will only work when ``Allow public uploads`` is checked in the Sharing section of the Administration Settings page.
.. note:: File Drop Shares currently have a limitation in that any files uploaded through an unauthenticated session will not be chunked.
Therefore the maximum file size that can be uploaded through File Drop Shares depends entirely on settings set within your environment.
wedding-pics/core/doc/admin/_sources/configuration_files/file_versioning.rst.txt
+55
View File
@@ -0,0 +1,55 @@
===================================
Controlling file versions and aging
===================================
The Versions app (files_versions) expires old file versions automatically to
ensure that users don't exceed their storage quotas. This is the default
pattern used to delete old versions:
* For the first second we keep one version
* For the first 10 seconds Nextcloud keeps one version every 2 seconds
* For the first minute Nextcloud keeps one version every 10 seconds
* For the first hour Nextcloud keeps one version every minute
* For the first 24 hours Nextcloud keeps one version every hour
* For the first 30 days Nextcloud keeps one version every day
* After the first 30 days Nextcloud keeps one version every week
The versions are adjusted along this pattern every time a new version is
created.
The Versions app never uses more than 50% of the user's currently available
free space. If the stored versions exceed this limit, Nextcloud deletes the
oldest file versions until it meets the disk space limit again.
You may alter the default pattern in ``config.php``. The default setting is
``auto``, which sets the default pattern::
'versions_retention_obligation' => 'auto',
Additional options are:
* ``D, auto``
Keep versions at least for D days, apply expiration rules to all versions
that are older than D days
* ``auto, D``
Delete all versions that are older than D days automatically, delete other
versions according to expiration rules
* ``D1, D2``
Keep versions for at least D1 days and delete when they exceed D2 days.
* ``disabled``
Disable the Versions app; no old file versions will be deleted.
Background job
--------------
To delete expired versions a background jobs runs every 30 minutes.
It's possible to deactivate the background job and setup a (system) cron to expire the versions via occ.
Deactivate background job: ``occ config:app:set --value=no files_versions background_job_expire_versions``
Activate background job: ``occ config:app:delete files_versions background_job_expire_versions``
Expire versions: ``occ versions:expire`` or ``occ versions:expire --quiet`` (without the progress bar)
wedding-pics/core/doc/admin/_sources/configuration_files/files_locking_transactional.rst.txt
+67
View File
@@ -0,0 +1,67 @@
==========================
Transactional file locking
==========================
Nextcloud's Transactional File Locking mechanism locks files to avoid
file corruption during normal operation. It performs these functions:
* Operates at a higher level than the filesystem, so you don't need to use a
filesystem that supports locking
* Locks parent directories so they cannot be renamed during any activity on
files inside the directories
* Releases locks after file transactions are interrupted, for
example when a sync client loses the connection during an upload
* Manages locking and releasing locks correctly on shared files during changes
from multiple users
* Manages locks correctly on external storage mounts
* Manages encrypted files correctly
What Transactional File locking is not for: it will not prevent multiple users
from editing the same document, or give notice that other users are working on
the same document. Multiple users can open and edit a file at the same time and
Transactional File locking does not prevent this. Rather, it prevents
simultaneous file saving.
File locking is enabled by default, using the database locking backend. This
places a significant load on your database. Using ``memcache.locking`` relieves
the database load and improves performance. Admins of Nextcloud servers with
heavy workloads should install a memcache. (See
:doc:`../configuration_server/caching_configuration`.)
To use a memcache with Transactional File Locking, you must install the Redis
server and corresponding PHP module. After installing Redis you must enter a
configuration in your ``config.php`` file like this example::
'filelocking.enabled' => true,
'memcache.locking' => '\OC\Memcache\Redis',
'redis' => array(
'host' => 'localhost',
'port' => 6379,
'timeout' => 0.0,
'password' => '', // Optional, if not defined no password will be used.
),
.. note:: For enhanced security it is recommended to configure Redis to require
a password. See http://redis.io/topics/security for more information.
If you want to configure Redis to listen on an Unix socket (which is
recommended if Redis is running on the same system as Nextcloud) use this example
``config.php`` configuration::
'filelocking.enabled' => true,
'memcache.locking' => '\OC\Memcache\Redis',
'redis' => array(
'host' => '/var/run/redis/redis.sock',
'port' => 0,
'timeout' => 0.0,
),
See ``config.sample.php`` to see configuration examples for Redis, and for all
supported memcaches.
Learn more about Redis at `Redis <http://redis.io/>`_. Memcached, the popular
distributed memory caching system, is not suitable for the new file locking
because it is not designed to store locks, and data can disappear from the cache
at any time. Redis is a key-value store, and it guarantees that cached objects
are available for as long as they are needed.
wedding-pics/core/doc/admin/_sources/configuration_files/index.rst.txt
+22
View File
@@ -0,0 +1,22 @@
===========================
File sharing and management
===========================
.. toctree::
:maxdepth: 2
file_sharing_configuration
federated_cloud_sharing_configuration
big_file_upload_configuration
default_files_configuration
primary_storage
external_storage_configuration_gui
external_storage/auth_mechanisms
encryption_configuration
encryption_details
encryption_migration
files_locking_transactional
previews_configuration
file_versioning
trashbin_configuration
wedding-pics/core/doc/admin/_sources/configuration_files/previews_configuration.rst.txt
+108
View File
@@ -0,0 +1,108 @@
======================
Previews configuration
======================
The Nextcloud thumbnail system generates previews of files for all
Nextcloud apps that display files, such as Files and Gallery.
The following image shows some examples of previews of various file types.
.. figure:: ../images/preview_images.png
:alt: Thumbnails of various image and audio/video files.
By default, Nextcloud can generate previews for the following filetypes:
* Images files
* Cover of MP3 files
* Text documents
.. note:: Technically Nextcloud can also generate the previews
of other file types such as PDF, SVG or various office documents.
Due to security concerns those providers have been disabled by
default and are considered unsupported.
While those providers are still available, we discourage enabling
them, and they are not documented.
Parameters
----------
Please notice that the Nextcloud preview system comes already with sensible
defaults, and therefore it is usually unnecessary to adjust those configuration
values.
But deemed necessary, following changes have to be made in ``config/config.php`` file. As a best practice, take a backup of this config file before making a lot of changes.
Disabling previews:
^^^^^^^^^^^^^^^^^^^
Under certain circumstances, for example if the server has limited
resources, you might want to consider disabling the generation of previews.
Note that if you do this all previews in all apps are disabled, including
the Gallery app, and will display generic icons instead of
thumbnails.
Set the configuration option ``enable_previews`` to ``false``:
::
<?php
'enable_previews' => false,
Maximum preview size:
^^^^^^^^^^^^^^^^^^^^^
There are two configuration options to set the maximum size of a preview.
::
<?php
'preview_max_x' => null,
'preview_max_y' => null,
By default, both options are set to null. 'Null' is equal to no limit.
Numeric values represent the size in pixels. The following code limits previews
to a maximum size of 100×100px:
::
<?php
'preview_max_x' => 100,
'preview_max_y' => 100,
'preview_max_x' represents the x-axis and 'preview_max_y' represents the y-axis.
Maximum scale factor:
^^^^^^^^^^^^^^^^^^^^^
If a lot of small pictures are stored on the Nextcloud instance and the preview
system generates blurry previews, you might want to consider setting a maximum
scale factor. By default, pictures are upscaled to 10 times the original size:
::
<?php
'preview_max_scale_factor' => 10,
If you want to disable scaling at all, you can set the config value to '1':
::
<?php
'preview_max_scale_factor' => 1,
If you want to disable the maximum scaling factor, you can set the config value
to 'null':
::
<?php
'preview_max_scale_factor' => null,
JPEG quality setting:
^^^^^^^^^^^^^^^^^^^^^
Default JPEG quality setting for preview images is '80'. Change this with:
::
occ config:app:set preview jpeg_quality --value="60"
wedding-pics/core/doc/admin/_sources/configuration_files/primary_storage.rst.txt
+302
View File
@@ -0,0 +1,302 @@
=============================================
Configuring Object Storage as Primary Storage
=============================================
Nextcloud allows to configure object storages like OpenStack Swift or
Amazon Simple Storage Service (S3) or any compatible S3-implementation
(e.g. Minio or Ceph Object Gateway) as primary storage replacing the default
storage of files.
By default, files are stored in :code:`nextcloud/data` or another directory configured
in the :code:`config.php` of your Nextcloud instance. This data directory might
still be used for compatibility reasons)
---------------------------------
Differences from External Storage
---------------------------------
When an object store is used as Primary Storage, Nextcloud requires exclusive access
over the bucket being used. All metadata (filenames, directory structures, etc)
is stored in Nextcloud and not in the object store. The metadata is only stored in the database and the
object store only holds the file content by unique identifier.
~~~~~~~~~~~~~~~~~~~~~~~~
Performance Implications
~~~~~~~~~~~~~~~~~~~~~~~~
Because of this, object stores configured as Primary Storage usually perform better than
when using the same object store via the External Storage support application, but the downside
is being unable to access the files from outside of Nextcloud. This makes using an object store
as Primary Storage distinct from using an object store via External Storage.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Data Backup and Recovery Implications
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
One impact of using an object store as Primary Storage is that your data backup strategy
needs to incorporate this. **Your data is longer stored on your Nextcloud server, but your
files are also no longer accessible by simply bypassing your Nextcloud server and accessing
your object store directly.**
-------------
Configuration
-------------
Primary object stores need to be configured in :code:`config.php` by specifying
the objectstore backend and any backend specific configuration.
.. note:: Configuring a primary object store on an existing Nextcloud instance will
make all existing files on the instance inaccessible.
The configuration has the following structure:
::
'objectstore' => [
'class' => 'Object\\Storage\\Backend\\Class',
'arguments' => [
...
],
],
~~~~~~~~~~~~~~~
OpenStack Swift
~~~~~~~~~~~~~~~
The OpenStack Swift backend mounts a container on an OpenStack Object Storage
server into the virtual filesystem.
The class to be used is :code:`\\OC\\Files\\ObjectStore\\Swift`
Both openstack v2 and v3 authentication are supported,
V2 Authentication:
::
'objectstore' => [
'class' => '\\OC\\Files\\ObjectStore\\Swift',
'arguments' => [
'username' => 'username',
'password' => 'Secr3tPaSSWoRdt7',
// the container to store the data in
'bucket' => 'nextcloud',
'autocreate' => true,
'region' => 'RegionOne',
// The Identity / Keystone endpoint
'url' => 'http://example.com/v2.0',
// optional on some swift implementations
'tenantName' => 'username',
'serviceName' => 'swift',
// The Interface / url Type, optional
'urlType' => 'internal'
],
],
V3 Authentication:
::
'objectstore' => [
'class' => 'OC\\Files\\ObjectStore\\Swift',
'arguments' => [
'autocreate' => true,
'user' => [
'name' => 'UserName',
'password' => 'Secr3tPaSSWoRdt7',
'domain' => [
'name' => 'Default',
],
],
'scope' => [
'project' => [
'name' => 'TenantName',
'domain' => [
'name' => 'Default',
],
],
],
'serviceName' => 'swift',
'region' => 'regionOne',
'url' => 'http://example.com/v3',
'bucket' => 'nextcloud',
],
],
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Simple Storage Service (S3)
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Simple Storage Service (S3) backend mounts a bucket on an Amazon S3 object
storage or compatible implementation (e.g. Minio or Ceph Object Gateway) into the
virtual filesystem.
The class to be used is :code:`\\OC\\Files\\ObjectStore\\S3`
Amazon-hosted S3:
::
'objectstore' => [
'class' => '\\OC\\Files\\ObjectStore\\S3',
'arguments' => [
'bucket' => 'my-nextcloud-store',
'region' => 'us-east-1',
'key' => 'EJ39ITYZEUH5BGWDRUFY',
'secret' => 'M5MrXTRjkyMaxXPe2FRXMTfTfbKEnZCu+7uRTVSj',
],
],
Non-Amazon hosted S3:
::
'objectstore' => [
'class' => '\\OC\\Files\\ObjectStore\\S3',
'arguments' => [
'bucket' => 'my-nextcloud-store',
'hostname' => 's3.example.com',
'key' => 'EJ39ITYZEUH5BGWDRUFY',
'secret' => 'M5MrXTRjkyMaxXPe2FRXMTfTfbKEnZCu+7uRTVSj',
'port' => 8443,
// required for some non-Amazon S3 implementations
'use_path_style' => true,
],
],
Minimum required parameters are:
* :code:`bucket` [Note: Even if non-Amazon hosted, bucket names must meet AWS S3 naming requirements regardless of what your S3 provider/platform considers acceptable - i.e. no underscores]
* :code:`key`
* :code:`secret`
.. note:: You will *probably* need to specify additional parameters beyond these, unless the default
values (see below) exactly match your situation. In particular, your :code:`region` (if Amazon
hosted) or :code:`hostname` (if non-Amazon hosted).
Optional parameters most commonly needing adjustment (and their defaults values if left
unconfigured):
* :code:`region` defaults to :code:`eu-west-1`
* :code:`storageClass` defaults to :code:`STANDARD`
* :code:`hostname` defaults to :code:`s3.REGION.amazonaws.com` [Note: If using this parameter (non-Amazon), specify the generic S3 endpoint hostname, **not** the hostname that contains your bucket name]
* :code:`use_ssl` defaults to :code:`true`
Optional parameters sometimes needing adjustment:
* :code:`use_path_style` defaults to :code:`false`
* :code:`port` defaults to :code:`443`
* :code:`sse_c_key` has no default
Optional parameters less commonly needing adjustment:
* :code:`proxy` defaults to :code:`false`
* :code:`timeout` defaults to :code:`15`
* :code:`uploadPartSize` defaults to :code:`524288000`
* :code:`putSizeLimit` defaults to :code:`104857600`
* :code:`legacy_auth` has no default
* :code:`version` defaults to :code:`latest`
* :code:`verify_bucket_exists` defaults to :code:`true` [Note: Setting this to :code:`false` *after* confirming the bucket has been created may provide a performance benefit, but may not be possible in multibucket scenarios.]
**If you are using Amazon S3:** the :code:`region` parameter is required unless you're happy with
the default of :code:`eu-west-1`. There is no need to override the :code:`hostname` or :code:`port`.
And :code:`storageClass` only needs to be modified if you're using a different configuration at AWS.
Lastly, :code:`use_path_style` is rarely required with Amazon, but some legacy Amazon datacenters
may require it.
**If you using a non-Amazon hosted S3 store:** you will need to set the :code:`hostname`
parameter (and can ignore the :code:`region` parameter). You may need to use :code:`use_path_style`
if your non-Amazon S3 store does *not* support requests like :code:`https://bucket.hostname.domain/`.
Setting :code:`use_path_style` to true configures the S3 client to make requests like
:code:`https://hostname.domain/bucket` instead.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Azure Blob Storage
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Azure Blob Storage backend mounts a container on Microsoft's Azure Blob Storage into the
virtual filesystem.
The class to be used is :code:`\\OC\\Files\\ObjectStore\\Azure`
::
'objectstore' => [
'class' => '\\OC\\Files\\ObjectStore\\Azure',
'arguments' => [
'container' => 'nextcloud',
'autocreate' => true,
'account_name' => 'account_name',
'account_key' => 'xxxxxxxxxx'
],
],
------------------------
Multibucket Object Store
------------------------
It's possible to configure Nextcloud to distribute the data over multiple buckets
for scalability purposes.
To setup multiple buckets, use :code:`'objectstore_multibucket'` storage backend
in :code:`config.php`:
::
'objectstore_multibucket' => [
'class' => 'Object\\Storage\\Backend\\Class',
'arguments' => [
// optional, defaults to 64
'num_buckets' => 64,
// will be postfixed by an integer in the range from 0 to (num_nuckets-1)
'bucket' => 'nextcloud_',
...
],
],
Multibucket object store backend maps every user to a range of buckets and saves
all files for that user in their corresponding bucket.
.. note:: While it is possible to change the number of buckets used by an existing Nextcloud
instance, the user-to-buckets mapping is only created once, so only newly created
users will be mapped to the updated range of buckets.
You can find out more information about upscaling with object storage and Nextcloud in the
`Nextcloud customer portal <https://portal.nextcloud.com/article/object-store-as-primary-storage-16.html>`_.
---------------------------
S3 SSE-C encryption support
---------------------------
Nextcloud supports server side encryption, also known as `SSE-C <http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html>`_, with compatible S3 bucket provider. The encryption and decryption happens on the S3 bucket side with a key provided by the Nextcloud server.
The key can be specified with the :code:`sse_c_key` parameter which needs to be provided as a base64 encoded string with a maximum length of 32 bytes. A random key could be generated using the the following command:
::
openssl rand 32 | base64
The following example shows how to configure the S3 object store with SSE-C encryption support in the objectstore section of the Nextcloud config.php file:
::
'objectstore' => [
array (
'class' => 'OC\\Files\\ObjectStore\\S3',
'arguments' =>
array (
'bucket' => 'nextcloud',
'key' => 'nextcloud',
'secret' => 'nextcloud',
'hostname' => 's3',
'port' => '443',
'use_ssl' => true,
'use_path_style' => true,
'autocreate' => true,
'verify_bucket_exists' => true,
'sse_c_key' => 'o9d3Q9tHcPMv6TIpH53MSXaUmY91YheZRwuIhwCFRSs=',
),
);
],
wedding-pics/core/doc/admin/_sources/configuration_files/trashbin_configuration.rst.txt
+51
View File
@@ -0,0 +1,51 @@
=========================
Deleted Items (trash bin)
=========================
If the trash bin app is enabled (default), this setting defines the policy
for when files and folders in the trash bin will be permanently deleted.
The app allows for two settings, a minimum time for trash bin retention,
and a maximum time for trash bin retention.
Minimum time is the number of days a file will be kept, after which it
may be deleted. Maximum time is the number of days at which it is guaranteed
to be deleted.
Both minimum and maximum times can be set together to explicitly define
file and folder deletion. For migration purposes, this setting is installed
initially set to "auto", which is equivalent to the default setting in
Nextcloud.
You may alter the default pattern in ``config.php``. The default setting is
``auto``, which sets the default pattern::
'trashbin_retention_obligation' => 'auto',
Available values:
* ``auto``
default setting. keeps files and folders in the trash bin for 30 days
and automatically deletes anytime after that if space is needed (note:
files may not be deleted if space is not needed).
* ``D, auto``
keeps files and folders in the trash bin for D+ days, delete anytime if
space needed (note: files may not be deleted if space is not needed)
* ``auto, D``
delete all files in the trash bin that are older than D days
automatically, delete other files anytime if space needed
* ``D1, D2``
keep files and folders in the trash bin for at least D1 days and
delete when exceeds D2 days (note: files will not be deleted automatically if space is needed)
* ``disabled``
trash bin auto clean disabled, files and folders will be kept forever
Background job
--------------
To permanently delete files a background jobs runs every 30 minutes.
It's possible to deactivate the background job and setup a (system) cron to expire the versions via occ.
Deactivate background job: ``occ config:app:set --value=no files_trashbin background_job_expire_trash``
Activate background job: ``occ config:app:delete files_trashbin background_job_expire_trash``
Expire versions: ``occ trashbin:expire`` or ``occ trashbin:expire --quiet`` (without the progress bar)
wedding-pics/core/doc/admin/_sources/configuration_mimetypes/index.rst.txt
+76
View File
@@ -0,0 +1,76 @@
====================
Mimetypes management
====================
Mimetype aliases
----------------
Nextcloud allows you to create aliases for mimetypes, so that you can display
custom icons for files. For example, you might want a nice audio icon for audio
files instead of the default file icon.
By default Nextcloud is distributed with
``nextcloud/resources/config/mimetypealiases.dist.json``.
Do not modify this file, as it will be replaced when Nextcloud is updated.
Instead, create your own ``nextcloud/config/mimetypealiases.json``
file with your custom aliases. Use the same syntax as in
``nextcloud/resources/config/mimetypealiases.dist.json``.
Once you have made changes to your ``mimetypealiases.json``, use the ``occ``
command to propagate the changes through the system. This example is for
Ubuntu Linux::
$ sudo -u www-data php occ maintenance:mimetype:update-js
# you may also need to update the mimetype for existing files, see nextcloud/server#30566
$ sudo -u www-data php occ maintenance:mimetype:update-db --repair-filecache
See :doc:`../configuration_server/occ_command` to learn more about ``occ``.
Some common mimetypes that may be useful in creating aliases are:
image
Generic image
image/vector
Vector image
audio
Generic audio file
x-office/document
Word processed document
x-office/spreadsheet
Spreadsheet
x-office/presentation
Presentation
text
Generic text document
text/code
Source code
Mimetype mapping
----------------
Nextcloud allows administrators to specify the mapping of a file extension to a
mimetype. For example files ending in ``mp3`` map to ``audio/mpeg``. Which
then in turn allows Nextcloud to show the audio icon.
By default Nextcloud comes with ``mimetypemapping.dist.json``. This is a
simple json array.
Administrators should not update this file as it will get replaced on upgrades
of Nextcloud. Instead the file ``mimetypemapping.json`` should be created and
modified, this file has precedence over the shipped file.
Icon retrieval
--------------
When an icon is retrieved for a mimetype, if the full mimetype cannot be found,
the search will fallback to looking for the part before the slash. Given a file
with the mimetype 'image/my-custom-image', if no icon exists for the full
mimetype, the icon for 'image' will be used instead. This allows specialised
mimetypes to fallback to generic icons when the relevant icons are unavailable.
wedding-pics/core/doc/admin/_sources/configuration_server/activity_configuration.rst.txt
+74
View File
@@ -0,0 +1,74 @@
============
Activity app
============
You can configure your Nextcloud server to automatically send out e-mail notifications
to your users for various events like:
* A file or folder has been shared
* A new file or folder has been created
* A file or folder has been changed
* A file or folder has been deleted
Users can see actions (delete, add, modify) that happen to files they have access to.
Sharing actions are only visible to the sharer and sharee.
Enabling the activity app
-------------------------
The Activity App is shipped and enabled by default. If it is not enabled
simply go to your Nextcloud Apps page to enable it.
Configuring your Nextcloud for the activity app
-----------------------------------------------
To configure your Nextcloud to send out e-mail notifications a working
:doc:`email_configuration` is mandatory.
Furthermore it is recommended to configure the background job ``Webcron`` or
``Cron`` as described in :doc:`background_jobs_configuration`.
There is also a configuration option ``activity_expire_days`` available in your
``config.php`` (See :ref:`label-activity-app-config`) which allows
you to clean-up older activities from the database.
.. _label-activities-groupfolders:
Activities in groupfolders or external storages
-----------------------------------------------
By default activities in groupfolders or external storages are only generated for the current user.
This is due to the logic of groupfolders and external storages. There is a config flag
``activity_use_cached_mountpoints`` that makes activities in groupfolders and external storages work
like in normal shares when set to ``true``.
.. warning::
This config option comes with the following limitations:
1. If "Advanced Permissions" (ACLs) are enabled in a groupfolder, the activities don't respect the permissions and therefore all users see all activities, even for files and directories they don't have access to. **This potentially leaks sensitive information!** See `this issue <https://github.com/nextcloud/groupfolders/issues/1057>`_ for more information.
2. Users that had access to a groupfolder, share or external storage can see activities in their stream and emails that happen after they are removed until they login again
3. Users that are newly added to a groupfolder, share or external storage can not see activities in their stream nor emails that happen after they are added until they login again
Better scheduling of activity emails
------------------------------------
In certain scenarios it makes sense to send the activity emails out more regularly,
e.g. you want to send the hourly emails always at the full hour, daily emails before
people start to work in the morning and weekly mails shall be send on monday morning,
so people can read up when starting into the week.
A console command is available to trigger sending those emails.
This allows to set up special cron jobs on your server with the known
granularity, instead of relying on the Nextcloud cron feature which is not very flexible
on scheduling.
To implement the samples mentioned above, the following three entries are necessary::
# crontab -u www-data -e
0 * * * * php -f /var/www/nextcloud/occ activity:send-mails hourly
30 7 * * * php -f /var/www/nextcloud/occ activity:send-mails daily
30 7 * * MON php -f /var/www/nextcloud/occ activity:send-mails weekly
If you want to manually send out all activity emails which are queued, you can run
``occ activity:send-mails`` without any argument.
wedding-pics/core/doc/admin/_sources/configuration_server/admin_delegation_configuration.rst.txt
+27
View File
@@ -0,0 +1,27 @@
=====================
Admin right privilege
=====================
By default only members of the admin group can access and edit the admin
settings. It is sometimes needed to give some group of users access to a
setting page while not giving them access to everything. For this you can
use the *Admin right privilege* settings.
.. note::
Not every setting pages support this features. This is due to either the
feature not being implemented yet for the specific setting page or due
to possible privilege escalations.
Configuring Admin right privilege
=================================
Go to the *Admin right privilege* Admin page, you should be presented
with the list of settings that support this features.
.. figure:: images/admin-right.png
By clicking on the combobox, you will be able to choose which user groups
are able to access the selected setting. You can revoke the access at any
time by removing the group from the selection.
wedding-pics/core/doc/admin/_sources/configuration_server/antivirus_configuration.rst.txt
+188
View File
@@ -0,0 +1,188 @@
=================
Antivirus scanner
=================
You can configure your Nextcloud server to automatically run a virus scan on
newly-uploaded files with the Antivirus app for Files. The Antivirus app for
Files integrates the open source anti-virus engine `ClamAV
<https://www.clamav.net/index.html>`_ with Nextcloud. ClamAV detects all forms
of malware including Trojan horses, viruses, and worms, and it operates on all
major file types including Windows, Linux, and Mac files, compressed files,
executables, image files, Flash, PDF, and many others. ClamAV's Freshclam
daemon automatically updates its malware signature database at scheduled
intervals.
ClamAV runs on Linux and any Unix-type operating system, and Microsoft Windows.
However, it has only been tested with Nextcloud on Linux, so these instructions
are for Linux systems. You must first install ClamAV, and then install and
configure the Antivirus app for Files on Nextcloud.
Installing ClamAV
-----------------
As always, the various Linux distributions manage installing and configuring
ClamAV in different ways.
Debian, Ubuntu, Linux Mint
On Debian and Ubuntu systems, and their many variants, install ClamAV with
these commands::
apt-get install clamav clamav-daemon
The installer automatically creates default configuration files and launches the
``clamd`` and ``freshclam`` daemons. You don't have to do anything more, though
it's a good idea to review the ClamAV documentation and your settings in
``/etc/clamav/``. Enable verbose logging in both ``clamd.conf`` and
``freshclam.conf`` until you get any kinks worked out.
RedHat Enterprise Linux 7, CentOS 7
On RedHat Enterprise Linux 7 and related systems you must install the Extra Packages for
Enterprise Linux (EPEL) repository, and then install ClamAV::
yum install epel-release
yum install clamav clamav-scanner clamav-scanner-systemd clamav-server
clamav-server-systemd clamav-update
This installs two configuration files: ``/etc/freshclam.conf`` and
``/etc/clamd.d/scan.conf``. You must edit both of these before you can run
ClamAV. Both files are well-commented, and ``man clamd.conf`` and ``man
freshclam.conf`` explain all the options. Refer to ``/etc/passwd`` and
``/etc/group`` when you need to verify the ClamAV user and group.
First edit ``/etc/freshclam.conf`` and configure your options.
``freshclam`` updates your malware database, so you want it to run frequently to
get updated malware signatures. Run it manually post-installation to download
your first set of malware signatures::
freshclam
The EPEL packages do not include an init file for ``freshclam``, so the quick
and easy way to set it up for regular checks is with a cron job. This example
runs it every hour at 47 minutes past the hour::
# m h dom mon dow command
47 * * * * /usr/bin/freshclam --quiet
Please avoid any multiples of 10, because those are when the ClamAV servers are
hit the hardest for updates.
Next, edit ``/etc/clamd.d/scan.conf``. When you're finished you must enable
the ``clamd`` service file and start ``clamd``::
systemctl enable clamd@scan.service
systemctl start clamd@scan.service
That should take care of everything. Enable verbose logging in ``scan.conf``
and ``freshclam.conf`` until it is running the way you want.
Docker, Docker-compose
To install ClamAV via docker or docker compose you can take official image of ClamAV, or build one by yourself.
This example is based on docker image from https://github.com/Cisco-Talos/clamav.
You can mount ClamAV Socket from the Docker Container to the host System as volume. In this case you do not need to expose any port outside of container.
For a Docker run this command::
docker run --name clamav -d -v /var/run/clamav/:/var/run/clamav/ -v /var/docker/clamav/virus_db/:/var/lib/clamav/ clamav/clamav:stable_base
For a Docker-compose use following settings::
version: "3.6"
services:
clamav:
image: "clamav/clamav:stable_base"
container_name: "clamav"
volumes:
# Socket
- /var/run/clamav/:/var/run/clamav/
# Virus DB
- /var/docker/clamav/virus_db/:/var/lib/clamav/
restart: unless-stopped
Enabling the antivirus app for files
------------------------------------
Place the ``files_antivirus`` app into the ``apps`` directory of your Nextcloud
server. Then the app shows up on the Nextcloud Apps page where it simply can be
enabled.
.. figure:: ../images/antivirus-app.png
Configuring ClamAV on Nextcloud
-------------------------------
Next, go to your Nextcloud Admin page and set your Nextcloud logging level to
Everything.
.. figure:: ../images/antivirus-logging.png
Now find your Antivirus Configuration panel on your Admin page.
.. figure:: ../images/antivirus-config.png
ClamAV runs in one of three modes:
* Daemon (Socket): ClamAV is running on the same server as Nextcloud. The ClamAV
daemon, ``clamd``, runs in the background. When there is no activity ``clamd``
places a minimal load on your system. If your users upload large volumes of
files you will see high CPU usage.
* Daemon: ClamAV is running on a different server. This is a good option
for Nextcloud servers with high volumes of file uploads.
* Executable: ClamAV is running on the same server as Nextcloud, and the
``clamscan`` command is started and then stopped with each file upload.
``clamscan`` is slow and not always reliable for on-demand usage; it is
better to use one of the daemon modes.
Daemon (Socket)
Nextcloud should detect your ``clamd`` socket and fill in the ``Socket``
field. This is the ``LocalSocket`` option in ``clamd.conf``. You can
run ``netstat`` to verify::
netstat -a|grep clam
unix 2 [ ACC ] STREAM LISTENING 15857 /var/run/clamav/clamd.ctl
.. figure:: ../images/antivirus-daemon-socket.png
The ``Stream Length`` value sets the number of bytes read in one pass.
10485760 bytes, or ten megabytes, is the default. This value should be
no larger than the PHP ``memory_limit`` settings, or physical memory if
``memory_limit`` is set to -1 (no limit).
``Action for infected files found while scanning`` gives you the choice of
logging any alerts without deleting the files, or immediately deleting
infected files.
Daemon
For the Daemon option you need the hostname or IP address of the remote
server running ClamAV, and the server's port number.
.. figure:: ../images/antivirus-daemon.png
Executable
The Executable option requires the path to ``clamscan``, which is the
interactive ClamAV scanning command. Nextcloud should find it automatically.
.. figure:: ../images/antivirus-executable.png
When you are satisfied with how ClamAV is operating, you might want to go
back and change all of your logging to less verbose levels.
Configuring ICAP on Nextcloud
-----------------------------
Nextcloud offers the integration of antivirus protection based on the ICAP protocol.
The settings are outlined here.
Additional documentation is work in progress.
.. figure:: ../images/antivirus-icap.png
Disabling background scan task
------------------------------
You can disable background scan with occ to only scan files during upload.
occ config:app:set files_antivirus av_background_scan --value="off"
wedding-pics/core/doc/admin/_sources/configuration_server/automatic_configuration.rst.txt
+125
View File
@@ -0,0 +1,125 @@
===============
Automatic setup
===============
If you need to install Nextcloud on multiple servers, you normally do not want
to set up each instance separately as described in
:doc:`../configuration_database/linux_database_configuration`.
For this reason, Nextcloud provides an automatic configuration feature.
To take advantage of this feature, you must create a configuration file, called
:file:`config/autoconfig.php`, and set the file parameters as required.
You can specify any number of parameters in this file. Any unspecified parameters appear on the "Finish setup" screen when you first launch Nextcloud.
The :file:`config/autoconfig.php` is automatically removed after the initial configuration has been applied.
.. note:: Keep in mind that the automatic configuration does not eliminate the need for
creating the database user and database in advance, as described in
:doc:`../configuration_database/linux_database_configuration`.
Parameters
----------
When configuring parameters, you must understand that two parameters are named differently in this configuration file when compared to the standard :file:`config.php` file.
+----------------+---------------+
| autoconfig.php | config.php |
+================+===============+
| directory | datadirectory |
+----------------+---------------+
| dbpass | dbpassword |
+----------------+---------------+
Automatic configurations examples
---------------------------------
The following sections provide sample automatic configuration examples and what information is requested at the end of the configuration.
Data Directory
^^^^^^^^^^^^^^
Using the following parameter settings, the "Finish setup" screen requests database and admin credentials settings.
::
<?php
$AUTOCONFIG = [
"directory" => "/www/htdocs/nextcloud/data",
];
SQLite database
^^^^^^^^^^^^^^^
Using the following parameter settings, the "Finish setup" screen requests data directory and admin credentials settings.
::
<?php
$AUTOCONFIG = [
"dbtype" => "sqlite",
"dbname" => "nextcloud",
"dbtableprefix" => "",
];
MySQL database
^^^^^^^^^^^^^^
Using the following parameter settings, the "Finish setup" screen requests data directory and admin credentials settings.
::
<?php
$AUTOCONFIG = array(
"dbtype" => "mysql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpass" => "password",
"dbhost" => "localhost",
"dbtableprefix" => "",
);
PostgreSQL database
^^^^^^^^^^^^^^^^^^^
Using the following parameter settings, the "Finish setup" screen requests data directory and admin credentials settings.
::
<?php
$AUTOCONFIG = array(
"dbtype" => "pgsql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpass" => "password",
"dbhost" => "localhost",
"dbtableprefix" => "",
);
.. note:: Keep in mind that the automatic configuration does not eliminate the need for
creating the database user and database in advance, as described in
:doc:`../configuration_database/linux_database_configuration`.
All parameters
^^^^^^^^^^^^^^
Using the following parameter settings, because all parameters are already configured in the file, the Nextcloud installation skips the "Finish setup" screen.
::
<?php
$AUTOCONFIG = array(
"dbtype" => "mysql",
"dbname" => "nextcloud",
"dbuser" => "username",
"dbpass" => "password",
"dbhost" => "localhost",
"dbtableprefix" => "",
"adminlogin" => "root",
"adminpass" => "root-password",
"directory" => "/www/htdocs/nextcloud/data",
);
.. note:: Keep in mind that the automatic configuration does not eliminate the need for
creating the database user and database in advance, as described in
:doc:`../configuration_database/linux_database_configuration`.
wedding-pics/core/doc/admin/_sources/configuration_server/background_jobs_configuration.rst.txt
+173
View File
@@ -0,0 +1,173 @@
===============
Background jobs
===============
A system like Nextcloud sometimes requires tasks to be done on a regular basis
without the need for user interaction or hindering Nextcloud performance. For
that purpose, as a system administrator, you can define background jobs (for
example, database clean-ups) which are executed without any need for user
interaction.
These jobs are typically referred to as *cron jobs*. Cron jobs are commands or
shell-based scripts that are scheduled to run periodically at fixed times,
dates, or intervals. ``cron.php`` is a Nextcloud internal process that runs
such background jobs on demand.
Nextcloud apps register actions with ``cron.php`` automatically
to take care of typical housekeeping operations, such as garbage collecting of
temporary files or checking for newly updated files using ``filescan()`` for
externally mounted file systems.
Parameters
----------
``maintenance_window_start``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.. note:: This setting is only taken into account in ``cron`` mode.
In the ``config/config.php`` file you can specify this config.
Some background jobs only run once a day. When an hour is defined (timezone is UTC)
for this config, the background jobs which advertise themselves as not time-sensitive
will be delayed during the "working" hours and only run in the 4 hours after the given
time. This is e.g. used for activity expiration, suspicious login training, and update checks.
A value of 1 e.g. will only run these background jobs between 01:00am UTC and 05:00am UTC::
'maintenance_window_start' => 1,
If you don't care when these jobs run, you can set the value to ``100``, but beware that
resource intensive jobs may then run unnecessarily during high usage periods. This may lead to
slower performance and a lower quality user experience.
This setting may also be set directly via ``occ`` just like any other configuration parameter::
occ config:system:set maintenance_window_start --type=integer --value=1
Cron jobs
---------
You can schedule cron jobs in three ways -- using AJAX, Webcron, or cron. The
default method is to use AJAX. However, the recommended method is to use cron.
The following sections describe the differences between each method.
AJAX
^^^^
**Use case: Single user instance**
The AJAX scheduling method is the default option. Unfortunately, however, it is
also the least reliable. Each time a user visits the Nextcloud page, a single
background job is executed. The advantage of this mechanism is that it does not
require access to the system nor registration with a third-party service. The
disadvantage of this mechanism, when compared to the Webcron service, is that it
requires regular visits to the page for it to be triggered.
.. warning:: Especially when using the Activity app or external storages, where new
files are added, updated or deleted, or when **multiple users** use the server, it
is recommended to use ``cron``.
Webcron
^^^^^^^
**Use case: Very small instance** (1–5 users depending on the usage)
By registering your Nextcloud ``cron.php`` script address at an external webcron
service (for example, easyCron_), you ensure that background jobs are executed
regularly. To use this type of service with your server, you must be able to
access your server using the Internet. For example::
URL to call: http[s]://<domain-of-your-server>/nextcloud/cron.php
.. warning:: Since WebCron is still executed via the web, the webserver in most cases limits the
resources on the execution. To avoid interrupts inside jobs only 1 job is executed
per call. When webcron is called once every 5 minutes this limits your instance to
288 background jobs per day, which is only suitable for very small instances.
For bigger instances, it is recommended to use ``cron``.
.. _system-cron-configuration-label:
Cron
^^^^
Using the operating system cron feature is the preferred method for executing
regular tasks. This method enables the execution of scheduled jobs without the
inherent limitations the Web server might have.
