How to install NextCloud 15 server on CentOS 7.x

NextCloud CentOS Logo

NextCloud is a Dropbox-like solution for self-hosted file sharing and syncing. Installing NextCloud 15 on CentOS is quite simple. Whether you want to backup, have file-syncing or just have a Google Calendar alternative, this guide is for you.

What is NextCloud? Is it like a “cloud”?

cloud computing

If you stumbled here by chance and don’t know what NextCloud is, here is an article explaining its principal features and advantages/disadvantages. In this other article you can find NextCloud 15 new features. To tell you the truth, NextCloud is a SaaS cloud, if you want to know more about cloud types you can read this article.

In this article we will cover the installation of the server (not the client).

What’s the newest version?

The newest version of this tutorial is the following:

Looking for an earlier version of this tutorial?

Step1: Install software

Important
I take NO responsibility of what you do with your machine; use this tutorial as a guide and remember you can possibly cause data loss if you touch things carelessly.

The first step in order to install NextCloud 15 is to install a web server and PHP. Since CentOS 7 ships with PHP 5.4 by default but NextCloud 15 requires at least PHP 7 we’ll also be installing PHP 7 from a third-party repository. The following procedure will install apache as webserver. Input the commands one by one to avoid errors!

CentOS 7

If you’d rather use PHP 7.3, you can follow this tutorial: how to install PHP 7.3 on CentOS 7. PHP 7.3 isn’t yet available in this repository.

Warning!
If you decided to use PHP 7.3 rather than PHP 7.2 using the past tutorial, replace each instance of php72w with php73w in all the successive commands.

Open a terminal and input the following commands:

# yum install epel-release
# rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
# yum install httpd php72w php72w-dom php72w-mbstring php72w-gd php72w-pdo php72w-json php72w-xml php72w-zip php72w-curl php72w-pear php72w-intl setroubleshoot-server bzip2 php72w-pecl-imagick

Step 2: Database selection

Now that you got the software, you need to choose a database that will support the installation. You have three choices:

  • SQLite: is a single-file database. It is suggested only for small installations since it will slow NextCloud down sensibly.
  • MariaDB/MySQL: are popular open source databases especially amongst web developers. It is the suggested choice.
  • PostgreSQL: a popular enterprise-class database. More complicated than MySQL/MariaDB.

Now, this choice won’t really alter the functionality of NextCloud (except if you use SQLite), so pick whatever you know best. If you’re unsure pick MariaDB/MySQL.

SQLiteMySQL/MariaDBPostgreSQL

No additional steps are required if you choose SQLite.

Install the software:

# yum install mariadb-server php72w-mysql

Start (and enable at boot) the service:

# systemctl start mariadb
# systemctl enable mariadb

Next step is to configure the database management system. During the configuration you will be prompted to choose a root password, pick a strong one.

# mysql_secure_installation

Now you need to enter the database (you will be asked the password you just set):

$ mysql -u root -p

Now that you are in create a database:

CREATE DATABASE nextcloud;

Now you need to create the user that will be used to connect to the database:

CREATE USER 'nc_user'@'localhost' IDENTIFIED BY 'YOUR_PASSWORD_HERE';

The last step is to grant the privileges to the new user:

GRANT ALL PRIVILEGES ON nextcloud.* TO 'nc_user'@'localhost';
FLUSH PRIVILEGES;

When you’re done type Ctrl-D to exit.

Install the software:

# yum install postgresql postgresql-server php72w-pgsql

Run the setup:

# postgresql-setup initdb

Start (and enable at boot) the service:

# systemctl start postgresql
# systemctl enable postgresql

Now you need to enter the database:

$ sudo -u postgres psql

Now that you are in create a database:

CREATE DATABASE nextcloud;

Now you need to create the user that will be used to connect to the database:

CREATE USER nc_user WITH PASSWORD 'YOUR_PASSWORD_HERE';

The last step is to grant the privileges to the new user:

GRANT ALL PRIVILEGES ON DATABASE nextcloud to nc_user;

When you’re done type \q and press enter to exit.

