[NEW:2020-07-27] NextCloud manual install on debian buster 10.3+

su -;   #sudo -i;   #latter fails if sudo isn't yet installed, which it isn't by default in buster 10.3+
apt install -y sudo;
sudo adduser user001 sudo

sudo apt install -y ca-certificates apt-transport-https gnupg
#Add some repos
wget -q https://packages.sury.org/php/apt.gpg -O- | sudo apt-key add -
repoToUse=$(lsb_release -cs | cut -d: -f2);     #I used stretch instead of buster by mistake on my first attempt. This way it will be correct
echo "deb https://packages.sury.org/php/ $repoToUse main" | sudo tee /etc/apt/sources.list.d/php.list
sudo apt update -y && sudo apt upgrade -y
sudo apt autoremove -y;

#Install Apache2,mysql/mariadb
sudo apt install -y \
    unzip wget \
    apache2 apache2-utils libapache2-mod-php7.4 \
    mariadb-server mariadb-client \
    ;
#systemctl enable apache2 && systemctl start apache2;   #these auto-start by default, so this is not required
#systemctl enable mariadb && systemctl start mariadb;   #these auto-start by default, so this is not required

#check that listeners are up and running
ss -tnlp | grep -i listen | grep "mysql\|apache2";      #I previously used netstat, but it is not installed by default, so SS is better

#Secure the DB server
mysql_secure_installation;

#Set some variables to simplify/minimise typing
mysqlUSR="root";                                        #as set in [mysql_secure_installation]
mysqlPWD="mysqlpassword";                               #as set in [mysql_secure_installation]
ncDBname="nextcloudDB";
ncDBuser="nextcloudUser";
ncDBpass="Mhq6T-LTbX8j-iayxcstehaZsT4MdG52";            #This is simply an EXAMPLE of an OK password - you should create your own password!
            #do NOT include any bad chars, like % $ * etc here, as they will mess up the $commandToRun variable etc below
ncInstallRoot="/var/www/html";                          #tune to YOUR preference 
ncDataRoot="/var/www/data";                             #tune to YOUR preference 
ncDomain="YOURdomain.com";                              #tune to YOUR domain 
myEMAIL="nextcloudadmin@$ncDomain";                     #for the certbot
myEmailPWD="djqBCAnGoWSAiueYCw40RgT3ZoVsUyGdD9BxpbSm0K";#for the smtp/cron system
#"Calculate" some other variables
ncLANip=$(ip -4 a | awk '/global/ {print $2}' | cut -d\/ -f1);
ncWANip=$(dig +short myip.opendns.com @resolver1.opendns.com);
ncSrvDirName=$(echo "nextcloud"."$ncDomain");   #Name of the VirtualHost/Machine  
                                                #my convention a subdir with the same name as this
                                                #so effectively, ServerName=SubdirName
#echo $ncDomain $ncSrvDirName

#create DB
mysql -u$mysqlUSER -p$mysqlPWD -Bse "CREATE DATABASE IF NOT EXISTS $ncDBname CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;";
#tighten security and restrict access
commandToRun="CREATE USER '$ncDBuser' IDENTIFIED BY '$ncDBpass';";                  #echo $commandToRun; ##the echo is for debug
mysql -u$mysqlUSR -p$mysqlPWD -Bse "$commandToRun";
commandToRun="GRANT ALL PRIVILEGES ON $ncDBname.* TO \"$ncDBuser\"@\"localhost\";"; #echo $commandToRun; ##the echo is for debug
mysql -u$mysqlUSR -p$mysqlPWD -Bse "$commandToRun";
commandToRun="FLUSH PRIVILEGES;";                                                   #echo $commandToRun; ##the echo is for debug
mysql -u$mysqlUSR -p$mysqlPWD -Bse "$commandToRun";