To run a cron job on a \*nix system, every 5 minutes, under the default Web
server user (often, ``www-data`` or ``wwwrun``), you must set up the following
cron job to call the **cron.php** script::
# crontab -u www-data -e
And append this line::
*/5 * * * * php -f /var/www/nextcloud/cron.php
You can verify if the cron job has been added and scheduled by executing::
# crontab -u www-data -l
Which returns::
[snip]
*/5 * * * * php -f /var/www/nextcloud/cron.php
.. note:: You have to replace the path ``/var/www/nextcloud/cron.php`` with the
path to your current Nextcloud installation.
.. note:: On some systems it might be required to call **php-cli** instead of **php**.
.. note:: For some configurations, it might be necessary to append ``--define apc.enable_cli=1`` to the cron command. Please refer to :doc:`./caching_configuration` (section APCu).
.. note:: Please refer to the crontab man page for the exact command syntax.
.. _easyCron: https://www.easycron.com/
systemd
^^^^^^^
If systemd is installed on the system, a systemd timer could be an alternative to a cronjob.
This approach requires two files: **nextcloudcron.service** and **nextcloudcron.timer**. Create these two files in ``/etc/systemd/system/``.
**nextcloudcron.service** should look like this::
[Unit]
Description=Nextcloud cron.php job
[Service]
User=www-data
ExecCondition=php -f /var/www/nextcloud/occ status -e
ExecStart=/usr/bin/php -f /var/www/nextcloud/cron.php
KillMode=process
Replace the user ``www-data`` with the user of your http server and ``/var/www/nextcloud/cron.php`` with the location of **cron.php** in your nextcloud directory.
The `ExecCondition` checks that the nextcloud instance is operating normally before running the background job, and skips it if otherwise.
The ``KillMode=process`` setting is necessary for external programs that are started by the cron job to keep running after the cron job has finished.
Note that the **.service** unit file does not need an ``[Install]`` section. Please check your setup because we recommended it in earlier versions of this admin manual.
**nextcloudcron.timer** should look like this::
[Unit]
Description=Run Nextcloud cron.php every 5 minutes
[Timer]
OnBootSec=5min
OnUnitActiveSec=5min
Unit=nextcloudcron.service
[Install]
WantedBy=timers.target
The important parts in the timer-unit are ``OnBootSec`` and ``OnUnitActiveSec``. ``OnBootSec`` will start the timer 5 minutes after boot, otherwise, you would have to start it manually after every boot. ``OnUnitActiveSec`` will set a 5-minute timer after the service-unit was last activated.
Now all that is left is to start and enable the timer by running this command::
systemctl enable --now nextcloudcron.timer
When the option ``--now`` is used with ``enable``, the respective unit will also be started.
.. note:: Selecting the option ``Cron`` in the admin menu for background jobs is not mandatory, because once `cron.php` is executed from the command line or cron service it will set it automatically to ``Cron``.
wedding-pics/core/doc/admin/_sources/configuration_server/bruteforce_configuration.rst.txt
+56
View File
@@ -0,0 +1,56 @@
======================
Brute force protection
======================
Nextcloud has built-in protection against brute force attempts. This protects
your system from attackers trying for example a lot of different passwords.
Brute force protection is enabled by default on Nextcloud.
How it works
------------
The brute force protection is easiest to see in action on the login page.
If you try to log in the first time with an invalid username and/or password you
will not notice anything. But if you do this a few times you start to notice
that the verification of the login is taking longer each time. This is the
brute force protection kicking in.
The maximum delay is 25 seconds.
After a successful login the attempts will be cleared. And once a user is
properly authenticated they will no longer be hit by the delay.
Brute force protection and load balancer/reverse proxy
------------------------------------------------------
If you are behind a reverse proxy or load balancer it is important you make sure it is
setup properly. Especially the **trusted_proxies** and **forwarded_for_headers**
`config.php` variables need to be set correctly. Otherwise it can happen
that Nextcloud actually starts throttling all traffic coming from the reverse
proxy or load balancer. For more information see :doc:`reverse_proxy_configuration`.
Exclude IP addresses from brute force protection
------------------------------------------------
It's possible to exlude IP addresses from the brute force protection.
- Enable the bruteforcesettings app
- Login as admin and go to Administration settings -> Security
.. warning::
Note that any excluded IP address can perform authentication attempts without any throttling.
Its best to exclude as few IP addresses as you can, or even none at all.
Troubleshooting
---------------
On most setups Nextcloud will work out of the box without any issues. If you
run into a situation where login is often very slow for all users the first
step is to inspect the `bruteforce_attempts` table. There you can see
which IP addresses are actually throttled.
wedding-pics/core/doc/admin/_sources/configuration_server/caching_configuration.rst.txt
+363
View File
@@ -0,0 +1,363 @@
==============
Memory caching
==============
You can significantly improve your Nextcloud server performance with memory
caching, where frequently-requested objects are stored in memory for faster
retrieval. There are two types of caches to use: a PHP opcode cache, which is
commonly called *opcache*, and data cache for your web server, commonly called
"memcache".
.. note:: If you do not install and enable a local memcache you will see a
warning on your Nextcloud admin page. **A memcache is not required. You
may safely ignore the warning if you prefer.** If you enable only a
distributed cache (``memcache.distributed``) in your ``config.php`` and not
a local cache (``memcache.local``) you will still see the cache warning.
A **PHP opcache** stores compiled PHP scripts, so they don't need to be re-compiled
every time they are called. PHP bundles the Zend OPcache in core since version
5.5, so you don't need to install an opcache manually.
**Data caching** is supplied by the user. Nextcloud supports multiple memory
caching backends, so you can choose the type of memcache that best fits your
needs. The supported caching backends are:
* `APCu <https://pecl.php.net/package/APCu>`_, APCu 4.0.6 and up required.
A local cache for systems.
* `Redis <http://redis.io/>`_, PHP module 2.2.6 and up required.
For local and distributed caching, as well as transactional file locking.
* `Memcached <https://www.memcached.org/>`_
For distributed caching.
Data caches, or memcaches, must be explicitly configured in Nextcloud by installing
and enabling your desired cache, and then adding the appropriate entry to
``config.php`` (See :doc:`config_sample_php_parameters` for an overview of
all possible config parameters).
Recommendations based on type of deployment
-------------------------------------------
You may use both a local and a distributed cache. Recommended caches are APCu
and Redis. After installing and enabling your chosen memcache (data cache),
verify that it is active by running :ref:`label-phpinfo`.
.. note:: See specific cache configuration options under the appropriate section further down.
Small/Private home server
^^^^^^^^^^^^^^^^^^^^^^^^^
Only use APCu::
'memcache.local' => '\OC\Memcache\APCu',
Organizations with single-server
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Use Redis for everything except local memcache::
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'redis' => [
'host' => 'localhost',
'port' => 6379,
],
Organizations with clustered setups
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Use APCu for local cache and either Redis cluster ...::
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'redis.cluster' => [
'seeds' => [ // provide some/all of the cluster servers to bootstrap discovery, port required
'cache-cluster:7000',
'cache-cluster:7001',
],
]
... or Memcached cluster ...::
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Memcached',
'memcache.locking' => '\OC\Memcache\Memcached',
'memcached_servers' => [
[ 'server1.example.com', 11211 ],
[ 'server2.example.com', 11211 ],
],
... for distributed and locking caches.
.. note:: If you run multiple web servers and enable a distributed cache in
your ``config.php`` (``memcache.distributed``) or a file locking provider
(``memcache.locking``) you need to make sure that they are referring to the
very same memcache server/cluster and not to ``localhost`` or a unix socket.
Additional notes for Redis vs. APCu on memory caching
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
APCu is faster at local caching than Redis. If you have enough memory, use APCu for Memory Caching
and Redis for File Locking. If you are low on memory, use Redis for both.
APCu
----
APCu is a data cache, and it is available in most
Linux distributions. On Red Hat/CentOS/Fedora systems install
``php-pecl-apcu``. On Debian/Ubuntu/Mint systems install ``php-apcu``.
After restarting your Web server, add this line to your ``config.php`` file::
'memcache.local' => '\OC\Memcache\APCu',
Refresh your Nextcloud admin page, and the cache warning should disappear.
.. warning:: APCu is disabled by default on CLI which could cause issues with nextcloud's
cron jobs. Please make sure you set the ``apc.enable_cli`` to ``1`` on your ``php.ini``
config file or append ``--define apc.enable_cli=1`` to the cron job call.
Redis
-----
Redis is an excellent modern memcache to use for distributed caching, and
as a key-value store for :doc:`Transactional File Locking
<../configuration_files/files_locking_transactional>` because it guarantees
that cached objects are available for as long as they are needed.
The Redis PHP module must be version 2.2.6+. If you are running a Linux
distribution that does not package the supported versions of this module, or
does not package Redis at all, see :ref:`install_redis_label`.
On Debian/Ubuntu/Mint, install ``redis-server`` and ``php-redis``. The installer
will automatically launch ``redis-server`` and configure it to launch at
startup.
On CentOS and Fedora, install ``redis`` and ``php-pecl-redis``. It will not
start automatically, so you must use your service manager to start
``redis``, and to launch it at boot as a daemon.
You can verify that the Redis daemon is running with ``ps ax``::
ps ax | grep redis
22203 ? Ssl 0:00 /usr/bin/redis-server 127.0.0.1:6379
Restart your Web server, add the appropriate entries to your ``config.php``, and
refresh your Nextcloud admin page.
Redis configuration in Nextcloud (config.php)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
For best performance, use Redis for file locking by adding this::
'memcache.locking' => '\OC\Memcache\Redis',
Additionally, you should use Redis for the distributed server cache::
'memcache.distributed' => '\OC\Memcache\Redis',
Furthermore, you could use Redis for the local cache like so, but it's not recommended (see warning below)::
'memcache.local' => '\OC\Memcache\Redis',
.. warning:: Using Redis for local cache on a multi-server setup can cause issues. Also, even on a single-server setup, APCu (see section above) should be faster.
When using Redis for any of the above cache settings, you also need to
specify either the ``redis`` or ``redis.cluster`` configuration in ``config.php``.
The following options are available to configure when using a single redis server (all but ``host`` and ``port`` are optional. For the latter two, see the next sections)::
'memcache.locking' => '\OC\Memcache\Redis',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.local' =>'\OC\Memcache\Redis' ,
'redis' => [
// 'host' => see connection parameters below
// 'port' => see connection parameters below
'user' => 'nextcloud',
'password' => 'password',
'dbindex' => 0,
'timeout' => 1.5,
'read_timeout' => 1.5,
]
The following options are available to configure when using a redis cluster (all but ``seeds`` are optional)::
'memcache.locking' => '\OC\Memcache\Redis',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.local' =>'\OC\Memcache\Redis' ,
'redis.cluster' => [
'seeds' => [ // provide some/all of the cluster servers to bootstrap discovery, port required
'cache-cluster:7000',
'cache-cluster:7001',
'cache-cluster:7002',
'cache-cluster:7003',
'cache-cluster:7004',
'cache-cluster:7005'
],
'failover_mode' => \RedisCluster::FAILOVER_ERROR
'timeout' => 0.0,
'read_timeout' => 0.0,
'user' => 'nextcloud',
'password' => 'password',
'dbindex' => 0,
]
.. note:: The port is required as part of the server URL. However, it is not necesarry to list all servers: for example, if all servers are load balanced via the same DNS name, only that server name is required.
Connecting to single Redis server over TCP
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To connect to a remote or local Redis server over TCP use::
'redis' => [
'host' => 'redis-host.example.com',
'port' => 6379,
],
Connecting to single Redis server over TLS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To connect via TCP over TLS, add the following configuration::
'redis' => [
'host' => 'tls://127.0.0.1',
'port' => 6379,
'ssl_context' => [
'local_cert' => '/certs/redis.crt',
'local_pk' => '/certs/redis.key',
'cafile' => '/certs/ca.crt',
'verify_peer_name' => false
]
]
Connecting to Redis cluster over TLS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To connect via TCP over TLS, add the following configuration::
'redis.cluster' => [
'seeds' => [ // provide some/all of the cluster servers to bootstrap discovery, port required
'cache-cluster:7000',
'cache-cluster:7001',
],
'ssl_context' => [
'local_cert' => '/certs/redis.crt',
'local_pk' => '/certs/redis.key',
'cafile' => '/certs/ca.crt',
'verify_peer_name' => false
]
]
Connecting to single Redis server over UNIX socket
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you want to connect to Redis configured to listen on an Unix socket (which is
recommended if Redis is running on the same system as Nextcloud) use this example
``config.php`` configuration::
'redis' => [
'host' => '/run/redis/redis-server.sock',
'port' => 0,
],
Only "host" and "port" variables are required, the other ones are optional.
Update the redis configuration in ``/etc/redis/redis.conf`` accordingly: uncomment Unix socket options and ensure the "socket" and "port" settings match your Nextcloud configuration.
Be sure to set the right permissions on redis.sock so that your webserver can
read and write to it. For this you typically have to add the webserver user
to the redis group::
usermod -a -G redis www-data
And modify the ``unixsocketperm`` of the ``redis.conf`` accordingly::
unixsocketperm 770
You might need to restart apache and redis for the changes to take effect::
systemctl restart apache2
systemctl restart redis-server
Redis is very configurable; consult `the Redis documentation
<http://redis.io/documentation>`_ to learn more.
Using the Redis session handler
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you are using Redis for locking and/or caching,
you may also wish to use Redis for session management. Redis can be used for centralized
session management across multiple Nextcloud application servers, unlike the standard
`files` handler. If you use the Redis handler, though, you *MUST* ensure that session
locking is enabled. As of this writing, the Redis session handler does *NOT* enable
session locking by default, which can lead to session corruption in some Nextcloud apps
that make heavy use of session writes such as Talk. In addition, even when session locking
is enabled, if the application fails to acquire a lock, the Redis session handler does not
currently return an error. Adding the following settings in your ``php.ini`` file will
prevent session corruption when using Redis as your session handler: ::
redis.session.locking_enabled=1
redis.session.lock_retries=-1
redis.session.lock_wait_time=10000
More information on configuration of phpredis session handler can be found on the
`PhpRedis GitHub page <https://github.com/phpredis/phpredis>`_
.. _install_redis_label:
Memcached
---------
Memcached is a reliable oldtimer for shared caching on distributed servers,
and performs well with Nextcloud with one exception: it is not suitable to use
with :doc:`Transactional File Locking <../configuration_files/files_locking_transactional>`
because it does not store locks, and data can disappear from the cache at any time
(Redis is the best memcache for this).
.. note:: Be sure to install the **memcached** PHP module, and not memcache, as
in the following examples. Nextcloud supports only the **memcached** PHP
module.
Setting up Memcached is easy. On Debian/Ubuntu/Mint install ``memcached`` and
``php-memcached``. The installer will automatically start ``memcached`` and
configure it to launch at startup.
On Red Hat/CentOS/Fedora install ``memcached`` and
``php-pecl-memcached``. It will not start automatically, so you must use
your service manager to start ``memcached``, and to launch it at boot as a
daemon.
You can verify that the Memcached daemon is running with ``ps ax``::
ps ax | grep memcached
19563 ? Sl 0:02 /usr/bin/memcached -m 64 -p 11211 -u memcache -l
127.0.0.1
Restart your Web server, add the appropriate entries to your
``config.php``, and refresh your Nextcloud admin page.
Memcached configuration in Nextcloud (config.php)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This example uses APCu for the local cache, Memcached as the distributed memcache,
and lists all the servers in the shared cache pool with their port numbers::
'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Memcached',
'memcache.locking' => '\OC\Memcache\Memcached',
'memcached_servers' => [
[ 'server0.example.com', 11211 ],
[ 'server1.example.com', 11211 ],
[ 'server2.example.com', 11211 ],
],
Cache Directory location
------------------------
The cache directory defaults to ``data/$user/cache`` where ``$user`` is the
current user. You may use the ``'cache_path'`` directive in ``config.php``
(See :doc:`config_sample_php_parameters`) to select a different location.
wedding-pics/core/doc/admin/_sources/configuration_server/config_sample_php_parameters.rst.txt
+3547
View File
File diff suppressed because it is too large Load Diff
wedding-pics/core/doc/admin/_sources/configuration_server/dashboard_configuration.rst.txt
+30
View File
@@ -0,0 +1,30 @@
=============
Dashboard app
=============
The Nextcloud Dashboard is your starting point of the day, giving users an overview of your upcoming appointments, urgent emails, chat messages, incoming tickets, latest tweets and much more! Users can add the widgets they like and change the background to their liking.
Enabling the dashboard app
--------------------------
The Dashboard App is shipped and enabled by default. If it is not enabled
simply go to your Nextcloud Apps page to enable it.
Configuring your Nextcloud for the activity app
-----------------------------------------------
The dashboard widgets are provided by apps and have a unique identifier. This can be used to customize the default layout of the dashboard as an administrator. The layout is stored as a comma-separated list of widget identifiers.
The layout of an existing user can be read with the following command::
occ user:setting admin dashboard layout
The layout of the dashboard for a specific user can be set with the following command::
occ user:setting admin dashboard layout --value="calendar,files,activity"
The default layout of the dashboard for all users can be set with the following command::
occ config:app:set dashboard layout --value="files,activity,calendar"
Changing the default layout will not affect existing users that already have a custom layout stored.
wedding-pics/core/doc/admin/_sources/configuration_server/domain_change.rst.txt
+8
View File
@@ -0,0 +1,8 @@
=====================
Domain Change
=====================
Changing the domain after the first setup is currently not supported by Nextcloud. That is mainly because Nextcloud's apps don't support changing the domain after they are set up.
.. note::
This documentation will get updated with steps what needs to be done if you want to change the domain as soon as this feature is available.
wedding-pics/core/doc/admin/_sources/configuration_server/email_configuration.rst.txt
+413
View File
@@ -0,0 +1,413 @@
.. _email-config:
=====
Email
=====
Nextcloud is capable of sending password reset emails, notifying users of new
file shares, changes in files, and activity notifications. Your users configure
which notifications they want to receive on their Personal pages.
Nextcloud does not contain a full email server, but rather connects to your
existing mail server. You must have a functioning mail server for Nextcloud to be
able to send emails. You may have a mail server on the same machine as Nextcloud,
or it may be a remote server.
To access the setup page below log in with an admin account. Click on your avatar
in the top right, and then click Settings. On the left side under Administration and
click Basic settings.
.. figure:: ../images/smtp-config-wizard.png
With the wizard, connecting Nextcloud to your mail server is fast and easy.
The wizard fills in the values in ``config/config.php``, so you may use either
or both as you prefer.
The Nextcloud Email wizard supports three types of mail server connections:
SMTP, qmail, and Sendmail. Use the SMTP configurator for a remote server or
Sendmail when your mail server is on the same machine as Nextcloud.
.. note:: The Sendmail option refers to the Sendmail SMTP server and any
drop-in Sendmail replacement such as Postfix, Exim, or Courier. All of
these include a ``sendmail`` binary, and are freely-interchangeable.
.. _email-smtp-config:
Configuring an SMTP server
--------------------------
You need the following information from your mail server administrator to
connect Nextcloud to a remote SMTP server:
.. warning:: There were changes to the 3rd party mailer library in Nextcloud 26:
* STARTTLS cannot be enforced. It will be used automatically if the mail server supports it. The encryption type should be set to 'None/STARTTLS' in this case. See :ref:`here<TLSPeerVerification>` for an example on how to configure self signed certificates.
* NTLM authentication for Microsoft Exchange is not supported by the new mailer library. Try using `basic authentication <https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/authentication-and-ews-in-exchange#basic-authentication>`_ instead.
* Encryption type: None/STARTTLS or SSL
* The From address you want your outgoing Nextcloud mails to use
* Whether authentication is required
* Authentication: when authentication is required, the underlying mailer will try the following authentication methods in the order they're listed:
* CramMd5
* Login
* Plain
* XOAuth2
* The server's IP address or fully-qualified domain name and the SMTP port
* Login credentials (if required)
.. note:: The ``overwrite.cli.url`` parameter from ``config.php`` will be used for the SMTP EHLO.
Your changes are saved immediately, and you can click the Send Email button to
test your configuration. This sends a test message to the email address you
configured on your Personal page. The test message says::
If you received this email, the settings seem to be correct.
--
Nextcloud
a safe home for all your data
Configuring Sendmail/qmail
--------------------------
Configuring Sendmail or qmail requires only that you select one of them
instead of SMTP, and then enter your desired return email address.
In most cases the ``SMTP`` option is best, since you will be able to control all
of your mail server options in one place, in your mail server configuration then.
Using email templates
---------------------
We designed a mechanism that generates emails which follow the theming
settings and look the same in all the different email clients out there.
.. note:: If, for some reason, you need text-only emails, consider simply configuring
this on the client side or let the receiving (or even sending) mail server drop the
HTML part. Note that there is no security impact from **sending** HTML emails, just
from displaying them and thus any security risk can only be mitigated by disabling
showing HTML on the client (or removing the HTML part in the mail server).
Modifying the look of emails beyond the theming app capabilities
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
You can overwrite templates by writing a class that implements the template interface
(or extends it to not need to copy over everything). Easiest way is to then put this class into
an app and load it so you do not need to patch it on every update.
This is the interface of the class that needs to be implemented: https://github.com/nextcloud/server/blob/master/lib/public/Mail/IEMailTemplate.php
That is the implementation that could be extended and used to see how it works: https://github.com/nextcloud/server/blob/master/lib/private/Mail/EMailTemplate.php
An example from `a GitHub issue <https://portal.nextcloud.com/article/customized-email-templates-29.html>`_:
1. Look at the source code of extended class `OC\\Mail\\EMailTemplate::class <https://github.com/nextcloud/server/blob/master/lib/private/Mail/EMailTemplate.php>`_
2. Then override what you need in your own `OC\\Mail\\EMailTemplate::class` extension
**Example:**
Let's assume that we need to override the email header::
<?php
namespace \OCA\MyApp;
use OC\Mail\EMailTemplate;
class MyClass extends EMailTemplate
{
protected string $header = <<<EOF
<table align="center" class="wrapper">
// your theme email header modification
</table>
EOF;
}
3. Then in ``config/config.php`` change ``mail_template_class`` to your class namespace::
'mail_template_class' => 'OCA\\MyApp\\MyClass',
You will find a detailed step by step guide in our `support portal <https://portal.nextcloud.com/article/customized-email-templates-29.html>`_.
Setting mail server parameters in config.php
--------------------------------------------
If you prefer, you may set your mail server parameters in ``config/config.php``.
The following examples are for SMTP, Sendmail, and Qmail.
SMTP
""""
If you want to send email using a local or remote SMTP server it is necessary
to enter the name or IP address of the server, optionally followed by a colon
separated port number, e.g. **:425**. If this value is not given the default
port 25/tcp will be used unless you change that by modifying the
**mail_smtpport** parameter.
::
"mail_smtpmode" => "smtp",
"mail_smtphost" => "smtp.server.dom:425",
or
::
"mail_smtpmode" => "smtp",
"mail_smtphost" => "smtp.server.dom",
"mail_smtpport" => 425,
If a malware or SPAM scanner is running on the SMTP server it might be
necessary that you increase the SMTP timeout to e.g. 30s:
::
"mail_smtptimeout" => 30,
If the SMTP server accepts insecure connections, the default setting can be
used:
::
"mail_smtpsecure" => '',
The connection will be upgraded automatically via STARTTLS if the SMTP server
supports it.
If required by the SMTP server, a secure SSL/TLS connection can be enforced
via the SMTPS protocol which uses the port 465/tcp:
::
"mail_smtphost" => "smtp.server.dom:465",
"mail_smtpsecure" => 'ssl',
And finally it is necessary to configure if the SMTP server requires
authentication, if not, the default values can be taken as is.
::
"mail_smtpauth" => false,
"mail_smtpname" => "",
"mail_smtppassword" => "",
If SMTP authentication is required you have to set the required username
and password.
::
"mail_smtpauth" => true,
"mail_smtpname" => "username",
"mail_smtppassword" => "password",
Sendmail
""""""""
If you want to use the well known Sendmail program to send email, it is
necessary to have an installed and working email system on your \*nix server.
The sendmail binary (**/usr/sbin/sendmail**) is usually part of that system.
Nextcloud should be able to send email out of the box.
::
"mail_smtpmode" => "sendmail",
"mail_smtphost" => "127.0.0.1",
"mail_smtpport" => 25,
"mail_smtptimeout" => 10,
"mail_smtpsecure" => "",
"mail_smtpauth" => false,
"mail_smtpauthtype" => "LOGIN",
"mail_smtpname" => "",
"mail_smtppassword" => "",
qmail
"""""
If you want to use the qmail program to send email, it is necessary to have an
installed and working qmail email system on your server. The qmail binary
installed on your server will then be used to send email. Nextcloud should
be able to send email out of the box.
::
"mail_smtpmode" => "qmail",
"mail_smtphost" => "127.0.0.1",
"mail_smtpport" => 25,
"mail_smtptimeout" => 10,
"mail_smtpsecure" => "",
"mail_smtpauth" => false,
"mail_smtpauthtype" => "LOGIN",
"mail_smtpname" => "",
"mail_smtppassword" => "",
Send a test email
-----------------
To test your email configuration, save your email address in your personal
settings and then use the **Send email** button in the *Email Server* section
of the Admin settings page.
Troubleshooting
---------------
Enabling debug mode
"""""""""""""""""""
If you are unable to send email, it might be useful to activate further debug
messages by enabling the ``mail_smtpdebug`` parameter and temporarily setting your NC loglevel to DEBUG:
::
"mail_smtpdebug" => true,
"loglevel" => 0,
Be cautious setting your ``loglevel`` to DEBUG (``0``) since it'll apply to everything occurring on your NC instance, not just email.
And don't forget to set it back to a more reasonable level when you're done troubleshooting:
::
"mail_smtpdebug" => false,
"loglevel" => 2,
.. note:: Immediately after pressing the **Send email** button, as described
before, several **SMTP -> get_lines(): ...** messages appear on the screen.
This is expected behavior and can be ignored.
Why is my web domain different from my mail domain?
"""""""""""""""""""""""""""""""""""""""""""""""""""
The default domain name used for the sender address is the hostname
where your Nextcloud installation is served. If you have a different mail domain
name you can override this behavior by setting the following configuration
parameter:
::
"mail_domain" => "example.com",
This setting results in every email sent by Nextcloud (for example, the password
reset email) having the domain part of the sender address appear as follows::
no-reply@example.com
How can I find out if an SMTP server is reachable?
""""""""""""""""""""""""""""""""""""""""""""""""""
Use the ping command to check the server availability::
ping smtp.server.dom
::
PING smtp.server.dom (ip-address) 56(84) bytes of data.
64 bytes from your-server.local.lan (192.168.1.10): icmp_req=1 ttl=64
time=3.64ms
How can I find out if the SMTP server is listening on a specific TCP port?
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
The best way to get mail server information is to ask your mail
server admin. If you are the mail server admin, or need information in a
hurry, you can use the ``netstat`` command. This example shows all active
servers on your system, and the ports they are listening on. The SMTP server is
listening on localhost port 25.
::
# netstat -pant
::
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State ID/Program name
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 4418/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2245/exim4
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1524/mysqld
* 25/tcp is unencrypted smtp
* 110/tcp/udp is unencrypted pop3
* 143/tcp/udp is unencrypted imap4
* 465/tcp is encrypted submissions
* 587/tcp is opportunistically-encrypted submission
* 993/tcp/udp is encrypted imaps
* 995/tcp/udp is encrypted pop3s
How can I determine if the SMTP server supports the SMTPS protocol?
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
A good indication that the SMTP server supports the SMTPS protocol
is that it is listening on the `submissions` port **465**.
How can I determine what authorization and encryption protocols the mail server supports?
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
SMTP servers usually announce the availability of STARTTLS
immediately after a connection has been established. You can easily check this
using the ``telnet`` command.
.. note:: You must enter the marked lines to obtain the information displayed.
::
telnet smtp.domain.dom 25
::
Trying 192.168.1.10...
Connected to smtp.domain.dom.
Escape character is '^]'.
220 smtp.domain.dom ESMTP Exim 4.80.1 Tue, 22 Jan 2013 22:39:55 +0100
EHLO your-server.local.lan # <<< enter this command
250-smtp.domain.dom Hello your-server.local.lan [ip-address]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-AUTH PLAIN LOGIN CRAM-MD5 # <<< Supported auth protocols
250-STARTTLS # <<< Encryption is supported
250 HELP
QUIT # <<< enter this command
221 smtp.domain.dom closing connection
Connection closed by foreign host.
.. _TLSPeerVerification:
How can I send mail using self-signed certificates or use STARTTLS with self signed certificates?
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
To disable peer verification or to use self signed certificates, add the following
to your ``config/config.php``::
"mail_smtpstreamoptions" => array(
'ssl' => array(
'allow_self_signed' => true,
'verify_peer' => false,
'verify_peer_name' => false
)
),
All emails keep getting rejected even though only one email address is invalid.
"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
Partial sending, i. e. sending to all but the faulty email address is not possible.
.. note:: Immediately after pressing the **Send email** button, as described
before, several **SMTP -> get_lines(): ...** messages appear on the screen.
This is expected behavior and can be ignored.
wedding-pics/core/doc/admin/_sources/configuration_server/external_sites.rst.txt
+67
View File
@@ -0,0 +1,67 @@
======================
Linking external sites
======================
You can embed external websites or documents inside your Nextcloud pages with the **External
sites** app, as this screenshot shows.
.. figure:: ../images/external-sites-1.png
*Click to enlarge*
This is useful for quick access to important pages such as the
Nextcloud manuals and informational pages for your company, and for presenting
external pages inside your custom Nextcloud branding, if you use your own custom
themes.
The External sites app can be easily installed from the app store. Go to **Settings > Apps >
Customization** to enable it. Then go to your Nextcloud **Settings > Administration > External sites** to create your
links, which are saved automatically.
Each link can have a unique icon, which can be uploaded in the admin settings.
If you select a language, the link will only be displayed for users with the selected language.
This allows you to have different documentation links for users depending on their language.
It is also possible to add links for a special device (recognized by the user agent).
Currently the following options are available: All devices, Android app, iOS app, Desktop client and all others (Browsers).
It is also possible to add links only for members of a given group.
.. figure:: ../images/external-sites-2.png
*Click to enlarge*
The links appear in the Nextcloud menu on the top or in the settings menu, after
reloading the page.
.. figure:: ../images/external-sites-3.png
Configurations preventing embedding
-----------------------------------
Your links may or may not work correctly due to the various ways that Web
browsers and Web sites handle HTTP and HTTPS URLs, and because the External
Sites app embeds external links in IFrames. Modern Web browsers try very hard
to protect Web surfers from dangerous links, and safety apps like
`Privacy Badger <https://www.eff.org/privacybadger>`_ and ad-blockers may block
embedded pages. It is strongly recommended to enforce HTTPS on your Nextcloud
server; do not weaken this, or any of your security tools, just to make
embedded Web pages work. After all, you can freely access them outside of
Nextcloud.
Most Web sites that offer login functionalities use the ``X-Frame-Options`` or
``Content-Security-Policy`` HTTP header which instructs browsers to not
allow their pages to be embedded for security reasons (e.g. "Clickjacking"). You
can usually verify the reason why embedding the website is not possible by using
your browser's console tool. For example, this page has an invalid SSL
certificate.
.. figure:: ../images/external-sites-4.png
On this page, X-Frame-Options prevents the embedding.
.. figure:: ../images/external-sites-5.png
There is also a redirect option, which allows that those websites can still be added for quick access.
Instead of embedding the website the user will be redirected to it.
wedding-pics/core/doc/admin/_sources/configuration_server/index.rst.txt
+29
View File
@@ -0,0 +1,29 @@
=======================
Nextcloud configuration
=======================
.. toctree::
:maxdepth: 2
security_setup_warnings
occ_command
activity_configuration
caching_configuration
background_jobs_configuration
config_sample_php_parameters
email_configuration
external_sites
language_configuration
logging_configuration
antivirus_configuration
dashboard_configuration
reverse_proxy_configuration
bruteforce_configuration
automatic_configuration
text_configuration
theming
oauth2
admin_delegation_configuration
domain_change
.. Intentional disabled antivirus_configuration
wedding-pics/core/doc/admin/_sources/configuration_server/language_configuration.rst.txt
+69
View File
@@ -0,0 +1,69 @@
=================
Language & Locale
=================
Default language
----------------
In normal cases Nextcloud will automatically detect the language of the Web-GUI.
If this does not work properly or you want to make sure that Nextcloud always
starts with a given language, you can set a **default_language** parameter in the
:file:`config/config.php`.
.. note:: The default_language parameter is only used, when the browser does not
send any language, and the user hasn't configured own language preferences.
::
"default_language" => "en",
Force language
--------------
If you want to force a specific language, users will no longer be able to change
their language in the personal settings. You can set a **force_language** parameter
in the :file:`config/config.php`.
::
"force_language" => "en",
If users shall be unable to change their language, but users have different languages,
this value can be set to ``true`` instead of a language code.
.. note:: Please check `Transifex language codes
<https://explore.transifex.com/languages/>`_ for the list of valid language
codes.
Default locale
--------------
The locale is used to define how dates and other formats are displayed. Nextcloud
should automatically pick an appropriate locale based on your current language.
Users can modify their locale inside their settings panel.
If that does not work properly or if you want to make sure that Nextcloud always
starts with a given locale, you can set a **default_locale** parameter in the
:file:`config/config.php`.
.. note:: The default_locale parameter is only used when the user hasn't configured
own locale preferences.
::
"default_locale" => "en_US",
Force locale
--------------
If you want to force a specific locale, users will no longer be able to change
their locale in the personal settings. You can set a **force_locale** parameter
in the :file:`config/config.php`.
::
"force_locale" => "en_US",
.. note:: Please check `the list of MomentJS supported locales
<https://github.com/moment/moment/tree/2.18.1/locale>`_ for the list of valid
locales.
wedding-pics/core/doc/admin/_sources/configuration_server/logging_configuration.rst.txt
+206
View File
@@ -0,0 +1,206 @@
=======
Logging
=======
Use your Nextcloud log to review system status, or to help debug problems. You may adjust logging levels, and choose how and where log data is stored. If additional event logging is required, you can optionally activate the **admin_audit** app.
When ``file`` based logging is utilized, both the Nextcloud log and, optionally, the **admit_audit** app log can be viewed within the Nextcloud interface under *Administration settings -> Logging* (this functionality is provided by the **logreader** app).
Further configuration and usage details for both the standard Nextcloud log and the optional **admin_audit** app log can be found below.
Log level
---------
Logging levels range from **DEBUG**, which logs all activity, to **FATAL**, which logs only fatal errors.
* **0**: DEBUG: All activity; the most detailed logging.
* **1**: INFO: Activity such as user logins and file activities, plus warnings, errors, and fatal errors.
* **2**: WARN: Operations succeed, but with warnings of potential problems, plus errors and fatal errors.
* **3**: ERROR: An operation fails, but other services and operations continue, plus fatal errors.
* **4**: FATAL: The server stops.
By default the log level is set to **2** (WARN). Use **DEBUG** when you have a problem to diagnose, and then reset your log level to a less-verbose level as **DEBUG** outputs a lot of information, and can affect your server performance.
Logging level parameters are set in the :file:`config/config.php` file.
Log type
--------
errorlog
~~~~~~~~
All log information will be sent to PHP ``error_log()``.
::
"log_type" => "errorlog",
.. warning:: Until version Nextcloud 25 log entries were prefixed with ``[owncloud]``. From 26 onwards messages start with ``[nextcloud]``.
file
~~~~
All log information will be written to a separate log file which can be
viewed using the log viewer on your Admin page. By default, a log
file named **nextcloud.log** will be created in the directory which has
been configured by the **datadirectory** parameter in :file:`config/config.php`.
The desired date format can optionally be defined using the **logdateformat** parameter in :file:`config/config.php`.
By default the `PHP date function`_ parameter ``c`` is used, and therefore the
date/time is written in the format ``2013-01-10T15:20:25+02:00``. By using the
date format in the example below, the date/time format will be written in the format
``January 10, 2013 15:20:25``.
::
"log_type" => "file",
"logfile" => "nextcloud.log",
"loglevel" => 3,
"logdateformat" => "F d, Y H:i:s",
syslog
~~~~~~
All log information will be sent to your default syslog daemon.
::
"log_type" => "syslog",
"syslog_tag" => "Nextcloud",
"logfile" => "",
"loglevel" => 3,
systemd
~~~~~~~
All log information will be sent to Systemd journal. Requires `php-systemd <https://github.com/systemd/php-systemd>`_ extension.
::
"log_type" => "systemd",
"syslog_tag" => "Nextcloud",
Log fields explained
--------------------
Example log entries
~~~~~~~~~~~~~~~~~~~
::
{
"reqId":"TBsuA2uE86DiOD0S8f9j",
"level":1,
"time":"April 13, 2021 16:55:37",
"remoteAddr":"192.168.56.1",
"user":"admin",
"app":"admin_audit",
"method":"GET",
"url":"/ocs/v1.php/cloud/users?disabled",
"message":"Login successful: \"admin\"",
"userAgent":"curl/7.68.0",
"version":"21.0.1.1"
}
{
"reqId":"ByeDVLuwkXKMfLpBgvxC",
"level":2,
"time":"April 14, 2021 09:03:29",
"remoteAddr":"192.168.56.1",
"user":"--",
"app":"no app in context",
"method":"POST",
"url":"/login",
"message":"Login failed: asdf (Remote IP: 192.168.56.1)",
"userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36",
"version":"21.0.1.1"
}
Log field breakdown
~~~~~~~~~~~~~~~~~~~
* **reqId** (request id): any log lines related to a single request have the same value
* **level**: logged incident's level, always 1 in audit.log
* **time**: date and time (format and timezone can be configured in config.php)
* **remoteAddr**: the IP address of the user (if applicable – empty for occ commands)
* **user**: acting user's id (if applicable)
* **app**: affected app (always admin_audit in audit.log)
* **method**: HTTP method, for example GET, POST, PROPFIND, etc. – empty on occ calls
* **url**: request path (if applicable – empty on occ calls)
* **message**: event information message
* **userAgent**: user agent (if applicable – empty on occ calls)
* **exception**: Full exception with trace (if applicable)
* **data** additional structured data (if applicable)
* **version**: Nextcloud version at the time of request
Empty value are written as two dashes: ``--``.