Warning: You may experience difficulties in authenticating NextCloud with PostgreSQL since the local authentication method is set to ident by default. If you want to change it keep reading.

The configuration file for PostgreSQL is a file located in /var/lib/pgsql/data/pg_hba.conf . Open it with your favourite editor and look for the marked line (line 5, 7):

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# "local" is for Unix domain socket connections only
local   all             all                                     peer
# IPv4 local connections:
host    all             all             127.0.0.1/32            ident
# IPv6 local connections:
host    all             all             ::1/128                 ident
# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident

Replace ident with md5 on that line and restart PostgreSQL:

# systemctl restart postgresql

Step 3: Install NextCloud

This step involves getting the software and configure Apache to run it.

CentOS 7

With these step we download the software and extract it:

# cd /var/www/html
# curl -o nextcloud-15-latest.tar.bz2 https://download.nextcloud.com/server/releases/latest-15.tar.bz2
# tar -xvjf nextcloud-15-latest.tar.bz2
# mkdir nextcloud/data
# chown -R apache:apache nextcloud
# rm nextcloud-15-latest.tar.bz2

Now we need to create a new file in /etc/httpd/conf.d/nextcloud.conf . Feel free to use whatever editor you feel comfortable with and add the following lines:

Alias /nextcloud "/var/www/html/nextcloud/"

<Directory /var/www/html/nextcloud/>
  Options +FollowSymlinks
  AllowOverride All

 <IfModule mod_dav.c>
  Dav off
 </IfModule>

 SetEnv HOME /var/www/html/nextcloud
 SetEnv HTTP_HOME /var/www/html/nextcloud

</Directory>

Step 4: Setting Apache and SELinux

In this step we’ll start (and enable) the webserver and we’ll set SELinux up. Now, many tutorials will tell you to disable SELinux (because it is a difficult component to manage). Instead, I suggest you to keep it on and add the rules for NextCloud:

CentOS 7
# semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
# semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
# semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
# semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.htaccess'
# semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
# restorecon -Rv '/var/www/html/nextcloud/'

If you decided to use a Mariadb/MySQL/PostgreSQL, you also need to allow apache to access it:

# setsebool -P httpd_can_network_connect_db 1

Now that you’ve configured SELinux let’s start and enable Apache:

# systemctl start httpd
# systemctl enable httpd

Step 5: Configuring firewall

This step is essential when your firewall is enabled. If your firewall is enabled you won’t be able to access your NextCloud 14 instance; on the other hand if it isn’t enabled you shouldn’t have any problems and you can simply skip this step. 

Tip!
Keep in mind having a firewall enabled is a good security practice and you should already have one enabled.

In order for the firewall to work, it must be enabled. This guide will not include this part. When you enable a firewall many things can go wrong, e.g. you’re using SSH, you enable the firewall and your connection is cut and can’t connect otherwise, hence you should carefully review the documentation from your distribution.

To open the ports needed by NextCloud 15 follow these steps:

FirewallDIPtables

FirewallD is a newer firewall used to simplify firewall management. If you’re using it you can simply do:

# firewall-cmd --add-service http --permanent
# firewall-cmd --add-service https --permanent
# firewall-cmd --reload

IPtables is an older firewall (still widely used), if you have disabled firewallD you can use IPtables directly.

# iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
# iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Step 6: Install

Once you’re done, it’s time to install everything. Head to http://YOUR_IP_ADDRESS/nextcloud/ and you will be facing the following screen:

NextCloud 15 Installation
NextCloud 15 Installation

Select an administrator username and password. Then click on “Storage & Database“, here you can select the data folder, but if you don’t know what you’re doing it’s best if you leave it with the default value. Then select the database you chose during step 2. Fill everything and if you’ve followed all the steps correctly you should be seeing the following screen:

NextCloud 15 Welcome screen
NextCloud 15 Welcome screen

Step 7: Enable Caching (suggested)

NextCloud is good but it can be very slow if you don’t configure a caching solution. There are two caching solutions covered in this guide:

  • PHP OPcache: a PHP inbuilt cache solution that speeds up scripts execution.
  • Redis server: a fast in-memory key-value store that speeds up everything in NextCloud.