#Install the php/apache modules
apt install -y \
    php7.4-cli php7.4-common php7.4-mbstring php7.4-gd php7.4-intl php7.4-bz2 php7.4-xml \
    php7.4-mysql \
    php7.4-zip php7.4-dev php7.4-fpm php7.4-ldap \
    php7.4-bcmath php7.4-gmp \
    redis-server php-redis \
    php-dompdf php-smbclient php-imagick \
    php7.4-curl
    ;
#disable/enable the required mods etc
sudo a2dismod php7.4;       #MUST be done first
sudo a2dismod mpm_prefork;  #MUST be done next
sudo a2enmod proxy_fcgi setenvif rewrite headers env dir mime ssl http2;
sudo a2enmod mpm_event;
#This sequence may seem a bit weird, but I found that the command(s) gave erros/warnings when I did it any other way

#Check the basic settings
cat /etc/php/7.4/fpm/php.ini | grep "opcache.enable=\|opcache.enable_cli=\|opcache.interned_strings_buffer=\|opcache.max_accelerated_files=\|opcache.memory_consumption=\|opcache.save_comments=\|opcache.revalidate_freq="
#FIX the basic settings
perl -pi -e 's/^;?(opcache.enable)(=[01])$/$1=1/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.enable_cli)(.*)$/$1=1/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.interned_strings_buffer)(=[0-9])$/$1=8/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.max_accelerated_files)(=[0-9]+)$/$1=10000/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.memory_consumption)(=[0-9]+)$/$1=128/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.save_comments)(=[0-9]+)$/$1=1/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(opcache.revalidate_freq)(=[0-9]+)$/$1=1/' /etc/php/7.4/fpm/php.ini

#Check the extended settings
cat /etc/php/7.4/fpm/php.ini | grep "max_execution_time\|max_input_time\|memory_limit\|upload_max_filesize"
#FIX the extended settings (as per markus-blog.de)
perl -pi -e 's/^;?(max_execution_time)( ?= ?[0-9]+)$/#$1$2\n$1 = 300/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(max_input_time)( ?= ?[0-9]+)$/#$1$2\n$1 = 600/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(memory_limit)( ?= ?[0-9]+)([KMG])$/#$1$2\n$1 = 512M/' /etc/php/7.4/fpm/php.ini
perl -pi -e 's/^;?(upload_max_filesize)( ?= ?[0-9]+)([KMG])$/#$1$2$3\n$1 = 10240M/' /etc/php/7.4/fpm/php.ini
##MAYBE ADD THIS TOO#date.timezone = Africa/Johannesburg


#Create directories for installation
sudo mkdir -p $ncInstallRoot/$ncSubdirName
#Create an index.php containing the phpinfo() function. This will help to view and confirm what PHP version is used by the VirtualHost.
echo "<?php phpinfo(); ?>" > $ncInstallRoot/$ncSrvDirName/index.php

#Create a VirtualHost. (These are in /etc/apache2/sites-available/*.conf)
cp /etc/apache2/sites-available/$ncSrvDirName.conf{,.orig}  #make a backup copy of the config if there
#Adust/edit the config manually using nano...
#sudo nano /etc/apache2/sites-available/$ncSrvDirName.conf
# OR #
cat <<EOF > /etc/apache2/sites-available/$ncSrvDirName.conf
#nextcloud.$ncDomain
<VirtualHost *:80>
    ServerName $ncSrvDirName
    serverAlias $ncLANip $ncWANip
    ServerAdmin webmaster@$ncDomain
    DocumentRoot $ncInstallRoot/$ncSrvDirName
    Protocols h2 h2c http/1.1

    ErrorLog \${APACHE_LOG_DIR}/$ncSrvDirName-error.log
    CustomLog \${APACHE_LOG_DIR}/$ncSrvDirName-access.log combined

    <IfModule mod_dav.c>
        Dav off
    </IfModule>

    <Directory $ncInstallRoot/$ncSrvDirName>
        #Options -Indexes +FollowSymLinks +MultiViews
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Require all granted
    </Directory>

    <FilesMatch \.php$>
        # Apache 2.4.10+ can proxy to unix socket [in my case because I have multiple versions of PHP available]
        SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost/"
    </FilesMatch>