Admin audit log (Optional)
--------------------------
By enabling the **admin_audit** app, additional information about various events can be logged. Similar to the normal logging, the audit log can be provided to any of the existing logging mechanisms in :file:`config/config.php`. The default behavior, if no parameters are specified after the app is enabled, is ``file`` based logging to a file called ``audit.log`` stored in the ``datadirectory``.
If you wish to override this and log to syslog instead the following would be one approach:
::
"log_type_audit" => "syslog",
"syslog_tag_audit" => "Nextcloud",
"logfile_audit" => "",
Log level interaction
~~~~~~~~~~~~~~~~~~~~~
If system ``loglevel`` in ``config.php`` is set to ``2`` or higher, audit logging needs to be triggered explicitly by adding the following setting to ``config.php``:
::
"log.condition" => [
"apps" => ["admin_audit"],
],
Find detailed documentation on auditable events for enterprises in our `customer portal <https://portal.nextcloud.com/article/using-the-audit-log-44.html>`_.
Integrating into the Web Interface
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The built-in NC ``logreader`` app (which is what provides the *Administration settings->Logging* interface) only accesses the file-based ``nextcloud.log``. The **admin_audit** app log output, however, can be integrated into the web interface by configuring it to *also* log to the ``nextcloud.log``.
Add the following to your ``config.php`` (adjusting the path to your own ``nextcloud.log`` path):
::
'log.condition' => [
'apps' => [ 'admin_audit'],
],
'logfile_audit' => '/var/www/html/data/nextcloud.log',
Configuring through admin_audit app settings
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Previously the audit logfile was defined in the app config. This config is still used when the system config is not provided, but is considered a legacy parameter.
::
occ config:app:set admin_audit logfile --value=/var/log/nextcloud/audit.log
.. _PHP date function: http://www.php.net/manual/en/function.date.php
Workflow log
------------
By default, the workflow log is stored to `flow.log` in the data folder.
The path of the workflow log can be set as follows:
::
occ config:app:set workflowengine logfile --value=/var/log/nextcloud/flow.log
Set the value to `/dev/null` to avoid storing the log.
Temporary overrides
-------------------
You can run override the config.php log level of ``occ`` commands with as :ref:`documented here<occ_debugging>`.
wedding-pics/core/doc/admin/_sources/configuration_server/oauth2.rst.txt
+43
View File
@@ -0,0 +1,43 @@
======
OAuth2
======
Nextcloud allows connecting external services (for example Moodle) to your Nextcloud.
This is done via ``OAuth2``. See `RFC6749 <https://tools.ietf.org/html/rfc6749>`_ for the
OAuth2 specification.
.. note:: Nextcloud does only support confidential clients.
Add an OAuth2 Application
-------------------------
Head over to your Administrator Security Settings. Here you can add a new ``OAuth2`` client.
.. figure:: images/oauth2-settings.png
Enter the name of your application and provide a redirection url.
You should now have a Client Identifier and Secret. Enter those into your ``OAuth2`` client.
Please provide the OAuth2 application the following details:
* Authorization endpoint: ``https://cloud.example.org/apps/oauth2/authorize``
* Token endpoint: ``https://cloud.example.org/apps/oauth2/api/v1/token``
Note that you must include ``index.php`` if pretty URL is not configured - i.e. ``https://cloud.example.org/index.php/apps/oauth2/api/v1/token``.
The access token
----------------
The access token obtained is a so called Bearer token. Which means that for request to the
Nextcloud server you will have to send the proper authorization header.
Authorization: Bearer <TOKEN>
Note that apache by default strips this. Make sure you have ``mod_headers``, ``mod_rewrite`` and ``mod_env`` enabled.
Security considerations
-----------------------
Nextcloud ``OAuth2`` implementation currently does not support scoped access. This means that every token has full access to the complete account including read and write permission to the stored files. It is essential to store the ``OAuth2`` tokens in a safe way!
Without scopes and restrictable access it is not recommended to use a Nextcloud instance as a user authentication service.
wedding-pics/core/doc/admin/_sources/configuration_server/occ_command.rst.txt
+1733
View File
File diff suppressed because it is too large Load Diff
wedding-pics/core/doc/admin/_sources/configuration_server/reverse_proxy_configuration.rst.txt
+175
View File
@@ -0,0 +1,175 @@
.. _serverconf_reverseproxy:
=============
Reverse proxy
=============
Nextcloud can be run through a reverse proxy, which can cache static assets such
as images, CSS or JS files, move the load of handling HTTPS to a different
server or load balance between multiple servers.
Defining trusted proxies
------------------------
For security, you must explicitly define the proxy servers that Nextcloud is to
trust. Connections from trusted proxies will be specially treated to get the
real client information, for use in access control and logging. Parameters are
configured in :file:`config/config.php`
Set the :file:`trusted_proxies` parameter as an array of:
* IPv4 addresses
* IPv4 ranges in CIDR notation
* IPv6 addresses
* IPv6 ranges in CIDR notation
to define the servers Nextcloud should trust as proxies. This parameter
provides protection against client spoofing, and you should secure those
servers as you would your Nextcloud server.
A reverse proxy can define HTTP headers with the original client IP address,
and Nextcloud can use those headers to retrieve that IP address. Nextcloud uses
the de-facto standard header 'X-Forwarded-For' by default, but this can be
configured with the **forwarded_for_headers** parameter. This parameter is an
array of PHP lookup strings, for example 'X-Forwarded-For' becomes
'HTTP_X_FORWARDED_FOR'. Incorrectly setting this parameter may allow clients
to spoof their IP address as visible to Nextcloud, even when going through the
trusted proxy! The correct value for this parameter is dependent on your
proxy software.
Overwrite parameters
--------------------
The automatic hostname, protocol or webroot detection of Nextcloud can fail in
certain reverse proxy situations. This configuration allows the automatic detection
to be manually overridden. If Nextcloud fails to automatically detect the hostname, protocol
or webroot you can use the **overwrite** parameters inside the :file:`config/config.php`.
* :file:`overwritehost` set the hostname of the proxy. You can also specify a port.
* :file:`overwriteprotocol` set the protocol of the proxy. You can choose between the two options **http** and **https**.
* :file:`overwritewebroot` set the absolute web path of the proxy to the Nextcloud folder.
* :file:`overwritecondaddr` overwrite the values dependent on the remote address. The value must be a **regular expression** of the IP addresses of the proxy. This is useful when you use a reverse SSL proxy only for https access and you want to use the automatic detection for http access.
* :file:`overwrite.cli.url` the base URL for any URLs which are generated within Nextcloud using any kind of command line tools. For example, the value set here will be used by the notifications area.
Leave the value empty or omit the parameter to keep the automatic detection.
Service Discovery
-----------------
The redirects for CalDAV or CardDAV does not work if Nextcloud is running behind a
reverse proxy. The recommended solution is that your reverse proxy does the redirects.
Apache2
^^^^^^^
::
RewriteEngine On
RewriteRule ^/\.well-known/carddav https://%{SERVER_NAME}/remote.php/dav/ [R=301,L]
RewriteRule ^/\.well-known/caldav https://%{SERVER_NAME}/remote.php/dav/ [R=301,L]
Thanks to `@ffried <https://github.com/ffried>`_ for apache2 example.
Traefik 1
^^^^^^^^^
Using Docker labels:
::
traefik.frontend.redirect.permanent: 'true'
traefik.frontend.redirect.regex: 'https://(.*)/.well-known/(?:card|cal)dav'
traefik.frontend.redirect.replacement: 'https://$$1/remote.php/dav'
Using traefik.toml:
::
[frontends.frontend1.redirect]
regex = "https://(.*)/.well-known/(?:card|cal)dav"
replacement = "https://$1/remote.php/dav
permanent = true
Thanks to `@pauvos <https://github.com/pauvos>`_ and `@mrtumnus <https://github.com/mrtumnus>`_ for traefik examples.
Traefik 2
^^^^^^^^^
Using Docker labels:
::
traefik.http.routers.nextcloud.middlewares: 'nextcloud_redirectregex'
traefik.http.middlewares.nextcloud_redirectregex.redirectregex.permanent: true
traefik.http.middlewares.nextcloud_redirectregex.redirectregex.regex: 'https://(.*)/.well-known/(?:card|cal)dav'
traefik.http.middlewares.nextcloud_redirectregex.redirectregex.replacement: 'https://$${1}/remote.php/dav'
Using a TOML file:
::
[http.middlewares]
[http.middlewares.nextcloud-redirectregex.redirectRegex]
permanent = true
regex = "https://(.*)/.well-known/(?:card|cal)dav"
replacement = "https://${1}/remote.php/dav"
HAProxy
^^^^^^^
::
acl url_discovery path /.well-known/caldav /.well-known/carddav
http-request redirect location /remote.php/dav/ code 301 if url_discovery
NGINX
^^^^^
::
location /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
or
::
rewrite ^/\.well-known/carddav https://$server_name/remote.php/dav/ redirect;
rewrite ^/\.well-known/caldav https://$server_name/remote.php/dav/ redirect;
Caddy
^^^^^
::
subdomain.example.com {
redir /.well-known/carddav /remote.php/dav 301
redir /.well-known/caldav /remote.php/dav 301
reverse_proxy {$NEXTCLOUD_HOST:localhost}
}
Example
-------
Multiple domains reverse SSL proxy
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you want to access your Nextcloud installation **http://domain.tld/nextcloud**
via a multiple domains reverse SSL proxy
**https://ssl-proxy.tld/domain.tld/nextcloud** with the IP address **10.0.0.1**
you can set the following parameters inside the :file:`config/config.php`.
::
<?php
$CONFIG = array (
'trusted_proxies' => ['10.0.0.1'],
'overwritehost' => 'ssl-proxy.tld',
'overwriteprotocol' => 'https',
'overwritewebroot' => '/domain.tld/nextcloud',
'overwritecondaddr' => '^10\.0\.0\.1$',
'overwrite.cli.url' => 'https://domain.tld/,
);
.. note:: If you want to use the SSL proxy during installation you have to
create the :file:`config/config.php` otherwise you have to extend the existing
**$CONFIG** array.
wedding-pics/core/doc/admin/_sources/configuration_server/security_setup_warnings.rst.txt
+132
View File
@@ -0,0 +1,132 @@
======================
Warnings on admin page
======================
Your Nextcloud server has a built-in configuration checker, and it reports its
findings at the top of your Admin page. These are some of the warnings you
might see, and what to do about them.
.. figure:: ../images/security-setup-warning-1.png
You can use the `Nextcloud Security Scan <https://scan.nextcloud.com>`_ to see
if your system is up to date and well secured. We have ran this scan over public
IP addresses in the past to try and reach out to `extremely outdated systems <https://nextcloud.com/blog/nextcloud-releases-security-scanner-to-help-protect-private-clouds/>`_
and might again in the future. Please, protect your privacy and keep your server
up to date! Privacy means little without security.
Cache warnings
--------------
"No memory cache has been configured. To enhance your performance please
configure a memcache if available." Nextcloud supports multiple php caching
extensions:
* APCu (minimum required PHP extension version 4.0.6)
* Memcached
* Redis (minimum required PHP extension version: 2.2.6)
You will see this warning if you have no caches installed and enabled, or if
your cache does not have the required minimum version installed; older versions
are disabled because of performance problems.
If you see "*{Cache}* below version *{Version}* is installed. for stability and
performance reasons we recommend to update to a newer *{Cache}* version" then
you need to upgrade, or, if you're not using it, remove it.
You are not required to use any caches, but caches improve server performance.
See :doc:`caching_configuration`.
Transactional file locking is disabled
--------------------------------------
"Transactional file locking is disabled, this might lead to issues with race
conditions."
Please see :doc:`../configuration_files/files_locking_transactional` on how
to correctly configure your environment for transactional file locking.
You are accessing this site via HTTP
------------------------------------
"You are accessing this site via HTTP. We strongly suggest you configure your
server to require using HTTPS instead." Please take this warning seriously;
using HTTPS is a fundamental security measure. You must configure your Web
server to support it, and then there are some settings in the **Security**
section of your Nextcloud Admin page to enable. The following pages
describe how to enable HTTPS on the Apache and Nginx Web servers.
:ref:`enabling_ssl_label` (on Apache)
:ref:`use_https_label`
:doc:`../installation/nginx`
The test with getenv(\"PATH\") only returns an empty response
-------------------------------------------------------------
Some environments are not passing a valid PATH variable to Nextcloud. The
:ref:`php_fpm_tips_label` provides the information about how to configure your
environment.
The "Strict-Transport-Security" HTTP header is not configured
-------------------------------------------------------------
"The "Strict-Transport-Security" HTTP header is not configured to least "15552000" seconds.
For enhanced security we recommend enabling HSTS as described in our security tips."
The HSTS header needs to be configured within your Web server by following the
:ref:`enable-hsts-label` documentation
/dev/urandom is not readable by PHP
-----------------------------------
"/dev/urandom is not readable by PHP which is highly discouraged for security reasons.
Further information can be found in our documentation."
This message is another one which needs to be taken seriously. Please have a look
at the :ref:`dev-urandom-label` documentation.
Your Web server is not yet set up properly to allow file synchronization
------------------------------------------------------------------------
"Your web server is not yet set up properly to allow file synchronization because
the WebDAV interface seems to be broken."
At the ownCloud community forums a larger `FAQ <https://forum.owncloud.org/viewtopic.php?f=17&t=7536>`_
is maintained containing various information and debugging hints.
Outdated NSS / OpenSSL version
------------------------------
"cURL is using an outdated OpenSSL version (OpenSSL/$version). Please update your
operating system or features such as installing and updating apps via the app store
or Federated Cloud Sharing will not work reliably."
"cURL is using an outdated NSS version (NSS/$version). Please update your operating
system or features such as installing and updating apps via the app store or Federated
Cloud Sharing will not work reliably."
There are known bugs in older OpenSSL and NSS versions leading to misbehavior in
combination with remote hosts using SNI. A technology used by most of the HTTPS
websites. To ensure that Nextcloud will work properly you need to update OpenSSL
to at least 1.0.2b or 1.0.1d. For NSS the patch version depends on your distribution
and an heuristic is running the test which actually reproduces the bug.
Your Web server is not set up properly to resolve /.well-known/caldav/ or /.well-known/carddav/
-----------------------------------------------------------------------------------------------
Both URLs need to be correctly redirected to the DAV endpoint of Nextcloud. Please
refer to :ref:`service-discovery-label` for more info.
Some files have not passed the integrity check
----------------------------------------------
Please refer to the :ref:`code_signing_fix_warning_label` documentation how to debug this issue.
Your database does not run with "READ COMMITED" transaction isolation level
---------------------------------------------------------------------------
"Your database does not run with "READ COMMITED" transaction isolation level.
This can cause problems when multiple actions are executed in parallel."
Please refer to :ref:`db-transaction-label` how to configure your database for this requirement.
wedding-pics/core/doc/admin/_sources/configuration_server/text_configuration.rst.txt
+32
View File
@@ -0,0 +1,32 @@
========
Text app
========
Disable rich workspaces globally
--------------------------------
Rich workspaces can be disabled globally by the admin by setting the following config option to 0 (default is 1):
::
occ config:app:set text workspace_available --value=0
Default file extension
----------------------
The default file extension can be changed to txt in order to always create plain text files (default is md):
::
occ config:app:set text default_file_extension --value=txt
Disable rich text editing
-------------------------
Rich text editing can be turned off globally to always open markdown files in their raw format, without rendering of the formatting (default is 1):
::
occ config:app:set text rich_editing_enabled --value=0
wedding-pics/core/doc/admin/_sources/configuration_server/theming.rst.txt
+85
View File
@@ -0,0 +1,85 @@
=======
Theming
=======
With our theming feature, you are able to customize the look and feel of your
Nextcloud instance according to the corporate design of your organization by
replacing the Nextcloud logo and color with your own assets.
The theming app is enabled by default so the section should appear by default in
your admin-settings. If not, check in the apps management that this app is enabled.
Modify the appearance of Nextcloud
----------------------------------
You can change the following parameters of the look and feel on your instance:
.. figure:: ../configuration_server/images/theming1.png
* Name (e.g. ACME Inc. Cloud)
* Web link (e.g. https://acme.inc/)
* Slogan
* Color: The color of the header bar, checkboxes, and folder icon
* Logo: The logo will appear in the header and on the login page. The default has 62/34 px.
* Background and login image: The background image
.. figure:: ../configuration_server/images/theming2.png
* Additional legal links (Legal notice and Privacy policy link)
* Custom header logo and favicon as an alternative to auto-generation based on logo
* Disable user theming: Although you can select and customize your instance, users can change their backgrounds and colors. If you want to enforce your customization, you can toggle this on.
Configure theming through CLI
-----------------------------
Theming configuration can also be adjusted through the ``occ theming:config`` command.
The following values are available to be set through this:
- name, url, imprintUrl, privacyUrl, slogan, color ``occ theming:config name "My Example Cloud"``
- background, logo, favicon, logoheader ``occ theming:config logo /tmp/mylogo.png``
- disable-user-theming (yes/no) ``occ theming:config disable-user-theming yes``
.. note:: Images require to be read from a local file on the Nextcloud server
Use a color instead of an image as a background:
::
occ theming:config color "#0082c9"
occ theming:config background backgroundColor
Theming of icons
----------------
According to the parameters you have set, Nextcloud will automatically generate
favicons and a header logo depending on the current logo and theming color.
This requires the following additional dependencies:
- PHP module ``imagick``
- SVG support for imagick (e.g. ``libmagickcore-6.q16-3-extra`` on Debian 9 and Ubuntu 18.04)
.. note:: In the advanced options of the theming app you are able to set a custom
favicon in case you do not want to use the same logo resources you have set above
or you do not want to install the mentioned dependencies.
Branded clients
---------------
.. note:: Nextcloud GmbH provides branding services, delivering sync clients (mobile
and desktop) which use your corporate identity and are pre-configured to help your
users get up and running in no time. If you are interested in our advanced branding &
support subscription, `contact our sales team <https://nextcloud.com/enterprise/>`_.
The theming app supports changing the URLs to the mobile apps (Android & iOS) that
are shown when the web interface is opened on one of those devices. Then there was a
header shown, that redirects the user to the app in the app store. By default,
this redirects to the Nextcloud apps. In some cases, it is wanted that this
links to branded versions of those apps. In those cases the IDs and URLs can be
set via the ``occ``-command::
occ config:app:set theming AndroidClientUrl --value "https://play.google.com/store/apps/details?id=com.nextcloud.client"
occ config:app:set theming iTunesAppId --value "1125420102"
occ config:app:set theming iOSClientUrl --value "https://itunes.apple.com/us/app/nextcloud/id1125420102?mt=8"
wedding-pics/core/doc/admin/_sources/configuration_user/index.rst.txt
+18
View File
@@ -0,0 +1,18 @@
===============
User management
===============
.. toctree::
:maxdepth: 2
user_configuration
reset_admin_password
reset_user_password
user_password_policy
two_factor-auth
user_auth_ftp_smb_imap
user_auth_ldap
user_auth_ldap_cleanup
user_auth_ldap_api
user_provisioning_api
profile_configuration
wedding-pics/core/doc/admin/_sources/configuration_user/instruction_set_for_apps.rst.txt
+176
View File
@@ -0,0 +1,176 @@
========================
Instruction set for apps
========================
Get list of apps
----------------
Returns a list of apps installed on the Nextcloud server. Authentication is done
by sending a Basic HTTP Authorization
header.
**Syntax: ocs/v1.php/cloud/apps/**
* HTTP method: GET
* url argument: filter, string - optional (``enabled`` or ``disabled``)
Status codes:
* 100 - successful
* 101 - invalid input data
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/apps?filter=enabled -H "OCS-APIRequest: true"
* Gets enabled apps
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<apps>
<element>files</element>
<element>provisioning_api</element>
</apps>
</data>
</ocs>
Get app info
------------
Provides information on a specific application. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/apps/{appid}**
* HTTP method: GET
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/apps/files -H "OCS-APIRequest: true"
* Get app info for the ``files`` app
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<info/>
<remote>
<files>appinfo/remote.php</files>
<webdav>appinfo/remote.php</webdav>
<filesync>appinfo/filesync.php</filesync>
</remote>
<public/>
<id>files</id>
<name>Files</name>
<description>File Management</description>
<licence>AGPL</licence>
<author>Robin Appelman</author>
<require>4.9</require>
<shipped>true</shipped>
<active>true</active>
<standalone></standalone>
<default_enable></default_enable>
<types>
<element>filesystem</element>
</types>
</data>
</ocs>
Enable an app
-------------
Enable an app. Authentication is done by sending a Basic HTTP Authorization
header.
**Syntax: ocs/v1.php/cloud/apps/{appid}**
* HTTP method: POST
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X POST http://admin:secret@example.com/ocs/v1.php/cloud/apps/files_texteditor -H "OCS-APIRequest: true"
* Enable the ``files_texteditor`` app
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
</ocs>
Disable an app
--------------
Disables the specified app. Authentication is
done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/apps/{appid}**
* HTTP method: DELETE
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X DELETE http://admin:secret@example.com/ocs/v1.php/cloud/apps/files_texteditor -H "OCS-APIRequest: true"
* Disable the ``files_texteditor`` app
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
</ocs>
wedding-pics/core/doc/admin/_sources/configuration_user/instruction_set_for_groups.rst.txt
+248
View File
@@ -0,0 +1,248 @@
==========================
Instruction set for groups
==========================
Search/get groups
-----------------
Retrieves a list of groups from the Nextcloud server. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups**
* HTTP method: GET
* url arguments: search - string, optional search string
* url arguments: limit - int, optional limit value
* url arguments: offset - int, optional offset value
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/groups?search=adm -H "OCS-APIRequest: true"
* Returns list of groups matching the search string.
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<groups>
<element>admin</element>
</groups>
</data>
</ocs>
Create a group
--------------
Adds a new group. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups**
* HTTP method: POST
* POST argument: groupid, string - the new groups name
Status codes:
* 100 - successful
* 101 - invalid input data
* 102 - group already exists
* 103 - failed to add the group
Example
^^^^^^^
::
$ curl -X POST http://admin:secret@example.com/ocs/v1.php/cloud/groups -d groupid="newgroup" -H "OCS-APIRequest: true"
* Adds a new group called ``newgroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Get members of a group
----------------------
Retrieves a list of group members. Authentication is done by sending a Basic
HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups/{groupid}**
* HTTP method: GET
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/groups/admin -H "OCS-APIRequest: true"
* Returns a list of users in the ``admin`` group
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<users>
<element>Frank</element>
</users>
</data>
</ocs>
Get subadmins of a group
------------------------
Returns subadmins of the group. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups/{groupid}/subadmins**
* HTTP method: GET
Status codes:
* 100 - successful
* 101 - group does not exist
* 102 - unknown failure
Example
^^^^^^^
::
$ curl -X GET https://admin:secret@example.com/ocs/v1.php/cloud/groups/mygroup/subadmins -H "OCS-APIRequest: true"
* Return the subadmins of the group: ``mygroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data>
<element>Tom</element>
</data>
</ocs>
Edit data of a single group
---------------------------
Edits attributes related to a group. Authentication
is done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups/{groupid}**
* HTTP method: PUT
* PUT argument: key, string - the field to edit:
+ displayname
* PUT argument: value, string - the new value for the field
Status codes:
* 100 - successful
* 101 - not supported by backend
Examples
^^^^^^^^
::
$ curl -X PUT http://admin:secret@example.com/ocs/v1.php/cloud/groups/mygroup -d key="displayname" -d value="My Group Name" -H "OCS-APIRequest: true"
* Updates the display name for the group ``mygroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Delete a group
--------------
Removes a group. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/groups/{groupid}**
* HTTP method: DELETE
Status codes:
* 100 - successful
* 101 - group does not exist
* 102 - failed to delete group
Example
^^^^^^^
::
$ curl -X DELETE http://admin:secret@example.com/ocs/v1.php/cloud/groups/mygroup -H "OCS-APIRequest: true"
* Delete the group ``mygroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
wedding-pics/core/doc/admin/_sources/configuration_user/instruction_set_for_users.rst.txt
+672
View File
@@ -0,0 +1,672 @@
=========================
Instruction set for users
=========================
Add a new user
--------------
Create a new user on the Nextcloud server. Authentication is done by sending a
basic HTTP authentication header.
**Syntax: ocs/v1.php/cloud/users**
* HTTP method: POST
* POST argument: userid - string, the required username for the new user
* POST argument: password - string, the password for the new user, leave empty to send welcome mail
* POST argument: displayName - string, the display name for the new user
* POST argument: email - string, the email for the new user, required if password empty
* POST argument: groups - array, the groups for the new user
* POST argument: subadmin - array, the groups in which the new user is subadmin
* POST argument: quota - string, quota for the new user
* POST argument: language - string, language for the new user
Status codes:
* 100 - successful
* 101 - invalid input data
* 102 - username already exists
* 103 - unknown error occurred whilst adding the user
* 104 - group does not exist
* 105 - insufficient privileges for group
* 106 - no group specified (required for subadmins)
* 107 - all errors that contain a hint - for example "Password is among the 1,000,000 most common ones. Please make it unique." (this code was added in 12.0.6 & 13.0.1)
* 108 - password and email empty. Must set password or an email
* 109 - invitation email cannot be send
Example
^^^^^^^
::
$ curl -X POST http://admin:secret@example.com/ocs/v1.php/cloud/users -d userid="Frank" -d password="frankspassword" -H "OCS-APIRequest: true"
* Creates the user ``Frank`` with password ``frankspassword``
* optionally groups can be specified by one or more ``groups[]`` query parameters:
``URL -d groups[]="admin" -D groups[]="Team1"``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data/>
</ocs>
Search/get users
----------------
Retrieves a list of users from the Nextcloud server. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users**
* HTTP method: GET
* url arguments: search - string, optional search string
* url arguments: limit - int, optional limit value
* url arguments: offset - int, optional offset value
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/users?search=Frank -H "OCS-APIRequest: true"
* Returns list of users matching the search string.
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<users>
<element>Frank</element>
</users>
</data>
</ocs>
Get data of a single user
-------------------------
Retrieves information about a single user. Authentication is done by sending a
Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}**
* HTTP method: GET
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank -H "OCS-APIRequest: true"
* Returns information on the user ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<enabled>true</enabled>
<id>Frank</id>
<quota>0</quota>
<email>frank@example.org</email>
<displayname>Frank K.</displayname>
<display-name>Frank K.</display-name>
<phone>0123 / 456 789</phone>
<address>Foobar 12, 12345 Town</address>
<website>https://nextcloud.com</website>
<twitter>Nextcloud</twitter>
<groups>
<element>group1</element>
<element>group2</element>
</groups>
</data>
</ocs>
Edit data of a single user
--------------------------
Edits attributes related to a user. Users are able to edit email, displayname
and password; admins can also edit the quota value. Further restrictions may apply,
check the `List of editable data fields`_ endpoint. Authentication
is done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}**
* HTTP method: PUT
* PUT argument: key, the field to edit:
+ email
+ quota
+ displayname
+ display (**deprecated** use `displayname` instead)
+ phone
+ address
+ website
+ twitter
+ password
* PUT argument: value, the new value for the field
Status codes:
* 100 - successful
* 101 - user not found
* 102 - invalid input data
Examples
^^^^^^^^
::
$ curl -X PUT http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank -d key="email" -d value="franksnewemail@example.org" -H "OCS-APIRequest: true"
* Updates the email address for the user ``Frank``
::
$ curl -X PUT http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank -d key="quota" -d value="100MB" -H "OCS-APIRequest: true"
* Updates the quota for the user ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
.. _editable_field_list:
List of editable data fields
----------------------------
Edits attributes related to a user. Users are able to edit email, displayname
and password; admins can also edit the quota value. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/user/fields**
* HTTP method: GET
Status codes:
* 100 - successful
Examples
^^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/user/fields -H "OCS-APIRequest: true"
* Gets the list of fields
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message>OK</message>
</meta>
<data>
<element>displayname</element>
<element>email</element>
<element>phone</element>
<element>address</element>
<element>website</element>
<element>twitter</element>
</data>
</ocs>
Disable a user
--------------
Disables a user on the Nextcloud server so that the user cannot login anymore.
Authentication is done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/disable**
* HTTP method: PUT
Statuscodes:
* 100 - successful
* 101 - failure
Example
^^^^^^^
::
$ curl -X PUT http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/disable -H "OCS-APIRequest: true"
* Disables the user ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data/>
</ocs>
Enable a user
-------------
Enables a user on the Nextcloud server so that the user can login again.
Authentication is done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/enable**
* HTTP method: PUT
Statuscodes:
* 100 - successful
* 101 - failure
Example
^^^^^^^
::
$ curl -X PUT http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/enable -H "OCS-APIRequest: true"
* Enables the user ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data/>
</ocs>
Delete a user
-------------
Deletes a user from the Nextcloud server. Authentication is done by sending a
Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}**
* HTTP method: DELETE
Statuscodes:
* 100 - successful
* 101 - failure
Example
^^^^^^^
::
$ curl -X DELETE http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank -H "OCS-APIRequest: true"
* Deletes the user ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Get user's groups
-----------------
Retrieves a list of groups the specified user is a member of. Authentication is
done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/groups**
* HTTP method: GET
Status codes:
* 100 - successful
Example
^^^^^^^
::
$ curl -X GET http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/groups -H "OCS-APIRequest: true"
* Retrieves a list of groups of which ``Frank`` is a member
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data>
<groups>
<element>admin</element>
<element>group1</element>
</groups>
</data>
</ocs>
Add user to group
-----------------
Adds the specified user to the specified group. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/groups**
* HTTP method: POST
* POST argument: groupid, string - the group to add the user to
Status codes:
* 100 - successful
* 101 - no group specified
* 102 - group does not exist
* 103 - user does not exist
* 104 - insufficient privileges
* 105 - failed to add user to group
Example
^^^^^^^
::
$ curl -X POST http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/groups -d groupid="newgroup" -H "OCS-APIRequest: true"
* Adds the user ``Frank`` to the group ``newgroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Remove user from group
----------------------
Removes the specified user from the specified group. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/groups**
* HTTP method: DELETE
* DELETE argument: groupid, string - the group to remove the user from
Status codes:
* 100 - successful
* 101 - no group specified
* 102 - group does not exist
* 103 - user does not exist
* 104 - insufficient privileges
* 105 - failed to remove user from group
Example
^^^^^^^
::
$ curl -X DELETE http://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/groups -d groupid="newgroup" -H "OCS-APIRequest: true"
* Removes the user ``Frank`` from the group ``newgroup``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Promote user to subadmin
------------------------
Makes a user the subadmin of a group. Authentication is done by sending a Basic
HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/subadmins**
* HTTP method: POST
* POST argument: groupid, string - the group of which to make the user a
subadmin
Status codes:
* 100 - successful
* 101 - user does not exist
* 102 - group does not exist
* 103 - unknown failure
Example
^^^^^^^
::
$ curl -X POST https://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/subadmins -d groupid="group" -H "OCS-APIRequest: true"
* Makes the user ``Frank`` a subadmin of the ``group`` group
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Demote user from subadmin
-------------------------
Removes the subadmin rights for the user specified from the group specified.
Authentication is done by sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/subadmins**
* HTTP method: DELETE
* DELETE argument: groupid, string - the group from which to remove the user's
subadmin rights
Status codes:
* 100 - successful
* 101 - user does not exist
* 102 - user is not a subadmin of the group / group does not exist
* 103 - unknown failure
Example
^^^^^^^
::
$ curl -X DELETE https://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/subadmins -d groupid="oldgroup" -H "OCS-APIRequest: true"
* Removes ``Frank's`` subadmin rights from the ``oldgroup`` group
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<statuscode>100</statuscode>
<status>ok</status>
</meta>
<data/>
</ocs>
Get user's subadmin groups
--------------------------
Returns the groups in which the user is a subadmin. Authentication is done by
sending a Basic HTTP Authorization header.
**Syntax: ocs/v1.php/cloud/users/{userid}/subadmins**
* HTTP method: GET
Status codes:
* 100 - successful
* 101 - user does not exist
* 102 - unknown failure
Example
^^^^^^^
::
$ curl -X GET https://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/subadmins -H "OCS-APIRequest: true"
* Returns the groups of which ``Frank`` is a subadmin
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data>
<element>testgroup</element>
</data>
</ocs>
Resend the welcome email
------------------------
The request to this endpoint triggers the welcome email for this user again.
**Syntax: ocs/v1.php/cloud/users/{userid}/welcome**
* HTTP method: POST
Status codes:
* 100 - successful
* 101 - email address not available
* 102 - sending email failed
Example
^^^^^^^
::
$ curl -X POST https://admin:secret@example.com/ocs/v1.php/cloud/users/Frank/welcome -H "OCS-APIRequest: true"
* Sends the welcome email to ``Frank``
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>100</statuscode>
<message/>
</meta>
<data/>
</ocs>
wedding-pics/core/doc/admin/_sources/configuration_user/profile_configuration.rst.txt
+97
View File
@@ -0,0 +1,97 @@
.. _profile:
=====================
Profile configuration
=====================
The user profile presents the information of a user and is enabled by default
for all users. Users may individually enable or disable their profile in their
Personal info settings under the Personal settings section.
As an administrator you may change the default for new users and may also
disable profile globally to remove all profile functionality.
Profile properties are also written into the :ref:`system address book<system-address-book>`.
To enable or disable profile by default for new users switch the toggle in
Basic settings under the Administration settings section.
.. figure:: ../images/profile_default_setting.png
.. note:: If you are upgrading from Nextcloud 22 to 23 and want profile to
be disabled by default for all users, you may run the ``occ`` command below
before upgrading or upgrade first then switch the toggle in Basic settings
before letting any users log in.
::
occ config:app:set settings profile_enabled_by_default --value="0"
Please refer to :doc:`../configuration_server/occ_command` for all available
``occ`` commands.
To disable profile globally add the following line to your ``config.php``
::
'profile.enabled' => false,
Please refer to :doc:`../configuration_server/config_sample_php_parameters` for
all available ``config.php`` options.
.. _profile-property-scopes:
Property scopes
---------------
User properties (Full name, Address, Website, Role, …) have specific visibility scopes (Private, Local, Federated, Published).
The visibility scopes are explained below:
:Private:
Contact details visible locally only
:Local:
Contact details visible locally and through public link access on local instance
:Federated:
Contact details visible locally, through public link access and on trusted federated servers.
:Published:
Contact details visible locally, through public link access, on trusted federated servers and published to the public lookup server.
The default values for each property for each new user is listed below, but you should consult the declaration of the ``DEFAULT_SCOPES`` constant in the ``OC\Accounts\AccountManager`` class (`see the code <https://github.com/nextcloud/server/blob/master/lib/private/Accounts/AccountManager.php>`_) to make sure these are up-to-date.
+--------------+--------------------------+
| Property | Default visibility scope |
+==============+==========================+
| Full name | Federated |
+--------------+--------------------------+
| Address | Local |
+--------------+--------------------------+
| Website | Local |
+--------------+--------------------------+
| Email | Federated |
+--------------+--------------------------+
| Avatar | Federated |
+--------------+--------------------------+
| Phone | Local |
+--------------+--------------------------+
| Twitter | Local |
+--------------+--------------------------+
| Organisation | Local |
+--------------+--------------------------+
| Role | Local |
+--------------+--------------------------+
| Headline | Local |
+--------------+--------------------------+
| Biography | Local |
+--------------+--------------------------+
If you'd like to override the value for one or several default visibility scopes, use the ``account_manager.default_property_scope`` ``config.php`` configuration key, which defaults to an empty array:
.. code-block:: php
'account_manager.default_property_scope' => [
\OCP\Accounts\IAccountManager::PROPERTY_PHONE => \OCP\Accounts\IAccountManager::SCOPE_PRIVATE,
\OCP\Accounts\IAccountManager::PROPERTY_ROLE => \OCP\Accounts\IAccountManager::SCOPE_FEDERATED
]
In the above example, the phone and role properties are respectively overwritten to the private and federated scopes. Note that these changes will only apply to *new* users, not existing ones.
wedding-pics/core/doc/admin/_sources/configuration_user/reset_admin_password.rst.txt
+26
View File
@@ -0,0 +1,26 @@
===============================
Resetting a lost admin password
===============================
The normal ways to recover a lost password are:
1. Click the password reset link on the login screen; this appears after a
failed login attempt. This works only if you have entered your email address
on your Personal page in the Nextcloud Web interface, so that the Nextcloud
server can email a reset link to you.
2. Ask another Nextcloud server admin to reset it for you.
If neither of these is an option, then you have a third option, and that is
using the ``occ`` command. See :doc:`../configuration_server/occ_command` to
learn more about using the ``occ`` command.
::
$ sudo -u www-data php /var/www/nextcloud/occ user:resetpassword admin
Enter a new password:
Confirm the new password:
Successfully reset password for admin
If your Nextcloud username is not ``admin``, then substitute your Nextcloud
username.
wedding-pics/core/doc/admin/_sources/configuration_user/reset_user_password.rst.txt
+14
View File
@@ -0,0 +1,14 @@
=========================
Resetting a user password
=========================
The Nextcloud login screen displays a **Wrong password. Reset it?** message
after a user enters an incorrect password, and then Nextcloud automatically
resets their password. However, if you are using a read-only authentication
backend such as LDAP or Active Directory, this will not work. In this case you
may specify a custom URL in your ``config.php`` file to direct your user to a
server than can handle an automatic reset::
'lost_password_link' => 'https://example.org/link/to/password/reset',
wedding-pics/core/doc/admin/_sources/configuration_user/two_factor-auth.rst.txt
+55
View File
@@ -0,0 +1,55 @@
=========================
Two-factor authentication
=========================
Two-factor authentication adds an additional layer of security to user accounts. In order to log
in on an account with two-factor authentication (2FA) enabled, it is necessary to provide both the
login password and another factor. 2FA in Nextcloud is pluggable, meaning that they are not part
of the Nextcloud Server component but provided by featured and 3rd-party Nextcloud apps.
Several 2FA apps are already available including
`TOTP <https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm>`_,
a Telegram/Signal/SMS gateway and `U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_.
Developers can `build new two-factor provider apps <https://docs.nextcloud.com/server/latest/developer_manual/digging_deeper/two-factor-provider.html>`_.