Enabling OPcache

CentOS

Open a terminal and input the following commands:

# yum install php-opcache

Now you need to edit a file located at /etc/php.d/10-opcache.ini . With your favorite editor, edit the file and make it look like this:

; Enable Zend OPcache extension module
zend_extension=opcache.so
opcache.enable=1
opcache.enable_cli=1
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

These values are suggested by NextCloud, but you’re free to tweak them to suit your needs. Once you’re done you can restart apache:

# systemctl restart httpd

Installing and configuring Redis

CentOS

Open a terminal and input the following commands:

# yum install redis php72w-pecl-redis

Now you must configure NextCloud to use Redis. To do so you need to edit the NextCloud configuration file located at /var/www/html/nextcloud/config/config.php . The file will look like this, add the highlighted lines:

<?php
$CONFIG = array (
  'instanceid' => '',
  'passwordsalt' => '',
  'secret' => '',
  'trusted_domains' =>
  array (
    0 => 'YOUR_IP',
  ),
  'datadirectory' => '/var/www/html/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '15.0.0.10',
  'overwrite.cli.url' => 'http://YOUR_IP/nextcloud',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'nc_user',
  'dbpassword' => 'YOUR_PASSWORD_HERE',
  'installed' => true,
  'memcache.locking' => '\OC\Memcache\Redis',
  'memcache.distributed' => '\OC\Memcache\Redis',
  'memcache.local' => '\OC\Memcache\Redis',
  'redis' => [
    'host' => 'localhost',
    'port' => 6379,
    'timeout' => 3,
  ],
);

These settings will enable NextCloud to use Redis for caching and file locks. Of course these settings are just an example, you can tweak them to suit your needs.

Now you need to modify (for some reason) the Redis port SELinux label in order to enable Apache to access Redis:

# semanage port -m -t http_port_t -p tcp 6379

Lastly, enable and start Redis and restart the webserver:

# systemctl start redis
# systemctl enable redis
# systemctl restart httpd

Step 8: Expose NextCloud to Internet (optional)

Important
Hosting applications available to the Internet is potentially dangerous. In order to keep your applications safe you need to be proficient in system security and to follow security best practices.

Most people will want to access their files from whatever location they are. To do so, your newly created NextCloud instance needs to be connected to the Internet.

Given that you need to take care of port-forwarding (if you’re a home user) and domain configuration (which varies according to your provider), here you can find the instructions to create a virtual host with Apache.

CentOS

Using your favorite text editor, edit the file we created previously at /etc/httpd/conf.d/nextcloud.conf . And make it look like this:

<VirtualHost *:80>
  ServerName YOURDOMAIN.TLD
  ServerAdmin [email protected]
  DocumentRoot /var/www/html/nextcloud

  <directory /var/www/html/nextcloud>
    Require all granted
    AllowOverride All
    Options FollowSymLinks MultiViews
    SetEnv HOME /var/www/html/nextcloud
    SetEnv HTTP_HOME /var/www/html/nextcloud
  </directory>
</VirtualHost>

It is important to set ServerName according to a domain you own and have configured correctly. Now you need to add YOURDOMAIN.TLD to the trusted domains in the NextCloud config file. You can do so with the following command:

$ sudo -u apache php /var/www/html/nextcloud/occ config:system:set trusted_domains 2 --value=YOURDOMAIN.TLD

Once you complete this step you won’t be able to access NextCloud through http://YOUR_IP_ADDRESS/nextcloud anymore. Instead you will be able to access it through http://YOURDOMAIN.TLD (notice /nextcloud is gone).

