Home Verkennen Help
Inloggen
jbranso
/
gnucode.me
Volgen 1
Ster 1
Vork 0
Bestanden Kwesties 0 Pull-aanvragen 0 Wiki
Boom: 25246d0b6b
Aftakkingen Labels
gnucode.me
/
site
/
nextcloud-and-guix-system-server.html

nextcloud-and-guix-system-server.html 17 KB
Geschiedenis Ruwe

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256 
  1. <!DOCTYPE html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><meta name="keywords" content="GNU, Emacs, Libre Software, Hurd, Guile, Guix" /><meta name="description" content="GNUcode.me is a website focusing on libre software projects, especially the GNU project." /><link type="application/atom+xml" rel="alternate" title="GNUcode.me -- Feed" href="/feed.xml" /><a rel="me" href="https://fosstodon.org/@thegnuguy"></a><link type="text/css" href="css/footer.min.css" rel="stylesheet"></link><link type="text/css" href="css/header.min.css" rel="stylesheet"></link><link type="text/css" href="css/main.min.css" rel="stylesheet"></link><title>Nextcloud and Guix System Server — GNUcode.me</title></head><body><header><nav><ul><li><a href="index.html">GNUcode.me</a></li><li><a href="services.html">Services</a></li><li><a href="business-ideas.html">Business-ideas</a></li><li><a href="about.html">About</a></li></ul></nav></header><h1>Nextcloud and Guix System Server</h1><main><section class="basic-section-padding"><article><h3>by Joshua Branson — February 22, 2023</h3><div><p>So I have wanted to run <a href="https://nextcloud.com/">nextcloud</a> for a while now. In my humble opinion, guix
    2. 

  2. system makes maintaining websites super easy, so I would prefer to run nextcloud
    3. 

  3. on guix system. Unfortunately, nextcloud will NOT be packaged in guix anytime
    4. 

  4. soon for two reasons:</p><ol><li>Guix does not currently have a php build system or any php packages, though
    5. 

  5. there is a 80% completed <a href="https://issues.guix.gnu.org/42338">work-in-progress issue.</a> So the php bits of nextcloud
    6. 

  6. cannot be packaged properly.</li><li>Nextcloud has a lot of javascript dependencies, and javascript is <a href="https://dustycloud.org/blog/javascript-packaging-dystopia/">notoriously
    7. 

  7. hard to package for guix.</a></li></ol><p>It seems like the easiest way to currently run nextcloud on guix system is by
    8. 

  8. using the <a href="https://github.com/nextcloud/all-in-one">all in one docker image.</a> Please consider this a guide to set up
    9. 

  9. running nextcloud on guix system via a linode, which currently costs me about $5
    10. 

  10. per month.</p><p>Note, that while this is the easiest method to run nextcloud, apparently this
    11. 

  11. all in one docker image has some security issues:</p><blockquote><p>The AIO image mounts the Docker socket, which is a security risk since it allows
    12. 

  12. full access to other container as well as running any new container. It’s a bad
    13. 

  13. idea and should be avoided.</p></blockquote><p>tl;dr  Here are the 6 simple steps that you need to do:</p><ol><li><p>Set up a <a href="https://guix.gnu.org/en/cookbook/en/html_node/Running-Guix-on-a-Linode-Server.html#Running-Guix-on-a-Linode-Server">linode guix system server.</a>  <code>info &quot;Guix Cookbook&quot; RET i linode RET</code>.</p></li><li><p>Buy a domain name.  I use <a href="https://hover.com">hover.com</a>.</p></li><li><p>Point your domain name at your linode IP address.</p></li><li><p>Set up a basic nginx static website without encryption.  This means that you
    14. 

  14. don’t want to define <code>(service certbot-service-type)</code>.</p><pre><code>sudo mkdir -p /srv/www/html/yourdomainname.com
    15. 

  15.     
    16. 

  16. # the command I did was this:
    17. 

  17. sudo mkdir -p /srv/www/html/the-nx.com
    18. 