.. TODO ON RELEASE: Update version number above on release
Enabling two-factor authentication
----------------------------------
You can enable 2FA by installing and enabling a 2FA app like TOTP which works
with Google Authenticator and compatible apps. The apps are available in the
Nextcloud App store so by navigating there and clicking **enable** for the app
you want, 2FA will be installed and enabled on your Nextcloud server.
.. figure:: ../images/2fa-app-install.png
Once 2FA has been enabled, users have to `activate it in their personal settings. <https://docs.nextcloud.com/server/latest/user_manual/en/user_2fa.html>`_
.. TODO ON RELEASE: Update version number above on release
Enforcing two-factor authentication
-----------------------------------
By default 2FA is *optional*, hence users are given the choice whether to enable
it for their account. Admins may enforce the use of 2FA.
Enforcement is possible system-wide (all users), for selected groups only and can
also be excluded for certain groups.
These settings can be found in the administrator's security settings.
.. figure:: ../images/2fa-admin-settings.png
When groups are selected/excluded, they use the following logic to determine if
a user has 2FA enforced:
* If no groups are selected, 2FA is enabled for everyone except members of the excluded groups
* If groups are selected, 2FA is enabled for all members of these. If a user is both in a
selected *and* excluded group, the selected takes precedence and 2FA is enforced.
wedding-pics/core/doc/admin/_sources/configuration_user/user_auth_ftp_smb_imap.rst.txt
+9
View File
@@ -0,0 +1,9 @@
==================================================
User authentication with IMAP, SMB, FTP and others
==================================================
You may configure additional user backends with the
External User Backends (user_external) app.
See https://github.com/nextcloud/user_external#readme
for an up to date documentation.
wedding-pics/core/doc/admin/_sources/configuration_user/user_auth_ldap.rst.txt
+912
View File
@@ -0,0 +1,912 @@
=============================
User authentication with LDAP
=============================
Nextcloud ships with an LDAP application to allow LDAP users (including Active
Directory) to appear in your Nextcloud user listings. These users will
authenticate to Nextcloud with their LDAP credentials, so you don't have to
create separate Nextcloud user accounts for them. You will manage their Nextcloud
group memberships, quotas, and sharing permissions just like any other Nextcloud
user.
.. note:: The PHP LDAP module is required; this is supplied by ``php-ldap`` on
most distributions.
The LDAP application supports:
* LDAP group support
* File sharing with Nextcloud users and groups
* Access via WebDAV and Nextcloud Desktop Client
* Versioning, external Storage and all other Nextcloud features
* Seamless connectivity to Active Directory, with no extra configuration
required
* Support for primary groups in Active Directory
* Auto-detection of LDAP attributes such as base DN, email, and the LDAP server
port number
* Only read access to your LDAP (edit or delete of users on your LDAP is not
supported)
* Optional: Allow users to change their LDAP password from Nextcloud
.. note:: A non-blocking or correctly configured SELinux setup is needed
for the LDAP backend to work. Please refer to the :ref:`selinux-config-label`.
Configuration
-------------
First enable the ``LDAP user and group backend`` app on the Apps page in
Nextcloud. Then go to your Admin page to configure it.
The LDAP configuration panel has four tabs. A correctly completed first tab
("Server") is mandatory to access the other tabs. A green indicator lights when
the configuration is correct. Hover your cursor over the fields to see some
pop-up tooltips.
Server tab
^^^^^^^^^^
Start with the Server tab. You may configure multiple servers if you have them.
.. note:: Do not configure any failover LDAP hosts here. See :ref:`advanced_settings_label` for instructions instead.
At a minimum you must supply the LDAP server's hostname. If your server requires
authentication, enter your credentials on this tab. Nextcloud will then attempt
to auto-detect the server's port and base DN. The base DN and port are
mandatory, so if Nextcloud cannot detect them you must enter them manually.
.. figure:: ../images/ldap-wizard-1-server.png
:alt: LDAP wizard, server tab
Server configuration:
Configure one or more LDAP servers. Click the **Delete Configuration**
button to remove the active configuration.
Host:
The host name or IP address of the LDAP server. It can also be a **ldaps://**
URI. If you enter the port number, it speeds up server detection.
Examples:
* *directory.my-company.com*
* *ldaps://directory.my-company.com*
* *directory.my-company.com:9876*
Port:
The port on which to connect to the LDAP server. The field is disabled in the
beginning of a new configuration. If the LDAP server is running on a standard
port, the port will be detected automatically. If you are using a
non-standard port, Nextcloud will attempt to detect it. If this fails you must
enter the port number manually.
Example:
* *389*
User DN:
The name as DN of a user who has permissions to do searches in the LDAP
directory. Leave it empty for anonymous access. We recommend that you have a
special LDAP system user for this.
Example:
* *uid=nextcloudsystemuser,cn=sysusers,dc=my-company,dc=com*
Password:
The password for the user given above. Empty for anonymous access.
Base DN:
The base DN of LDAP, from where all users and groups can be reached. You may
enter multiple base DNs, one per line. (Base DNs for users and groups can be
set in the Advanced tab.) This field is mandatory. Nextcloud attempts to
determine the Base DN according to the provided User DN or the provided
Host, and you must enter it manually if Nextcloud does not detect it.
Example:
* *dc=my-company,dc=com*
Users tab
^^^^^^^^^
Use this to control which LDAP users are listed as Nextcloud users on your
Nextcloud server. In order to control which LDAP users can login to your Nextcloud
server use the **Login Attributes** tab. Those LDAP users who have access but are not listed
as users (if there are any) will be hidden users. You may bypass the form fields
and enter a raw LDAP filter if you prefer.
.. figure:: ../images/ldap-wizard-2-user.png
:alt: User filter
Only those object classes:
Nextcloud will determine the object classes that are typically available for
user objects in your LDAP. Nextcloud will automatically select the object
class that returns the highest amount of users. You may select multiple
object classes.
Only from those groups:
If your LDAP server supports the ``member-of-overlay`` in LDAP filters, you
can define that only users from one or more certain groups are allowed to
appear in user listings in Nextcloud. By default, no value will be selected.
You may select multiple groups.
If your LDAP server does not support the ``member-of-overlay`` in LDAP filters,
the input field is disabled. Please contact your LDAP administrator.
Edit LDAP Query:
Clicking on this text toggles the filter mode and you can enter the raw LDAP
filter directly. Example::
(&(objectClass=inetOrgPerson)(memberOf=cn=nextcloudusers,ou=groups,
dc=example,dc=com))
x users found:
This is an indicator that tells you approximately how many users will be
listed in Nextcloud. The number updates automatically after any changes.
Login attributes tab
^^^^^^^^^^^^^^^^^^^^
The settings in the Login Attributes tab determine which LDAP users can log in to
your Nextcloud system and which attribute or attributes the provided login name
is matched against (e.g. LDAP/AD username, email address). You may select
multiple user details. (You may bypass the form fields and enter a raw LDAP
filter if you prefer.)
You may override your User Filter settings on the Users tab by using a raw
LDAP filter.
.. figure:: ../images/ldap-wizard-3-login.png
:alt: Login filter
LDAP Username:
If this value is checked, the login value will be compared to the username in
the LDAP directory. The corresponding attribute, usually *uid* or
*samaccountname* will be detected automatically by Nextcloud.
LDAP Email Address:
If this value is checked, the login value will be compared to an email address
in the LDAP directory; specifically, the *mailPrimaryAddress* and *mail*
attributes.
Other Attributes:
This multi-select box allows you to select other attributes for the
comparison. The list is generated automatically from the user object
attributes in your LDAP server.
Edit LDAP Query:
Clicking on this text toggles the filter mode and you can enter the raw LDAP
filter directly.
The **%uid** placeholder is replaced with the login name entered by the
user upon login.
Examples:
* only username::
(&(objectClass=inetOrgPerson)(memberOf=cn=nextcloudusers,ou=groups,
dc=example,dc=com)(uid=%uid)
* username or email address::
((&(objectClass=inetOrgPerson)(memberOf=cn=nextcloudusers,ou=groups,
dc=example,dc=com)(|(uid=%uid)(mail=%uid)))
Groups tab
^^^^^^^^^^
By default, no LDAP groups will be available in Nextcloud. The settings in the
Groups tab determine which groups will be available in Nextcloud. You may
also elect to enter a raw LDAP filter instead.
.. figure:: ../images/ldap-wizard-4-group.png
:alt: Group filter
Only these object classes:
Nextcloud will determine the object classes that are typically available for
group objects in your LDAP server. Nextcloud will only list object
classes that return at least one group object. You can select multiple
object classes. A typical object class is "group", or "posixGroup".
Only from these groups:
Nextcloud will generate a list of available groups found in your LDAP server.
Then you select the group or groups that get access to your Nextcloud
server.
Edit LDAP Query:
Clicking on this text toggles the filter mode and you can enter the raw LDAP
filter directly.
Example:
* *objectClass=group*
* *objectClass=posixGroup*
y groups found:
This tells you approximately how many groups will be available in Nextcloud.
The number updates automatically after any change.
.. _advanced_settings_label:
Advanced settings
-----------------
The LDAP Advanced Setting section contains options that are not needed for a
working connection. This provides controls to disable the current
configuration,
configure replica hosts, and various performance-enhancing options.
The Advanced Settings are structured into four parts:
* Connection Settings
* Directory Settings
* Special Attributes
* User Profile Attributes
Connection settings
^^^^^^^^^^^^^^^^^^^
.. figure:: ../images/ldap-advanced-1-connection.png
:alt: Advanced settings
Configuration Active:
Enables or Disables the current configuration. By default, it is turned off.
When Nextcloud makes a successful test connection it is automatically turned
on.
Backup (Replica) Host:
If you have a backup LDAP server, enter the connection settings here.
Nextcloud will then automatically connect to the backup when the main server
cannot be reached. The backup server must be a replica of the main server so
that the object UUIDs match.
Example:
* *directory2.my-company.com*
Backup (Replica) Port:
The connection port of the backup LDAP server. If no port is given,
but only a host, then the main port (as specified above) will be used.
Example:
* *389*
Disable Main Server:
You can manually override the main server and make Nextcloud only connect to
the backup server. This is useful for planned downtimes.
Turn off SSL certificate validation:
Turns off SSL certificate checking. Use it for testing only!
*Note*: The effect of this setting depends on the PHP system configuration.
It does for example not work with the
[official Nextcloud container image](https://github.com/nextcloud/docker).
To disable certificate verification for a particular use, append the following
configuration line to your `/etc/ldap/ldap.conf`:
```
TLS_REQCERT ALLOW
```
Cache Time-To-Live:
A cache is introduced to avoid unnecessary LDAP traffic, for example caching
usernames so they don't have to be looked up for every page, and speeding up
loading of the Users page. Saving the configuration empties the cache. The
time is given in seconds.
Note that almost every PHP request requires a new connection to the LDAP
server. If you require fresh PHP requests we recommend defining a minimum
lifetime of 15s or so, rather than completely eliminating the cache.
Examples:
* ten minutes: *600*
* one hour: *3600*
See the Caching section below for detailed information on how the cache
operates.
.. _ldap_directory_settings:
Directory settings
^^^^^^^^^^^^^^^^^^
.. figure:: ../images/ldap-advanced-2-directory.png
:alt: Directory settings.
User Display Name Field:
The attribute that should be used as display name in Nextcloud.
* Example: *displayName*
2nd User Display Name Field:
An optional second attribute displayed in brackets after the display name,
for example using the ``mail`` attribute displays as ``Molly Foo
(molly@example.com)``.
Base User Tree:
The base DN of LDAP, from where all users can be reached. This must be a
complete DN, regardless of what you have entered for your Base DN in the
Basic setting. You can specify multiple base trees, one on each line.
* Example:
| *cn=programmers,dc=my-company,dc=com*
| *cn=designers,dc=my-company,dc=com*
User Search Attributes:
These attributes are used when searches for users are performed, for example
in the share dialogue. The user display name attribute is the
default. You may list multiple attributes, one per line.
If an attribute is not available on a user object, the user will not be
listed, and will be unable to login. This also affects the display name
attribute. If you override the default you must specify the display name
attribute here.
* Example:
| *displayName*
| *mail*
Group Display Name Field:
The attribute that should be used as Nextcloud group name. Nextcloud allows a
limited set of characters (a-zA-Z0-9.-_@). Once a group name is assigned it
cannot be changed.
* Example: *cn*
Base Group Tree:
The base DN of LDAP, from where all groups can be reached. This must be a
complete DN, regardless of what you have entered for your Base DN in the
Basic setting. You can specify multiple base trees, one in each line.
* Example:
| *cn=barcelona,dc=my-company,dc=com*
| *cn=madrid,dc=my-company,dc=com*
Group Search Attributes:
These attributes are used when a search for groups is done, for example in
the share dialogue. By default the group display name attribute as specified
above is used. Multiple attributes can be given, one in each line.
If you override the default, the group display name attribute will not be
taken into account, unless you specify it as well.
* Example:
| *cn*
| *description*
Group Member association:
The attribute that is used to indicate group memberships, i.e. the attribute
used by LDAP groups to refer to their users.
Nextcloud detects the value automatically. You should only change it if you
have a very valid reason and know what you are doing.
* Example: *uniquemember*
Nested groups:
Enable group member retrieval from sub groups.
To allow user listing and login from nested groups, please see **User listing
and login per nested groups** in the section **Troubleshooting, Tips and
Tricks**.
Enable LDAP password changes per user:
Allow LDAP users to change their password and allow Super Administrators and Group Administrators to change the password of their LDAP users.
To enable this feature, the following requirements have to be met:
* General requirements:
* Access control policies must be configured on the LDAP server to grant permissions for password changes. The User DN as configured in *Server Settings* needs to have write permissions in order to update the userPassword attribute.
* Passwords are sent in plaintext to the LDAP server. Therefore, transport encryption must be used for the communication between Nextcloud and the LDAP server, e.g. employ LDAPS.
* Enabling password hashing on the LDAP server is highly recommended. While Active Directory stores passwords in a one-way format by default, OpenLDAP users could configure the ``ppolicy_hash_cleartext`` directive of the ppolicy overlay that ships with OpenLDAP.
* Additional requirements for Active Directory:
* At least a 128-bit transport encryption must be used for the communication between Nextcloud and the LDAP server.
* Make sure that the ``fUserPwdSupport`` char of the dSHeuristics is configured to employ the ``userPassword`` attribute as ``unicodePwd`` alias. While this is set accordingly on AD LDS by default, this is not the case on AD DS.
Default password policy DN:
This feature requires OpenLDAP with ppolicy. The DN of a default password policy will be used for password expiry handling in the absence of any user specific password policy. Password expiry handling features the following:
* When a LDAP password is about to expire, display a warning message to the user showing the number of days left before it expires. Password expiry warnings are displayed through the notifications app for Nextcloud.
* Prompt LDAP users with expired passwords to reset their password during login, provided that an adequate number of grace logins is still available.
Leave the setting empty to keep password expiry handling disabled.
For the password expiry handling feature to work, LDAP password changes per user must be enabled and the LDAP server must be running OpenLDAP with its ppolicy module configured accordingly.
* Example:
| *cn=default,ou=policies,dc=my-company,dc=com*
.. _LDAP_Special_Attributes:
Special attributes
^^^^^^^^^^^^^^^^^^
.. figure:: ../images/ldap-advanced-3-attributes.png
:alt: Special Attributes.
Quota Field:
Nextcloud can read an LDAP attribute and set the user quota according to its
value. Specify the attribute here, and it will return human-readable values,
e.g. "2 GB".
* Example: *NextcloudQuota*
.. warning:: LDAP quota parameters override quota parameters set in the Nextcloud user management page.
Quota Default:
Specifies a default quota for LDAP users who do not have a quota set in
the above Quota Field.
* Example: *15 GB*
.. warning:: LDAP quota parameters override quota parameters set in the Nextcloud user management page.
Email Field:
Set the user's email from their LDAP attribute. Leave it empty for default
behavior.
* Example: *mail*
User Home Folder Naming Rule:
By default, the Nextcloud server creates the user directory in your Nextcloud
data directory and gives it the Nextcloud username, .e.g ``/var/www/nextcloud/data/alice``. You may want to override this setting and name it after an LDAP
attribute value. The attribute can also return an absolute path, e.g.
``/mnt/storage43/alice``. Leave it empty for default behavior.
* Example: *cn*
In new Nextcloud installations the home folder rule is enforced. This means that once you set a home folder naming rule (get a home folder from an LDAP attribute), it must be available for all users. If it isn't available for a user, then that user will not be able to login. Also, the filesystem will not be set up for that user, so their file shares will not be available to other users.
In migrated Nextcloud installations the old behavior still applies, which is using the Nextcloud username as the home folder when an LDAP attribute is not set. You may change this enforcing the home folder rule with the ``occ`` command in Nextcloud, like this example on Ubuntu::
sudo -u www-data php occ config:app:set user_ldap enforce_home_folder_naming_rule --value=1
.. _LDAP_User_Profile_Attributes:
User Profile attributes
^^^^^^^^^^^^^^^^^^^^^^^
.. figure:: ../images/ldap-advanced-4-attributes.png
:alt: User Profile Attributes.
After configuring those attributes, the User Profile data will be overwritten with the according data from LDAP. The checksum of data from LDAP will be stored in user settings ``user_ldap``, ``lastProfileChecksum`` and profile update is skipped as long as data from LDAP doesn't change. If ``memcache.distributed`` is enabled in ``config.php`` the checksum will be cached and the checking will be skipped, as long as the cached value exists (expires after ``ldapCacheTTL`` seconds).
Please be aware:
- The user can change the data in profile, but it will get overwritten if changed in LDAP
- The user can change the visibility scope in profile
- The default visibility can be adjusted with setting the ``account_manager.default_property_scope`` array in ``config.php``
- If multiple attribute values are present, only the first distributed value is used
- All user profile properties are limited to 2048 character
- Having misformatted data in LDAP will most probably leave you with empty user profile fields
- Setting the global ``profile.enabled => false`` on ``config.php`` skips the code
By calling ``php occ ldap:check-user --update <uid>`` the users data from LDAP will be displayed and the profile gets updated. To get the correct ``<uid>`` value for any user you can use ``php occ user:list``.
.. note:: After unsetting an attribute name here, the data won't be deleted from user profile. Setting an nonexisting attribute will empty the corresponding profile field.
Phone Field:
The LDAP Attribute holding the phone number, to copy to the Profile Phone field.
The phone number has to be formatted in international syntax without delimiters (E.164).
Be sure to format phone numbers like ``+4966612345678``.
* Example: *telephoneNumber*
* Example: *mobile*
.. note:: You should set your ``default_phone_region`` in ``config.php``.
Website Field:
The LDAP attribute holding the website URI.
The URI must start with ``https://`` or ``http://`` others are currently not allowed in Nextcloud user profile.
If using ``labeledURI`` attributes the label (everything after first SPACE) gets removed.
* Example: *wWWHomePage*
* Example: *labeledURI*
Address Field:
The LDAP attribute holding the users address. Named Location on user profile page.
Nextcloud wants a single line value like ``city, country`` or ``somewhere under the loving sun``.
Multi line postalAddress format will get reformatted, DOLLAR sign delimiter gets replaced with COMMA+SPACE.
* Example: *postalAddress*
* Example: *localityName*
Twitter Field:
The LDAP attribute holding the Twitter account name.
Fediverse Field:
The LDAP attribute holding the users Fediverse address.
Organisation Field:
The LDAP attribute holding the Organisation name.
* Example: *company*
* Example: *o* or *organizationName*
Role Field:
The LDAP attribute holding the organizational role, within the organisation or job title.
* Example: *title*
Headline Field:
The LDAP attribute holding the users headline.
Biography Field:
The LDAP attribute holding the users about i.e. short biography.
Multi line value with unix LF line ending.
Windows CRLF and Macintosh CR line endings will be replaced with unix LF line ending.
Expert settings
---------------
.. figure:: ../images/ldap-expert.png
:alt: Expert settings.
In the Expert Settings fundamental behavior can be adjusted to your needs. The
configuration should be well-tested before starting production use.
Internal Username:
The internal username is the identifier in Nextcloud for LDAP users. By default
it will be created from the UUID attribute. The UUID attribute ensures that
the username is unique, and that characters do not need to be converted. Only
these characters are allowed: [\a-\zA-\Z0-\9_.@-]. Other characters are
replaced with their ASCII equivalents, or are simply omitted.
The LDAP backend ensures that there are no duplicate internal usernames in
Nextcloud, i.e. that it is checking all other activated user backends
(including local Nextcloud users). On collisions a random number (between 1000
and 9999) will be attached to the retrieved value. For example, if "alice"
exists, the next username may be "alice_1337".
The internal username is the default name for the user home folder in
Nextcloud. It is also a part of remote URLs, for instance for all \*DAV
services.
You can override all of this with the Internal Username setting. Leave it
empty for default behavior. Changes will affect only newly mapped LDAP users.
When configuring this, be aware that the username in Nextcloud is considered
immutable and cannot be changed afterwards. This can cause issues when using
an attribute that might change, e.g. the email address of a user that will
get changed during name change.
* Example: *uid*
Override UUID detection
By default, Nextcloud auto-detects the UUID attribute. The UUID attribute is
used to uniquely identify LDAP users and groups. The internal username will
be created based on the UUID, if not specified otherwise.
You can override the setting and pass an attribute of your choice. You must
make sure that the attribute of your choice can be fetched for both users and
groups and it is unique. Leave it empty for default behavior. Changes will
have effect only on newly mapped LDAP users and groups. It also will
have effect when a user's or group's DN changes and an old UUID was cached,
which will result in a new user. Because of this, the setting should be
applied before putting Nextcloud in production use and clearing the bindings
(see the ``User and Group Mapping`` section below).
* Example: *cn*
Username-LDAP User Mapping
Nextcloud uses usernames as keys to store and assign data. In order to
precisely identify and recognize users, each LDAP user will have a internal
username in Nextcloud. This requires a mapping from Nextcloud username to LDAP
user. The created username is mapped to the UUID of the LDAP user.
Additionally the DN is cached as well to reduce LDAP interaction, but it is
not used for identification. If the DN changes, the change will be detected by
Nextcloud by checking the UUID value.
The same is valid for groups.
The internal Nextcloud name is used all over in Nextcloud. Clearing the Mappings
will have leftovers everywhere. Never clear the mappings in a production
environment, but only in a testing or experimental server.
.. warning:: Clearing the Mappings is not configuration sensitive, it affects all LDAP
configurations!
Testing the configuration
-------------------------
The **Test Configuration** button checks the values as currently given in the
input fields. You do not need to save before testing. By clicking on the
button, Nextcloud will try to bind to the Nextcloud server using the
settings currently given in the input fields. If the binding fails you'll see a
yellow banner with the error message "The configuration is invalid. Please have
a look at the logs for further details."
When the configuration test reports success, save your settings and check if the
users and groups are fetched correctly on the Users page.
Additional configuration options via occ
----------------------------------------
Few configuration settings can only be set on command line via ``occ``.
Attribute update interval
^^^^^^^^^^^^^^^^^^^^^^^^^
The LDAP backend will update user information that is used within Nextcloud
with the values provided by the LDAP server. For instance these are email,
quota or the avatar. This happens on every login, the first detection of a user
from LDAP and regularly by a background job.
The interval value determines the time between updates of the values and is
used to avoid frequent overhead, including time-expensive write actions to
the database.
The interval is described in seconds and it defaults to 86400 equalling a day.
It is not a per-configuration option.
The value can be modified by::
sudo -u www-data php occ config:app:set user_ldap updateAttributesInterval --value=86400
A value of 0 will update it on every of the named occasions.
Administrative Group mapping
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is possible to promote **one** LDAP per connection as an admin group, so
that all its members also have administrative privileges in Nextcloud.
A group can either be promoted via a dedicated ``occ`` call providing a group
parameter that can be either a nextcloud group ID or a group name that will be
search against. When a search is executed an exact match is required.
Example usage::
$ php occ ldap:promote-group --help
Description:
declares the specified group as admin group (only one is possible per LDAP configuration)
Usage:
ldap:promote-group [options] [--] <group>
Arguments:
group the group ID in Nextcloud or a group name
Options:
-y, --yes do not ask for confirmation
…
# Example
$ php occ ldap:promote-group "Nextcloud Admins"
Promote Nextcloud Admins to the admin group (y|N)? y
Group Nextcloud Admins was promoted
$ php occ ldap:promote-group "Paramount Court"
Promote Nextcloud Admins to the admin group and demote Nextcloud Admins (Group ID: nextcloud_admins) (y|N)? y
Group Paramount Court was promoted
$ php occ ldap:promote-group "Paramount Court"
The specified group is already promoted
.. note:: Note the group ID will only be displayed when it differs from the
group's display name.
It is also possible to set the admin group mapping using
``occ ldap:set-config $configId ldapAdminGroup $groupId``, but as the Nextcloud
group ID might not be known (yet) it is recommended (especially for automatized
setups) to use the `promote-group` command, that would also pull in the group
and determine the group ID.
In order to demote or reset a promotion, an empty string should be set against
to the targeted config's ldapAdminGroup::
# Reset an admin group mapping via set-config
occ ldap:set-config $configId ldapAdminGroup ""
# Example
occ ldap:set-config s01 ldapAdminGroup ""
.. tip:: To have more than one administrative groups in a connection, create a
holding group in your LDAP directory that contains the single groups as
nested members, and promote this one.
Nextcloud avatar integration
----------------------------
Nextcloud supports user profile pictures, which are also called avatars. If a user
has a photo stored in the *jpegPhoto* or *thumbnailPhoto* attribute on your LDAP
server, it will be used as their avatar. In this case the user cannot alter their
avatar (on their Personal page) as it must be changed in LDAP. *jpegPhoto* is
preferred over *thumbnailPhoto*.
.. figure:: ../images/ldap-fetched-avatar.png
:alt: Profile picture fetched from LDAP.
If the *jpegPhoto* or *thumbnailPhoto* attribute is not set or empty, then
users can upload and manage their avatars on their Nextcloud Personal pages.
Avatars managed in Nextcloud are not stored in LDAP.
The *jpegPhoto* or *thumbnailPhoto* attribute is fetched once a day to make
sure the current photo from LDAP is used in Nextcloud. LDAP avatars override
Nextcloud avatars, and when an LDAP avatar is deleted then the most recent
Nextcloud avatar replaces it.
Photos served from LDAP are automatically cropped and resized in Nextcloud. This
affects only the presentation, and the original image is not changed.
Use a specific attribute or turn off loading of images
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is possible to turn off the avatar integration or specify a single,
different attribute to read the image from. It is expected to contain image
data just like *jpegPhoto* or *thumbnailPhoto* do.
The behaviour can be changed using the occ command line tool only. Essentially
those options are available:
* The default behaviour as described above should be used
``occ ldap:set-config "s01" "ldapUserAvatarRule" "default"``
* User images shall not be fetched from LDAP
``occ ldap:set-config "s01" "ldapUserAvatarRule" "none"``
* The image should be read from the attribute "selfiePhoto"
``occ ldap:set-config "s01" "ldapUserAvatarRule" "data:selfiePhoto"``
The "s01" refers to the configuration ID as can be retrieved per
``occ ldap:show-config``.
Troubleshooting, tips and tricks
--------------------------------
SSL certificate verification (LDAPS, TLS)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
A common mistake with SSL certificates is that they may not be known to PHP.
If you have trouble with certificate validation make sure that
* You have the certificate of the server installed on the Nextcloud server
* The certificate is announced in the system's LDAP configuration file (usually
*/etc/ldap/ldap.conf*)
* Using LDAPS, also make sure that the port is correctly configured (by default
636)
Microsoft Active Directory
^^^^^^^^^^^^^^^^^^^^^^^^^^
Compared to earlier Nextcloud versions, no further tweaks need to be done to
make Nextcloud work with Active Directory. Nextcloud will automatically find the
correct configuration in the set-up process.
memberOf / read memberof permissions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you want to use ``memberOf`` within your filter you might need to give your
querying user the permissions to use it. For Microsoft Active Directory this
is described `here <https://serverfault.com/questions/167371/what-permissions-are
-required-for-enumerating-users-groups-in-active-directory/167401#167401>`_.
User listing and login per nested groups
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
When it is intended to allow user listing and login based on a specific group
having subgroups ("nested groups"), checking **Nested groups** on **Directory
Settings** is not enough. Also the User (and Login) filter need to be changed,
by specifying the ``LDAP_MATCHING_RULE_IN_CHAIN`` matching rule. Change the
filter parts containing the *memberof* condition according to this example:
* (memberof=cn=Nextcloud Users Group,ou=Groups,…)
to
* (memberof:1.2.840.113556.1.4.1941:=cn=Nextcloud Users Group,ou=Groups,…)
Duplicating server configurations
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
In case you have a working configuration and want to create a similar one or
"snapshot" configurations before modifying them you can do the following:
#. Go to the **Server** tab
#. On **Server Configuration** choose *Add Server Configuration*
#. Answer the question *Take over settings from recent server configuration?*
with *yes*.
#. (optional) Switch to **Advanced** tab and uncheck **Configuration Active**
in the *Connection Settings*, so the new configuration is not used on Save
#. Click on **Save**
Now you can modify and enable the configuration.
Nextcloud LDAP internals
------------------------
Some parts of how the LDAP backend works are described here.
User and group mapping
^^^^^^^^^^^^^^^^^^^^^^
In Nextcloud the user or group name is used to have all relevant information in
the database assigned. To work reliably a permanent internal user name and
group name is created and mapped to the LDAP DN and UUID. If the DN changes in
LDAP it will be detected, and there will be no conflicts.
Those mappings are done in the database table ``ldap_user_mapping`` and
``ldap_group_mapping``. The user name is also used for the user's folder (except
if something else is specified in *User Home Folder Naming Rule*), which
contains files and meta data.
The internal user name and a visible display name are separated.
This is not the case for group names, yet, i.e. a group name cannot be altered.
That means that your LDAP configuration should be good and ready before putting
it into production. The mapping tables are filled early, but as long as you are
testing, you can empty the tables any time. Do not do this in production.
The attributes of users are fetched on demand (i.e. for sharing autocompletion
or in the user management) and then stored inside the Nextcloud database to
allow a better performance on our side. They are typically checked twice a day
in batches from all users again. Beside that they are also refreshed during a
login for this user or can be fetched manually via the occ command
``occ ldap:check-user --update USERID`` where ``USERID`` is Nextcloud's user id.
For groups, a cache of memberships is stored in the database to be able to trigger
events when a membership is added or removed. This cache is updated by a background
job, and can be force updated using ``occ ldap:check-group --update GROUPID``.
Caching
^^^^^^^
The LDAP information is cached in Nextcloud memory cache, and you must install
and configure the memory cache (see
:doc:`../configuration_server/caching_configuration`). The Nextcloud **Cache**
helps to speed up user interactions and sharing. It is populated on demand,
and remains populated until the **Cache Time-To-Live** for each unique request
expires. User logins are not cached, so if you need to improve login times set
up a slave LDAP server to share the load.
You can adjust the **Cache Time-To-Live** value to balance performance and
freshness of LDAP data. All LDAP requests will be cached for 10 minutes by
default, and you can alter this with the **Cache Time-To-Live** setting. The
cache answers each request that is identical to a previous request, within the
time-to-live of the original request, rather than hitting the LDAP server.
The **Cache Time-To-Live** is related to each single request. After a cache
entry expires there is no automatic trigger for re-populating the information,
as the cache is populated only by new requests, for example by opening the
User administration page, or searching in a sharing dialog.
There is one trigger which is automatically triggered by a certain background
job which keeps the ``user-group-mappings`` up-to-date, and always in cache.
Under normal circumstances, all users are never loaded at the same time.
Typically the loading of users happens while page results are generated, in
steps of 30 until the limit is reached or no results are left. For this to
work on a Nextcloud-Server and LDAP-Server, **Paged Results** must be supported.
Nextcloud remembers which user belongs to which LDAP-configuration. That means
each request will always be directed to the right server unless a user is
defunct, for example due to a server migration or unreachable server. In this
case the other servers will also receive the request.
Handling with backup server
^^^^^^^^^^^^^^^^^^^^^^^^^^^
When Nextcloud is not able to contact the main LDAP server, Nextcloud assumes it
is offline and will not try to connect again for the time specified in **Cache
Time-To-Live**. If you have a backup server configured Nextcloud will connect to
it instead. When you have scheduled downtime, check **Disable Main Server** to
avoid unnecessary connection attempts.
Note
----
When a LDAP object's name or surname, that is display name attribute, by default
"displayname", is left empty, Nextcloud will treat it as an empty object, therefore
no results from this user or AD-Object will be shown to avoid gathering of
technical accounts.
wedding-pics/core/doc/admin/_sources/configuration_user/user_auth_ldap_api.rst.txt
+320
View File
@@ -0,0 +1,320 @@
==========================
The LDAP configuration API
==========================
All methods require that the "OCS-APIREQUEST" header be set to "true". Methods take an optional "format" parameter, which may be "xml" (the default) or "json".
Creating a configuration
------------------------
Creates a new and empty LDAP configuration. It returns its ID. Authentication is done by sending a
basic HTTP authentication header.
**Syntax: ocs/v2.php/apps/user_ldap/api/v1/config**
* HTTP method: POST
Example
^^^^^^^
::
$ curl -X POST https://admin:secret@example.com/ocs/v2.php/apps/user_ldap/api/v1/config -H "OCS-APIREQUEST: true"
* Creates a new, empty configuration
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>200</statuscode>
<message>OK</message>
</meta>
<data>
<configID>s01</configID>
</data>
</ocs>
Deleting a configuration
------------------------
Deletes a given LDAP configuration. Authentication is done by sending a basic HTTP authentication header.
**Syntax: ocs/v2.php/apps/user_ldap/api/v1/config/{configID}**
* HTTP method: DELETE
Example
^^^^^^^
::
$ curl -X DELETE ``https://admin:secret@example.com/ocs/v2.php/apps/user_ldap/api/v1/config/s02 -H "OCS-APIREQUEST: true"
* deletes the LDAP configuration
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>200</statuscode>
<message>OK</message>
</meta>
<data/>
</ocs>
Reading a configuration
-----------------------
Returns all keys and values of the specified LDAP configuration. Authentication is done by sending a basic HTTP authentication header.
**Syntax: ocs/v2.php/apps/user_ldap/api/v1/config/{configID}**
* HTTP method: GET
* url argument: showPassword - int, optional, default 0, whether to return the password in clear text
Example
^^^^^^^
::
$ curl -X GET https://admin:secret@example.com/ocs/v2.php/apps/user_ldap/api/v1/config/s02?showPassword=1 -H "OCS-APIREQUEST: true"
* fetches the LDAP configuration
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>200</statuscode>
<message>OK</message>
</meta>
<data>
<ldapHost>ldap://ldap.server.tld</ldapHost>
<ldapPort>389</ldapPort>
<ldapBackupHost></ldapBackupHost>
<ldapBackupPort></ldapBackupPort>
<ldapBase>ou=Department XLII,dc=example,dc=com</ldapBase>
<ldapBaseUsers>ou=users,ou=Department XLII,dc=example,dc=com</ldapBaseUsers>
<ldapBaseGroups>ou=Department XLII,dc=example,dc=com</ldapBaseGroups>
<ldapAgentName>cn=root,dc=example,dc=com</ldapAgentName>
<ldapAgentPassword>Secret</ldapAgentPassword>
<ldapTLS>1</ldapTLS>
<turnOffCertCheck>0</turnOffCertCheck>
<ldapIgnoreNamingRules/>
<ldapUserDisplayName>displayname</ldapUserDisplayName>
<ldapUserDisplayName2>uid</ldapUserDisplayName2>
<ldapGidNumber>gidNumber</ldapGidNumber>
<ldapUserFilterObjectclass>inetOrgPerson</ldapUserFilterObjectclass>
<ldapUserFilterGroups></ldapUserFilterGroups>
<ldapUserFilter>(&amp;(objectclass=nextcloudUser)(nextcloudEnabled=TRUE))</ldapUserFilter>
<ldapUserFilterMode>1</ldapUserFilterMode>
<ldapGroupFilter>(&amp;(|(objectclass=nextcloudGroup)))</ldapGroupFilter>
<ldapGroupFilterMode>0</ldapGroupFilterMode>
<ldapGroupFilterObjectclass>nextcloudGroup</ldapGroupFilterObjectclass>
<ldapGroupFilterGroups></ldapGroupFilterGroups>
<ldapGroupMemberAssocAttr>memberUid</ldapGroupMemberAssocAttr>
<ldapGroupDisplayName>cn</ldapGroupDisplayName>
<ldapLoginFilter>(&amp;(|(objectclass=inetOrgPerson))(uid=%uid))</ldapLoginFilter>
<ldapLoginFilterMode>0</ldapLoginFilterMode>
<ldapLoginFilterEmail>0</ldapLoginFilterEmail>
<ldapLoginFilterUsername>1</ldapLoginFilterUsername>
<ldapLoginFilterAttributes></ldapLoginFilterAttributes>
<ldapQuotaAttribute></ldapQuotaAttribute>
<ldapQuotaDefault>20 MB</ldapQuotaDefault>
<ldapEmailAttribute>mail</ldapEmailAttribute>
<ldapCacheTTL>600</ldapCacheTTL>
<ldapUuidUserAttribute>auto</ldapUuidUserAttribute>
<ldapUuidGroupAttribute>auto</ldapUuidGroupAttribute>
<ldapOverrideMainServer></ldapOverrideMainServer>
<ldapConfigurationActive>1</ldapConfigurationActive>
<ldapAttributesForUserSearch>uid;sn;givenname</ldapAttributesForUserSearch>
<ldapAttributesForGroupSearch></ldapAttributesForGroupSearch>
<ldapExperiencedAdmin>0</ldapExperiencedAdmin>
<homeFolderNamingRule>attr:mail</homeFolderNamingRule>
<hasPagedResultSupport></hasPagedResultSupport>
<hasMemberOfFilterSupport>1</hasMemberOfFilterSupport>
<useMemberOfToDetectMembership>1</useMemberOfToDetectMembership>
<ldapExpertUsernameAttr></ldapExpertUsernameAttr>
<ldapExpertUUIDUserAttr></ldapExpertUUIDUserAttr>
<ldapExpertUUIDGroupAttr></ldapExpertUUIDGroupAttr>
<lastJpegPhotoLookup>0</lastJpegPhotoLookup>
<ldapNestedGroups>0</ldapNestedGroups>
<ldapPagingSize>500</ldapPagingSize>
<turnOnPasswordChange>1</turnOnPasswordChange>
<ldapDynamicGroupMemberURL></ldapDynamicGroupMemberURL>
<ldapDefaultPPolicyDN></ldapDefaultPPolicyDN>
</data>
</ocs>
Modifying a configuration
-------------------------
Updates a configuration with the provided values. Authentication is done by sending a basic HTTP authentication header.
**Syntax: ocs/v2.php/apps/user_ldap/api/v1/config/{configID}**
* HTTP method: PUT
* url argument: configData - array, see table below for the fields. All fields are optional. The values must be url-encoded.
Example
^^^^^^^
::
$ curl -X PUT https://admin:secret@example.com/ocs/v2.php/apps/user_ldap/api/v1/config/s01 -H "OCS-APIREQUEST: true" -d "configData[ldapHost]=ldap%3A%2F%2Fldap.server.tld &configData[ldapPort]=389"
* updates the LDAP configuration
XML output
^^^^^^^^^^
.. code-block:: xml
<?xml version="1.0"?>
<ocs>
<meta>
<status>ok</status>
<statuscode>200</statuscode>
<message>OK</message>
</meta>
<data/>
</ocs>
Configuration keys
------------------
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| Key | Mode | Required | Description |
+===============================+======+==========+=======================================================================================================================+
| ldapHost | rw | yes | LDAP server host, supports protocol |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapPort | rw | yes | LDAP server port |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapBackupHost | rw | no | LDAP replica host |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapBackupPort | rw | no | LDAP replica port |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapOverrideMainServer | rw | no | Whether replica should be used instead |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapBase | rw | yes | Base |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapBaseUsers | rw | no | Base for users, defaults to general base if not specified |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapBaseGroups | rw | no | Base for groups, defaults to general base if not specified |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapAgentName | rw | no | DN for the (service) user to connect to LDAP |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapAgentPassword | rw | no | Password for the service user |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapTLS | rw | no | Whether to use StartTLS |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| turnOffCertCheck | rw | no | Turns off certificate validation for TLS connections |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapIgnoreNamingRules | rw | no | Backwards compatibility, do not set it. |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserDisplayName | rw | yes | Attribute used as display name for users |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserDisplayName2 | rw | no | Additional attribute, if set show on brackets next to the main attribute |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserAvatarRule | rw | no | Specify the avatar integration behavior, possible values: "default", "none", "data:$ATTRIBUTENAME" |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGidNumber | rw | no | group ID attribute, needed for primary groups on OpenLDAP (and compatible) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserFilterObjectclass | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserFilterGroups | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserFilter | rw | yes | LDAP Filter used to retrieve user |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUserFilterMode | rw | no | used by the Settings Wizard, set to 1 for manual editing |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapAttributesForUserSearch | rw | no | attributes to be matched when searching for users. separate by ; |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupFilter | rw | no | LDAP Filter used to retrieve groups |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupFilterMode | rw | no | used by the Settings Wizard, set to 1 for manual editing |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupFilterObjectclass | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupFilterGroups | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupMemberAssocAttr | rw | no | attribute that indicates group members, one of: member, memberUid, uniqueMember, gidNumber |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapGroupDisplayName | rw | no | Attribute used as display name for groups, required if groups are used |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapAttributesForGroupSearch | rw | no | attributes to be matched when searching for groups. separate by ; |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapLoginFilter | rw | yes | LDAP Filter used to authenticate users |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapLoginFilterMode | rw | no | used by the Settings Wizard, set to 1 for manual editing |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapLoginFilterEmail | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapLoginFilterUsername | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapLoginFilterAttributes | rw | no | set by the Settings Wizard (web UI) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapQuotaAttribute | rw | no | LDAP attribute containing the quote value (per user) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapQuotaDefault | rw | no | Default Quota, if specified quota attribute is empty |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapEmailAttribute | rw | no | LDAP attribute containing the email address (takes first if multiple are stored) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapCacheTTL | rw | no | How long results from LDAP are cached, defaults to 10min |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUuidUserAttribute | r | no | set in runtime |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapUuidGroupAttribute | r | no | set in runtime |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapConfigurationActive | rw | no | whether this configuration is active. 1 is on, 0 is off. |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapExperiencedAdmin | rw | no | used by the Settings Wizard, set to 1 for manual editing |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| homeFolderNamingRule | rw | no | LDAP attribute to use a user folder name |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| hasPagedResultSupport | r | no | set in runtime |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport | r | no | set in runtime |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| useMemberOfToDetectMembership | rw | no | Whether to use memberOf to detect group memberships |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapExpertUsernameAttr | rw | no | LDAP attribute to use as internal username. Might be modified (e.g. to avoid name collisions, character restrictions) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapExpertUUIDUserAttr | rw | no | override the LDAP servers UUID attribute to identify LDAP user records |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapExpertUUIDGroupAttr | rw | no | override the LDAP servers UUID attribute to identify LDAP group records |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| lastJpegPhotoLookup | r | no | set in runtime |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapNestedGroups | rw | no | Whether LDAP supports nested groups |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapPagingSize | rw | no | Number of results to return per page |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| turnOnPasswordChange | rw | no | Whether users are allowed to change passwords (hashing must happen on LDAP!) |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapDynamicGroupMemberURL | rw | no | URL for dynamic groups |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapDefaultPPolicyDN | rw | no | PPolicy DN for password rules |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
| ldapConnectionTimeout | rw | no | Set the ``LDAP_OPT_NETWORK_TIMEOUT`` connection options. Default to 15 sec. |
+-------------------------------+------+----------+-----------------------------------------------------------------------------------------------------------------------+
wedding-pics/core/doc/admin/_sources/configuration_user/user_auth_ldap_cleanup.rst.txt
+80
View File
@@ -0,0 +1,80 @@
=================
LDAP user cleanup
=================
LDAP User Cleanup is a new feature in the ``LDAP user and group backend``
application. LDAP User Cleanup is a background process that automatically
searches the Nextcloud LDAP mappings table, and verifies if the LDAP users are
still available. Any users that are not available are marked as ``deleted`` in
the ``oc_preferences`` database table. Then you can run a command to display
this table, displaying only the users marked as ``deleted``, and then you have
the option of removing their data from your Nextcloud data directory.
These items are removed upon cleanup:
* Local Nextcloud group assignments
* User preferences (DB table ``oc_preferences``)
* User's Nextcloud home folder
* User's corresponding entry in ``oc_storages``
There are two prerequisites for LDAP User Cleanup to operate:
1. Set ``ldapUserCleanupInterval`` in ``config.php`` to your desired check
interval in minutes. The default is 51 minutes.
2. All configured LDAP connections are enabled and operating correctly. As users
can exist on multiple LDAP servers, you want to be sure that all of your
LDAP servers are available so that a user on a temporarily disconnected LDAP
server is not marked as ``deleted``.
The background process examines 50 users at a time, and runs at the interval you
configured with ``ldapUserCleanupInterval``. For example, if you have 200 LDAP
users and your ``ldapUserCleanupInterval`` is 20 minutes, the process will
examine the first 50 users, then 20 minutes later the next 50 users, and 20
minutes later the next 50, and so on.
The amount of users to check can be set to a custom value via occ command. The
following example sets it to 300:
``sudo -u www-data php occ config:app:set --value=300 user_ldap cleanUpJobChunkSize``
There are two ``occ`` commands to use for examining a table of users marked as
deleted, and then manually deleting them. The ``occ`` command is in your
Nextcloud directory, for example ``/var/www/nextcloud/occ``, and it must be run as
your HTTP user. To learn more about ``occ``, see
:doc:`../configuration_server/occ_command`.
These examples are for Ubuntu Linux:
1. ``sudo -u www-data php occ ldap:show-remnants`` displays a table with all
users that have been marked as deleted, and their LDAP data.
2. ``sudo -u www-data php occ user:delete [user]`` removes the user's data from the
Nextcloud data directory.
This example shows what the table of users marked as ``deleted`` looks like::
$ sudo -u www-data php occ ldap:show-remnants
+-----------------+-----------------+------------------+--------------------------------------+
| Nextcloud name | Display Name | LDAP UID | LDAP DN |
+-----------------+-----------------+------------------+--------------------------------------+
| aaliyah_brown | aaliyah brown | aaliyah_brown | uid=aaliyah_brown,ou=people,dc=com |
| aaliyah_hammes | aaliyah hammes | aaliyah_hammes | uid=aaliyah_hammes,ou=people,dc=com |
| aaliyah_johnston| aaliyah johnston| aaliyah_johnston | uid=aaliyah_johnston,ou=people,dc=com|
| aaliyah_kunze | aaliyah kunze | aaliyah_kunze | uid=aaliyah_kunze,ou=people,dc=com |
+-----------------+-----------------+------------------+--------------------------------------+
Following flags can be specified additionally:
* ``--short-date``: formats the dates for ``Last login`` and ``Detected on`` in a short Y-m-d format (e.g. 2019-01-14)
* ``--json``: instead of a table, the output is json-encoded. This makes it easy to process the data programmatically.
Then you can run ``sudo -u www-data php occ user:delete aaliyah_brown`` to delete
user aaliyah_brown. You must use the user's Nextcloud name.
Deleting local Nextcloud users
------------------------------
You may also use ``occ user:delete [user]`` to remove a local Nextcloud user;
this removes their user account and their data.
wedding-pics/core/doc/admin/_sources/configuration_user/user_configuration.rst.txt
+231
View File
@@ -0,0 +1,231 @@
===============
User management
===============
On the User management page of your Nextcloud Web UI you can:
* Create new users
* View all of your users in a single scrolling window
* Filter users by group
* See what groups they belong to
* Edit their full names and passwords
* See their data storage locations
* View and set quotas
* Create and edit their email addresses
* Send an automatic email notification to new users
* Disable and Enable users
* Delete them with a single click
The default view displays basic information about your users.
.. figure:: ../images/users-config.png
The Group filters on the left sidebar lets you quickly filter users by their
group memberships, and create new groups.
.. figure:: ../images/users-config-1.png
Click the gear icon on the lower left sidebar to set a default storage quota,
and to display additional fields: **Show storage location, Show last log in,
Show user backend, Send email to new users,** and **Show email address**.
.. figure:: ../images/users-config-2.png
User accounts have the following properties:
*Login Name (Username)*
The unique ID of a Nextcloud user, and it cannot be changed.
*Full Name*
The user's display name that appears on file shares, the Nextcloud Web
interface, and emails. Admins and users may change the Full Name anytime. If
the Full Name is not set it defaults to the login name.
*Password*
The admin sets the new user's first password. Both the user and the admin can
change the user's password at anytime.
*Groups*
You may create groups, and assign group memberships to users. By default new
users are not assigned to any groups.
*Group Admin*
Group admins are granted administrative privileges on specific groups, and
can add and remove users from their groups.
*Quota*
The maximum disk space assigned to each user. Any user that exceeds the quota
cannot upload or sync data. You have the the option to include external
storage in user quotas.
*Manager*
Every user can have one organizational manager. The manager property goes into
the system address book card of the user and is used for the Contacts app's
organization chart, for example. Setting a manager does **not** change any
authorization level of the user or their manager.
Creating a new user
-------------------
To create a user account:
* Enter the new user's **Login Name** and their initial **Password**
* Optionally, assign **Groups** memberships
* Click the **Create** button
.. figure:: ../images/users-create.png
Login names may contain letters (a-z, A-Z), numbers (0-9), dashes (-),
underscores (_), periods (.), spaces ( ) and at signs (@). After creating the user, you
may fill in their **Full Name** if it is different than the login name, or
leave it for the user to complete.
If you have checked **Send email to new user** in the control panel on the
lower left sidebar, you may also enter the new user's email address, and
Nextcloud will automatically send them a notification with their new login
information. You may edit this email using the email template editor on your
Admin page (see :doc:`../configuration_server/email_configuration`).
Set the **Send email to new user**-checkbox allows you to leave the **Password**
field empty. The user will get an activation-email to set their own password.
Reset a user's password
-----------------------
You cannot recover a user's password, but you can set a new one:
* Hover your cursor over the user's **Password** field
* Click on the **pencil icon**
* Enter the user's new password in the password field, and remember to provide
the user with their password
If you have encryption enabled, there are special considerations for user
password resets. Please see
:doc:`../configuration_files/encryption_configuration`.
Renaming a user
---------------
Each Nextcloud user has two names: a unique **Login Name** used for
authentication, and a **Full Name**, which is their display name. You can edit
the display name of a user, but you cannot change the login name of any user.
To set or change a user's display name:
* Hover your cursor over the user's **Full Name** field
* Click on the **Pencil icon**
* Enter the user's new display name
Granting administrator privileges to a user
-------------------------------------------
Nextcloud has two types of administrators: **Super Administrators** and **Group
Administrators**. Group administrators have the rights to create, edit and
delete users in their assigned groups. Group administrators cannot access
system settings, or add or modify users in the groups that they are not **Group
Administrators** for. Use the dropdown menus in the **Group Admin** column to
assign group admin privileges.
.. figure:: ../images/users-groups.png
**Super Administrators** have full rights on your Nextcloud server, and can
access and modify all settings. To assign the **Super Administrators** role to
a user, simply add them to the ``admin`` group.
Managing groups
---------------
You can assign new users to groups when you create them, and create new groups
when you create new users. You may also use the **Add Group** button at the top
of the left pane to create new groups. New group members will immediately
have access to file shares that belong to their new groups.
Setting Storage quotas
----------------------
Click the gear on the lower left pane to set a default storage quota. This is
automatically applied to new users. You may assign a different quota to any user
by selecting from the **Quota** dropdown, selecting either a preset value or
entering a custom value. When you create custom quotas, use the normal
abbreviations for your storage values such as 500 MB, 5 GB, 5 TB, and so on.
You now have a configurable option in ``config.php`` that controls whether
external storage is counted against user's quotas. This is still
experimental, and may not work as expected. The default is to not count
external storage as part of user storage quotas. If you prefer to include it,
then change the default ``false`` to ``true``.
::
'quota_include_external_storage' => false,
.. note:: If an external storage is defined as root, the quota will not
be calculable and will be **ignored**.
Metadata (such as thumbnails, temporary files, and encryption keys) takes up
about 10% of disk space, but is not counted against user quotas. Users can check
their used and available space on their Personal pages. Only files that
originate with users count against their quotas, and not files shared with them
that originate from other users. For example, if you upload files to a
different user's share, those files count against your quota. If you re-share a
file that another user shared with you, that file does not count against your
quota, but the originating user's.
Encrypted files are a little larger than unencrypted files; the unencrypted size
is calculated against the user's quota.
Deleted files that are still in the trash bin do not count against quotas. The
trash bin is set at 50% of quota. Deleted file aging is set at 30 days. When
deleted files exceed 50% of quota then the oldest files are removed until the
total is below 50%.
When version control is enabled, the older file versions are not counted
against quotas.
When a user creates a public share via URL, and allows uploads, any uploaded
files count against that user's quota.
Disable and enable users
------------------------
.. figure:: ../images/users-actions.png
Sometimes you may want to disable a user without permanently deleting their
settings and files. The user can be activated any time again, without data-loss.
Hover your cursor over their name on the **Users** page until the "..."-menu icon
appears at the far right. After clicking on it, you will see the **Disable** option.
The user will not longer be able to access their Nextcloud until you enable them again.
Also all external shares, via public link or email, will not be accessible.
Internal shares will still be working, so that other users on Nextcloud can continue working.
If you wish for internal shares to be disabled as well when a user is disabled,
activate the configuration option files_sharing:hide_disabled_user_shares::
occ config:app:set files_sharing hide_disabled_user_shares --value yes
You will find all disabled users in the **disabled**-section on the left pane.
Enabling users is as easy as disabling them. Just click on the "..."-menu, and
select **Enable**.
Deleting users
--------------
.. figure:: ../images/users-actions.png
Deleting a user is easy: hover your cursor over their name on the **Users** page
until the "..."-menu icon appears at the far right. After clicking on it, you will
see the **Delete** option. Clicking on it, deletes a user with all their data immediately.
You'll see an undo button at the top of the page, which remains for some seconds.
When the undo button is gone you cannot recover the deleted user.
All of the files owned by the user are deleted as well, including all files they
have shared. If you need to preserve the user's files and shares, you must first
download them from your Nextcloud Files page, which compresses them into a zip
file, or use a sync client to copy them to your local computer. See
:doc:`../configuration_files/file_sharing_configuration` to learn how to create
persistent file shares that survive user deletions.
wedding-pics/core/doc/admin/_sources/configuration_user/user_password_policy.rst.txt
+20
View File
@@ -0,0 +1,20 @@
====================
User password policy
====================
A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
In the security-section of your administrator-settings you can configure
* a minimal length of a password. Default is 10 characters.
* a password history
* a password expiration period
* a lockout policy
* to forbid common passwords like 'password' or 'login'.
* to enforce upper and lower case characters
* to enforce numeric characters
* to enforce special characters like ! or :
* to check the password against the list of breached passwords from haveibeenpwnd.com (hashed check via haveibeenpwnd.com-API)
.. figure:: ../images/user_password_policy_configuration_app.png
wedding-pics/core/doc/admin/_sources/configuration_user/user_provisioning_api.rst.txt
+25
View File
@@ -0,0 +1,25 @@
=====================
User provisioning API
=====================
The Provisioning API application enables a set of APIs that external systems can use to create,
edit, delete and query user attributes, query, set and remove groups, set quota
and query total storage used in Nextcloud. Group admin users can also query
Nextcloud and perform the same functions as an admin for groups they manage. The
API also enables an admin to query for active Nextcloud applications, application
info, and to enable or disable an app remotely. HTTP
requests can be used via a Basic Auth header to perform any of the functions
listed above. The Provisioning API app is enabled by default.
The base URL for all calls to the share API is ``https://cloud.example.com/ocs/v1.php/cloud``.
All calls to OCS endpoints require the ``OCS-APIRequest`` header to be set to ``true``.
All POST requests require the ``Content-Type: application/x-www-form-urlencoded`` header. (Note: Some libraries like cURL set this header automatically, others require setting the header explicitly.)
.. toctree::
:maxdepth: 1
instruction_set_for_users
instruction_set_for_groups
instruction_set_for_apps
wedding-pics/core/doc/admin/_sources/contents.rst.txt
+25
View File
@@ -0,0 +1,25 @@
=================
Table of contents
=================
.. toctree::
:maxdepth: 2
index
release_notes/index
release_schedule
installation/index
configuration_server/index
apps_management
configuration_user/index
configuration_files/index
file_workflows/index
groupware/index
office/index
reference/index
ai/index
configuration_database/index
configuration_mimetypes/index
maintenance/index
issues/index
gdpr/index
wedding-pics/core/doc/admin/_sources/file_workflows/access_control.rst.txt
+123
View File
@@ -0,0 +1,123 @@
====================
Files access control
====================
Nextcloud's File Access Control app enables administrators to create and
manage a set of rule groups. Each of the rule groups consists of one or more
rules. If all rules of a group hold true, the group matches the request and
access is being denied. The rules criteria range from IP address, to user
groups, collaborative tags and :ref:`some more <available-rules-label>`.
Denied access
-------------
If access to a file has been denied for a user, the user can not:
* Create/upload the file
* Modify the files
* Delete the file
* Download the file
* Synchronize the file with clients, such as the Nextcloud desktop and mobile clients
Examples
--------
After installing the File Access Control app as described in :doc:`../apps_management`
navigate to the configuration and locate the settings for the Flow application.
.. figure:: images/files_access_control_sample_rules.png
:alt: Sample rules to block on user group, time and IP base.
The first rule group ``Support only 9-5`` denies any access to files for users
of the Support user group, between 5pm and 9am.
The second rule group ``Internal testing`` prevents users of the Internal
testers group to access files from outside of the local network.
Denying access to folders
-------------------------
The easiest way to block access to a folder, is to use a collaborative tag. As
mentioned in the :ref:`Available rules <available-rules-label>` section below,
either the file itself or one of the parents needs to have the given tag
assigned.
So you just need to assign the tag to the folder or file, and then block the
tag with a rule group. The check is independent of the user's permissions for
the tag. Therefor restricted and invisible tags are recommended, otherwise a
user could remove and reassign the tag.
This example blocks access to any folder with the tag ``Confidential``.
.. figure:: images/files_access_control_collaborative_tags.png
:alt: Deny access based on collaborative tag
Prevent uploading of specific files
-----------------------------------
It's possible to prevent specific files from being uploaded to Nextcloud. You
simply need to define a rule based on the mimetype and our powerful access control
engine will block any attempt to upload the file. The safest way to define the rule
is to use a regular expression, as it will help you cover all the known media types
used for the type of file you're trying to block.
The following example prevents zip files from being uploaded by using the regular
expression: ``/^application\/(zip|x-zip-compressed)$/i``
.. figure:: images/files_access_control_block_mimetype.png
:alt: Prevent upload based on mimetype
Common misconfigurations
------------------------
Blocking user groups
^^^^^^^^^^^^^^^^^^^^
When trying to deny access to a group of users, make sure that sharing does not
allow them to create a way back in. When users are able to create a public link,
the users can log themselves out and visit their own public link to access the
files. Since at this point they are no user and therefor no member of the
blocked group, they will be able to read and change the file.
The recommended work around is to create the same rule again, and deny access
for all users that are ``not member of`` a group, that contains all users of
your installation.
External storage
^^^^^^^^^^^^^^^^
While access to files in external storages is not possible via Nextcloud, users
that have direct access to the external storage, can of course change files
there directly. Therefor it is recommended to disable the ``Allow users to mount
external storage`` option, when trying to to completely lock out users.
.. _available-rules-label:
Available rules
---------------
All rules can also be inverted (from ``is`` to ``is not``) using the operator
option.
* **File collaborative tag:** Either the file itself, or any of the file
owner's parent folders needs to be tagged with the tag.
.. note:: Tags used in access control rules should be restricted tags,
otherwise any user can remove the tag to access the file again.
The best way to do this is with the :doc:`automated_tagging`.
* **File MIME type:** The MIME type of the file, e.g. ``text/plain`` for a text file or ``httpd/unix-directory`` for a folder.
.. note:: see `mimetypealiases.dist.json <https://github.com/nextcloud/server/blob/master/resources/config/mimetypealiases.dist.json>`_ for a full list of possible MIME types.
* **File name:** The name of the file (``is`` and ``is not`` are case-insensitive)
* **File size:** The size of the file (*Only available on upload*)
* **Request remote address:** An IP range (either v4 or v6) for the accessing user
* **Request time:** Time span and timezone when the request happens
* **Request URL:** The URL which requests the file. (*This is the URL the file
is served from, not the URL the user is currently looking at.*)
* **Request user agent:** The user agent of the users browser or client.
Nextcloud desktop, Android and iOS clients are available as preconfigured
options.
* **User group membership:** Whether the user is a member of the given group.
wedding-pics/core/doc/admin/_sources/file_workflows/automated_tagging.rst.txt
+55
View File
@@ -0,0 +1,55 @@
==========================
Automated tagging of files
==========================
Nextcloud's Files Automated Tagging app allows to assign collaborative tags
to files and folders based on rules, similar to :doc:`access_control`.
Assigning restricted and invisible tags
---------------------------------------
The main functionality of this app is to allow users to indirectly assign
restricted and invisible tags to files they upload.
This is especially useful for retention and :doc:`access_control`, so people
that got the files shared can not remove the tag to stop the retention or
allow access against the owners will.
Example
-------
After installing the Files automated tagging app as described in :doc:`../apps_management`
navigate to the configuration and locate the Workflow settings.
.. figure:: images/automated_tagging_sample_rule.png
:alt: Example rule to assign a restricted tag.
In the example you can see a simple rule with only one condition.
It will tag all files with the restricted tag ``Protected file`` that are
uploaded into a folder that is tagged with ``Protect content``. No user can
remove the tag ``Protected file`` and therefor access control and retention
both work fine without users being able to work around them.
In this case folder will be also tagged with tag ``Protected file``, to avoid
this, simply modify the rule to exclude Directory ``httpd/unix-directory`` from it.
.. figure:: images/automated_tagging_sample_rule_exclude_folder.png
:alt: Example rule to assign a restricted tag except to Directory.
Available rules
---------------
The available rules can be seen in the access control section: :ref:`available-rules-label`.
.. note::
Please note that the rules do not apply when creating external storages and groupfolders.
The root folders of those need to be tagged manually with the desired initial tags.
Items created inside later on apply the rules as defined.
Executing actions
-----------------
It is possible to execute actions like ```convert to PDF``` based on assigned tags. Nextcloud
GmbH assists customers in this with hands-on help and documentation on our
`customer portal <https://portal.nextcloud.com>`_.
wedding-pics/core/doc/admin/_sources/file_workflows/configuration.rst.txt
+7
View File
@@ -0,0 +1,7 @@
==================
Flow configuration
==================
Administrators can disable user flows since they can have an impact on the performance of a system and you might not want to give users the ability to define their own flows rules. They can be disabled through the following command::
occ config:app:set workflowengine user_scope_disabled --value yes
wedding-pics/core/doc/admin/_sources/file_workflows/index.rst.txt
+12
View File
@@ -0,0 +1,12 @@
====
Flow
====
.. toctree::
:maxdepth: 2
configuration
access_control
automated_tagging
retention
wedding-pics/core/doc/admin/_sources/file_workflows/retention.rst.txt
+39
View File
@@ -0,0 +1,39 @@
==================
Retention of files
==================
Nextcloud's Files Retention app allows to automatically delete files that
are tagged with a collaborative tag and have a certain age.
Example
-------
After installing the Retention app as described in :doc:`../apps_management`
navigate to the configuration and locate the Workflow settings.
.. figure:: images/retention_sample.png
:alt: Sample rule to delete files after 14 days after creation.
The rule from the example will delete all files tagged with ``Temporary file`` 14 days after the creation.
You can also use the "Notify owner a day before a file is automatically deleted" option to
make sure the file owner will get a notification before a file will be deleted.
Common misconfigurations
------------------------
Public collaborative tag
^^^^^^^^^^^^^^^^^^^^^^^^
Similar to :doc:`access_control` retention should use ``restricted`` or ``invisible``
tags. Otherwise any user can remove the tag and the file is not removed after the given
period. Use :doc:`automated_tagging` to assign such tags to newly uploaded files.
File age
^^^^^^^^
Currently retention is based on the creation date of the file. The sync client sends
the **original** creation date to the server, while uploading through the web interface
will create a new file with a **new** creation date.
We hope to be able to add a ``upload date`` to the filesystem soon, which would make more
sense. Until then this potentially unexpected behavior has to be taken into account.
wedding-pics/core/doc/admin/_sources/gdpr/cookies.rst.txt
+32
View File
@@ -0,0 +1,32 @@
=======
Cookies
=======
.. sectionauthor:: Björn Schießle <bjoern@nextcloud.com>
.. _cookies:
Nextcloud only stores cookies needed for Nextcloud to work properly. All cookies comes from your Nextcloud server directly, no 3rd-party cookies will be sent to your system. Regarding GDPR, `only data which contain personal data are relevant`_.
.. _`only data which contain personal data are relevant`: https://gdpr-info.eu/recitals/no-26/
Cookies stored by Nextcloud
===========================
==================== ==================================== ================
Cookie Data Stored Lifetime
==================== ==================================== ================
Session cookie - session ID 24 minutes
- secret token (used to decrypt
the session on the server)
Same-site cookies no user-related data are stored, forever
all same-site cookies are the same
for all users on all Nextcloud
instances
Remember-me cookie - user id 15 days (can be
- original session id configured)
- remember token
==================== ==================================== ================
The same-site cookies are used to determine how a request reaches the Nextcloud server. We use them to prevent CSRF attacks. No identifiable information is stored in those.
The rest of the cookies are strictly used to identify the user to the system.
wedding-pics/core/doc/admin/_sources/gdpr/index.rst.txt
+8
View File
@@ -0,0 +1,8 @@
===============
GDPR-compliance
===============
.. toctree::
:maxdepth: 2
cookies
wedding-pics/core/doc/admin/_sources/groupware/calendar.rst.txt
+162
View File
@@ -0,0 +1,162 @@
=================
Calendar / CalDAV
=================
Events
------
You can customize the events user interface.
Hide export buttons
~~~~~~~~~~~~~~~~~~~
By default users can export their calendar data from the editor and the sidebar. Admins can disable this feature::
php occ config:app:set calendar hideEventExport --value=yes
Invitations
-----------
Nextcloud can send invitations for event attendees if this option is activated.
Be sure to have configured the email server first so that the invitations go through.
See :doc:`../configuration_server/email_configuration`.
You must also make sure the "Send invitations to attendees" setting is activated in the admin setting groupware section for the emails to be sent.
Birthday calendar
-----------------
Contacts that have a birthday date filled are automatically added as events to a special Birthday calendar.
If you deactivate this option, all users will no longer have this calendar.
When activating this option, users birthday calendars won't be available right away because they need to be generated
by a background task. See :doc:`../configuration_server/occ_command` section DAV commands.
Reminder notifications
----------------------
Nextcloud handles sending notifications for events.
Nextcloud currently handles two types of reminder notifications: Build-in Nextcloud notifications and
email notifications. For the emails to be send, you'll need a configured email server.
See :doc:`../configuration_server/email_configuration`.
Make sure the "Send notifications for events" and the "Enable notifications for events via push" are activated in the admin setting groupware section for this feature to work.
Background jobs
~~~~~~~~~~~~~~~
Running background jobs can be an expensive task when there are a large number of events, reminders, event sharees and attendees. However, this needs to happen
often enough so that the notifications are sent on time. To accomplish this you should use a dedicated ``occ`` command that runs
more often than the standard ``cron`` system::
# crontab -u www-data -e
*/5 * * * * php -f /var/www/nextcloud/occ dav:send-event-reminders
See :doc:`../configuration_server/occ_command` section Dav commands.
You'll also need to change the sending mode from ``background-job`` to ``occ``::
php occ config:app:set dav sendEventRemindersMode --value occ
If you don't use this dedicated command, the reminders will just be sent as soon as possible when the background jobs run.
Event alarm types
-----------------
Nextcloud allows users to set notification and email reminders for events. Admins can enforce one of the two options::
occ config:app:set calendar forceEventAlarmType --value=EMAIL
Allowed values are ``EMAIL`` (email) and ``DISPLAY`` (notification).
.. note:: This only enforces alarm types for events created with the Nextcloud Calendar. This setting has no influence for other connected applications.
FreeBusy
--------
When logged-in, Nextcloud can return FreeBusy information for all users of the instance, to know when they are available so that you can schedule an event at the right time.
If you don't wish for users to have this capability, you can disable FreeBusy for the whole instance with the following setting::
php occ config:app:set dav disableFreeBusy --value yes
Subscriptions
-------------
Custom public calendars
~~~~~~~~~~~~~~~~~~~~~~~
In addition to the public holiday calendars, it is possible to define your own calendar.
They act in the same way as the holiday calendars and can be configured with the following command::
php occ config:app:set calendar publicCalendars --value '[{"name":"My custom calendar","source":"http://example.com/example.ics"}]'
The setting is specified as a JSON array of objects with the following options:
* ``name`` - name of the calendar in the listing
* ``source`` - URL of the calendar's ICS file
* ``displayName`` - optional, to overwrite the name of the subscribed calendar
* ``description`` - optional, description in the listing
* ``authors`` - optional, copyrights and so on
Refresh rate
~~~~~~~~~~~~
Calendar subscriptions are cached on server and refreshed periodically.
The default refresh rate is one week, unless the subscription itself tells otherwise.
To set up a different default refresh rate, change the ``calendarSubscriptionRefreshRate`` option::
php occ config:app:set dav calendarSubscriptionRefreshRate --value "P1D"
Where the value is a `DateInterval <https://www.php.net/manual/dateinterval.construct.php>`_, for instance with the above command all of the Nextcloud instance's calendars would be refreshed every day.
Allow subscriptions on local network
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Because of security issues, Nextcloud forbids subscriptions from local network hosts.
If you need to allow this, change the following parameter to::
php occ config:app:set dav webcalAllowLocalAccess --value yes
Trash bin
---------
Nextcloud supports a calendar, events and tasks trash bin.
The default delay before objects are purged from the trash bin is 30 days. A background job runs every 6 hours to clean up expired objects.
To set up a different retention period, change the ``calendarRetentionObligation`` option::
php occ config:app:set dav calendarRetentionObligation --value=2592000
Where the value is the number of seconds for the period. Setting the value to ``0`` disables the trash bin.
Resources and rooms
-------------------
The Nextcloud CalDAV backend supports resources and rooms. Resources and rooms can be booked for appointments, and the system will schedule them so they can only be used once at a time. Those resources and rooms have to be provided by an app that provides a backend for this.
Once a backend app is installed, the app typically allows admins, or even users, to define the resources, but this is subject of the specific implementation.
Nextcloud periodically queries all registered backends, therefore new/updated resources and rooms will show with a delay.
Known backends
~~~~~~~~~~~~~~
* `Calendar Resource Management <https://github.com/nextcloud/calendar_resource_management>`_: database backend with CLI configuration for admins
Rate limits
-----------
Nextcloud rate limits the creation of calendars and subscriptions if too many items are created within a short time frame. The default is 10 calendars or subscriptions per hour. This can be customized as follows::
# Set limit to 15 items per 30 minutes
php occ config:app:set calendar rateLimitCalendarCreation --type=integer --value=15
php occ config:app:set calendar rateLimitPeriodCalendarCreation --type=integer --value=1800
Additionally, the maximum number of calendars and subscriptions a user may create is limited to 30 items. This can be customized too::
# Allow users to create 50 calendars/subscriptions
php occ config:app:set calendar maximumCalendarsSubscriptions --type=integer --value=50
or::
# Allow users to create calendars/subscriptions without restriction
php occ config:app:set calendar maximumCalendarsSubscriptions --type=integer --value=-1
wedding-pics/core/doc/admin/_sources/groupware/contacts.rst.txt
+44
View File
@@ -0,0 +1,44 @@
==================
Contacts / CardDAV
==================
Nextcloud ships a CardDAV backend for users to store and share their address books and contacts.
.. _system-address-book:
System Address Book
-------------------
.. versionchanged:: 27
The system address book is now accessible to all Nextcloud users
Nextcloud maintains a read-only address book containing contact information of all users of the instance.
Disabled users are removed from this address book.
You can disable access to the system address book by using the app config value ``system_addressbook_exposed``.
Run ``occ config:app:set dav system_addressbook_exposed --value="no"`` to disable access to the system address book for all users. Please note that this does not influence :ref:`Federated sharing<label-direct-share-link>`.
.. warning:: If clients have already connected to the CalDAV endpoint, the clients might experience sync issues after system address book access was disabled. This can often be remedied by chosing a different default address book on the client and forcing a resync.
Privacy and User Property Scopes
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Contact information in the system address book is taken from users' :ref:`profile information<profile>`. Profile properties are only written to the system contact if the :ref:`scope<profile-property-scopes>` is set to *Local* or higher.
Users who set all their property scopes to *Private* are removed from the system address book and therefore not seen by other users.
:ref:`File sharing settings<file-sharing-configuration>` controls the enumeration of other users.
* If username autocompletion is not allowed, the system address book will only show user's own system contact but no other contacts.
* If username autocompletion is allowed, users will see contact cards for all other users.
* If autocompletion is limited to users within the same groups, users will see contact cards for other users in shared groups.
* If autocompletion is limited to matching phone numbers, the system address book will only show user's own system contact but no other contacts.
* If autocompletion is limited to users within the same groups **and** matching phone numbers, users will see contact cards for other users in shared groups.
Address Book Sync
^^^^^^^^^^^^^^^^^
The address book is updated automatically with every added, modified, disabled or removed user. Admins can also trigger a full rewrite of the address book :ref:`with occ<occ-dav-sync-system-address-book>`.
wedding-pics/core/doc/admin/_sources/groupware/index.rst.txt
+12
View File
@@ -0,0 +1,12 @@
===============
Groupware
===============
.. toctree::
:maxdepth: 2
calendar
contacts
mail
out_of_office
wedding-pics/core/doc/admin/_sources/groupware/mail.rst.txt
+113
View File
@@ -0,0 +1,113 @@
====
Mail
====
Account delegation
------------------
The Mail app supports account delegation if the delegation is handled by the mail server. That means the mail server has to accept emails sent from an alias address.
In mailcow, for example, the setting is called *Also allowed to send as user*.
.. warning:: Unless paired with shared *Sent* mailboxes or handled otherwise by the mail server, sent messages will be stored in the sender's personal *Sent* mailbox.
Snooze and scheduled sending
----------------------------
.. note:: If AJAX is selected for cron job execution in the admin settings, the snooze feature and scheduled sending are deactivated because of unreliable execution.
XOAUTH2 Authentication with Microsoft Azure AD
----------------------------------------------
.. versionadded:: 3.0.0
The Mail app supports XOAUTH2 authentication with hosted Microsoft Outlook accounts. An app has to be registered in the Microsoft Azure web interface and its credentials have to be supplied to the Nextcloud instance. You can find relevant settings in the Groupware section of the admin settings.
Step 1: Open the Azure AD Dashboard
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Visit the `Azure portal <https://portal.azure.com>`_ and navigate to the Azure AD dashboard.
.. figure:: images/azure_xoauth2/1.png
Step 2: Create a new app registration
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.. figure:: images/azure_xoauth2/2.png
Chose a name, allow organizational and personal Microsoft accounts. Configure a web app and copy the redirect URI from the groupware settings of your Nextcloud instance. Have a look at step 8 on where to find the redirect URI. Finally, click on register to proceed.
.. figure:: images/azure_xoauth2/3.png
Step 3: Copy the client ID
~~~~~~~~~~~~~~~~~~~~~~~~~~
This ID will be needed later for the Nextcloud settings.
.. figure:: images/azure_xoauth2/4.png
Step 4: Create a new client secret
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.. figure:: images/azure_xoauth2/5.png
Chose a descriptive name for the secret and set the an appropriate expiration date. Click on add to create the secret.