    SetEnv HOME $ncInstallRoot/$ncSrvDirName
    SetEnv HTTP_HOME $ncInstallRoot/$ncSrvDirName
    #Satisfy Any
</VirtualHost>
EOF
cat /etc/apache2/sites-available/$ncSrvDirName.conf
#END-of-apache2-conf
#enable the site and restart apache2/php7.4
sudo a2ensite $ncSrvDirName
sudo systemctl restart apache2 php7.4-fpm

#Prepare to add Let'sEncrypt
sudo apt install python-certbot-apache certbot wget curl sudo unzip

##NB!!! make sure your DNS is already set up and working, and that your firewall port to this machine is open on ports 80/443
##You would normally be prompted for your email address and possibly a few permission related questions (you can adjust the certbot commandline to include these with some CLI switches)    #ie.  -m email@domain.com --agree-tos
certbot --apache --staging --agree-tos --rsa-key-size 4096 certonly \
    -w $ncInstallRoot/$ncSrvDirName \
     -d $ncSrvDirName \
     -m $myEMAIL \
     ;  #Request a cert in staging/test mode
#root@host:~# certbot --apache --staging --agree-tos --rsa-key-size 4096 certonly     -w $ncInstallRoot/$ncSrvDirName      -d $ncSrvDirName     -m $myEMAIL;
#Saving debug log to /var/log/letsencrypt/letsencrypt.log
#Plugins selected: Authenticator apache, Installer apache
#Obtaining a new certificate
#IMPORTANT NOTES:
# - Congratulations! Your certificate and chain have been saved at: #   /etc/letsencrypt/live/nextcloud.YOURdomain.com/fullchain.pem
#   Your key file has been saved at:                                #   /etc/letsencrypt/live/nextcloud.YOURdomain.com/privkey.pem
#   Your cert will expire on 2020-10-03. To obtain a new or tweaked version of this certificate in the future, simply run certbot again.

#IF this is successful, then add a non-staging one
certbot --apache --agree-tos --rsa-key-size 4096 \
    -w $ncInstallRoot/$ncSrvDirName \
    -d $ncSrvDirName -m $myEMAIL \
    ;
# Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): email@YOURdomain.com
#*(A)gree/(C)ancel: A
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Would you be willing to share your email address with the Electronic Frontier
#*(Y)es/(N)o: Y
# Cert not yet due for renewal, What would you like to do?
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# 1: Attempt to reinstall this existing certificate
# 2: Renew & replace the cert (limit ~5 per 7 days)
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#*Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
# Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# 1: No redirect - Make no further changes to the webserver configuration.
# 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#*Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
# Redirecting vhost in /etc/apache2/sites-enabled/nextcloud.YOURdomain.com.conf to ssl vhost in /etc/apache2/sites-available/nextcloud.YOURdomain.com-le-ssl.conf
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Your existing certificate has been successfully renewed, and the new certificate has been installed.
# The new certificate covers the following domains: # https://nextcloud.YOURdomain.com
# You should test your configuration at:            # https://www.ssllabs.com/ssltest/analyze.html?d=nextcloud.YOURdomain.com
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# IMPORTANT NOTES:
#  - Congratulations! Your certificate and chain have been saved at:    #    /etc/letsencrypt/live/nextcloud.YOURdomain.com/fullchain.pem
#    Your key file has been saved at:                                   #    /etc/letsencrypt/live/nextcloud.YOURdomain.com/privkey.pem
#    Your cert will expire on 2020-10-03. To obtain a new or tweaked.....
#______________________________________________________________________________#
#cat /var/log/letsencrypt/letsencrypt.log   #logfile in case anything goes wrong

#nano /etc/apache2/sites-available/$ncSrvDirName-le-ssl.conf
#Add this section below the DocumentRoot-directive: (I am using a HEREdoc)

#create a HEREdoc for the additional section
cat <<EOF > /etc/apache2/sites-available/sslBlock.conf

    #This will be added below DocumentRoot
    <IfModule mod_headers.c>
        Header always set Strict-Transport-Security "max-age=15768000; preload"
        Header always set Referrer-Policy "strict-origin-when-cross-origin"
        # Prevent MIME based attacks
        Header always set X-Content-Type-Options "nosniff"
        Header always set X-Frame-Options "SAMEORIGIN"
    </IfModule>
    # SSL Configuration - uses strong cipher list - these might need to be downgraded if you need to support older browsers/devices
    SSLEngine on
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder On
    #end of additions