  18.     
    19. 

  19. sudo chgrp -R users /srv
    20. 

  20. sudo chmod -R g+rwx /srv</code></pre><p>Inside your newly created directory (<em>srv/www/html/yourdomainname.com</em>), put
    21. 

  21. a simple HTML file and call it “index.html”. You could use this:</p><pre><code>&lt;!doctype html&gt;
    22. 

  22. &lt;html class=&quot;no-js&quot; lang=&quot;&quot;&gt;
    23. 

  23.     &lt;head&gt;
    24. 

  24.         &lt;meta charset=&quot;utf-8&quot;&gt;
    25. 

  25.         &lt;meta http-equiv=&quot;x-ua-compatible&quot; content=&quot;ie=edge&quot;&gt;
    26. 

  26.         &lt;title&gt;the nx&lt;/title&gt;
    27. 

  27.         &lt;meta name=&quot;description&quot; content=&quot;&quot;&gt;
    28. 

  28.         &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1&quot;&gt;
    29. 

  29.         &lt;link rel=&quot;apple-touch-icon&quot; href=&quot;/apple-touch-icon.png&quot;&gt;
    30. 

  30.     
    31. 

  31.     &lt;/head&gt;
    32. 

  32.     &lt;body&gt;
    33. 

  33.         &lt;!--[if lt IE 8]&gt;
    34. 

  34.             &lt;p class=&quot;browserupgrade&quot;&gt;
    35. 

  35.             You are using an &lt;strong&gt;outdated&lt;/strong&gt; browser. Please
    36. 

  36.             &lt;a href=&quot;http://browsehappy.com/&quot;&gt;upgrade your browser&lt;/a&gt; to improve
    37. 

  37.             your experience.
    38. 

  38.             &lt;/p&gt;
    39. 

  39.         &lt;![endif]--&gt;
    40. 

  40.     
    41. 

  41.         &lt;p&gt;Hello!&lt;/p&gt;
    42. 

  42.     &lt;/body&gt;
    43. 

  43. &lt;/html&gt;</code></pre><p>Now set up a basic nginx configuration for a static website without
    44. 

  44. encryption. It will end up looking something like:</p><pre><code>(service nginx-service-type
    45. 

  45.          (nginx-configuration
    46. 

  46.           (server-blocks
    47. 

  47.            (list
    48. 

  48.             (nginx-server-configuration
    49. 

  49.              (server-name '(&quot;the-nx.com&quot;))
    50. 

  50.              (listen (list &quot;80&quot; &quot;[::]:80&quot;))
    51. 

  51.              (root &quot;/srv/www/html/the-nx.com&quot;))))))</code></pre><p>Now you need to reconfigure so that the <code>nginx</code> user is created:</p><p><code>sudo guix system reconfigure config.scm</code></p><p>Now, nginx is running, but you will probably need to give nginx access to
    52. 

  52. read the files in your /srv directory.</p><pre><code>sudo chown -R nginx /srv
    53. 

  53. sudo chmod -R u-rwx /srv</code></pre><p>Open up a web browser and go to <a href="http://yourdomainname.com">http://yourdomainname.com</a> and check to see
    54. 

  54. that you see a basic website.</p></li><li><p>Now you need to turn your basic static website, into a site that has https
    55. 

  55. support.  Now you need to edit your nginx config and add in a certbot config:</p><p>Before your <code>(operating-system ...)</code> declartion, define this bit of code:</p><pre><code>(define %nginx-deploy-hook
    56. 

  56.   (program-file
    57. 

  57.    &quot;nginx-deploy-hook&quot;
    58. 

  58.    #~(let ((pid (call-with-input-file &quot;/var/run/nginx/pid&quot; read)))
    59. 

  59.        (kill pid SIGHUP))))</code></pre><p>Also make sure that you add in a <code>certbot</code> service and a modified <code>nginx</code>
    60. 

  60. service that look like this:</p><pre><code>(service certbot-service-type
    61. 