.. figure:: images/azure_xoauth2/6.png
Step 5: Copy the client secret
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copy the client secret manually or by clicking on the copy button. You can find it in the value column. The secret will also be needed later for the Nextcloud settings.
.. figure:: images/azure_xoauth2/7.png
Step 6: Configure Nextcloud
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Open the groupware settings in the Nextcloud admin settings and fill in the client ID and client secret. Leave the tenant ID as is (common). You can also find the redirect URI here. Click on save to proceed.
.. warning:: Using a custom tenant ID is not covered by this guide. Only configure it if you are an expert and changed the supported account types in step 2.
.. figure:: images/azure_xoauth2/8.png
Step 7: Connect Microsoft Outlook accounts
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Congratulations! You are now able to use hosted Microsoft Outlook accounts in the Mail app. Use your Microsoft account email and any password when adding your account. The password will be discarded and you will be prompted with a Microsoft consent popup to log in to your account.
.. figure:: images/azure_xoauth2/9.png
.. figure:: images/azure_xoauth2/10.png
Mailbox Share
-------------
Users can share mailboxes with each other. So far, there is no UI for users to change the ACL in the Mail app, but if you want to use it, you need to enable it on the IMAP sever and configure the shares there.
Thread Summary
--------------
.. _mail_thread_summary:
The mail app supports summarizing message threads that contain 3 or more messages.
.. warning:: `A text generation AI integration <https://apps.nextcloud.com/apps/integration_openai>`_ should be already in place to enable this feature.
The feature is opt-in, it is disabled by default and can be enabled in mail adminstration settings.
Administration settings > Groupware > Mail app > Enable thread summary
Smart Replies
--------------
.. versionadded:: 3.6.0
The Mail app supports smart replies, based on processing emails with AI.
.. note:: `A text generation AI integration <https://apps.nextcloud.com/apps/integration_openai>`_ has to be available to enable this feature.
The feature is opt-in, it is disabled by default and can be enabled in Mail adminstration settings.
Administration settings > Groupware > Mail app > Enable smart replies
wedding-pics/core/doc/admin/_sources/groupware/out_of_office.rst.txt
+36
View File
@@ -0,0 +1,36 @@
=====================
Out-of-office feature
=====================
.. versionadded:: 28.0.0
The out-of-office feature allows users to schedule an out-of-office period including a status and
message that is integrated with other apps such as Nextcloud Mail. Please refer to the user
documentation for more information about the feature itself. It may be disabled globally by admins.
The feature relies on users to configure their preferred calendar time zones correctly. However, if
a user does not configure their time zone, the default time zone of the server is used. It can be
configured by setting ``default_timezone`` in the `config.php` file of your Nextcloud server. The
configuration value accepts IANA identifiers like ``Europe/Berlin`` and defaults to ``UTC``. Please
refer to the `Nextcloud configuration` section for more information about the value.
To disable the out-of-office feature for all users the ``hide_absence_settings`` app configuration
value of the `dav` app has to be set to `yes`. This can be achieved by running the following
command on your server:
::
occ config:app:set --value=yes dav hide_absence_settings
.. note::
Out-of-office periods that were scheduled before the feature was disabled will not be deleted.
Disabling it will only hide the feature from the user interface. If the feature is enabled
again, the periods will be visible again.
Set the value for `hide_absence_settings` to `no` or delete the configuration option entirely to enable the feature again. The following
command can be used to do so:
::
occ config:app:set --value=no dav hide_absence_settings
wedding-pics/core/doc/admin/_sources/index.rst.txt
+43
View File
@@ -0,0 +1,43 @@
============
Introduction
============
Welcome to the Nextcloud Server Administration Guide. This guide describes
administration tasks for Nextcloud, the flexible open source file synchronization
and sharing solution. Nextcloud includes the Nextcloud server, which runs on
Linux, client applications for Microsoft Windows, macOS and Linux, and mobile
clients for the Android and iOS operating systems.
Current editions of Nextcloud manuals are always available online at
`docs.nextcloud.com <https://docs.nextcloud.com/>`_.
Nextcloud server is available:
* As a free, full featured community-supported server, with all enterprise features.
* Or with full enterprise support, including phone and email access to Nextcloud developers.
Videos and blogs
----------------
See the `official Nextcloud channel
<https://www.youtube.com/c/Nextcloud>`_
on YouTube for tutorials, overviews, and conference videos.
Visit `our blog <https://nextcloud.com/news/>`_ for latest news and to learn more
about what is going on in and around Nextcloud.
Target audience
---------------
This guide is for users who want to install, administer, and
optimize their Nextcloud servers. To learn more about the Nextcloud Web
user interface, and desktop and mobile clients, please refer to their
respective manuals:
* `Nextcloud User Manual`_
* `Nextcloud Desktop Client`_
.. _`Nextcloud User Manual`: https://docs.nextcloud.com/server/latest/user_manual/en/
.. _`Nextcloud Desktop Client`: https://docs.nextcloud.com/desktop/latest/
.. TODO ON RELEASE: Update version number above on release
wedding-pics/core/doc/admin/_sources/installation/apps_supported.rst.txt
+93
View File
@@ -0,0 +1,93 @@
==============
Supported apps
==============
Below is the list of apps supported for Nextcloud |version|. Supported here means that we'll accept bugreports and resolve them in these apps with regard to functionality and compatibility with Nextcloud |version|. To get access to work-arounds, long term support, priority bug fixing and custom consulting, contact Nextcloud GmbH.
All apps are licensed under ``AGPLv3``.
Nextcloud Files
---------------
* `Activity <https://github.com/nextcloud/activity>`_
* `Auditing / Logging <https://github.com/nextcloud/server/tree/master/apps/admin_audit>`_
* `Antivirus for files <https://github.com/nextcloud/files_antivirus>`_
* `Brute-force settings <https://github.com/nextcloud/bruteforcesettings>`_
* `Circles <https://github.com/nextcloud/circles>`_
* `Collaborative Tags <https://github.com/nextcloud/server/tree/master/apps/systemtags>`_
* `Comments <https://github.com/nextcloud/server/tree/master/apps/comments>`_
* `Contacts Interaction <https://github.com/nextcloud/server/tree/master/apps/contactsinteraction>`_
* `Data Request <https://github.com/nextcloud/data_request>`_
* `Default encryption module <https://github.com/nextcloud/server/tree/master/apps/encryption>`_
* `Deleted files <https://github.com/nextcloud/server/tree/master/apps/files_trashbin>`_
* `External Sites <https://github.com/nextcloud/external>`_
* `External storage support <https://github.com/nextcloud/server/tree/master/apps/files_external>`_
* `Federated file sharing <https://github.com/nextcloud/server/tree/master/apps/federatedfilesharing>`_
* `Federation <https://github.com/nextcloud/server/tree/master/apps/federation>`_
* `File sharing <https://github.com/nextcloud/server/tree/master/apps/files_sharing>`_
* `Files access control <https://github.com/nextcloud/files_accesscontrol>`_
* `Files <https://github.com/nextcloud/server/tree/master/apps/files>`_
* `Files Automated Tagging <https://github.com/nextcloud/files_automatedtagging>`_
* `First run wizard <https://github.com/nextcloud/firstrunwizard>`_
* `Flow <https://github.com/nextcloud/server/tree/master/apps/workflowengine>`_
* `Full Text Search <https://github.com/nextcloud/fulltextsearch>`_
* `Full Text Search - Elasticsearch Platform <https://github.com/nextcloud/fulltextsearch_elasticsearch>`_
* `Full Text Search - Files <https://github.com/nextcloud/files_fulltextsearch>`_
* `Full Text Search - Tesseract OCR <https://github.com/daita/files_fulltextsearch_tesseract>`_
* `Group folders <https://github.com/nextcloud/groupfolders>`_
* `Guests <https://github.com/nextcloud/guests>`_
* `LDAP user and group backend <https://github.com/nextcloud/server/tree/master/apps/user_ldap>`_
* `Log Reader <https://github.com/nextcloud/logreader>`_
* `Monitoring <https://github.com/nextcloud/serverinfo>`_
* `Nextcloud announcements <https://github.com/nextcloud/nextcloud_announcements>`_
* `Notifications <https://github.com/nextcloud/notifications>`_
* `Password policy <https://github.com/nextcloud/password_policy>`_
* `PDF Viewer <https://github.com/nextcloud/files_pdfviewer>`_
* `Photos <https://github.com/nextcloud/photos>`_
* `Provisioning API <https://github.com/nextcloud/server/tree/master/apps/provisioning_api>`_
* `Recommendations <https://github.com/nextcloud/recommendations>`_
* `Related Resources <https://github.com/nextcloud/related_resources/>`_
* `Share by mail <https://github.com/nextcloud/server/tree/master/apps/sharebymail>`_
* `SharePoint Backend <https://github.com/nextcloud/sharepoint>`_
* `Suspicious Login <https://github.com/nextcloud/suspicious_login>`_
* `SSO & SAML authentication <https://github.com/nextcloud/user_saml>`_
* Social sharing via:
* `Diaspora <https://github.com/nextcloud/socialsharing/tree/master/socialsharing_diaspora>`_
* `Email <https://github.com/nextcloud/socialsharing/tree/master/socialsharing_email>`_
* `Facebook <https://github.com/nextcloud/socialsharing/tree/master/socialsharing_facebook>`_
* `Twitter <https://github.com/nextcloud/socialsharing/tree/master/socialsharing_twitter>`_
* `Terms of Service <https://github.com/nextcloud/terms_of_service/>`_
* `Text <https://github.com/nextcloud/text>`_
* `Theming <https://github.com/nextcloud/server/tree/master/apps/theming>`_
* `Two factor backup codes <https://github.com/nextcloud/server/tree/master/apps/twofactor_backupcodes>`_
* `Two factor TOTP Provider <https://github.com/nextcloud/twofactor_totp>`_
* `Two factor U2F <https://github.com/nextcloud/twofactor_u2f>`_
* `Update Notifications <https://github.com/nextcloud/server/tree/master/apps/updatenotification>`_
* `Versions <https://github.com/nextcloud/server/tree/master/apps/files_versions>`_
* `WebDAV endpoint <https://github.com/nextcloud/server/tree/master/apps/dav>`_
Nextcloud Groupware
-------------------
* `Calendar <https://github.com/nextcloud/calendar>`_
* `Contacts <https://github.com/nextcloud/contacts>`_
* `Deck <https://github.com/nextcloud/deck>`_
* `Mail <https://github.com/nextcloud/mail>`_
Nextcloud Talk
--------------
* `Talk <https://github.com/nextcloud/spreed>`_
Collaborative editing
---------------------
* `Collabora Online <https://github.com/nextcloud/richdocuments>`_
* `ONLYOFFICE <https://github.com/ONLYOFFICE/onlyoffice-nextcloud>`_
Global Scale
------------
* `Global Site Selector <https://github.com/nextcloud/globalsiteselector>`_
* `Lookup Server Connector <https://github.com/nextcloud/server/tree/master/apps/lookup_server_connector>`_
wedding-pics/core/doc/admin/_sources/installation/command_line_installation.rst.txt
+41
View File
@@ -0,0 +1,41 @@
============================
Installing from command line
============================
It is now possible to install Nextcloud entirely from the command line. This is
convenient for scripted operations, headless servers, and sysadmins who prefer
the command line. There are three stages to installing Nextcloud via the command
line:
1. Download the Nextcloud code and unpack the tarball in the appropriate directories. (See :doc:`source_installation`.)
2. Change the ownership of your ``nextcloud`` directory to your HTTP user, like
this example for Debian/Ubuntu. You must run ``occ`` as your HTTP user; see
:ref:`http_user_label`::
$ sudo chown -R www-data:www-data /var/www/nextcloud/
3. Use the ``occ`` command to complete your installation. This takes the place
of running the graphical Installation Wizard::
$ cd /var/www/nextcloud/
$ sudo -u www-data php occ maintenance:install \
--database='mysql' --database-name='nextcloud' \
--database-user='root' --database-pass='password' \
--admin-user='admin' --admin-pass='password'
Nextcloud is not installed - only a limited number of commands are available
Nextcloud was successfully installed
Note that you must change to the root Nextcloud directory, as in the example
above, to run ``occ maintenance:install``, or the installation will fail with
a PHP fatal error message.
Supported databases are::
- sqlite (SQLite3 - Nextcloud Community edition only)
- mysql (MySQL/MariaDB)
- pgsql (PostgreSQL)
- oci (Oracle 11g currently only possible if you contact us at https://nextcloud.com/enterprise as part of a subscription)
See :ref:`command_line_installation_label` for more information.
wedding-pics/core/doc/admin/_sources/installation/deployment_recommendations.rst.txt
+5
View File
@@ -0,0 +1,5 @@
==========================
Deployment recommendations
==========================
Find up-to-date deployment recommendations for enterprises in our `customer portal <https://portal.nextcloud.com/categories/Scalability/Deployment-recommendations>`_.
wedding-pics/core/doc/admin/_sources/installation/example_centos.rst.txt
+226
View File
@@ -0,0 +1,226 @@
.. _centos7_installation_label:
Example installation on CentOS 8
================================
In this install tutorial we will be deploying CentOS 8, PHP 7.4, MariaDB, Redis as memcache and Nextcloud running on Apache.
Start off by installing a CentOS 8 minimal install. This should provide a sufficient platform to run a successful Nextcloud instance.
First install some dependencies you will be needing during installation, but which will also be useful in every day use situations::
dnf install -y epel-release yum-utils unzip curl wget \
bash-completion policycoreutils-python-utils mlocate bzip2
Now make sure your system is up to date::
dnf update -y
Apache
------
::
dnf install -y httpd
Create a virtualhost in ``/etc/httpd/conf.d/nextcloud.conf`` and add the following content to it:
::
<VirtualHost *:80>
DocumentRoot /var/www/html/nextcloud/
ServerName your.server.com
<Directory /var/www/html/nextcloud/>
Require all granted
AllowOverride All
Options FollowSymLinks MultiViews
<IfModule mod_dav.c>
Dav off
</IfModule>
</Directory>
</VirtualHost>
See :ref:`apache_configuration_label` for further details.
Make sure the apache web service is enabled and started::
systemctl enable httpd.service
systemctl start httpd.service
PHP
---
.. note:: CentOS 8 doesn't come with packages for the redis and imagick php extensions.
Those can either be installed using pecl. Apart from the official PHP packages there are 3rdparty
repositories available at ``https://rpms.remirepo.net``. Using remirepo you can also install the
latest PHP version instead of the standard shipped one.
Setting up remirepo with PHP 8.2
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
More details can be found on ``https://blog.remirepo.net/pages/Config-en``
Command to install the Remi repository configuration package:
::
dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm
Command to install the yum-utils package (for the yum-config-manager command):
::
dnf install yum-utils
You want a single version which means replacing base packages from the distribution. Packages have the same name than the base repository, ie php-\*. Some common dependencies are available in remi-safe repository, which is enabled by default.
You have to enable the module stream for 8.2:
::
dnf module reset php
dnf module install php:remi-8.2
dnf update
Installing PHP and the required modules
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Next, install the PHP modules needed for this install. Remember, because this is a limited basic install, we only install the neccessary modules, not all of them. If you are making a more complete install, please refer to PHP module list in the source installation documentation, :doc:`../installation/source_installation`::
dnf install -y php php-cli php-gd php-mbstring php-intl php-pecl-apcu\
php-mysqlnd php-opcache php-json php-zip
Installing optional modules redis/imagick
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
::
dnf install -y php-redis php-imagick
Database
--------
As mentioned, we will be using MySQL/MariaDB as our database.::
dnf install -y mariadb mariadb-server
Make sure the database service is enabled to start at boot time.::
systemctl enable mariadb.service
systemctl start mariadb.service
Improve MariaDB security.::
mysql_secure_installation
After you have done this, make sure you create a database with a username and password so that
Nextcloud will have access to it. For further details on database setup and configuration,
see the :doc:`../configuration_database/linux_database_configuration` documentation.
Redis
-----
::
dnf install -y redis
systemctl enable redis.service
systemctl start redis.service
**Installing Nextcloud**
Nearly there, so keep at it, you are doing great!
Now download the archive of the latest Nextcloud version:
* Go to the `Nextcloud Download Page <https://nextcloud.com/install>`_.
* Go to **Download Nextcloud Server > Download > Archive file for
server owners** and download either the tar.bz2 or .zip archive.
* This downloads a file named nextcloud-x.y.z.tar.bz2 or nextcloud-x.y.z.zip
(where x.y.z is the version number).
* Download its corresponding checksum file, e.g. nextcloud-x.y.z.tar.bz2.md5,
or nextcloud-x.y.z.tar.bz2.sha256.
* Verify the MD5 or SHA256 sum::
md5sum -c nextcloud-x.y.z.tar.bz2.md5 < nextcloud-x.y.z.tar.bz2
sha256sum -c nextcloud-x.y.z.tar.bz2.sha256 < nextcloud-x.y.z.tar.bz2
md5sum -c nextcloud-x.y.z.zip.md5 < nextcloud-x.y.z.zip
sha256sum -c nextcloud-x.y.z.zip.sha256 < nextcloud-x.y.z.zip
* You may also verify the PGP signature::
wget https://download.nextcloud.com/server/releases/nextcloud-x.y.z.tar.bz2.asc
wget https://nextcloud.com/nextcloud.asc
gpg --import nextcloud.asc
gpg --verify nextcloud-x.y.z.tar.bz2.asc nextcloud-x.y.z.tar.bz2
For the sake of the walk-through, we grabbed the latest version of Nextcloud in the form a zip file, confirmed the download with the above-mentioned command, and now we will extract it::
unzip nextcloud-*.zip
Copy the content over to the root directory of your webserver. In our case, we are using apache so it will be ``/var/www/html/``::
cp -R nextcloud/ /var/www/html/
During the install process, no data folder is created, so we will create one manually to help with the installation wizard::
mkdir /var/www/html/nextcloud/data
Make sure that apache has read and write access to the whole nextcloud folder::
chown -R apache:apache /var/www/html/nextcloud
Restart apache::
systemctl restart httpd.service
Create a firewall rule for access to apache::
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload
**SELinux**
Again, there is an extensive write-up done on SELinux which can be found at :doc:`../installation/selinux_configuration`, so if you are using SELinux in Enforcing mode, please run the commands suggested on that page.
The following commands only refers to this tutorial::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.htaccess'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/3rdparty/aws/aws-sdk-php/src/data/logs(/.*)?'
restorecon -R '/var/www/html/nextcloud/'
setsebool -P httpd_can_network_connect on
If you need more SELinux configs, refer to the above-mentioned URL, return to this tutorial.
Once done with with SELinux, please head over to ``http://your.server.com/nextcloud`` and follow the steps as found :doc:`../installation/installation_wizard`, where it will explain to you exactly how to proceed with the final part of the install, which is done as admin user through your web browser.
.. note:: If you use this tutorial, and you see warnings in the web browser after installation about ``OPcache`` not being enabled or configured correctly, you need to make the suggested changes in ``/etc/opt/rh/rh-php74/php.d/10-opcache.ini`` for the errors to disappear. These warnings will be on the Admin page, under Basic settings.
Because we used ``Redis`` as a memcache, you will need a config similar to the following example in ``/var/www/html/nextcloud/config/config.php`` which is auto-generated when you run the online installation wizard mentioned earlier.
Example config::
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'memcache.local' => '\OC\Memcache\APCu',
'redis' => array(
'host' => 'localhost',
'port' => 6379,
),
Remember, this tutorial is only for a basic setup of Nextcloud on CentOS 8, with PHP 7.4. If you are going to use more features like LDAP or Single Sign On, you will need additional PHP modules as well as extra configurations. So please visit the rest of the Admin manual, :doc:`../index`, for detailed descriptions on how to get this done.
wedding-pics/core/doc/admin/_sources/installation/example_openbsd.rst.txt
+236
View File
@@ -0,0 +1,236 @@
.. _openbsd_installation_label:
Example installation on OpenBSD
===============================
.. warning::
Nextcloud does not have official OpenBSD or other BSDs support
In this install tutorial we will be deploying Nextcloud on a minimal OpenBSD with our own httpd(8), PHP, PostgreSQL and redis (for -stable or -current are the same steps).
From a base installed OpenBSD system you can just do::
# pkg_add nextcloud
The extra packages::
# pkg_add postgresql-server redis pecl74-redis php-pdo_pgsql
This will take care of your dependencies and give you the options to choose which PHP version do you want.
HTTPD(8)
--------
Create a virtualhost in ``/etc/httpd.conf`` and add the following content to it::
server "domain.tld" {
listen on egress tls port 443
hsts max-age 15768000
tls {
certificate "/etc/ssl/domain.tld_fullchain.pem"
key "/etc/ssl/private/domain.tld_private.pem"
}
# Set max upload size to 513M (in bytes)
connection max request body 537919488
connection max requests 1000
connection request timeout 3600
connection timeout 3600
block drop
# Ensure that no '*.php*' files can be fetched from these directories
location "/nextcloud/config/*" {
block drop
}
location "/nextcloud/data/*" {
block drop
}
# Note that this matches "*.php*" anywhere in the request path.
location "/nextcloud/*.php*" {
root "/nextcloud"
request strip 1
fastcgi socket "/run/php-fpm.sock"
pass
}
location "/nextcloud/apps/*" {
root "/nextcloud"
request strip 1
pass
}
location "/nextcloud/core/*" {
root "/nextcloud"
request strip 1
pass
}
location "/nextcloud" {
block return 301 "$DOCUMENT_URI/index.php"
}
location "/nextcloud/" {
block return 301 "$DOCUMENT_URI/index.php"
}
location "/.well-known/carddav" {
block return 301 "https://$SERVER_NAME/nextcloud/remote.php/dav"
}
location "/.well-known/caldav" {
block return 301 "https://$SERVER_NAME/nextcloud/remote.php/dav"
}
location "/.well-known/webfinger" {
block return 301 "https://$SERVER_NAME/nextcloud/public.php?service=webfinger"
}
location match "/nextcloud/ocs-provider/*" {
directory index index.php
pass
}
}
Make sure that httpd(8) is enabled and started::
# rcctl enable httpd
# rcctl start httpd
PHP
---
Assuming that you are on OpenBSD -current (or >= 6.8-stable) you could use PHP 7.4 so I will keep this version, but the concept is the same for other version.
The PHP packages will be available since you installed Nextcloud with pkg_add, so you just need to adjust a bit your php.ini.
It is recommended to add opcache to it::
[opcache]
opcache.enable=1
opcache.enable_cli=1
opcache.memory_consumption=512
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.revalidate_freq=1
opcache.save_comments=1
And increase some limits::
post_max_size = 513M
upload_max_filesize = 513M
We can enable the PHP modules with::
# cd /etc/php-7.4.sample
# for i in *; do ln -sf ../php-7.4.sample/$i ../php-7.4/; done
And then we just enable and start PHP::
# rcctl enable php74_fpm
# rcctl start php74_fpm
Database
--------
As mentioned, we will be using PostgreSQL as our database, and we already installed it, now we need to initialised::
$ su - _postgresql
$ mkdir /var/postgresql/data
$ initdb -D /var/postgresql/data -U postgres -A md5 -E UTF8 -W
...
Enter new superuser password: PASSWORD
Enter it again: PASSWORD
...
Success. You can now start the database server using:
pg_ctl -D /var/postgresql/data -l logfile start
$ pg_ctl -D /var/postgresql/data -l logfile start
server starting
$ exit
We need to check, enable and start postgres::
# rcctl check postgresql
# rcctl enable postgresql
# rcctl start postgresql
You can follow the README on ``/usr/local/share/doc/pkg-readmes/postgresql-server`` to create users and permission.
Redis
-----
We installed redis before, we need to enable it and start it and also add it to the Nextcloud conf::
# rcctl enable redis
# rcctl start redis
# mg /var/www/nextcloud/config/config.php
...
'memcache.local' => '\OC\Memcache\Redis',
'redis' => array(
'host' => 'localhost',
'port' => 6379,
'timeout' => 0.0,
),
...
Cron job
--------
We need to add the Nextcloud cron job to get some tasks done by adding this entry on your cronjob::
*/5 * * * * /usr/bin/ftp -Vo - https://domain.tld/cron.php >/dev/null
Chroot
------
Since in OpenBSD httpd(8) works with a chroot(8) by default, we need to be sure that we have the relevant files into the /var/www jail::
# mkdir -p /var/www/etc/ssl
# install -m 444 -o root -g bin /etc/ssl/cert.pem /etc/ssl/openssl.cnf \
/var/www/etc/ssl/
# cp /etc/resolv.conf /var/www/etc
Nextcloud final steps
---------------------
Now that we have all in place, you should go to your browser with your URL (I am asuming you have an SSL already installed)::
https://domain.tld
Now you just need to follow the steps and put in place your DB name, usr and passwords.
Keep in mind that the upgrades for Nextcloud you can do it by running on -current::
# pkg_add -u -Dsnap
And on -stable::
# pkg_add -u
Then you just follow the steps from your browser.
NOTE
----
Remember always to read all the READMES from the OpenBSD packages on::
/usr/local/share/doc/pkg-readmes/
All this information and more is available for you there.
wedding-pics/core/doc/admin/_sources/installation/example_ubuntu.rst.txt
+94
View File
@@ -0,0 +1,94 @@
.. _ubuntu_installation_label:
========================================
Example installation on Ubuntu 22.04 LTS
========================================
You can use .deb packages to install the required and recommended modules for a
typical Nextcloud installation, using Apache and MariaDB, by issuing the
following commands in a terminal::
sudo apt update && sudo apt upgrade
sudo apt install apache2 mariadb-server libapache2-mod-php php-gd php-mysql \
php-curl php-mbstring php-intl php-gmp php-bcmath php-xml php-imagick php-zip
* This installs the packages for the Nextcloud core system.
If you are planning on running additional apps, keep in mind that they might
require additional packages. See `Prerequisites for manual installation <https://docs.nextcloud.com/server/latest/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation>`_ for details.
.. TODO ON RELEASE: Update version number above on release
Now you need to create a database user and the database itself by using the
MySQL command line interface. The database tables will be created by Nextcloud
when you login for the first time.
To start the MySQL command line mode use the following command::
sudo mysql
Then a **MariaDB [root]>** prompt will appear. Now enter the following lines,
replacing ``username`` and ``password`` with appropriate values, and confirm
them with the Enter key:
::
CREATE USER 'username'@'localhost' IDENTIFIED BY 'password';
CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
GRANT ALL PRIVILEGES ON nextcloud.* TO 'username'@'localhost';
FLUSH PRIVILEGES;
You can quit the prompt by entering::
quit;
Now download the archive of the latest Nextcloud version:
* Go to the `Nextcloud Download Page <https://nextcloud.com/install>`_.
* Go to **Download Nextcloud Server > Download > Archive file for
server owners** and download either the tar.bz2 or .zip archive.
* This downloads a file named nextcloud-x.y.z.tar.bz2 or nextcloud-x.y.z.zip
(where x.y.z is the version number).
* Download its corresponding checksum file, e.g. nextcloud-x.y.z.tar.bz2.md5,
or nextcloud-x.y.z.tar.bz2.sha256.
* Verify the MD5 or SHA256 sum::
md5sum -c nextcloud-x.y.z.tar.bz2.md5 < nextcloud-x.y.z.tar.bz2
sha256sum -c nextcloud-x.y.z.tar.bz2.sha256 < nextcloud-x.y.z.tar.bz2
md5sum -c nextcloud-x.y.z.zip.md5 < nextcloud-x.y.z.zip
sha256sum -c nextcloud-x.y.z.zip.sha256 < nextcloud-x.y.z.zip
* You may also verify the PGP signature::
wget https://download.nextcloud.com/server/releases/nextcloud-x.y.z.tar.bz2.asc
wget https://nextcloud.com/nextcloud.asc
gpg --import nextcloud.asc
gpg --verify nextcloud-x.y.z.tar.bz2.asc nextcloud-x.y.z.tar.bz2
* Now you can extract the archive contents. Run the appropriate unpacking
command for your archive type::
tar -xjvf nextcloud-x.y.z.tar.bz2
unzip nextcloud-x.y.z.zip
* This unpacks to a single ``nextcloud`` directory. Copy the Nextcloud directory
to its final destination. When you are running the Apache HTTP server you may
safely install Nextcloud in your Apache document root::
sudo cp -r nextcloud /var/www
* Finally, change the ownership of your Nextcloud directories to your HTTP
user::
sudo chown -R www-data:www-data /var/www/nextcloud
On other HTTP servers it is recommended to install Nextcloud outside of the
document root.
Next steps
----------
After installing the prerequisites and extracting the nextcloud directory, you
should follow the instructions for Apache configuration at
:ref:`apache_configuration_label`. Once Apache is installed, you can optionally
follow the :doc:`source_installation` guide from :ref:`pretty_urls_label` until
:ref:`other_HTTP_servers_label`
wedding-pics/core/doc/admin/_sources/installation/harden_server.rst.txt
+313
View File
@@ -0,0 +1,313 @@
===============================
Hardening and security guidance
===============================
Nextcloud aims to ship with secure defaults that do not need to get modified by
administrators. However, in some cases some additional security hardening can be
applied in scenarios were the administrator has complete control over
the Nextcloud instance. This page assumes that you run Nextcloud Server on Apache2
in a Linux environment.
.. note:: Nextcloud will warn you in the administration interface if some
critical security-relevant options are missing. However, it is still up to
the server administrator to review and maintain system security.
Passwords
---------
Storage of access tokens
^^^^^^^^^^^^^^^^^^^^^^^^
Upon successful authentication, Nextcloud issues an access token that clients will use for all future HTTP requests. This access token uniquely identifies a user and should not be stored on any system other than the client requesting it. The user password is also stored encrypted in the Nextcloud database. For encryption of the password, the token and an instance-specific secret is used.
Leakage of the access token can have negative security consequences. Depending on the data access by the actor, the risk here is different:
- An actor with access to only the access token can impersonate users and login as them.
- An actor with access to the access token, the Nextcloud config file, and the Nextcloud database can decrypt user passwords stored in the database.
Limit on password length
^^^^^^^^^^^^^^^^^^^^^^^^
Nextcloud uses the bcrypt algorithm, and thus for security and performance
reasons, e.g. Denial of Service as CPU demand increases exponentially, it only
verifies the first 72 characters of passwords. This applies to all passwords
that you use in Nextcloud: user passwords, passwords on link shares, and
passwords on external shares.
Operating system
----------------
.. _dev-urandom-label:
Give PHP read access to ``/dev/urandom``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Nextcloud uses a `RFC 4086 ("Randomness Requirements for Security")`_ compliant
mixer to generate cryptographically secure pseudo-random numbers. This means
that when generating a random number Nextcloud will request multiple random
numbers from different sources and derive from these the final random number.
The random number generation also tries to request random numbers from
``/dev/urandom``, thus it is highly recommended to configure your setup in such
a way that PHP is able to read random data from it.
.. note:: When having an ``open_basedir`` configured within your ``php.ini`` file,
make sure to include ``/dev/urandom``.
Enable hardening modules such as SELinux
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is highly recommended to enable hardening modules such as SELinux where
possible. See :doc:`../installation/selinux_configuration` to learn more about
SELinux.
Deployment
----------
Place data directory outside of the web root
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is highly recommended to place your data directory outside of the Web root
(i.e. outside of ``/var/www``). It is easiest to do this on a new
installation.
.. Doc on moving data dir coming soon
.. You may also move your data directory on an existing
.. installation; see :doc:``
Disable preview image generation
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Nextcloud is able to generate preview images of common filetypes such as images
or text files. By default the preview generation for some file types that we
consider secure enough for deployment is enabled. However,
administrators should be aware that these previews are generated using PHP
libraries written in C which might be vulnerable to attack vectors.
For high security deployments we recommend disabling the preview generation by
setting the ``enable_previews`` switch to ``false`` in ``config.php``. As an
administrator you are also able to manage which preview providers are enabled by
modifying the ``enabledPreviewProviders`` option switch.
Disable Debug Mode
^^^^^^^^^^^^^^^^^^
Verify that ``debug`` is ``false`` in your ``config.php``. The default is ``false``
in new installations (or when not specified). It should not be enabled in production
environments or outside of targeted troubleshooting situations. When enabled, things
like server-wide WebDAV collection listings are permitted. It is intended for local
development and usage in controlled environments only.
.. _use_https_label:
Use HTTPS
---------
Using Nextcloud without using an encrypted HTTPS connection opens up your server
to a man-in-the-middle (MITM) attack, and risks the interception of user data
and passwords. It is a best practice, and highly recommended, to always use
HTTPS on production servers, and to never allow unencrypted HTTP.
How to setup HTTPS on your Web server depends on your setup; please consult the
documentation for your HTTP server. The following examples are for Apache.
Redirect all unencrypted traffic to HTTPS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To redirect all HTTP traffic to HTTPS administrators are encouraged to issue a
permanent redirect using the 301 status code. When using Apache this can be
achieved by a setting such as the following in the Apache VirtualHosts
configuration::
<VirtualHost *:80>
ServerName cloud.nextcloud.com
Redirect permanent / https://cloud.nextcloud.com/
</VirtualHost>
.. _enable-hsts-label:
Enable HTTP Strict Transport Security
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
While redirecting all traffic to HTTPS is good, it may not completely prevent
man-in-the-middle attacks. Thus administrators are encouraged to set the HTTP
Strict Transport Security header, which instructs browsers to not allow any
connection to the Nextcloud instance using HTTP, and it attempts to prevent site
visitors from bypassing invalid certificate warnings.
This can be achieved by setting the following settings within the Apache
VirtualHost file::
<VirtualHost *:443>
ServerName cloud.nextcloud.com
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
</IfModule>
</VirtualHost>
.. warning::
We recommend the additional setting ``; preload`` to be added to that header.
Then the domain will be added to a hardcoded list that is shipped with all
major browsers and enforce HTTPS upon those domains. See the `HSTS preload
website for more information <https://hstspreload.org/>`_. Due to the policy
of this list you need to add it to the above example for yourself once you
are sure that this is what you want. `Removing the domain from this list
<https://hstspreload.org/#removal>`_ could take some months until it reaches
all installed browsers.
This example configuration will make all subdomains only accessible via HTTPS.
If you have subdomains not accessible via HTTPS, remove ``includeSubDomains``.
This requires the ``mod_headers`` extension in Apache.
Proper SSL configuration
^^^^^^^^^^^^^^^^^^^^^^^^
Default SSL configurations by Web servers are often not state-of-the-art, and
require fine-tuning for an optimal performance and security experience. The
available SSL ciphers and options depend completely on your environment and
thus giving a generic recommendation is not really possible.
We recommend using the `Mozilla SSL Configuration Generator`_ to generate a
suitable configuration suited for your environment. To verify your
configuration you can use the free `Web TLS Profiler`_ service.
This service gives detailed error messages, if your server's TLS settings deviate
from the Mozilla Configuration. Another useful tool to check your server's
TLS configuration is the free `Qualys SSL Labs Test`_ which provides general
information about the TLS settings.
Also ensure that HTTP compression is disabled to mitigate the BREACH attack.
Use a dedicated domain for Nextcloud
------------------------------------
Administrators are encouraged to install Nextcloud on a dedicated domain such as
cloud.domain.tld instead of domain.tld to gain all the benefits offered by the
Same-Origin-Policy.
Ensure that your Nextcloud instance is installed in a DMZ
---------------------------------------------------------
As Nextcloud supports features such as Federated File Sharing we do not consider
Server Side Request Forgery (SSRF) part of our threat model. In fact, given all our
external storage adapters this can be considered a feature and not a vulnerability.
This means that a user on your Nextcloud instance could probe whether other hosts
are accessible from the Nextcloud network. If you do not want this you need to
ensure that your Nextcloud is properly installed in a segregated network and proper
firewall rules are in place.
Serve security related headers by the Web server
------------------------------------------------
Basic security headers are served by Nextcloud already in a default environment.
These include:
- ``X-Content-Type-Options: nosniff``
- Instructs some browsers to not sniff the mimetype of files. This is used for example to prevent browsers from interpreting text files as JavaScript.
- ``X-XSS-Protection: 1; mode=block``
- Instructs browsers to enable their browser side Cross-Site-Scripting filter.
- ``X-Robots-Tag: noindex, nofollow``
- Instructs search machines to not index these pages and not follow any links there.
- ``X-Frame-Options: SAMEORIGIN``
- Prevents embedding of the Nextcloud instance within an iframe from other domains to prevent Clickjacking and other similar attacks.
- ``Referrer-Policy: no-referrer``
- The default `no-referrer` policy instructs the browser not to send referrer information along with requests to any origin.
These headers are hard-coded into the Nextcloud server, and need no intervention
by the server administrator.
For optimal security, administrators are encouraged to serve these basic HTTP
headers by the Web server to enforce them on response. To do this Apache has to
be configured to use the ``.htaccess`` file and the following Apache
modules need to be enabled:
- mod_headers
- mod_env
Administrators can verify whether this security change is active by accessing a
static resource served by the Web server and verify that the above mentioned
security headers are shipped.
.. _Mozilla SSL Configuration Generator: https://mozilla.github.io/server-side-tls/ssl-config-generator/
.. _Qualys SSL Labs Test: https://www.ssllabs.com/ssltest/
.. _Web TLS Profiler: https://tlsprofiler.danielfett.de/
.. _RFC 4086 ("Randomness Requirements for Security"): https://tools.ietf.org/html/rfc4086#section-5.2
Connections to remote servers
-----------------------------
Some Nextcloud functionalites require connecting to remote servers. Depending on
your server setup, these are the possible connections:
- www.nextcloud.com, www.startpage.com, www.eff.org, www.edri.org for checking the internet connection
- cloud.nextcloud.com (https) for validating the enterprise subscription
- updates.nextcloud.com (https) for Nextcloud server updates
- push-notifications.nextcloud.com (https) for sending push notifications to mobile clients
- pushfeed.nextcloud.com (https) for the Nextcloud announcements app
- lookup.nextcloud.com (https) for updating and lookups to the federated sharing addressbook
- surveyserver.nextcloud.com (https) if the admin has agreed to share anonymized data
- apps.nextcloud.com (https) for available apps and their updates
- github.com (https) for downloading Nextcloud standard apps
- Any remote Nextcloud server that is connected with federated sharing
Setup fail2ban
--------------
Exposing your server to the internet will inevitably lead to the exposure of the
services running on the internet-exposed ports to brute force login attempts.