EOF
cp /etc/apache2/sites-available/$ncSrvDirName-le-ssl.conf{,.orig} #make a backup copy of the config...
#split the file before/after
csplit /etc/apache2/sites-available/$ncSrvDirName-le-ssl.conf.orig '/Protocols h2 h2c http/1.1/' '{*}'
#rejoin them with the extra bit
cat /etc/apache2/sites-available/xx00 /etc/apache2/sites-available/sslBlock.conf /etc/apache2/sites-available/xx01 > /etc/apache2/sites-available/$ncSrvDirName-le-ssl.conf
cat /etc/apache2/sites-available/$ncSrvDirName-le-ssl.conf
rm -f /etc/apache2/sites-available/xx00 /etc/apache2/sites-available/xx01 /etc/apache2/sites-available/sslBlock.conf
sudo systemctl restart apache2 php7.4-fpm
printf "\nNow browse to http://$ncSrvDirName\n\t- You should get rerouted to an https version of the page\nNB! If you browse using https://$ncLANip it will warn you about an insecure certificate, since we set/cert'd $ncSrvDirName and not the $ncLANip.\nThis is OK - we just want to make sure that the end result domain name ($ncSrvDirName) is covered";
#There is some additional security which can be added - see https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1d&guideline=5.4

cd $ncInstallRoot
#Fetch the latest version
sudo wget https://download.nextcloud.com/server/releases/latest.zip
#unzip it
sudo unzip latest.zip;
#reposition it
sudo mv ./nextcloud/.user* ./nextcloud/.ht* $ncInstallRoot/$ncSrvDirName/   #for reason unklnown to me, the .htaccess and .user.ini files don't move when using *, hence this "workaround";
sudo mv ./nextcloud/* $ncInstallRoot/$ncSrvDirName/;
#cleanup and set permissions etc
sudo rmdir ./nextcloud;
sudo chown -R www-data:www-data $ncInstallRoot/$ncSrvDirName/;
sudo mkdir -p $ncDataRoot && chown -R www-data:www-data $ncDataRoot/;

#Now load the page in your browser at
printf "Now point your browser to https://$ncSrvDirName (<- Ctrl-Click this link)\n";
printf "Make sure to use the same values as you did on the creation above\n";
printf "Create an admin account\n";
printf "Username: ncAdminMU\n";
printf "\tI chose \"ncAdminMU\" but this can be whatever you prefer\n";
printf "Password: EKLO[ro41m4KR-ViYLjde)KpoM0k8j[8bkMwu8]L9tqFYomkDLuAp7N-JB>Wq5W-\n";
printf "\tI chose the above password but this can be whatever you prefer\n";
printf "Data folder: $ncDataRoot\n";
printf "Database user: $ncDBuser\n";
printf "Database password: $ncDBpass\n";
printf "Database name: $ncDBname\n";
printf "Database host: localhost\n";

#______________________________________________________________________________#
#some minor optimisations..
#Adjust Nextcloud’s config.php to configure the recommended memory cache:
cd $ncInstallRoot/$ncSrvDirName/config;
cp ./config.php{,.orig}; #make a backup copy of the config...
cat ./config.php.orig;