  61.          (certbot-configuration
    62. 

  62.           (email &quot;mysubscriptions@member.fsf.org&quot;)
    63. 

  63.           (webroot &quot;/srv/www/&quot;)
    64. 

  64.           (certificates
    65. 

  65.            (list
    66. 

  66.             (certificate-configuration
    67. 

  67.              (name &quot;the-nx.com&quot;)
    68. 

  68.              (domains '(&quot;the-nx.com&quot; &quot;www.the-nx.com&quot;))
    69. 

  69.              (deploy-hook %nginx-deploy-hook))))))
    70. 

  70.     
    71. 

  71. (service nginx-service-type
    72. 

  72.          (nginx-configuration
    73. 

  73.           (server-blocks
    74. 

  74.            (list
    75. 

  75.             (nginx-server-configuration
    76. 

  76.              (server-name '(&quot;the-nx.com&quot;))
    77. 

  77.              (listen (list &quot;80&quot;
    78. 

  78.                            &quot;443 ssl http2&quot;
    79. 

  79.                            &quot;[::]:80&quot;
    80. 

  80.                            &quot;[::80]:443 ssl http2&quot;))
    81. 

  81.              (root &quot;/srv/www/html/the-nx.com&quot;)
    82. 

  82.              (ssl-certificate &quot;/etc/letsencrypt/live/the-nx.com/fullchain.pem&quot;)
    83. 

  83.              (ssl-certificate-key &quot;/etc/letsencrypt/live/the-nx.com/privkey.pem&quot;)
    84. 

  84.              (locations
    85. 

  85.               (list
    86. 

  86.                (nginx-location-configuration ;; for certbot
    87. 

  87.                 (uri &quot;/.well-known&quot;)
    88. 

  88.                 (body (list &quot;root /srv/www;&quot;))))))))))</code></pre><p>Now we will have to reconfigure again to set up certbot:</p><pre><code>sudo guix system reconfigure config.scm
    89. 

  89.     
    90. 

  90. # tell certbot to set up our certificates
    91. 

  91. sudo /var/lib/certbot/renew-certificates</code></pre><p>Now you should be able to go to <a href="https://yourdomainname.com">https://yourdomainname.com</a> and see your site
    92. 

  92. in glorious encrypted mode!</p></li><li><p>Modify your guix config based on my <a href="https://notabug.org/jbranso/linode-guix-system-configuration/src/master/the-nx.com-current-config.scm">the-nx.com-current-config.scm</a>.
    93. 

  93. You will need to enable these services <code>(dbus-service)</code>, <code>(service docker-service-type)</code>, <code>(elogind service)</code>, <code>(service certbot-service-type)</code>,
    94. 

  94. and <code>(service nginx-service-type)</code>.</p></li></ol><p>I just ran this command, and my local nextcloud just started working.</p><pre><code>sudo docker run \
    95. 

  95. --sig-proxy=false \
    96. 

  96. --name nextcloud-aio-mastercontainer \
    97. 

  97. --restart always \
    98. 

  98. --publish 80:80 \
    99. 

  99. --publish 8080:8080 \
    100. 

  100. --publish 8443:8443 \
    101. 

  101. --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
    102. 

  102. --volume /var/run/docker.sock:/var/run/docker.sock:ro \
    103. 

  103. nextcloud/all-in-one:latest</code></pre><p>The following is the same quick guide as above, but has more details:</p><p>I decided to create a new linode image following the linode cookbook guide, and
    104. 

  104. I noticed a tiny error in the guide:</p><p><code>sudo apt-get install gpg</code> failed.  It worked after I ran <code>sudo apt-get update</code>.</p><p>Also the basic config example needs to migrate to the new &lt;swap-space&gt; record.
    105. 

  105. It gave me this warning message:</p><p>/root/config.scm:11:0: warning: List elements of the field ’swap-devices’ should
    106. 

  106. now use the &lt;swap-space&gt; record, as the old method is deprecated. See “(guix)
    107. 