Lastly, restart the webserver:

# systemctl restart httpd

Step 9: Get a free SSL certificate with Let’s Encrypt! (SUGGESTED!

Now that you have your NextCloud instance up and running you’re good to go, but beware: you’re not safe. Internet is a dangerous place for your data and you will most likely need an SSL certificate to ensure your communications are encrypted. Provided you own a domain name you can get one for free using Let’s Encrypt! No catches, free forever.

Warning!
Let’s Encrypt has rate limits in place to prevent inappropriate usage of the CA. There’s a limit on the numbers of attempts you can do before getting a temporary ban. During this setup, if things go wrong, I suggest you to use the –staging option to avoid the temporary ban. The –staging option will use a testing server and will not issue valid certificates. When you have completed the procedure against the test server successfully, you can remove the –staging option to obtain the real certificate.
CentOS

Open a terminal and input the following commands:

# yum install certbot certbot-apache

Now you will run the command to install a certificate, follow the procedure and you will get everything configured out of the box:

$ sudo certbot --apache

Lastly, restart the webserver:

# systemctl restart httpd

If you need further help you can follow my other tutorial on Let’s Encrypt on CentOS (the apache part).

Image courtesy of mark | marksei
mark

You may also like...

17 Responses

  1. The AlieN says:

    Following your docs which are great. Modifying slightly based on other docs out there. I noticed on step:

    # yum install redis php72w-pecl-redis

    I’m getting:

    Resolving Dependencies
    –> Running transaction check
    —> Package php72w-pecl-redis.x86_64 0:3.1.6-1.w7 will be installed
    –> Processing Dependency: php-pecl-igbinary(x86-64) for package: php72w-pecl-redis-3.1.6-1.w7.x86_64
    —> Package redis.x86_64 0:3.2.12-2.el7 will be installed
    –> Processing Dependency: libjemalloc.so.1()(64bit) for package: redis-3.2.12-2.el7.x86_64
    –> Running transaction check
    —> Package jemalloc.x86_64 0:3.6.0-1.el7 will be installed
    —> Package php55w-pecl-igbinary.x86_64 0:2.0.1-1.w7 will be installed
    –> Processing Dependency: php(zend-abi) = 20121212-64 for package: php55w-pecl-igbinary-2.0.1-1.w7.x86_64
    –> Processing Dependency: php(api) = 20121113-64 for package: php55w-pecl-igbinary-2.0.1-1.w7.x86_64
    –> Running transaction check
    —> Package php55w-common.x86_64 0:5.5.38-1.w7 will be installed
    –> Processing Conflict: php72w-common-7.2.16-1.w7.x86_64 conflicts php-common Finished Dependency Resolution

    I also tried:

    [root@~]# yum –enablerepo=webtatic install php72w-pecl-igbinary
    Loaded plugins: fastestmirror
    Loading mirror speeds from cached hostfile
    * base: repos.mia.quadranet.com
    * epel: reflector.westga.edu
    * extras: repos.mia.quadranet.com
    * updates: repos.mia.quadranet.com
    * webtatic: us-east.repo.webtatic.com
    No package php72w-pecl-igbinary available.

    I had to do:

    # rpm -ivh ftp://ftp.pbone.net/mirror/repo.webtatic.com/yum/el7/x86_64/RPMS/php72w-pecl-igbinary-2.0.5-1.w7.x86_64.rpm

    And then: # yum install redis php72w-pecl-redis

    Then it installed.

    • mark says:

      Hello The AlieN, I’m currently investigating the issue but I can’t seem to be able to reproduce it.

    • mark says:

      Hello The AlieN, I’m currently investigating the issue but I can’t seem to be able to reproduce it.

  2. Magnus Pesch says:

    Thank you for this tutorial. I was able to deploy it with Nextcloud V15.0.7 right now.

    But one thing is not working – after step 8 I was able to type the IP and was directly getting to IP/nextcloud, which is ok.