#Check and trim off the last line of the config.php file
ifLast=");";    lastLine=$(tail -n 1  ./config.php);
if [[ $lastLine == $ifLast ]]; then
  head -n -1  ./config.php > ./config.php.pre;
  echo "$lastLine" > ./config.php.post;
  #cat ./config.php.pre ./config.php.post;#4DBG#
fi;
#Create the additions text block
cat <<EOF > ./config.php.add
  'memcache.local' => '\OC\Memcache\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => array(
    'host' => 'localhost',
    'port' => 6379,
    ),
EOF
#Merge them all into one file (you still have a copy of the original one named ./config.php.orig)
cat ./config.php.pre ./config.php.add ./config.php.post > ./config.php
#cat ./config.php;#4DBG#
    #You can do this manually using...
    #nano $ncInstallRoot/$ncSrvDirName/config/config.php
    ##add the above bits of code (before the last line which should say ');'):
printf "\nIf you browse to http://$ncSrvDirName/index.php/settings/admin/overview (<- Ctrl-click)\n\t- You SHOULD have a green tick on the Administration Overview once you've logged in as the ncAdminMU user as per the above part\n\n";
#You SHOULD have a green tick on the Administration Overview once you've logged in as the ncAdminMU user as per the above part
#______________________________________________________________________________#
#Now switch from AJAX to CRON method
#   #configure the user’s cron job accordingly www-data(adjust path and/or user if you use another one):
#   printf "#Now run\nsudo crontab -u www-data -e\n# ...and add this at the end...\n*/15 * * * * php7.4 -f $ncInstallRoot/$ncSrvDirName/cron.php\n"
sudo crontab -u www-data -l > www-data-crontabs;
printf "\n#NextCloud CRON as user www-data\n*/15 * * * * cd $ncInstallRoot/$ncSrvDirName && php7.4 -f $ncInstallRoot/$ncSrvDirName/cron.php\n" >> www-data-crontabs;
crontab -u www-data www-data-crontabs && crontab -u www-data -l

#restart services
systemctl restart apache2 && sudo systemctl restart php7.4-fpm
#and then refresh your browser
#
#______________________________________________________________________________#
#Do not forget to configure your mail-settings
#Specifically, I initially had a problem with the settings that kept failing
# because my SMTP certificates had expired - once fixed, it worked perfectly

#This CAN be done via CLI if you edit the config.php here
#Adjust Nextcloud’s config.php to configure the recommended memory cache:
cd $ncInstallRoot/$ncSrvDirName/config;
cp ./config.php{,.b4smtp}; #make a backup copy of the config...
cat ./config.php.b4smtp;

#Check and trim off the last line of the config.php file
ifLast=");";    lastLine=$(tail -n 1  ./config.php);
if [[ $lastLine == $ifLast ]]; then
  head -n -1  ./config.php > ./config.php.preSMTP;
  echo "$lastLine" > ./config.php.postSMTP;
  #cat ./config.php.pre ./config.php.post;#4DBG#
fi;
#Create the additions text block
cat <<EOF > ./config.php.4SMTP
  'mail_smtpmode' => 'smtp',
  'mail_smtphost' => 'smtp.$ncDomain',
  'mail_sendmailmode' => 'smtp',
  'mail_smtpport' => '587',
  'mail_domain' => '$ncDomain',
  'mail_from_address' => 'nextcloud',
  'mail_smtpauthtype' => 'PLAIN',
  'mail_smtpauth' => 1,
  'mail_smtpsecure' => 'tls',
  'mail_smtpname' => 'nextcloud@$ncDomain',
  'mail_smtppassword' => '$myEmailPWD',
EOF
#Merge them all into one file (you still have a copy of the original one named ./config.php.orig)
cat ./config.php.preSMTP ./config.php.4SMTP ./config.php.postSMTP > ./config.php
#cat ./config.php;#4DBG#
        #You could also have done these via an editor
        #nano $ncInstallRoot/$ncSrvDirName/config/config.php
        ##and add in the reqd lines...(just after the previous section but before the closing bracket)
        ##OBVIOUSLY you need to set these to the relevant values for YOUR email account

#Add CODE if the install failed (it often does!)
cd $ncInstallRoot/$ncSrvDirName;
sudo -u www-data php -d memory_limit=512M occ app:install richdocumentscode
#Add some indices and convert some tables in ncDBname to big int with the following two commands as user www-data:
cd $ncInstallRoot/$ncSrvDirName;
sudo -u www-data php7.4 occ db:add-missing-indices
sudo -u www-data php7.4 occ db:convert-filecache-bigint
#Last task would be to install your Desktop Client for your OS. For debian, you can try these
#______________________________________________________________________________#
sudo apt install nextcloud-desktop
sudo apt install dolphin-nextcloud