Fail2ban is a service that uses iptables to automatically drop connections for a
pre-defined amount of time from IPs that continuously failed to authenticate to
the configured services.
In order to setup fail2ban, you first need to download and install it on your
server. Downloads for several distributions can be found on `fail2ban download
page`_. It is often available from most distributions' package managers (e.g.
``apt-get``).
The standard path for fail2ban's configuration is ``/etc/fail2ban``.
Setup a filter and a jail for Nextcloud
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
A filter defines regex rules to identify when users fail to authenticate on
Nextcloud's user interface, WebDAV, or use an untrusted domain to access the
server.
Create a file in ``/etc/fail2ban/filter.d`` named ``nextcloud.conf`` with the
following contents::
[Definition]
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
The jail file defines how to handle the failed authentication attempts found by
the Nextcloud filter.
Create a file in ``/etc/fail2ban/jail.d`` named ``nextcloud.local`` with the
following contents::
[nextcloud]
backend = auto
enabled = true
port = 80,443
protocol = tcp
filter = nextcloud
maxretry = 3
bantime = 86400
findtime = 43200
logpath = /path/to/data/directory/nextcloud.log
Ensure to replace ``logpath`` with your installation's ``nextcloud.log``
location. If you are using ports other than ``80`` and ``443`` for your
Web server you should replace those too. The ``bantime`` and ``findtime`` are
defined in seconds.
Restart the fail2ban service. You can check the status of your Nextcloud jail by
running::
fail2ban-client status nextcloud
.. _fail2ban download page: https://www.fail2ban.org/wiki/index.php/Downloads
wedding-pics/core/doc/admin/_sources/installation/index.rst.txt
+22
View File
@@ -0,0 +1,22 @@
=====================================
Installation and server configuration
=====================================
.. toctree::
:maxdepth: 2
system_requirements
deployment_recommendations
php_configuration
source_installation
installation_wizard
command_line_installation
apps_supported
selinux_configuration
nginx
harden_server
server_tuning
example_ubuntu
example_centos
example_openbsd
wedding-pics/core/doc/admin/_sources/installation/installation_wizard.rst.txt
+118
View File
@@ -0,0 +1,118 @@
===================
Installation wizard
===================
Quick start
-----------
When Nextcloud prerequisites are fulfilled and all Nextcloud files are installed,
the last step to completing the installation is running the Installation
Wizard.
This is just three steps:
#. Point your Web browser to ``http://localhost/nextcloud``
#. Enter your desired administrator's username and password.
#. Click **Finish Setup**.
.. figure:: images/install-wizard-a.png
:scale: 75%
:alt: screenshot of the installation wizard
You're finished and can start using your new Nextcloud server.
Of course, there is much more that you can do to set up your Nextcloud server for
best performance and security. In the following sections we will cover important
installation and post-installation steps.
* :ref:`Data Directory Location <data_directory_location_label>`
* :ref:`Database Choice <database_choice_label>`
* :ref:`Trusted Domains <trusted_domains_label>`
.. _data_directory_location_label:
Data directory location
-----------------------
Click **Storage and Database** to expose additional installation configuration
options for your Nextcloud data directory and database.
.. figure:: images/install-wizard-a1.png
:scale: 75%
:alt: installation wizard with all options exposed
You should locate your Nextcloud data directory outside of your Web root if you
are using an HTTP server other than Apache, or you may wish to store your
Nextcloud data in a different location for other reasons (e.g. on a storage
server). It is best to configure your data directory location at installation,
as it is difficult to move after installation. You may put it anywhere; in this
example is it located in ``/opt/nextcloud/``. This directory must already exist,
and must be owned by your HTTP user.
.. _database_choice_label:
Database choice
---------------
SQLite is the default database for Nextcloud Server and it is good only for
testing and lightweight single-user setups without client synchronization.
Supported databases are MySQL, MariaDB, Oracle 11g, and PostgreSQL, and we
recommend :doc:`MySQL/MariaDB <system_requirements>`. Your database and PHP
connectors must be installed before you run the Installation Wizard. When
you install Nextcloud from packages all the necessary dependencies will be
satisfied (see :doc:`source_installation` for a detailed listing of required
and optional PHP modules). You will need the root database login, or any
administrator login , and then enter any name you want for your Nextcloud database.
Be careful your administrator login needs to have the permissions to create
and modify databases and they needs to have the permissions to grant permissions
to other users.
After you enter your root or administrator login for your database, the
installer creates a special database user with privileges limited to the
Nextcloud database. Then Nextcloud needs only the special Nextcloud database
user, and drops the root dB login. This user is named for your Nextcloud admin
user, with an ``oc_`` prefix, and then given a random password. The Nextcloud
database user and password are written into ``config.php``::
'dbuser' => 'oc_molly',
'dbpassword' => 'pX65Ty5DrHQkYPE5HRsDvyFHlZZHcm',
Click Finish Setup, and start using your new Nextcloud server.
.. figure:: images/install-wizard-a2.png
:scale: 75%
:alt: Nextcloud welcome screen after a successful installation
Now we will look at some important post-installation steps.
.. _trusted_domains_label:
Trusted domains
---------------
All URLs used to access your Nextcloud server must be whitelisted in your
``config.php`` file, under the ``trusted_domains`` setting. Users
are allowed to log into Nextcloud only when they point their browsers to a
URL that is listed in the ``trusted_domains`` setting. This is not a
list of allowed client-side domains or IP addresses.
You may use IP addresses and domain names.
A typical configuration looks like this::
'trusted_domains' =>
array (
0 => 'localhost',
1 => 'server1.example.com',
2 => '192.168.1.50',
3 => '[fe80::1:50]',
),
Note:
The loopback address, ``127.0.0.1``, is automatically whitelisted, so as long
as you have access to the physical server you can always log in. In the event
that a load balancer is in place there will be no issues as long as it sends
the correct X-Forwarded-Host header. When a user tries a URL that
is not whitelisted the following error appears:
.. figure:: images/install-wizard-a4.png
:scale: 75%
:alt: Error message when URL is not whitelisted
wedding-pics/core/doc/admin/_sources/installation/nginx.rst.txt
+159
View File
@@ -0,0 +1,159 @@
.. _nginx-config:
===================
NGINX configuration
===================
.. warning::
Please note that webservers other than Apache 2.x are not officially supported.
.. note::
This page covers example NGINX configurations to run a Nextcloud server.
These configurations examples were originally provided by `@josh4trunks <https://github.com/josh4trunks>`_
and are exclusively community-maintained. (Thank you contributors!)
- You need to insert the following code into **your Nginx configuration file**. Choose the appropriate example based on whether you are deploying :ref:`nginx_webroot_example` (i.e. :code:`https://cloud.example.com/`) or :ref:`nginx_subdir_example` (i.e. :code:`https://cloud.example.com/nextcloud`).
- Adjust the server directive under :code:`upstream php-handler` to match your PHP installation's configured FPM listener (a misconfiguration here will result in a :code:`502 Bad Gateway` - see :ref:`nginx_php_handler_tips` for details)
- Adjust the existing :code:`server_name` directives found under *both* :code:`server` sections to your real hostname
- Adjust :code:`root` to the webroot of your Nextcloud installation
- Adjust the :code:`ssl_certificate` and :code:`ssl_certificate_key` directives to the real paths for your signed
certificate and private key. Make sure your SSL certificates are readable by the nginx server process (see `nginx HTTPS SSL
Module documentation <https://wiki.nginx.org/HttpSslModule>`_).
- Be careful about line breaks if you copy the examples, as long lines may be
broken for page display and result in an invalid configuration files.
- Some environments might need a ``cgi.fix_pathinfo`` set to ``1`` in their
``php.ini``.
.. _nginx_webroot_example:
Nextcloud in the webroot of NGINX
---------------------------------
The following configuration should be used when Nextcloud is placed in the
webroot of your nginx installation. In this example it is
``/var/www/nextcloud`` and it is accessed via ``http(s)://cloud.example.com/``
.. literalinclude:: nginx-root.conf.sample
:language: nginx
.. _nginx_subdir_example:
Nextcloud in a subdir of the NGINX webroot
------------------------------------------
The following config should be used when Nextcloud is placed within a subdir of
the webroot of your nginx installation.
In this example the Nextcloud files are located at
``/var/www/nextcloud`` and the Nextcloud instance is accessed via ``http(s)://cloud.example.com/nextcloud/``.
The configuration differs from the "Nextcloud in webroot" configuration above in the following ways:
- All requests for ``/nextcloud`` are encapsulated within a single ``location`` block, namely ``location ^~ /nextcloud``.
- The string ``/nextcloud`` is prepended to all prefix paths.
- The root of the domain is mapped to ``/var/www`` rather than ``/var/www/nextcloud``, so that the URI ``/nextcloud`` is mapped to the server directory ``/var/www/nextcloud``.
- The blocks that handle requests for paths outside of ``/nextcloud`` (i.e. ``/robots.txt`` and ``/.well-known``) are pulled out of the ``location ^~ /nextcloud`` block.
- The block which handles `/.well-known` doesn't need a regex exception, since the rule which prevents users from accessing hidden folders at the root of the Nextcloud installation no longer matches that path.
.. literalinclude:: nginx-subdir.conf.sample
:language: nginx
Tips and tricks
---------------
.. _nginx_php_handler_tips:
PHP-Handler Configuration / Avoiding "502 Bad Gateway"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The :code:`server` line within the :code:`upstream php-handler` above needs to be adjusted to reflect your local PHP FPM configuration. It must match whatever is configured for the :code:`listen` directive within the PHP FPM pool you'll be using for NC.
Many Linux distributions define a listener for a default PHP-FPM pool called :code:`www` in a file called :code:`www.conf` located somewhere like :code:`/etc/php/8.1/pool.d`.
Look for the line that is set to something like:
:code:`listen = /var/run/php/php-fpm.sock`
or
:code:`listen = 127.0.0.1:9000`
If PHP FPM will be running on the same host as NGINX (it's probably a safe assumption it will be if you're unsure), it is recommended you use the UNIX socket (i.e. :code:`/var/run/php/php-fpm.sock`) rather than TCP (:code:`127.0.0.1:9000`) for maximum performance (though either will work as long as your NGINX and PHP FPM configurations match).
After deciding how you'd prefer to connect NGINX with PHP FPM (and, if necessary, updating your local PHP FPM configuration and restarting FPM), set your NGINX configuration's :code:`upstream php-handler` :code:`server` to match your preference (Note: If using UNIX sockets, prepend :code:`unix:` in the NGINX configuration, but *not* in your PHP FPM :code:`www.conf`).
Suppressing log messages
^^^^^^^^^^^^^^^^^^^^^^^^
If you're seeing meaningless messages in your logfile, for example ``client
denied by server configuration: /var/www/data/htaccesstest.txt``, add this section to
your nginx configuration to suppress them:
.. code-block:: nginx
location = /data/htaccesstest.txt {
allow all;
log_not_found off;
access_log off;
}
JavaScript (.js) or CSS (.css) files not served properly
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
A common issue with custom nginx configs is that JavaScript (.js)
or CSS (.css) files are not served properly leading to a 404 (File not found)
error on those files and a broken webinterface.
This could be caused by the:
.. code-block:: nginx
location ~* \.(?:css|js)$ {
block shown above not located **below** the:
.. code-block:: nginx
location ~ \.php(?:$|\/) {
block. Other custom configurations like caching JavaScript (.js)
or CSS (.css) files via gzip could also cause such issues.
Another cause of this issue could be not properly including mimetypes in the
http block, as shown `here. <https://www.nginx.com/resources/wiki/start/topics/examples/full/>`_
Upload of files greater than 10 MiB fails
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you configure nginx (globally) to block all requests to (hidden) dot files,
it may be not possible to upload files greater than 10 MiB using the webpage
due to Nextclouds requirement to upload the file to a URL ending with ``/.file``.
You may require to change:
.. code-block:: nginx
location ~ /\. {
to the following to re-allow file uploads:
.. code-block:: nginx
location ~ /\.(?!file).* {
See `issue #8802 on nextcloud/server <https://github.com/nextcloud/server/issues/8802>`_ for more information.
Login loop without any clue in access.log, error.log, nor nextcloud.log
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you after fresh installation (Centos 7 with nginx) have problem with first login, you should as first check these files:
.. code-block:: bash
tail /var/www/nextcloud/data/nextcloud.log
tail /var/log/nginx/access.log
tail /var/log/nginx/error.log
If you just see some correct requests in access log, but no login happens, you check access rights for php session and wsdlcache directory. Try to check permissions and execute change if needed:
.. code-block:: bash
chown nginx:nginx /var/lib/php/session/
chown root:nginx /var/lib/php/wsdlcache/
chown root:nginx /var/lib/php/opcache/
wedding-pics/core/doc/admin/_sources/installation/php_configuration.rst.txt
+132
View File
@@ -0,0 +1,132 @@
===========================
PHP Modules & Configuration
===========================
PHP Modules
-----------
This
section lists all required and optional PHP modules. Consult the `PHP manual
<https://php.net/manual/en/extensions.php>`_ for more information on modules.
You can
check the presence of a module by typing ``php -m | grep -i <module_name>``.
If you get a result, the module is present.
Required:
* PHP (see :doc:`./system_requirements` for a list of supported versions)
* PHP module ctype
* PHP module curl
* PHP module dom
* PHP module fileinfo (included with PHP)
* PHP module filter (only on Mageia and FreeBSD)
* PHP module GD
* PHP module hash (only on FreeBSD)
* PHP module JSON (included with PHP >= 8.0)
* PHP module libxml (Linux package libxml2 must be >=2.7.0)
* PHP module mbstring
* PHP module openssl (included with PHP >= 8.0)
* PHP module posix
* PHP module session
* PHP module SimpleXML
* PHP module XMLReader
* PHP module XMLWriter
* PHP module zip
* PHP module zlib
Database connectors (pick the one for your database):
* PHP module pdo_sqlite (>= 3, usually not recommended for performance reasons)
* PHP module pdo_mysql (MySQL/MariaDB)
* PHP module pdo_pgsql (PostgreSQL)
*Recommended* packages:
* PHP module intl (increases language translation performance and fixes sorting
of non-ASCII characters)
* PHP module sodium (for Argon2 for password hashing. bcrypt is used as fallback, but if passwords were hashed with Argon2 already and the module is missing, your users can't log in.)
Required for specific apps:
* PHP module ldap (for LDAP integration)
* PHP module smbclient (SMB/CIFS integration, see
:doc:`../configuration_files/external_storage/smb`)
* PHP module ftp (for FTP storage / external user authentication)
* PHP module imap (for external user authentication)
* PHP module bcmath (for passwordless login)
* PHP module gmp (for passwordless login)
Recommended for specific apps (*optional*):
* PHP module gmp (for SFTP storage)
* PHP module exif (for image rotation in pictures app)
For enhanced server performance (*optional*) select one or more of the following
caches:
* PHP module apcu (>= 4.0.6)
* PHP module memcached
* PHP module redis (>= 2.2.6, required for Transactional File Locking)
See :doc:`../configuration_server/caching_configuration` to learn how to select
and configure a cache.
For preview generation (*optional*):
* PHP module imagick
* avconv or ffmpeg
* OpenOffice or LibreOffice
.. note::
If the preview generation of PDF files fails with a "not authorized" error message, you must adjust the imagick policy file.
See https://cromwell-intl.com/open-source/pdf-not-authorized.html
For command line processing (*optional*):
* PHP module pcntl (enables command interruption by pressing ``ctrl-c``)
.. note::
You also need to ensure that ``pcntl_signal`` and ``pcntl_signal_dispatch`` are not disabled
in your php.ini by the ``disable_functions`` option.
For command line updater (*optional*):
* PHP module phar (upgrades Nextcloud by running ``sudo -u www-data php /var/www/nextcloud/updater/updater.phar``)
ini values
----------
The following ini settings should be adapted if needed for Nextcloud:
* ``apc.enable_cli``: see :doc:`../configuration_server/caching_configuration`
* ``disable_functions``: avoid disabling functions unless you know exactly what you are doing
* ``max_execution_time``: see :doc:`../configuration_files/big_file_upload_configuration`
* ``memory_limit``: should be at least 512MB. See also :doc:`../configuration_files/big_file_upload_configuration`
* ``opcache.enable`` and friends: See :doc:`../configuration_server/caching_configuration` and :doc:`server_tuning`
* ``open_basedir``: see :doc:`harden_server`
* ``upload_tmp_dir``: see :doc:`../configuration_files/big_file_upload_configuration`
.. _php_ini_tips_label:
php.ini configuration notes
---------------------------
Keep in mind that changes to ``php.ini`` may have to be configured on more than one
ini file. This can be the case, for example, for the ``date.timezone`` setting.
You can search for a parameter with the following command: ``grep -r date.timezone /etc/php``.
**php.ini - used by the Web server:**
::
/etc/php/8.0/apache2/php.ini
or
/etc/php/8.0/fpm/php.ini
or ...
**php.ini - used by the php-cli and so by Nextcloud CRON jobs:**
::
/etc/php/8.0/cli/php.ini
.. note:: Path names have to be set in respect of the installed PHP
(8.0, 8.1 or 8.2) as applicable.
wedding-pics/core/doc/admin/_sources/installation/selinux_configuration.rst.txt
+138
View File
@@ -0,0 +1,138 @@
.. _selinux-config-label:
=====================
SELinux configuration
=====================
When you have SELinux enabled on your Linux distribution, you may run into
permissions problems after a new Nextcloud installation, and see ``permission
denied`` errors in your Nextcloud logs.
The following settings should work for most SELinux systems that use the
default distro profiles. Run these commands as root, and remember to adjust the filepaths
in these examples for your installation::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.htaccess'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/3rdparty/aws/aws-sdk-php/src/data/logs(/.*)?'
restorecon -Rv '/var/www/html/nextcloud/'
If you uninstall Nextcloud you need to remove the Nextcloud directory labels. To do
this execute the following commands as root after uninstalling Nextcloud::
semanage fcontext -d '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/.htaccess'
semanage fcontext -d '/var/www/html/nextcloud/.user.ini'
semanage fcontext -d '/var/www/html/nextcloud/3rdparty/aws/aws-sdk-php/src/data/logs(/.*)?'
restorecon -Rv '/var/www/html/nextcloud/'
If you have customized SELinux policies and these examples do not work, you must give the
HTTP server write access to these directories::
/var/www/html/nextcloud/data
/var/www/html/nextcloud/config
/var/www/html/nextcloud/apps
Enable updates via the web interface
------------------------------------
To enable updates via the web interface, you may need this to enable writing to the directories::
setsebool httpd_unified on
When the update is completed, disable write access::
setsebool -P httpd_unified off
Disallow write access to the whole web directory
------------------------------------------------
For security reasons it's suggested to disable write access to all folders in /var/www/ (default)::
setsebool -P httpd_unified off
Allow access to a remote database
---------------------------------
An additional setting is needed if your installation is connecting to a remote database::
setsebool -P httpd_can_network_connect_db on
Allow access to LDAP server
---------------------------
Use this setting to allow LDAP connections::
setsebool -P httpd_can_connect_ldap on
Allow access to remote network
------------------------------
Nextcloud requires access to remote networks for functions such as Server-to-Server sharing, external storages or
the app store. To allow this access use the following setting::
setsebool -P httpd_can_network_connect on
Allow access to network memcache
--------------------------------
This setting is not required if ``httpd_can_network_connect`` is already on::
setsebool -P httpd_can_network_memcache on
Allow access to SMTP/sendmail
-----------------------------
If you want to allow Nextcloud to send out e-mail notifications via sendmail you need
to use the following setting::
setsebool -P httpd_can_sendmail on
Allow access to CIFS/SMB
------------------------
If you have placed your datadir on a CIFS/SMB share use the following setting::
setsebool -P httpd_use_cifs on
Allow access to FuseFS
----------------------
If your data folder resides on a Fuse Filesystem (e.g. EncFS etc), this setting is required as well::
setsebool -P httpd_use_fusefs on
Allow access to GPG for Rainloop
--------------------------------
If you use a the rainloop webmail client app which supports GPG/PGP, you might need this::
setsebool -P httpd_use_gpg on
Troubleshooting
---------------
For general Troubleshooting of SELinux and its profiles try to install the
package ``setroubleshoot`` and run::
sealert -a /var/log/audit/audit.log > /path/to/mylogfile.txt
to get a report which helps you configuring your SELinux profiles.
Another tool for troubleshooting is to enable a single ruleset for your
Nextcloud directory::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud(/.*)?'
restorecon -RF /var/www/html/nextcloud
It is much stronger security to have a more fine-grained ruleset as in the
examples at the beginning, so use this only for testing and troubleshooting. It
has a similar effect to disabling SELinux, so don't use it on production
systems.
wedding-pics/core/doc/admin/_sources/installation/server_tuning.rst.txt
+222
View File
@@ -0,0 +1,222 @@
=============
Server tuning
=============
Using cron to perform background jobs
-------------------------------------
See :doc:`../configuration_server/background_jobs_configuration` for a description and the
benefits.
Reducing system load
--------------------
High system load will slow down Nextcloud and might also lead to other unwanted
side effects. To reduce load you should first identify the source of the problem.
Tools such as htop, iotop, `netdata <https://my-netdata.io>`_ or
`glances <https://nicolargo.github.io/glances/>`_
will help to identify the process or the drive that slows down your system. First
you should make sure that you installed/assigned enough RAM. Swap usage should be
prevented by all means. If you run your database inside a VM, you should not
store it inside a VM image file. Better put it on a dedicated block device to
reduce latency due to multiple abstraction layers.
.. _caching:
Log Levels
----------
Verify the ``loglevel`` in your ``config.php``. The default the log level is
set to ``2`` (WARN) in new installations. Sometimes this parameter is inadvertently
left at the DEBUG level (``0``) after a troubleshooting event. In some older installations this
parameter may also be something other than the default. Use ``0`` (DEBUG)
when you have a problem to diagnose, and then reset your log level to a
less-verbose level. DEBUG outputs a lot of information, and can affect your
server performance.
Debug Mode
----------
Verify that ``debug`` is ``false`` in your ``config.php``. The default is ``false`` in new
installations (or when not specified). While similar to the DEBUG logging level, this option
also disables various optimizations (to faciliate easier debugging) and generates additional
debug output both at the browser level and server-side. It should not be enabled in production
environments outside of isolated troubleshooting situations.
Caching
-------
Caching improves performance by storing data, code, and other objects in memory.
Memory cache configuration for the Nextcloud server must be installed and configured.
See :doc:`../configuration_server/caching_configuration`.
Compression
-----------
Enabling compression in your web server for JavaScript, CSS, and SVG files improves the
performance because fewer bytes need to be transferred to the clients.
Using MariaDB/MySQL instead of SQLite
-------------------------------------
MySQL or MariaDB are preferred because of the `performance limitations of
SQLite with highly concurrent applications
<https://www.sqlite.org/whentouse.html>`_, like Nextcloud.
See the section :doc:`../configuration_database/linux_database_configuration` for how to
configure Nextcloud for MySQL or MariaDB. If your installation is already running on
SQLite then it is possible to convert to MySQL or MariaDB using the steps provided
in :doc:`../configuration_database/db_conversion`.
For more details and help tuning your database, check `this article at MariaDB <https://mariadb.com/kb/en/optimization-and-tuning/>`_.
Using Redis-based transactional file locking
--------------------------------------------
File locking is enabled by default, using the database locking backend. This
places a significant load on your database. See the section
:doc:`../configuration_files/files_locking_transactional` for how to
configure Nextcloud to use Redis-based Transactional File Locking.
TLS / encryption app
--------------------
TLS (HTTPS) and file encryption/decryption can be offloaded to a processor's
AES-NI extension. This can both speed up these operations while lowering
processing overhead. This requires a processor with the `AES-NI instruction set
<https://wikipedia.org/wiki/AES_instruction_set>`_.
Here are some examples how to check if your CPU / environment supports the
AES-NI extension:
* For each CPU core present: ``grep flags /proc/cpuinfo`` or as a summary for
all cores: ``grep -m 1 '^flags' /proc/cpuinfo`` If the result contains any
``aes``, the extension is present.
* Search eg. on the Intel web if the processor used supports the extension
`Intel Processor Feature Filter
<https://ark.intel.com/MySearch.aspx?AESTech=true>`_ You may set a filter by
``"AES New Instructions"`` to get a reduced result set.
* For versions of openssl >= 1.0.1, AES-NI does not work via an engine and
will not show up in the ``openssl engine`` command. It is active by default
on the supported hardware. You can check the openssl version via ``openssl
version -a``
* If your processor supports AES-NI but it does not show up eg via grep or
coreinfo, it is maybe disabled in the BIOS.
* If your environment runs virtualized, check the virtualization vendor for
support.
Enable HTTP/2 for faster loading
--------------------------------
HTTP/2 has `huge speed improvements <https://www.troyhunt.com/i-wanna-go-fast-https-massive-speed-advantage/>`_ over HTTP with multiple request. Most `browsers already support HTTP/2 over TLS (HTTPS) <https://caniuse.com/#feat=http2>`_. Refer to your web server manual for guides on how to enable HTTP/2.
Tune PHP-FPM
------------
If you are using a default installation of PHP-FPM you might have noticed
excessive load times on the web interface or even sync issues. This is due
to the fact that each simultaneous request of an element is handled by a
separate PHP-FPM process. So even on a small installation you should allow
more processes to run in parallel to handle the requests.
`This link <https://spot13.com/pmcalculator/>`_ can help you calculate the good values for your system.
Enable PHP OPcache
------------------
The `OPcache <https://php.net/manual/en/intro.opcache.php>`_ improves the performance of PHP applications by caching precompiled bytecode. The default OPcache settings are usually sufficient for Nextcloud code to be fully cached. If any cache size limit is reached by more than 90%, the admin panel will show a related warning. Nextcloud strictly requires code comments to be preserved in opcode, which is the default. But in case PHP settings are changed on your system, you may need set the following:
.. code:: ini
opcache.save_comments = 1
By default, cached scripts are revalidated on access to ensure that changes on disk take effect after at most ``2`` seconds. Since Nextcloud handles cache revalidation internally when required, the revalidation frequency can be reduced or completely disabled to enhance performance. Note, however, that it affects manual changes to scripts, including ``config.php``. To check for changes at most every ``60`` seconds, use the following setting:
.. code:: ini
opcache.revalidate_freq = 60
To disable the revalidation completely:
.. code:: ini
opcache.validate_timestamps = 0
Any change to ``config.php`` will then require either restarting PHP, manually clearing the cache, or invalidating this particular script.
For more details check out the `official documentation <https://php.net/manual/en/opcache.configuration.php>`_. To monitor OPcache usage, clear individual or all cache entries, `opcache-gui <https://github.com/amnuts/opcache-gui>`_ can be used.
PHP 8.0 and above ship with a JIT compiler that can be enabled to benefit any CPU intensive apps you might be running. To enable a tracing JIT with all optimizations:
.. code:: ini
opcache.jit = 1255
opcache.jit_buffer_size = 128M
Previews
--------
It is possible to speed up preview generation using an
external microservice: `Imaginary <https://github.com/h2non/imaginary>`_.
.. warning::
Imaginary is currently incompatible with server-side-encryption.
See https://github.com/nextcloud/server/issues/34262
We strongly recommend running our custom docker image that is more up to date than the official image.
You can find the image at `docker.io/nextcloud/aio-imaginary:latest`.
To do so, you will need to deploy the service and make sure that it is
not accessible from outside of your servers. Then you can configure
Nextcloud to use Imaginary by editing your `config.php`:
.. code:: php
<?php
'enabledPreviewProviders' => [
'OC\Preview\MP3',
'OC\Preview\TXT',
'OC\Preview\MarkDown',
'OC\Preview\OpenDocument',
'OC\Preview\Krita',
'OC\Preview\Imaginary',
],
'preview_imaginary_url' => 'http://<url of imaginary>',
.. warning::
Make sure to start Imaginary with the `-return-size` command line parameter. Otherwise, there will be a minor performance impact. The flag requires a recent version of Imaginary (newer than v1.2.4) and is by default added to the `aio-imaginary` container.
Also make sure to add the capability `SYS_NICE` via `--cap-add=sys_nice` or `cap_add: - SYS_NICE` as it is required by imaginary to generate HEIC previews.
.. note::
For large instance, you should follow `Imaginary's scalability recommendation <https://github.com/h2non/imaginary#scalability>`.
Settings:
^^^^^^^^^
If you want set the preview format for imaginary.
You can change between jpeg and webp, the default is jpeg:
::
<?php
'preview_format' => 'webp',
If you want set a api key for imaginary':
::
<?php
'preview_imaginary_key' => 'secret',
Default WebP quality setting for preview images is '80'. Change this with:
::
occ config:app:set preview webp_quality --value="30"
wedding-pics/core/doc/admin/_sources/installation/source_installation.rst.txt
+425
View File
@@ -0,0 +1,425 @@
=====================
Installation on Linux
=====================
There are multiple ways of installing Nextcloud depending on your preferences, requirements and goals.
If you prefer an automated installation, you have the option to:
* use the `official Nextcloud AIO Docker-based image <https://github.com/nextcloud/all-in-one#nextcloud-all-in-one>`_. Nextcloud AIO stands for Nextcloud All-in-One and provides easy deployment and maintenance with most features included in this one Nextcloud instance. It includes Office, a turnkey Backup solution, Imaginary (for previews of heic, heif, illustrator, pdf, svg, tiff and webp) and more.
* use the `community Snap Package <https://snapcraft.io/nextcloud>`_. This includes a full production-ready stack, will maintain your HTTPS certificates for you, and will automatically update as needed to stay secure.
* use the `community Nextcloud VM Appliance <https://github.com/nextcloud/vm/>`_ (aka Nextcloud Virtual Machine or NcVM). This helps you create a personal or corporate Nextcloud Server faster and easier. It can be used install directly on a clean Ubuntu Server or downloaded as a fully functioning VM.
* use the `community NextcloudPi scripts <https://nextcloudpi.com/>`_ (based on Debian). It will setup everything for you and include scripts for automated installation of apps like: Collabora, OnlyOffice, Talk and so on.
* use the `community Nextcloud Docker image <https://hub.docker.com/_/nextcloud/>`_. This image is designed to be used in a micro-service environment. There are two versions of the image you can choose from: the Apache one contains a full Nextcloud installation including an Apache web server. The second option is an FPM installation and runs a FastCGI process that serves your Nextcloud installation (you will need to supply your preferred web, database and other desired supplementary services).
.. note:: Please note that the community options are not officially supported by Nextcloud GmbH.
In case you prefer installing from the source tarball, you can setup Nextcloud
from scratch using a classic LAMP stack (Linux, Apache, MySQL/MariaDB, PHP).
This document provides a complete walk-through for installing Nextcloud on
Ubuntu 18.04 LTS Server with Apache and MariaDB, using `the Nextcloud .tar
archive <https://nextcloud.com/install/>`_. This method is recommended to install Nextcloud.
This installation guide is giving a general overview of required dependencies and their configuration. For a distribution specific setup guide have a look at the :doc:`./example_ubuntu` and :doc:`./example_centos`.
.. _prerequisites_label:
.. note:: Admins of SELinux-enabled distributions such as CentOS, Fedora, and
Red Hat Enterprise Linux may need to set new rules to enable installing
Nextcloud. See :ref:`selinux_tips_label` for a suggested configuration.
Prerequisites for manual installation
-------------------------------------
The Nextcloud .tar archive contains all of the required PHP modules.
Your Linux distribution should have packages for all required modules.
See :doc:`php_configuration` for a list of required and suggested modules.
You don’t need the WebDAV module for your Web server (i.e. Apache’s
``mod_webdav``), as Nextcloud has a built-in WebDAV server of its own,
SabreDAV.
If ``mod_webdav`` is enabled you must disable it for Nextcloud. (See
:ref:`apache_configuration_label` for an example configuration.)
.. _apache_configuration_label:
Apache Web server configuration
-------------------------------
Configuring Apache requires the creation of a single configuration
file. On Debian, Ubuntu, and their derivatives, this file will be
:file:`/etc/apache2/sites-available/nextcloud.conf`. On Fedora,
CentOS, RHEL, and similar systems, the configuration file will be
:file:`/etc/httpd/conf.d/nextcloud.conf`.
You can choose to install Nextcloud in a directory on an existing
webserver, for example `https://www.example.com/nextcloud/`, or in a
virtual host if you want Nextcloud to be accessible from its own
subdomain such as `https://cloud.example.com/`.
To use the directory-based installation, put the following in your
:file:`nextcloud.conf` replacing the **Directory** and **Alias** filepaths
with the filepaths appropriate for your system::
Alias /nextcloud "/var/www/nextcloud/"
<Directory /var/www/nextcloud/>
Require all granted
AllowOverride All
Options FollowSymLinks MultiViews
<IfModule mod_dav.c>
Dav off
</IfModule>
</Directory>
To use the virtual host installation, put the following in your
:file:`nextcloud.conf` replacing **ServerName**, as well as the
**DocumentRoot** and **Directory** filepaths with values appropriate
for your system::
<VirtualHost *:80>
DocumentRoot /var/www/nextcloud/
ServerName your.server.com
<Directory /var/www/nextcloud/>
Require all granted
AllowOverride All
Options FollowSymLinks MultiViews
<IfModule mod_dav.c>
Dav off
</IfModule>
</Directory>
</VirtualHost>
On Debian, Ubuntu, and their derivatives, you should run the following
command to enable the configuration::
a2ensite nextcloud.conf
Additional Apache configurations
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
* For Nextcloud to work correctly, we need the module ``mod_rewrite``. Enable
it by running::
a2enmod rewrite
Additional recommended modules are ``mod_headers``, ``mod_env``, ``mod_dir`` and ``mod_mime``::
a2enmod headers
a2enmod env
a2enmod dir
a2enmod mime
If you're running ``mod_fcgi`` instead of the standard ``mod_php`` also enable::
a2enmod setenvif
* You must disable any server-configured authentication for Nextcloud, as it
uses Basic authentication internally for DAV services. If you have turned on
authentication on a parent folder (via e.g. an ``AuthType Basic``
directive), you can turn off the authentication specifically for the
Nextcloud entry. Following the above example configuration file, add the
following line in the ``<Directory>`` section::
Satisfy Any
* When using SSL, take special note of the ServerName. You should specify one
in the server configuration, as well as in the CommonName field of the
certificate. If you want your Nextcloud to be reachable via the internet,
then set both of these to the domain you want to reach your Nextcloud server.
* Now restart Apache::
service apache2 restart
* If you're running Nextcloud in a subdirectory and want to use CalDAV or
CardDAV clients make sure you have configured the correct
:ref:`service-discovery-label` URLs.
.. _pretty_urls_label:
Pretty URLs
-----------
Pretty URLs remove the ``index.php``-part in all Nextcloud URLs, for example
in sharing links like ``https://example.org/nextcloud/index.php/s/Sv1b7krAUqmF8QQ``,
making URLs shorter and thus prettier.
``mod_env`` and ``mod_rewrite`` must be installed on your webserver and the :file:`.htaccess`
must be writable by the HTTP user. To enable ``mod_env`` and ``mod_rewrite``, run ``sudo a2enmod env`` and ``sudo a2enmod rewrite``. Then you can set in the :file:`config.php` two variables::
'overwrite.cli.url' => 'https://example.org/nextcloud',
'htaccess.RewriteBase' => '/nextcloud',
if your setup is available on ``https://example.org/nextcloud`` or::
'overwrite.cli.url' => 'https://example.org/',
'htaccess.RewriteBase' => '/',
if it isn't installed in a subfolder. Finally run this occ-command to update
your .htaccess file::
sudo -u www-data php /var/www/nextcloud/occ maintenance:update:htaccess
After each update, these changes are automatically applied to the ``.htaccess``-file.
.. _enabling_ssl_label:
Enabling SSL
------------
.. note:: You can use Nextcloud over plain HTTP, but we strongly encourage you
to use SSL/TLS to encrypt all of your server traffic, and to protect
user's logins and data in transit.
Apache installed under Ubuntu comes already set-up with a simple
self-signed certificate. All you have to do is to enable the ssl module and
the default site. Open a terminal and run::
a2enmod ssl
a2ensite default-ssl
service apache2 reload
.. note:: Self-signed certificates have their drawbacks - especially when you
plan to make your Nextcloud server publicly accessible. Consider getting
a certificate signed by a signing authority. Check with your domain name
registrar or hosting service for good deals on commercial certificates.
Or use a free `Let's Encrypt <https://letsencrypt.org/>`_ ones.
.. _installation_wizard_label:
Installation wizard
-------------------
After restarting Apache you must complete your installation by running either
the graphical Installation Wizard, or on the command line with the ``occ``
command. To enable this, change the ownership on your Nextcloud directories to
your HTTP user::
chown -R www-data:www-data /var/www/nextcloud/
.. note:: Admins of SELinux-enabled distributions may need to write new SELinux
rules to complete their Nextcloud installation; see
:ref:`selinux_tips_label`.
To use ``occ`` see :doc:`command_line_installation`.
To use the graphical Installation Wizard see :doc:`installation_wizard`.
.. _background_jobs_label:
Setting up background jobs
--------------------------
Nextcloud requires that some tasks are run regularly. These may include
maintenance tasks to ensure optimal performance or time sensitive tasks like
sending notifications.
See :doc:`../configuration_server/background_jobs_configuration` for a detailed
description and the benefits.
.. _selinux_tips_label:
SELinux configuration tips
--------------------------
See :doc:`selinux_configuration` for a suggested configuration for
SELinux-enabled distributions such as Fedora and CentOS.
.. _php_fpm_tips_label:
php-fpm configuration notes
---------------------------
**System environment variables**
When you are using ``php-fpm``, system environment variables like
PATH, TMP or others are not automatically populated in the same way as
when using ``php-cli``. A PHP call like ``getenv('PATH');`` can therefore
return an empty result. So you may need to manually configure environment
variables in the appropropriate ``php-fpm`` ini/config file.
Here are some example root paths for these ini/config files:
+-----------------------+-----------------------+
| Debian/Ubuntu/Mint | CentOS/Red Hat/Fedora |
+-----------------------+-----------------------+
| ``/etc/php/8.0/fpm/`` | ``/etc/php-fpm.d/`` |
+-----------------------+-----------------------+
In both examples, the ini/config file is called ``www.conf``, and depending on
the distro version or customizations you have made, it may be in a subdirectory such as ``pool.d``.