    But: on my firewall I am running HAProxy, and there I am managing Let’s Encrypt certs with SSL termination, So it should go to the nextcloud server on port 80.

    Now, via IP, I am getting to nextcloud, as I said. When I type the correct domainname I am getting an 503 error. I think there has to be an additional configuration in nextcloud, maybe you can give a hint!?

    • Magnus Pesch says:

      Hi again, went fast – I found the answer myself.

      Nextcloud’s config.php is to change like this:
      ‘overwrite.cli.url’ => ‘https://YOURDOMAIN.TLD/nextcloud’,
      ‘overwriteprotocol’ => ‘https’,

  3. rafale says:

    $ sudo -u apache php /var/www/html/nextcloud/occ config:system:set trusted_domains 2 –value=YOURDOMAIN.TLD

    I don’t think this command works… there is no apache binary. I think this command is for version 12 era? Could you please provide an update?

    • mark says:

      Hello Rafale, you should try commands before actually reporting they do not work (you might be impressed! : ) ). The -u flag of sudo specifies the “user” that will execute the command, in this case, apache. The actual command is “php”.

      Although it may seem that my tutorials are all copy’n’pasted between versions, I put a lot of time and effort into making them work as intended at each release.

  4. Wolfgang Szoecs says:

    A REALLY COOL SETUP-guide !
    I just followed the steps – and I indeed got a working setup – incl. SSL/TLS working.
    As I plan to replace my dropbox-setup with nextcloud – there’s some more homework to do for me,
    but for a quick start – this guide is really valuable. – SUPER COOL work!

    • mark says:

      Hello Wolfgang,
      thank you for using my guide, I’m planning on expanding this guide with other guides explaining how to get further with NextCloud. Do you have any ideas about which guides you’d like to see here the most? I’d gladly appreciate your feedback : )

  5. Karel says:

    Something strange is going on, when the client is on the same lan as the server I can reach the nextcloud instance (using an no-ip domain). But whenever I’m on a different lan or load the nextcloud instance over 4G I get an error that “the connection was reset”. SSH is working, I scanned all ports and HTTP and HTTPS are open. Any idea what could be going wrong? I did use nextcloud 16…

    • Karel says:

      Just saw you posted the nextcloud 16 guide two days ago… I’ll check that as well. Thank you!

    • mark says:

      Hello Karel, the problem is probably related to one of these three things:
      – no-ip is failing to get you public IP address and it is exposing the private one
      – apache is not listening on the right address
      – a firewall/NAT sitting between the Internet and your NextCloud instance (mostly your router) has not been configured to forward the traffic properly.

      • Karel says:

        I tried to follow your guide to the letter, I also followed the one on the Nextcloud website itself.
        `

        When I connect over 4G i can do a port scan of the no-ip domain name and it says all ports are open:


        Open TCP Port: 1 tcpmux
        Open TCP Port: 2 compressnet
        Open TCP Port: 3 compressnet
        Open TCP Port: 4
        Open TCP Port: 5 rje
        Open TCP Port: 6
        Open TCP Port: 7 echo
        Open TCP Port: 8
        Open TCP Port: 9 discard
        Open TCP Port: 10
        Open TCP Port: 11 systat
        Open TCP Port: 12
        Open TCP Port: 13 daytime
        Open TCP Port: 14
        Open TCP Port: 15
        Open TCP Port: 16
        Open TCP Port: 17 qotd
        Open TCP Port: 18 msp
        Open TCP Port: 19 chargen
        Open TCP Port: 20 ftp-data
        Open TCP Port: 21 ftp
        Open TCP Port: 22 ssh
        Open TCP Port: 23 telnet
        Open TCP Port: 24
        Open TCP Port: 25 smtp
        Open TCP Port: 26
        Open TCP Port: 27 nsw-fe
        Open TCP Port: 28
        Open TCP Port: 29 msg-icp
        Open TCP Port: 30
        Open TCP Port: 31 msg-auth
        Open TCP Port: 32
        Open TCP Port: 33 dsp
        Open TCP Port: 34
        Open TCP Port: 35
        Open TCP Port: 36
        Open TCP Port: 37 time
        Open TCP Port: 38 rap
        Open TCP Port: 39 rlp
        Open TCP Port: 40
        Open TCP Port: 41 graphics
        Open TCP Port: 42 name
        Open TCP Port: 43 nicname
        Open TCP Port: 44 mpm-flags
        Open TCP Port: 45 mpm
        Open TCP Port: 46 mpm-snd
        Open TCP Port: 47 ni-ftp
        Open TCP Port: 48 auditd
        Open TCP Port: 49 tacacs
        Open TCP Port: 50 re-mail-ck
        Open TCP Port: 51 la-maint
        Open TCP Port: 52 xns-time
        Open TCP Port: 53 domain
        Open TCP Port: 54 xns-ch
        Open TCP Port: 55 isi-gl
        Open TCP Port: 56 xns-auth
        Open TCP Port: 57
        Open TCP Port: 58 xns-mail
        Open TCP Port: 59
        Open TCP Port: 60
        Open TCP Port: 61 ni-mail
        Open TCP Port: 62 acas
        Open TCP Port: 63 whois++
        Open TCP Port: 64 covia
        Open TCP Port: 65 tacacs-ds
        Open TCP Port: 66 sql*net
        Open TCP Port: 67 bootps
        Open TCP Port: 68 bootpc
        Open TCP Port: 69 tftp
        Open TCP Port: 70 gopher
        Open TCP Port: 71 netrjs-1
        Open TCP Port: 72 netrjs-2
        Open TCP Port: 73 netrjs-3
        Open TCP Port: 74 netrjs-4
        Open TCP Port: 75
        Open TCP Port: 76 deos
        Open TCP Port: 77
        Open TCP Port: 78 vettcp
        Open TCP Port: 79 finger
        Open TCP Port: 80 http
        Open TCP Port: 81 hosts2-ns
        Open TCP Port: 82 xfer
        Open TCP Port: 83 mit-ml-dev
        Open TCP Port: 84 ctf
        Open TCP Port: 85 mit-ml-dev
        Open TCP Port: 86 mfcobol
        Open TCP Port: 87
        Open TCP Port: 88 kerberos
        Open TCP Port: 89 su-mit-tg
        Open TCP Port: 90 dnsix
        Open TCP Port: 91 mit-dov
        Open TCP Port: 92 npp
        Open TCP Port: 93 dcp
        Open TCP Port: 94 objcall
        Open TCP Port: 95 supdup
        Open TCP Port: 96 dixie
        Open TCP Port: 97 swift-rvf
        Open TCP Port: 98 tacnews
        Open TCP Port: 99 metagram
        Open TCP Port: 100 newacct


        It the portscan also shows the correct dynamic IP of the router.

        I did the port forward on the router http, https and ssh go to my internal IP of the webserver.
        


        When you mention that apache is not listening on the correct addres you mean the virtualhost file correct? Mine looks like this:

        ServerName domain.ddns.net
        ServerAdmin [email protected]
        DocumentRoot /var/www/html/nextcloud

        Require all granted
        AllowOverride All
        Options FollowSymLinks MultiViews

        Dav off

        SetEnv HOME /var/www/html/nextcloud
        SetEnv HTTP_HOME /var/www/html/nextcloud
        Satisfy Any

        Could you recommend any other ways to troubleshoot the issue?

        What really baffles me is that whenever I’m on my local lan I can browse to domain.ddns.net and everything works as expected. It also seems to route all traffic locally because when I upload large files I get 1Gb speeds. But whenever I’m connecting via an external network I get a time out error…

        Also I can SSH into the server from an external network because I forwarded that port as well.

        Many Thanks!

        • mark says:

          The problem lies probably in the fact that domain.ddns.net points to a local IP address instead of a public one. Please review this in your ddns profile : )

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: