Install NextCloud & collabora online on openLiteSpeed

CREATE DATABASE nc;
CREATE USER 'nextcloud'@'127.0.0.1' IDENTIFIED BY 'yourPassWord';
GRANT ALL ON nc.* TO 'nc'@'127.0.0.1';

FLUSH PRIVILEGES;

sudo su -

vi /etc/hosts
---
127.0.0.1 localhost nc.you.com lool.you.com
127.0.1.1 nc.you.com lool.you.com
---

apt install redis-server -y

vi /etc/redis/redis.conf
---
supervised systemd
maxmemory 16mb
maxmemory-policy volatile-lfu
unixsocket /var/run/redis/redis-server.sock
unixsocketperm 777
timeout 60
---

usermod -a -G redis www-data

systemctl enable redis-server
systemctl restart redis.service
systemctl status redis-server

apt install -y cron vim build-essential
systemctl start cron
systemctl enable cron

wget -O - https://repo.litespeed.sh > enable_lst_debian_repo.sh
bash enable_lst_debian_repo.sh

apt update
apt install openlitespeed -y

systemctl status lshttpd
systemctl enable lshttpd
systemctl start lshttpd

# public folders for http
mkdir /var/www/{nextcloud,80}
chown -R www-data:www-data /var/www/

# folders of the virtual host config files
mkdir -p /usr/local/lsws/conf/vhosts/{nextcloud,httpPort,loolProxy}
chown www-data:www-data /usr/local/lsws/conf/vhosts/{nextcloud,httpPort,loolProxy}

# root folders of vertual hosts
mkdir -p /usr/local/lsws/vhosts/{nextcloud,httpPort,loolProxy}
chown www-data:www-data /usr/local/lsws/vhosts/{nextcloud,httpPort,loolProxy}

# PHP 8.1 
apt install -y lsphp81 lsphp81-curl lsphp81-dev lsphp81-mysql lsphp81-redis lsphp81-apcu lsphp81-intl lsphp81-imagick

# to use php-imagick function fully
apt install -y libmagickcore-6.q16-6-extra

# main config file. The below shows only changed lines.
vi /usr/local/lsws/conf/httpd_config.conf
---
serverName                        nc.you.com
#user                             nobody
#group                            nogroup
user                             www-data
group                            www-data
#indexFiles                       index.html, index.php
indexFiles                       index.html, index.php, index.htm
#path                    lsphp73/bin/lsphp
path                    lsphp81/bin/lsphp
---

# re-install. you need this command when changed user and group.
apt -y install --reinstall openlitespeed

# set admin password 
/usr/local/lsws/admin/misc/admpass.sh

User name [admin]: your Name

Password: yourPassword
Retype password: yourPassword

# make ram disk
mkdir /tmp/ram
mount -t tmpfs -o size=8m /dev/shm /tmp/ram

vi /etc/fstab
---
tmpfs /tmp/ram tmpfs defaults,noatime,size=8m 0 0
---

# php setting. The below shows only chnaged (or added) lines.
vi /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini
---
memory_limit = 512M
upload_max_filesize = 64M
max_file_uploads = 100
post_max_size = 40M
output_buffering = Off

date.timezone = "Asia/Tokyo"

[Pdo_mysql]
# the below is depend on you environment
pdo_mysql.default_socket = /var/run/mysqld/mysqld.sock

[opcache]
opcache.enable=1
opcache.enable_cli=1
opcache.interned_strings_buffer=32
opcache.max_accelerated_files=1000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

opcache.jit=on
opcache.jit_buffer_size=128M

apc.enabled=1
apc.enable_cli = 1
apc.shm_size=64M
apc.ttl=3600
apc.gc_ttl=3600
---

# nobody user folder. will be made by www-date user automatically.
rm -rf /tmp/lshttpd

# openLiteSpeed admin panel setting 
vi /usr/local/lsws/admin/conf/admin_config.conf
---
# change below seciotn like this.
listener adminListener {
  address               *:7080
  secure                0
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  clientVerify          0
}
---

systemctl restart lshttpd

# to use php 8.1 easily 
su - www-data
vi ~/.bash_profile
---
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi
---

vi ~/.bashrc
---
alias lsphp='/usr/local/lsws/lsphp81/bin/php -c /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini'
---
source ~/.bashrc
exit

# also root user
vi ~/.bashrc
---
# 以下1行を追加
alias lsphp='/usr/local/lsws/lsphp81/bin/php -c /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini'
---
source ~/.bashrc

vi /usr/local/lsws/conf/httpd_config.conf
---
# Add below section
virtualhost httpPort {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            0
  restrained              1
}
# Change below setion like this
listener Default {
  address                 *:80
  secure                  0
  map                     httpPort nc.you.com, lool.you.com
}
---

# make new file
vi /usr/local/lsws/conf/vhosts/httpPort/vhconf.conf
---
docRoot                   /var/www/80/

errorlog $SERVER_ROOT/logs/$VH_NAME_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10k
  keepDays                90
}

accesslog $SERVER_ROOT/logs/$VH_NAME_access.log {
  useServer               0
  logFormat               %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"
  rollingSize             10k
  keepDays                90
}
---
chown lsadm:www-data /usr/local/lsws/conf/vhosts/httpPort/vhconf.conf

apt install certbot -y

# get the SSL certificate. Dont forget to change the e-mail address to your own one.
certbot certonly --non-interactive --agree-tos -m yourmail@mail.com --webroot -w /var/www/80/ -d nc.you.com -d lool.you.com

vi /etc/cron.d/certbot
---
# change
#0 */12 * * * root test -x /usr/bin/certbot -a ! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
0 */12 * * * root test -x /usr/bin/certbot -a ! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --deploy-hook "systemctl restart lshttpd"
---

vi /usr/local/lsws/admin/conf/admin_config.conf
---
# change this section like below
listener adminListener {
  address               *:7080
  secure                1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  clientVerify          0
}
---

# The below shows only chnaged (or added) lines.
vi /usr/local/lsws/conf/httpd_config.conf
---
# add below line around top global section around user / group setting
statDir                   /tmp/ram/

# change below line and add one line of autoIndex,
indexFiles                index.html, index.phpi, index.htm
autoIndex                 0

# change this secion's maxConns and env
extprocessor lsphp {
  maxConns                200
  env                     PHP_LSAPI_CHILDREN=200
  env                     LSAPI_AVOID_FORK=200M
}
---

mkdir ~/src/
cd ~/src/

# Check the nextcloud site to chose the latest version. the below is the example of version 24.0.4.
wget https://download.nextcloud.com/server/releases/nextcloud-24.0.4.tar.bz2
tar xf nextcloud-24.0.4.tar.bz2
cp -r ./nextcloud/. /var/www/nextcloud/

mkdir /var/www/nextcloud/{data,.well-known}
mkdir /var/www/nextcloud/.well-known/{carddav,caldav,webfinger,nodeinfo}

chown -R www-data:www-data /var/www/nextcloud/

vi /var/www/nextcloud/config/config.php
---
# the below is only changed (or added) line. Don't erase other lines
$CONFIG = array (
  'memcache.local' => '\OC\Memcache\APCu',
  'memcache.distributed' => '\OC\Memcache\Redis',
  'redis' =>
  array (
    'host' => '/var/run/redis/redis-server.sock',
    'port' => 0,
    'timeout' => 0.0,
  ),
  'memcache.locking' => '\OC\Memcache\Redis',
  'overwrite.cli.url' => 'https://nc.you.com/',
  'htaccess.RewriteBase' => '/',
---

su - www-data
lsphp /var/www/nextcloud/occ maintenance:update:htaccess
exit

vi /usr/local/lsws/conf/httpd_config.conf
---
# add below sections
virtualhost nextcloud {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            1
  restrained              1
}

listener nextcloud {
  address                 *:443
  secure                  1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  map                     nextcloud nc.you.com
}
---
# make this file
vi /usr/local/lsws/conf/vhosts/nextcloud/vhconf.conf
---
docRoot                   /var/www/nextcloud/
enableGzip                1

errorlog $SERVER_ROOT/logs/nextcloud_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10M
  keepDays                30
}

accesslog $SERVER_ROOT/logs/nextcloud_access.log {
  useServer               0
  logFormat               %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"
  rollingSize             10M
  keepDays                30
}

index  {
  useServer               0
}
errorpage 403 {
  url                     /
}

errorpage 404 {
  url                     /
}
context / {
  allowBrowse             1
  extraHeaders            Strict-Transport-Security "max-age=15552000; includeSubDomains;preload"