  107. operating-system Reference” for more details.</p><p>The cookbook guide also should probably mention that you may need to login to
    108. 

  108. the server for the first time using linode’s weblish, and set up the root passwd
    109. 

  109. with <code>passwd</code>. Then set up your user password with <code>passwd &lt;username&gt;</code>.</p><p>Now that we have a basic site set up, let’s set up certbot and the nginx services:</p><pre><code>(service certbot-service-type
    110. 

  110.          (certbot-configuration
    111. 

  111.           (email &quot;mysubscriptions@member.fsf.org&quot;)
    112. 

  112.           (webroot &quot;/srv/www/&quot;)
    113. 

  113.           (certificates
    114. 

  114.            (list
    115. 

  115.             (certificate-configuration
    116. 

  116.              (name &quot;the-nx.com&quot;)
    117. 

  117.              (domains '(&quot;the-nx.com&quot; &quot;www.the-nx.com&quot;))
    118. 

  118.              (deploy-hook %nginx-deploy-hook))))))
    119. 

  119. 

  120. (nginx-configuration
    121. 

  121.  (server-blocks
    122. 

  122.   (list
    123. 

  123.    (nginx-server-configuration
    124. 

  124.     (server-name '(&quot;the-nx.com&quot;))
    125. 

  125.     (listen (list &quot;80&quot;
    126. 

  126.                   &quot;443 ssl http2&quot;
    127. 

  127.                   ;;&quot;[::]:80&quot;
    128. 

  128.                   ;;&quot;[::80]:443 ssl http2&quot;
    129. 

  129.                   ))
    130. 

  130.     (root &quot;/srv/www/html/the-nx.com&quot;)
    131. 

  131.     (ssl-certificate &quot;/etc/letsencrypt/live/the-nx.com/fullchain.pem&quot;)
    132. 

  132.     (ssl-certificate-key &quot;/etc/letsencrypt/live/the-nx.com/privkey.pem&quot;)
    133. 

  133.     (locations
    134. 

  134.      (list
    135. 

  135.       (nginx-location-configuration ;; for certbot
    136. 

  136.        (uri &quot;/.well-known&quot;)
    137. 

  137.        (body (list &quot;root /srv/www;&quot;)))))))))</code></pre><p>Now let’s reconfigure and get a certbot certificate.  <code>ssh</code> into the-nx.com and
    138. 

  138. run these commands:</p><pre><code>sudo guix system reconfigure the-nx.com-current-config.scm
    139. 

  139. 

  140. # tell certbot to set up our certificates
    141. 

  141. sudo /var/lib/certbot/renew-certificates</code></pre><p>So now my server has a valid certificate. It is time change the nginx
    142. 

  142. configuration to proxy incoming requests to the docker all in one image.</p><p>Ok, maybe I can use sexpressions to tell nginx to redirect all incoming traffic
    143. 

  143. to <code>the-nx.com</code> to the docker nextcloud image:</p><pre><code>(nginx-location-configuration
    144. 

  144.  (uri &quot;/&quot;)
    145. 

  145.  (body
    146. 

  146.   (list
    147. 

  147.    &quot;proxy_pass http://127.0.0.1:9000;\n&quot;
    148. 

  148.    &quot;proxy_set_header X-Real-IP $remote_addr;\n&quot;
    149. 

  149.    &quot;proxy_set_header Host $host;\n&quot;
    150. 

  150.    &quot;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n&quot;
    151. 

  151.    &quot;client_max_body_size 0;\n&quot;
    152. 

  152.    &quot;# Websocket\n&quot;
    153. 

  153.    &quot;proxy_http_version 1.1;\n&quot;
    154. 

  154.    &quot;proxy_set_header Upgrade $http_upgrade;\n&quot;)))</code></pre><p>I am going to deploy this image, and take a look at the generated nginx
    155. 

  155. configuration file.  I ran this command on my T400 laptop:</p><p><code>guix deploy the-nx.com-current-config.scm</code></p><p>Well, that’s super annoying. I do not know which nginx.conf file is the right
    156. 