Usually, you will find some or all of the environment variables
already in the file, but commented out like this::
;env[HOSTNAME] = $HOSTNAME
;env[PATH] = /usr/local/bin:/usr/bin:/bin
;env[TMP] = /tmp
;env[TMPDIR] = /tmp
;env[TEMP] = /tmp
Uncomment the appropriate existing entries. Then run ``printenv PATH`` to
confirm your paths, for example::
$ printenv PATH
/home/user/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:
/sbin:/bin:/
If any of your system environment variables are not present in the file then
you must add them.
Alternatively it is possible to use the environment variables of your system by modifying::
/etc/php/8.0/fpm/pool.d/www.conf
and uncommenting the line::
clear_env = no
When you are using shared hosting or a control panel to manage your `Nextcloud VM`_
or server, the configuration files are almost
certain to be located somewhere else, for security and flexibility reasons, so
check your documentation for the correct locations.
Please keep in mind that it is possible to create different settings for
``php-cli`` and ``php-fpm``, and for different domains and Web sites.
The best way to check your settings is with :ref:`label-phpinfo`.
**Maximum upload size**
If you want to increase the maximum upload size, you will also have to modify
your ``php-fpm`` configuration and increase the ``upload_max_filesize`` and
``post_max_size`` values. You will need to restart ``php-fpm`` and your HTTP
server in order for these changes to be applied.
**.htaccess notes for Apache**
Nextcloud comes with its own ``nextcloud/.htaccess`` file. Because ``php-fpm``
can't read PHP settings in ``.htaccess`` these settings and permissions must
be set in the ``nextcloud/.user.ini`` file.
.. _other_HTTP_servers_label:
Other Web servers
-----------------
* :doc:`nginx`
.. _vm_label:
Installing on Windows (virtual machine)
---------------------------------------
If you are using Windows, the easiest way to get Nextcloud up and running is
using a virtual machine (VM). There are two options:
* **Enterprise/SME appliance**
Nextcloud GmbH maintains a free appliance built on the
`Univention Corporate Server (UCS) <https://www.univention.com/products/univention-app-center/app-catalog/nextcloud/>`_
with easy graphical setup and web-based administration. It includes user
management via LDAP, can replace an existing Active Directory setup and
has optional ONLYOFFICE and Collabora Online integration, with many more applications
available for easy and quick install.
It can be installed on hardware or run in a virtual machine using VirtualBox,
VMWare (ESX) and KVM images.
Download the the Appliance here:
- `Univention Corporate Server (UCS) <https://www.univention.com/products/univention-app-center/app-catalog/nextcloud/>`_
* **Home User/SME appliance**
The `Nextcloud VM`_ is maintained by
`T&M Hansson IT <https://www.hanssonit.se/nextcloud-vm/>`_ and several different versions are
offered. Collabora, OnlyOffice, Full Text Search and other apps can easily be installed with the included scripts which you can choose to run during the first setup, or download them later and run it afterwards. You can find all the currently available automated app installations `on GitHub <https://github.com/nextcloud/vm/tree/master/apps/>`_.
The VM comes in different sizes and versions.
You can find all the available versions `here <https://shop.hanssonit.se/product-category/virtual-machine/nextcloud-vm/>`_.
For complete instructions and downloads see:
- `Nextcloud VM (GitHub) <https://github.com/nextcloud/vm/>`_
- `Nextcloud VM (T&M Hansson IT) <https://www.hanssonit.se/nextcloud-vm/>`_
.. note:: You can install the VM on several different operating systems as long as you can mount OVA, VMDK, or VHD/VHDX VM in your hypervisor. If you are using KVM then you need to install the VM from the scripts on GitHub. You can follow the `instructions in the README <https://github.com/nextcloud/vm#build-your-own-vm-or-install-on-a-vps>`_.
.. _snaps_label:
Installing via Snap packages
----------------------------
A snap is a zip file containing an application together with its dependencies,
and a description of how it should safely be run on your system, especially
the different ways it should talk to other software. Most importantly snaps are
designed to be secure, sandboxed, containerized applications isolated from the
underlying system and from other applications.
To install the Nextcloud Snap Package, run the following command in a terminal::
sudo snap install nextcloud
.. note:: The `snapd technology <http://snapcraft.io/docs/core/>`_ is the core
that powers snaps, and it offers a new way to package, distribute, update and
run OS components and applications on a Linux system. See more about snaps on
`snapcraft.io <http://snapcraft.io/>`_.
Installation via web installer on a VPS or web space
----------------------------------------------------
When you don't have access to the command line, for example at a web hosting or VMPS,
an easy option is to use our web installer. This script can be found on our
`server installation page here. <https://nextcloud.com/install/#instructions-server>`_
The script checks the dependencies, downloads Nextcloud from the official server,
unpacks it with the right permissions and the right user account. Finally, you will be
redirected to the Nextcloud installer. Here a quick how-to:
1. Get the file from the installation page
2. Upload setup-nextcloud.php to your web space
3. Point your web browser to setup-nextcloud.php on your webspace
4. Follow the instructions and configure Nextcloud
5. Login to your newly created Nextcloud instance!
.. note:: that the installer uses the same Nextcloud version as available for the built
in updater in Nextcloud. After a major release it can take up to a month before
it becomes available through the web installer and the updater. This is done to
spread the deployment of new major releases out over time.
Installation on TrueNAS
-----------------------
See the `TrueNAS installation documentation <https://www.truenas.com/docs/core/solutions/integrations/nextcloud/>`_.
Installation via install script
-------------------------------
One of the easiest ways of installing is to use the Nextcloud VM or NextcloudPI scripts. It's basically just two steps:
1. Download the latest `VM installation script <https://github.com/nextcloud/vm/blob/master/nextcloud_install_production.sh/>`_.
2. Run the script with::
sudo bash nextcloud_install_production.sh
or
1. Download the latest `PI installation script <https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh/>`_.
2. Run the script with::
sudo bash install.sh
A guided setup will follow and the only thing you have to do it to follow the on screen instructions, when given to you.
.. _Nextcloud VM:
https://github.com/nextcloud/vm
wedding-pics/core/doc/admin/_sources/installation/system_requirements.rst.txt
+139
View File
@@ -0,0 +1,139 @@
===================
System requirements
===================
Server
------
For best performance, stability and functionality we have documented some recommendations for running a Nextcloud server.
.. note:: If you plan a setup for your organization and you rely on professional deployment consulting (e.g. efficient and
reliable scaling) and support, we strongly recommend you to check out our `enterprise support
<https://nextcloud.com/enterprise/>`_.
+------------------+-----------------------------------------------------------------------+
| Platform | Options |
+==================+=======================================================================+
| Operating System | - **Ubuntu 22.04 LTS** (recommended) |
| (64-bit) | - Ubuntu 20.04 LTS |
| | - **Red Hat Enterprise Linux 9** (recommended) |
| | - Red Hat Enterprise Linux 8 |
| | - Debian 12 (Bookworm) |
| | - SUSE Linux Enterprise Server 15 |
| | - openSUSE Leap 15.5 |
| | - CentOS Stream |
+------------------+-----------------------------------------------------------------------+
| Database | - **MySQL 8.0+** or MariaDB 10.3/10.5/**10.6** (recommended)/10.11 |
| | - Oracle Database 11g (*only as part of an enterprise subscription*) |
| | - PostgreSQL 12/13/14/15 |
| | - SQLite (*only recommended for testing and minimal-instances*) |
+------------------+-----------------------------------------------------------------------+
| Webserver | - **Apache 2.4 with** ``mod_php`` **or** ``php-fpm`` (recommended) |
| | - nginx with ``php-fpm`` |
+------------------+-----------------------------------------------------------------------+
| PHP Runtime | - 8.0 (*deprecated*) |
| | - 8.1 |
| | - **8.2** (*recommended*) |
| | - 8.3 |
+------------------+-----------------------------------------------------------------------+
See :doc:`source_installation` for minimum PHP-modules and additional software for installing Nextcloud.
CPU Architecture and OS
^^^^^^^^^^^^^^^^^^^^^^^
A 64-bit CPU, OS and PHP is required for Nextcloud to run well.
32-bit systems are supported, with the following known limitations:
- Dates before Unix Epoch (1970-01-01) are not supported
- Dates after 2038 are not supported
Memory
^^^^^^
Memory requirements for running a Nextcloud server are greatly variable,
depending on the numbers of users, apps, files and volume of server activity.
Nextcloud needs a minimum of **128MB** RAM per process, and we recommend a minimum of **512MB** RAM per process.
Database requirements for MySQL / MariaDB
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The following is currently required if you're running Nextcloud together with a MySQL / MariaDB database:
* InnoDB storage engine (MyISAM is not supported)
* "READ COMMITTED" transaction isolation level (See: :ref:`db-transaction-label`)
* Disabled or BINLOG_FORMAT = ROW configured Binary Logging (See: https://dev.mysql.com/doc/refman/5.7/en/binary-log-formats.html)
* For **Emoji (UTF8 4-byte) support** see :doc:`../configuration_database/mysql_4byte_support`
Why we drop old PHP versions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Every year, a new PHP version is added and old PHP versions are deprecated. This also affects our documented recommended PHP version.
We try to support old PHP versions for as long as reasonably possible. However the list of security, performance, and bug fixes will only increase, some of those fixes might be considered critical and thus at some point the deprecation will be inevitable.
Thus it is recommended to keep your PHP version up to date.
Advantages of upgrading PHP
===========================
- **Security**
PHP deprecates security fixes of old versions. Nextcloud cannot implement security fixes that come with new PHP versions as long as we support deprecated PHP versions, since the syntax that we are allowed to use must be the lowest one of the supported versions, thus the upstream packages of third parties break because they dropped this support.
- **Performance**
The language continuously improves over time which makes it possible to do more requests in significantly less time.
Long term support
=================
If you are running Nextcloud for an organisation-critical use case, you could consider upgrading your subscription to a premium subscription which comes with 5 years of long term support. This means you continue to receive maintenance releases for high and critical security issues, data loss fixes, and regressions within version over this extended period of time.
Desktop client
--------------
We strongly recommend using the latest version of your operating system to get the full and most stable experience out
of our clients.
* **Windows** 10+
* **macOS** Lion (10.14)+ (64-bits only)
* **Linux** (64-bits only) Should run on any distribution newer than Ubuntu 18.04 with our official AppImage package
Mobile apps
-----------
We strongly recommend using the latest version of your mobile operating system to get the full and most stable experience out
of our mobile apps.
Files App
^^^^^^^^^
- **iOS** 15.0+
- **Android** 6.0+
Talk App
^^^^^^^^
- **iOS** 15.0+
- **Android** 6.0+
- **Nextcloud Server** 14.0+
- **Nextcloud Talk** 4.0+
.. note:: When using Nextcloud Talk 12.0+ please update the Android Talk App to the newest version (or at least to v12.1).
Web browser
-----------
For the best experience with the Nextcloud web interface, we recommend that you use the latest and supported version
of a browser from this list, or one based on those:
- Microsoft **Edge**
- Mozilla **Firefox**
- Google **Chrome**/Chromium
- Apple **Safari**
.. note:: If you want to use Nextcloud Talk you should use Mozilla **Firefox** 52+ or Google **Chrome**/Chromium 49+ to have
the full experience with video calls and screensharing. Google Chrome/Chromium requires an additional plugin for
screensharing.
wedding-pics/core/doc/admin/_sources/issues/applying_patch.rst.txt
+47
View File
@@ -0,0 +1,47 @@
==================
Patching Nextcloud
==================
Applying a patch
----------------
Patching server
^^^^^^^^^^^^^^^
1. Navigate into your Nextcloud server's root directory (contains the ``status.php`` file)
2. Now apply the patch with the following command::
patch -p 1 < /path/to/the/file.patch
.. note::
There can be errors about not found files, especially when you take a patch from GitHub there might be development or test files included in the patch. when the files are in build/ or a tests/ subdirectory it is mostly being
Patching apps
^^^^^^^^^^^^^
1. Navigate to the root of this app (mostly ``apps/[APPID]/``), if you can not find the app there use the ``sudo -u www-data php occ app:getpath APPID`` command to find the path.
2. Now apply the patch with the same command as in `Patching server`_
Reverting a patch
-----------------
1. Navigate to the directory where you applied the patch.
2. Now revert the patch with the ``-R`` option::
patch -R -p 1 < /path/to/the/file.patch
Getting a patch from a GitHub pull request
------------------------------------------
If you found a related pull request on GitHub that solves your issue, or you want to help developers and verify a fix works, you can get a patch for the pull request.
1. Using https://github.com/nextcloud/server/pull/26396 as an example.
2. Append ``.patch`` to the URL: https://github.com/nextcloud/server/pull/26396.patch
3. Download the patch to your server and follow the `Applying a patch`_ steps.
4. In case you are on an older version, you might first need to go the the correct version of the patch.
.. image:: images/getting-a-patch-from-github.png
:alt: backportbot-nextcloud linking to the pull request for an older version.
5. You can find it by looking for a link by the ``backportbot-nextcloud`` or a developer will leave a manual comment about the backport to an older Nextcloud version. For the example above you the pull request for Nextcloud 21 is at https://github.com/nextcloud/server/pull/26406 and the patch at https://github.com/nextcloud/server/pull/26406.patch
wedding-pics/core/doc/admin/_sources/issues/code_signing.rst.txt
+230
View File
@@ -0,0 +1,230 @@
============
Code signing
============
.. sectionauthor:: Lukas Reschke <lukas@nextcloud.com>
.. _code_signing_label:
Nextcloud supports code signing for the core releases, and for Nextcloud
applications. Code signing gives our users an additional layer of security by
ensuring that nobody other than authorized persons can push updates.
It also ensures that all upgrades have been executed properly, so that no files
are left behind, and all old files are properly replaced. In the past, invalid
updates were a significant source of errors when updating Nextcloud.
FAQ
---
Why did Nextcloud add code signing?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
By supporting Code Signing we add another layer of security by ensuring that
nobody other than authorized persons can push updates for applications, and
ensuring proper upgrades.
Do we lock down Nextcloud?
^^^^^^^^^^^^^^^^^^^^^^^^^^
The Nextcloud project is open source and always will be. We do not want to
make it more difficult for our users to run Nextcloud. Any code signing errors on
upgrades will not prevent Nextcloud from running, but will display a warning on
the Admin page. For applications that are not tagged "Official" the code signing
process is optional.
Not open source anymore?
^^^^^^^^^^^^^^^^^^^^^^^^
The Nextcloud project is open source and always will be. The code signing
process is optional, though highly recommended. The code check for the
core parts of Nextcloud is enabled when the Nextcloud release version branch has
been set to stable.
For custom distributions of Nextcloud it is recommended to change the release
version branch in version.php to something else than "stable".
Is code signing mandatory for apps?
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Code signing is required for all applications on apps.nextcloud.com.
.. _code_signing_fix_warning_label:
Fixing invalid code integrity messages
--------------------------------------
A code integrity error message ("Some files have not passed the integrity check…") appears on your Nextcloud admin page under "Overview", which provides
the following options:
1. Link to this documentation entry.
2. Show a list of invalid files.
3. Trigger a rescan.
.. image:: images/code-integrity-admin.png
:alt: Links for resolving code integrity warnings.
To debug issues caused by the code integrity check click on "List of invalid
files...", and you will be shown a text document listing the different issues. The
content of the file will look similar to the following example:
::
Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.
Results
=======
- core
- INVALID_HASH
- /index.php
- /version.php
- EXTRA_FILE
- /test.php
- calendar
- EXCEPTION
- OC\IntegrityCheck\Exceptions\InvalidSignatureException
- Signature data not found.
Raw output
==========
Array
(
[core] => Array
(
[INVALID_HASH] => Array
(
[/index.php] => Array
(
[expected] =>
f1c5e2630d784bc9cb02d5a28f55d6f24d06dae2a0fee685f3
c2521b050955d9d452769f61454c9ddfa9c308146ade10546c
fa829794448eaffbc9a04a29d216
[current] =>
ce08bf30bcbb879a18b49239a9bec6b8702f52452f88a9d321
42cad8d2494d5735e6bfa0d8642b2762c62ca5be49f9bf4ec2
31d4a230559d4f3e2c471d3ea094
)
[/version.php] => Array
(
[expected] =>
c5a03bacae8dedf8b239997901ba1fffd2fe51271d13a00cc4
b34b09cca5176397a89fc27381cbb1f72855fa18b69b6f87d7
d5685c3b45aee373b09be54742ea
[current] =>
88a3a92c11db91dec1ac3be0e1c87f862c95ba6ffaaaa3f2c3
b8f682187c66f07af3a3b557a868342ef4a271218fe1c1e300
c478e6c156c5955ed53c40d06585
)
)
[EXTRA_FILE] => Array
(
[/test.php] => Array
(
[expected] =>
[current] =>
09563164f9904a837f9ca0b5f626db56c838e5098e0ccc1d8b
935f68fa03a25c5ec6f6b2d9e44a868e8b85764dafd1605522
b4af8db0ae269d73432e9a01e63a
)
)
)
[calendar] => Array
(
[EXCEPTION] => Array
(
[class] => OC\IntegrityCheck\Exceptions\InvalidSignature
Exception
[message] => Signature data not found.
)
)
)
In above error output it can be seen that:
1. In the Nextcloud core (that is, the Nextcloud server itself) the files
"index.php" and "version.php" do have the wrong version.
2. In the Nextcloud core the unrequired extra file "/test.php" has been found.
3. It was not possible to verify the signature of the calendar application.
The solution is to upload the correct "index.php" and "version.php" files, and
delete the "test.php" file. For the calendar exception contact the developer of
the application. For other means on how to receive support please take a look at
https://nextcloud.com/support/. After fixing these problems verify by clicking
"Rescan…".
.. note:: When using a FTP client to upload those files make sure it is using the
``Binary`` transfer mode instead of the ``ASCII`` transfer mode.
.. _rescans_label:
Rescans
-------
Rescans are triggered at installation, and by updates. You may run scans manually with the ``occ`` command. The first command scans the Nextcloud server files, and the second command scans the named app. There is not yet a command to manually scan all apps::
occ integrity:check-core
occ integrity:check-app $appid
See :doc:`../configuration_server/occ_command` to learn more about using ``occ``.
Errors
------
.. warning:: Please don't modify the mentioned ``signature.json`` itself.
The following errors can be encountered when trying to verify a code signature.
- ``INVALID_HASH``
- The file has a different hash than specified within ``signature.json``. This
usually happens when the file has been modified after writing the signature
data.
- ``MISSING_FILE``
- The file cannot be found but has been specified within ``signature.json``.
Either a required file has been left out, or ``signature.json`` needs to be
edited.
- ``EXTRA_FILE``
- The file does not exist in ``signature.json``. This usually happens when a
file has been removed and ``signature.json`` has not been updated. It also
happens if you have placed additional files in your Nextcloud installation
folder.
- ``EXCEPTION``
- Another exception has prevented the code verification. There are currently
these following exceptions:
- ``Signature data not found.``
- The app has mandatory code signing enforced but no ``signature.json``
file has been found in its ``appinfo`` folder.
- ``Certificate is not valid.``
- The certificate has not been issued by the official Nextcloud Code
Signing Root Authority.
- ``Certificate is not valid for required scope. (Requested: %s, current: %s)``
- The certificate is not valid for the defined application. Certificates
are only valid for the defined app identifier and cannot be used for
others.
- ``Signature could not get verified.``
- There was a problem with verifying the signature of ``signature.json``.
wedding-pics/core/doc/admin/_sources/issues/general_troubleshooting.rst.txt
+504
View File
@@ -0,0 +1,504 @@
=======================
General troubleshooting
=======================
If you have trouble installing, configuring or maintaining Nextcloud, please
refer to our community support channels:
* `The Nextcloud Forums`_
The Nextcloud forums have a `FAQ page`_ where each topic corresponds
to typical mistakes or frequently occurring issues
Please understand that all these channels essentially consist of users like you
helping each other out. Consider helping others out where you can, to contribute
back for the help you get. This is the only way to keep a community like
Nextcloud healthy and sustainable!
If you are using Nextcloud in a business or otherwise large scale deployment,
note that Nextcloud GmbH offers commercial support options.
Bugs
----
If you think you have found a bug in Nextcloud, please:
* Search for a solution (see the options above)
* Double-check your configuration
If you can't find a solution, please use our `bugtracker`_. You can generate a
configuration report with the :ref:`occ config command
<config_commands_label>`, with passwords automatically obscured.
.. _the Nextcloud Forums: https://help.nextcloud.com
.. _FAQ page: https://help.nextcloud.com/t/how-to-faq-wiki
.. _bugtracker: https://docs.nextcloud.com/server/latest/developer_manual/prologue/bugtracker/index.html
.. TODO ON RELEASE: Update version number above on release
General troubleshooting
-----------------------
Check the Nextcloud :doc:`../installation/system_requirements`, especially
supported browser versions.
When you see warnings about ``code integrity``, refer to :doc:`code_signing`.
Disable 3rdparty / non-shipped apps
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It might be possible that 3rd party / non-shipped apps are causing various
different issues. Always disable 3rd party apps before upgrades, and for
troubleshooting. Please refer to the :ref:`apps_commands_label` on how
to disable an app from command line.
Nextcloud logfiles
^^^^^^^^^^^^^^^^^^
In a standard Nextcloud installation the log level is set to ``Normal``. To find
any issues you need to raise the log level to ``All`` in your ``config.php``
file, or to **Everything** on your Nextcloud Admin page. Please see
:doc:`../configuration_server/logging_configuration` for more information on
these log levels.
Some logging - for example JavaScript console logging - needs debugging
enabled. Edit :file:`config/config.php` and change ``'debug' => false,`` to
``'debug' => true,`` Be sure to change it back when you are finished.
For JavaScript issues you will also need to view the javascript console. All
major browsers have developer tools for viewing the console, and you
usually access them by pressing F12.
.. note:: The logfile of Nextcloud is located in the data directory
``nextcloud/data/nextcloud.log``.
.. _label-phpinfo:
PHP version and information
^^^^^^^^^^^^^^^^^^^^^^^^^^^
You will need to know the PHP version and configuration that is in-use on your
Nextcloud server. This will not necessarily be the same version and configuration as
can be reached from the command-line. The simplest way to gather this information is
by using what's commonly referenced as ``phpinfo()``.
The most accurate - and easiest - way to access ``phpinfo`` is by checking it from
within Nextcloud itself. Of course, this requires that Nextcloud is functioning
enough that you can log in as an administrator and access the
**Administration settings -> System** menu. If so, you can enable the exposure of
``phpinfo`` data by toggling it on via ``occ``:
``./occ config:app:set --value=yes serverinfo phpinfo``
From then on a new button labeled **Show phpinfo** will be visible in the web
interface under **Administration settings -> System**. Clicking it will expose
just about everything you may want to know about your PHP environment.
If accessing the Nextcloud web interface is not an option, you may create a
plain-text file named **phpinfo.php** and place it in your Web root, for
example ``/var/www/html/phpinfo.php``. (Your Web root may be in a different
location; your Linux distribution documentation will tell you where.) This file
contains just this line::
<?php phpinfo(); ?>
Open this file in a Web browser by pointing your browser to
``localhost/phpinfo.php``:
.. figure:: ../images/phpinfo.png
Your PHP version is at the top, and the rest of the page contains abundant
system information such as active modules, active ``.ini`` files, and much more.
When you are finished reviewing your information you must delete
``phpinfo.php``, or move it outside of your Web directory, because it is a
security risk to expose such sensitive data.
Debugging sync issues
^^^^^^^^^^^^^^^^^^^^^
.. warning:: The data directory on the server is exclusive to Nextcloud and must
not be modified manually.
Disregarding this can lead to unwanted behaviors like:
* Problems with sync clients
* Undetected changes due to caching in the database
If you need to directly upload files from the same server please use a WebDAV
command line client like ``cadaver`` to upload files to the WebDAV interface at:
``https://example.com/nextcloud/remote.php/dav``
Common problems / error messages
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Some common problems / error messages found in your logfiles as described above:
* ``SQLSTATE[HY000] [1040] Too many connections`` -> You need to increase the
connection limit of your database, please refer to the manual of your database
for more information.
* ``SQLSTATE[HY000]: General error: 5 database is locked`` -> You're using
``SQLite``
which can't handle a lot of parallel requests. Please consider converting to
another database like described in
:doc:`../configuration_database/db_conversion`.
* ``SQLSTATE[HY000]: General error: 2006 MySQL server has gone away`` -> Please
refer to :ref:`db-troubleshooting-label` for more information.
* ``SQLSTATE[HY000] [2002] No such file or directory`` -> There is a problem
accessing your SQLite database file in your data directory
(``data/nextcloud.db``). Please check the permissions of this folder/file or
if it exists at all. If you're using MySQL please start your database.
* ``Connection closed / Operation cancelled`` -> This could be caused by wrong
``KeepAlive`` settings within your Apache config. Make sure that
``KeepAlive`` is set to ``On`` and also try to raise the limits of
``KeepAliveTimeout`` and ``MaxKeepAliveRequests``.
* ``No basic authentication headers were found`` -> This error is shown in your
``data/nextcloud.log`` file. Some Apache modules like ``mod_fastcgi``, ``mod_fcgid``
or ``mod_proxy_fcgi`` are not passing the needed authentication headers to
PHP and so the login to Nextcloud via WebDAV, CalDAV and CardDAV clients is
failing.
Troubleshooting Web server and PHP problems
-------------------------------------------
Logfiles
^^^^^^^^
When having issues the first step is to check the logfiles provided by PHP, the
Web server and Nextcloud itself.
.. note:: In the following the paths to the logfiles of a default Debian
installation running Apache2 with mod_php is assumed. On other Web servers,
Linux distros or operating systems they can differ.
* The logfile of Apache2 is located in ``/var/log/apache2/error.log``.
* The logfile of PHP can be configured in your ``/etc/php/8.0/apache2/php.ini``.
You need to set the directive ``log_errors`` to ``On`` and choose the path
to store the logfile in the ``error_log`` directive. After those changes you
need to restart your Web server.
* The logfile of Nextcloud is located in the data directory
``/var/www/nextcloud/data/nextcloud.log``.
Web server and PHP modules
^^^^^^^^^^^^^^^^^^^^^^^^^^
.. note:: Lighttpd is not supported with Nextcloud, and some Nextcloud features
may not work at all on Lighttpd.
There are some Web server or PHP modules which are known to cause various
problems like broken uploads/downloads. The following shows a draft overview of
these modules:
1. Apache
* mod_pagespeed
* mod_evasive
* mod_security
* mod_reqtimeout
* mod_deflate
* libapache2-mod-php*filter (use libapache2-mod-php8.0 instead)
* mod_spdy together with libapache2-mod-php5 / mod_php (use fcgi or php-fpm
instead)
* mod_dav
* mod_xsendfile / X-Sendfile (causing broken downloads if not configured
correctly)
2. NginX
* ngx_pagespeed
* HttpDavModule
* X-Sendfile (causing broken downloads if not configured correctly)
3. PHP
* eAccelerator
.. _trouble-webdav-label:
Troubleshooting WebDAV
----------------------
Nextcloud uses SabreDAV, and the SabreDAV documentation is comprehensive and
helpful.
.. note: Lighttpd is not supported on Nextcloud, and Lighttpd WebDAV does not
work with Nextcloud.
See:
* `SabreDAV FAQ <http://sabre.io/dav/faq/>`_
* `Web servers <http://sabre.io/dav/webservers>`_ (Lists lighttpd as not
recommended)
* `Working with large files <http://sabre.io/dav/large-files/>`_ (Shows a PHP
bug in older SabreDAV versions and information for mod_security problems)
* `0 byte files <http://sabre.io/dav/0bytes>`_ (Reasons for empty files on the
server)
* `Clients <http://sabre.io/dav/clients/>`_ (A comprehensive list of WebDAV
clients, and possible problems with each one)
* `Finder, OS X's built-in WebDAV client
<http://sabre.io/dav/clients/finder/>`_
(Describes problems with Finder on various Web servers)
There is also a well maintained FAQ thread available at the `ownCloud Forums
<https://central.owncloud.org/t/how-to-fix-caldav-carddav-webdav-problems/852>`_
which contains various additional information about WebDAV problems.
.. _service-discovery-label:
Service discovery
-----------------
Some clients - especially on iOS/macOS - have problems finding the proper
sync URL, even when explicitly configured to use it.
If you want to use CalDAV or CardDAV clients or other clients that require service discovery
together with Nextcloud it is important to have a correct working setup of the following
URLs:
| ``https://example.com/.well-known/carddav``
| ``https://example.com/.well-known/caldav``
|
Those need to be redirecting your clients to the correct endpoints. If Nextcloud
is running at the document root of your Web server the correct URL is
``https://example.com/remote.php/dav`` for CardDAV and CalDAV and if running in a
subfolder like ``nextcloud``, then ``https://example.com/nextcloud/remote.php/dav``.
For the first case the :file:`.htaccess` file shipped with Nextcloud should do
this work for you when you're running Apache. You need to make sure that your
Web server is using this file. Additionally, you need the mod_rewrite Apache
module installed and ``AllowOverride All`` set in your :file:`apache2.conf`
or vHost-file to process these redirects. When running Nginx please refer to
:doc:`../installation/nginx`.
If your Nextcloud instance is installed in a subfolder called ``nextcloud`` and
you're running Apache, create or edit the :file:`.htaccess` file within the
document root of your Web server and add the following lines::
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule ^\.well-known/carddav /nextcloud/remote.php/dav [R=301,L]
RewriteRule ^\.well-known/caldav /nextcloud/remote.php/dav [R=301,L]
RewriteRule ^\.well-known/webfinger /nextcloud/index.php/.well-known/webfinger [R=301,L]
RewriteRule ^\.well-known/nodeinfo /nextcloud/index.php/.well-known/nodeinfo [R=301,L]
</IfModule>
Make sure to change /nextcloud to the actual subfolder your Nextcloud instance is running in.
.. note:: If you put the above directives directly into an Apache
configuration file (usually within ``/etc/apache2/``)
instead of ``.htaccess``, you need to prepend the first argument of
each ``RewriteRule`` option with a forward slash ``/``, for example
``^/\.well-known/carddav``.
This is because Apache normalizes paths for the use in ``.htaccess``
files by dropping any number of leading slashes, but it does not
do so for the use in its main configuration files.
If you are running NGINX, make sure ``location = /.well-known/carddav {`` and ``location = /.well-known/caldav {`` are properly configured as described in :doc:`../installation/nginx`, adapt to use a subfolder if necessary.
Now change the URL in the client settings to just use:
``https://example.com``
instead of e.g.
``https://example.com/nextcloud/remote.php/dav/principals/username``.
There are also several techniques to remedy this, which are described extensively at
the `Sabre DAV website <http://sabre.io/dav/service-discovery/>`_.
Troubleshooting sharing
-----------------------------------
Users' Federated Cloud IDs not updated after a domain name change
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1. run Database query
| ``DELETE FROM oc_cards_properties WHERE name = 'CLOUD' AND addressbookid = (select id from oc_addressbooks where principaluri = 'principals/system/system' AND uri = 'system');``
2. run occ commands
| ``occ dav:sync-system-addressbook``
| ``occ federation:sync-addressbooks``
.. _trouble-file-encoding-ext-storages:
Troubleshooting file encoding on external storages
--------------------------------------------------
When using external storage, it can happen that some files with special characters will not
appear in the file listing, or they will appear and not be accessible.
When this happens, please run the :ref:`files scanner<occ_files_scan_label>`, for example with::
sudo -u www-data php occ files:scan --all
If the scanner tells about an encoding issue on the affected file, please enable Mac encoding compatibility in the :ref:`mount options<external_storage_mount_options_label>`
and then :ref:`rescan the external storage<occ_files_scan_label>`.
.. note::
This mode comes with a performance impact because Nextcloud will always try both encodings when detecting files
on external storages.
Mac computers are using the NFD Unicode Normalization for file names which is different than NFC, the one used
by other operating systems. Mac users might upload files directly to the external storage using NFD normalized
file names. When uploading through Nextcloud, file names will always be normalized to the NFC standard for consistency.
It is recommended to let Nextcloud use external storages exclusively to avoid such issues.
See also `technical explanation about NFC vs NFD normalizations <https://www.win.tue.nl/~aeb/linux/uc/nfc_vs_nfd.html>`_.
Troubleshooting contacts & calendar
-----------------------------------
Unable to update contacts or events
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you get an error like:
``PATCH https://example.com/remote.php/dav HTTP/1.0 501 Not Implemented``
it is likely caused by one of the following reasons:
Using Pound reverse-proxy/load balancer
As of writing this Pound doesn't support the HTTP/1.1 verb.
Pound is easily `patched
<http://www.apsis.ch/pound/pound_list/archive/2013/2013-08/1377264673000>`_
to support HTTP/1.1.
Misconfigured Web server
Your Web server is misconfigured and blocks the needed DAV methods.
Please refer to :ref:`trouble-webdav-label` above for troubleshooting steps.
Troubleshooting data-directory
------------------------------
If you have a fresh install, consider reinstalling with your preferred directory location.
Unofficially moving the data directory can be done as follows:
1. Make sure no cron jobs are running
2. Stop apache
3. Move /data to the new location
4. Change the config.php entry
5. Edit the database: In oc_storages change the path on the local::/old-data-dir/ entry
6. Ensure permissions are still correct
7. Restart apache
.. warning
However this is not supported and you risk breaking your database.
For a safe moving of data directory, supported by Nextcloud, recommended actions are:
1. Make sure no cron jobs are running
2. Stop apache
3. Move /data to the new location
4. Create a symlink from the original location to the new location
5. Ensure permissions are still correct
6. Restart apache
.. warning
Note, you may need to configure your webserver to support symlinks.
Troubleshooting quota or size issues
------------------------------------
Sometimes it can happen that the used space reported in the web UI or with ``occ user:info $userId``
does not match the actual data stored in the user's ``data/$userId/files`` directory.
.. note::
Metadata, versions, trashbin and encryption keys are not counted in the used space above.
Please refer to the `quota documentation <https://docs.nextcloud.com/server/latest/user_manual/en/files/quota.html>`_ for details.
.. TODO ON RELEASE: Update version number above on release
Running the following command can help fix the sizes and quota for a given user::
sudo -u www-data php occ files:scan -vvv <user-id>
If **encryption was enabled earlier on the instance and disabled later on**, it is likely that some
size values in the database did not correctly get reset upon decrypting.
You can run the following SQL query to reset those after **backing up the database**:
.. code-block:: sql
UPDATE oc_filecache SET unencrypted_size=0 WHERE encrypted=0;
Troubleshooting downloading or decrypting files
-----------------------------------------------
Bad signature error
^^^^^^^^^^^^^^^^^^^
In some rare cases it can happen that encrypted files cannot be downloaded
and return a "500 Internal Server Error". If the Nextcloud log contains an error about
"Bad Signature", then the following command can be used to repair affected files::
occ encryption:fix-encrypted-version userId --path=/path/to/broken/file.txt
Replace "userId" and the path accordingly.
The command will do a test decryption for all files and automatically repair the ones with a signature error.
.. _troubleshooting_encryption_key_not_found:
Encryption key cannot be found
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If the logs contain an error stating that the encryption key cannot be found, you can manually search the data directory for a folder that has the same name as the file name.
For example if a file "example.md" cannot be decrypted, run::
find path/to/datadir -name example.md -type d
Then check the results located in the ``files_encryption`` folder.
If the key folder is in the wrong location, you can move it to the correct folder and try again.
The ``data/files_encryption`` folder contains encryption keys for group folders and system-wide external storages
while ``data/$userid/files_encryption`` contains the keys for specific user storage files.
.. note::
This can happen if encryption was disabled at some point but the :ref:`occ command for decrypt-all<occ_disable_encryption_label>` was not run, and
then someone moved the files to another location. Since encryption was disabled, the keys did not get moved.
Encryption key cannot be found with external storage or group folders
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To resolve this issue, please run the following command::
sudo -u www-data php occ encryption:fix-key-location <user-id>
This will attempt to recover keys that were not moved properly.
If this doesn't resolve the problem, please refer to the section :ref:`Encryption key cannot be found<troubleshooting_encryption_key_not_found>` for a manual procedure.
.. note::
There were two known issues where:
- moving files between an encrypted and non-encrypted storage like external storage or group folder `would not move the keys with the files <https://github.com/nextcloud/groupfolders/issues/1896>`_.
- putting files on system-wide external storage would store the keys in the `wrong location <https://github.com/nextcloud/server/pull/32690>`_.
Fair Use Policy
---------------
Nextcloud is open source and you can host it for free on your own server or at a provider.
Nextcloud recommends Using Nextcloud Enterprise for deploying instances with more than 500 users. With that size, issues like a broken server or a data leak become very serious.
If there is an issue with the server, 500 people can't work. A data leak would risk the data of many users. In short, the server should be considered mission-critical. We believe you and your users would have a better experience with Nextcloud Enterprise.
Nextcloud Enterprise is pre-configured and optimised for the needs of professional organisations rather than home users. It comes with support, security and scaling benefits, compliance expertise, and access to our knowledge about running a successful Nextcloud, to get the best possible experience for users and admins. This also reduces the load on our home user forum http://help.nextcloud.com from issues unique to big deployments.
Nextcloud provides some infrastructure components needed for Nextcloud servers to run reliably. This includes notification, our app store and more. To ensure these resources do not get overloaded by administrators who run Nextcloud for thousands of users without providing financial resources to Nextcloud in return, these components are limited and will not work for more than 500 users.
We believe all organisations who run Nextcloud for hundreds of users should be officially supported. We know there can be financial restrictions for non-profit organisations and, as we want everybody to have a chance to get the most out of Nextcloud, we have special offers for NGOs, small schools and other non-profits. Please reach out to talk to us about what is possible through the `contact form on our site <https://nextcloud.com/contact/>`_ or ask your system administrator to reach out.
Other issues
------------
Some services like *Cloudflare* can cause issues by minimizing JavaScript
and loading it only when needed. When having issues like a not working
login button or creating new users make sure to disable such services
first.

Some files were not shown because too many files have changed in this diff Show More