  rewrite  {

  }
  addDefaultCharset       off

  phpIniOverride  {

  }
}
rewrite  {
  enable                  1
  autoLoadHtaccess        0
  rules                   <<<END_rules
RewriteRule ^/data/.*$ - [F,L]
RewriteRule ^/config/.*$ - [F,L]
# add below from .htacccess file. erase this comment line. i dont kwno how to comment.
RewriteCond %{HTTP_USER_AGENT} DavClnt
RewriteRule ^$ /remote.php/webdav/ [L,R=302]
RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^/.well-known/carddav /remote.php/dav/ [R=301,L]
RewriteRule ^/.well-known/caldav /remote.php/dav/ [R=301,L]
RewriteRule ^/remote/(.*) remote.php [QSA,L]
RewriteRule ^/(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
RewriteRule ^/.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
RewriteRule ^/(?:.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]

RewriteRule ^/core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]
RewriteRule ^/core/preview.png$ index.php [PT,E=PATH_INFO:$1]
RewriteCond %{REQUEST_FILENAME} !.(css|js|svg|gif|png|html|ttf|woff2?|ico|jpg|jpeg|map|webm|mp4|mp3|ogg|wav|wasm|tflite)$
RewriteCond %{REQUEST_FILENAME} !/core/ajax/update.php
RewriteCond %{REQUEST_FILENAME} !/core/img/(favicon.ico|manifest.json)$
RewriteCond %{REQUEST_FILENAME} !/(cron|public|remote|status).php
RewriteCond %{REQUEST_FILENAME} !/ocs/v(1|2).php
RewriteCond %{REQUEST_FILENAME} !/robots.txt
RewriteCond %{REQUEST_FILENAME} !/(ocm-provider|ocs-provider|updater)/
RewriteCond %{REQUEST_URI} !^/.well-known/(acme-challenge|pki-validation)/.*
RewriteCond %{REQUEST_FILENAME} !/richdocumentscode(_arm64)?/proxy.php$
RewriteRule . index.php [PT,E=PATH_INFO:$1]
  END_rules
}
---

# check the config files
/usr/local/lsws/bin/openlitespeed -t

systemctl restart lshttpd

cd /usr/share/keyrings
sudo wget https://collaboraoffice.com/downloads/gpg/collaboraonline-release-keyring.gpg

# make a file
vi /etc/apt/sources.list.d/collaboraonline.sources
---
Types: deb
URIs: https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-ubuntu2204
Suites: ./
Signed-By: /usr/share/keyrings/collaboraonline-release-keyring.gpg
---

# install
apt update
apt install coolwsd code-brand -y

# setting
loolconfig set ssl.enable false
loolconfig set ssl.termination true
loolconfig set storage.wopi.host nc.you.com
loolconfig set server_name lool.you.com

# set admin password
loolconfig set-admin-password

# change the setting file
vi /etc/coolwsd/coolwsd.xml
---
# change the following three setting
# net.proto => IPv4 
# num_prespawn_children => 10
# allowed_languages => en_US
---

systemctl enable coolwsd
systemctl start coolwsd

# check the status
systemctl status coolwsd

vi /usr/local/lsws/conf/httpd_config.conf
---
# add below section
virtualhost loolProxy {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            1
  restrained              1
}

# change below seciton (add last one line )
listener nextcloud {
  address                 *:443
  secure                  1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  map                     nextcloud nc.you.com
  map                     loolProxy lool.you.com  
}
---

# make this file
vi /usr/local/lsws/conf/vhosts/loolProxy/vhconf.conf
---
docRoot                   /var/www/80

errorlog $SERVER_ROOT/logs/$VH_NAME_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10M
  keepDays                30
}

accesslog $SERVER_ROOT/logs/$VH_NAME_access.log {
  useServer               0
  logFormat               %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"
  rollingSize             10M
  keepDays                30
}

extprocessor lool {
  type                    proxy
  address                 127.0.0.1:9980
  maxConns                100
  pcKeepAliveTimeout      60
  initTimeout             60
  retryTimeout            0
  respBuffer              0
}

context / {
  type                    proxy
  handler                 lool
  addDefaultCharset       off
}

websocket / {
  address                 127.0.0.1:9980
}
---

# check the config files
/usr/local/lsws/bin/openlitespeed -t

systemctl restart lshttpd