  156. one:</p><pre><code>find /gnu/store -name '*nginx.conf'
    157. 

  157. 

  158. /gnu/store/7m1ygzqk6njn5mywqmhwbydbb2z4b9li-nginx.conf
    159. 

  159. /gnu/store/0gcfj61q4943h94jdqq7i9y0a0v9jr9q-nginx.conf
    160. 

  160. /gnu/store/4mzrp39w5i4v94kxf98gxc13ws79l88n-nginx.conf
    161. 

  161. /gnu/store/0nia2iqfw63ziasibbgq321wr9b3152n-nginx.conf
    162. 

  162. /gnu/store/pf8d0sj1yf9b2ndsbc61yj3h6rp4pck2-nginx.conf
    163. 

  163. /gnu/store/9nra62v41wsk08xf3msw5a1z35gji2gx-nginx-1.23.2/share/nginx/conf/nginx.conf
    164. 

  164. /gnu/store/4b1szfyn0snwzf3lm1snvaapk6diz3yq-nginx.conf
    165. 

  165. /gnu/store/fv5rg3nf5999vyg6qvp4sbgjysnkn1fc-nginx.conf
    166. 

  166. /gnu/store/vmjwj2zwblcz4wx2whsmxdfc7zxcgjh5-nginx.conf
    167. 

  167. /gnu/store/n3m2lihq9cjm6mxdln57q5nrbjgz53s6-nginx.conf
    168. 

  168. /gnu/store/jnl72hx0papzb42kbd1f19qx35w76lmg-nginx-1.23.2/share/nginx/conf/nginx.conf</code></pre><p>I guess I will reboot, run <code>guix system delete-generations</code> and <code>guix gc</code>, and
    169. 

  169. run the above command again:</p><pre><code>find /gnu/store -name '*nginx.conf'
    170. 

  170. 

  171. /gnu/store/7m1ygzqk6njn5mywqmhwbydbb2z4b9li-nginx.conf
    172. 

  172. /gnu/store/jnl72hx0papzb42kbd1f19qx35w76lmg-nginx-1.23.2/share/nginx/conf/nginx.conf</code></pre><p>Well that looks promising.  Let's check out my nginx.conf file.</p><pre><code>cat /gnu/store/i2mzdhg8wlbxv7iza8y4qk5v0vmvp27q-nginx.conf
    173. 

  173. 

  174. user nginx nginx;
    175. 

  175. pid /var/run/nginx/pid;
    176. 

  176. error_log /var/log/nginx/error.log info;
    177. 

  177. events { }
    178. 

  178. http {
    179. 

  179.     client_body_temp_path /var/run/nginx/client_body_temp;
    180. 

  180.     proxy_temp_path /var/run/nginx/proxy_temp;
    181. 

  181.     fastcgi_temp_path /var/run/nginx/fastcgi_temp;
    182. 

  182.     uwsgi_temp_path /var/run/nginx/uwsgi_temp;
    183. 

  183.     scgi_temp_path /var/run/nginx/scgi_temp;
    184. 

  184.     access_log /var/log/nginx/access.log;
    185. 

  185.     include /gnu/store/jnl72hx0papzb42kbd1f19qx35w76lmg-nginx-1.23.2/share/nginx/conf/mime.types;
    186. 

  186. 

  187.     server {
    188. 

  188.       listen 443 ssl http2;
    189. 

  189.       server_name the-nx.com ;
    190. 

  190.       ssl_certificate /etc/letsencrypt/live/the-nx.com/fullchain.pem;
    191. 

  191.       ssl_certificate_key /etc/letsencrypt/live/the-nx.com/privkey.pem;
    192. 

  192.       root /srv/www/html/the-nx.com;
    193. 

  193.       index index.html ;
    194. 

  194.       server_tokens off;
    195. 

  195. 

  196.       location /.well-known {
    197. 

  197.         root /srv/www;
    198. 

  198.       }
    199. 

  199.       location / {
    200. 

  200.         proxy_pass http://127.0.0.1:9000;
    201. 

  201. 

  202.         proxy_set_header X-Real-IP $remote_addr;
    203. 

  203. 

  204.         proxy_set_header Host $host;
    205. 

  205. 

  206.         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    207. 

  207. 

  208.         client_max_body_size 0;
    209. 

  209. 

  210.         # Websocket
    211. 

  211. 

  212.         proxy_http_version 1.1;
    213. 

  213. 

  214.         proxy_set_header Upgrade $http_upgrade;
    215. 

  215. 

  216.       }
    217. 

  217. 

  218.     }
    219. 

  219.     server {
    220. 

  220.       listen 80;
    221. 

  221.       listen [::]:80;
    222. 

  222.       server_name the-nx.com www.the-nx.com ;
    223. 

  223.       root /srv/http;
    224. 

  224.       index index.html ;
    225. 

  225.       server_tokens off;
    226. 

  226. 

  227.       location /.well-known {
    228. 

  228.         root /srv/www/;
    229. 

  229.       }
    230. 

  230.       location / {
    231. 

  231.         return 301 https://$host$request_uri;
    232. 

  232.       }
    233. 

  233. 

  234.     }
    235. 

  235. 

  236. }</code></pre><p>The generated configuration seems pretty wonky, and I am suprised that nginx is
    237. 

  237. still running, but it is still running.  And I suppose that it should work.</p><p>I was able to get nextcloud to start with this command:</p><pre><code>sudo docker run --sig-proxy=false --name nextcloud-aio-mastercontainer \
    238. 

  238.  --restart always \
    239. 

  239.  --publish 8080:8080 \
    240. 

  240.  -e APACHE_PORT=9000 \
    241. 

  241.  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
    242. 

  242.  --volume /var/run/docker.sock:/var/run/docker.sock:ro  \
    243. 

  243.  nextcloud/all-in-one:latest</code></pre><p>So now I can login at the-nx.com:8080 and configure various stuff. Also I really
    244. 

  244. need to set up a firewall. That’s probably a really good idea.  Also what’s nice
    245. 

  245. about this docker image is that it will start itself if you update the guix
    246. 

  246. system server and reboot.</p><p>MORE BONUS CONTENT:</p><p>If you see this blog post, and you decide to set up your nextcloud on a guix
    247. 

  247. system server, and if your nginx config doesn’t seem to be proxying requests to
    248. 

  248. your docker container, then you may follow these steps to delete the docker
    249. 

  249. image and start over:</p><p>This <a href="https://help.nextcloud.com/t/aio-this-site-can-t-provide-a-secure-connection/128478/5">page</a> has some good commands for deleting the docker image and starting
    250. 

  250. over:</p><pre><code>sudo docker stop nextcloud-aio-mastercontainer &amp;&amp; \\
    251. 

  251. sudo docker rm nextcloud-aio-mastercontainer &amp;&amp; \\
    252. 

  252. sudo docker container prune -f &amp;&amp; \\
    253. 

  253. sudo docker volume prune -f &amp;&amp; \\
    254. 

  254. sudo docker pull nextcloud/all-in-one:latest</code></pre><p>Ok, so it looks like the nextcloud all in one documentation has a <a href="https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md">page</a> for
    255. 

  255. understanding the reverse proxy.</p><p>It would also be nice to get my nextcloud image to sync my contacts.  I probably just need to add in another nginx
    256. 

  256. location line for that.  That will be a project for another day.</p></div></article></section></main><footer><p>© 2020 Joshua Branson.  The text on this site is free culture under the Creative Commons Attribution Share-Alike 4.0 International license.</p><p>This website is build with Haunt, a static site generator written in Guile Scheme.  Source code is <a href="https://notabug.org/jbranso/gnucode.me">available.</a></p><p>The color theme of this website is based off of the famous <a href="#3f3f3f" target="_blank">zenburn</a> theme.</p></footer></body>
    257.