カテゴリー: 社内SE

WRN  Waking up dead poll thread [HttpSynReqPoll], started: false, fin
ished: false| net/Socket.hpp:725
ERR  #30: Read failed, have 0 buffered bytes (EPIPE: Broken pipe)
ERR  #30: Socket write returned -1 (EPIPE: Broken pipe)
ERR  loading document exception: WOPI::CheckFileInfo failed:
ERR  Failed to add session to [https://hogehoge.com:443/index.
php/apps/richdocuments/wopi/files/52797_ocic20zydkap] with URI [https://hogehoge.com/index.php/apps/richdocuments/wopi/files/52797_ocic20zydkap?access_token=dcy91ZZq9mSvxv1XsGrW2ucmp8CmFcu4&access_tok
en_ttl=0]: WOPI::CheckFileInfo failed:

sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
sysctl -w net.ipv6.conf.lo.disable_ipv6=1

vi /etc/sysctl.d/60-custom.conf
---
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
--

sysctl -p
systemctl restart procps

CREATE DATABASE nc;
CREATE USER 'nextcloud'@'127.0.0.1' IDENTIFIED BY 'yourPassWord';
GRANT ALL ON nc.* TO 'nc'@'127.0.0.1';

FLUSH PRIVILEGES;

sudo su -

vi /etc/hosts
---
127.0.0.1 localhost nc.you.com lool.you.com
127.0.1.1 nc.you.com lool.you.com
---

apt install redis-server -y

vi /etc/redis/redis.conf
---
supervised systemd
maxmemory 16mb
maxmemory-policy volatile-lfu
unixsocket /var/run/redis/redis-server.sock
unixsocketperm 777
timeout 60
---

usermod -a -G redis www-data

systemctl enable redis-server
systemctl restart redis.service
systemctl status redis-server

# 入っていない場合に備えて
apt install -y cron vim build-essential
systemctl start cron
systemctl enable cron

wget -O - https://repo.litespeed.sh > enable_lst_debian_repo.sh
bash enable_lst_debian_repo.sh

apt update
apt install openlitespeed -y

systemctl status lshttpd
systemctl enable lshttpd
systemctl start lshttpd

# 公開フォルダ作成
mkdir /var/www/{nextcloud,80}
chown -R www-data:www-data /var/www/

# vertual hostの設定保存先
mkdir -p /usr/local/lsws/conf/vhosts/{nextcloud,httpPort,loolProxy}
chown www-data:www-data /usr/local/lsws/conf/vhosts/{nextcloud,httpPort,loolProxy}

# vertual hostのrootフォルダー
mkdir -p /usr/local/lsws/vhosts/{nextcloud,httpPort,loolProxy}
chown www-data:www-data /usr/local/lsws/vhosts/{nextcloud,httpPort,loolProxy}

# PHP 8.1 
apt install -y lsphp81 lsphp81-curl lsphp81-dev lsphp81-mysql lsphp81-redis lsphp81-apcu lsphp81-intl lsphp81-imagick

# php-imagickの警告削除のため。
apt install -y libmagickcore-6.q16-6-extra

# 設定ファイル　変更部分のみ
vi /usr/local/lsws/conf/httpd_config.conf
---
serverName                        nc.you.com
#user                             nobody
#group                            nogroup
user                             www-data
group                            www-data
#indexFiles                       index.html, index.php
indexFiles                       index.html, index.php, index.htm
#path                    lsphp73/bin/lsphp
path                    lsphp81/bin/lsphp
---

# 実行ユーザを変更した場合、必ず再インストール
apt -y install --reinstall openlitespeed

# 管理画面へのパスワード設定
/usr/local/lsws/admin/misc/admpass.sh

User name [admin]: your Name

Password: yourPassword
Retype password: yourPassword

# ramディスク作成
mkdir /tmp/ram
mount -t tmpfs -o size=8m /dev/shm /tmp/ram

vi /etc/fstab
---
tmpfs /tmp/ram tmpfs defaults,noatime,size=8m 0 0
---

# php設定　変更部分のみ
vi /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini
---
memory_limit = 512M
upload_max_filesize = 64M
max_file_uploads = 100
post_max_size = 40M
output_buffering = Off

date.timezone = "Asia/Tokyo"

[Pdo_mysql]
# 環境に合わせて
pdo_mysql.default_socket = /var/run/mysqld/mysqld.sock

[opcache]
opcache.enable=1
opcache.enable_cli=1
opcache.interned_strings_buffer=32
opcache.max_accelerated_files=1000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

opcache.jit=on
opcache.jit_buffer_size=128M

apc.enabled=1
apc.enable_cli = 1
apc.shm_size=64M
apc.ttl=3600
apc.gc_ttl=3600
---

# デフォルトユーザnobodyで作られるので一旦削除
rm -rf /tmp/lshttpd

# openLiteSpeed adminパネルの設定
vi /usr/local/lsws/admin/conf/admin_config.conf
---
# 以下の個所を以下のように修正
listener adminListener {
  address               *:7080
  secure                0
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  clientVerify          0
}
---

systemctl restart lshttpd

# www-dataでphpを簡単に扱えるように.bashrcのaliasを追加
su - www-data
vi ~/.bash_profile
---
if [ -f ~/.bashrc ]; then
        . ~/.bashrc
fi
---

vi ~/.bashrc
---
alias lsphp='/usr/local/lsws/lsphp81/bin/php -c /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini'
---
source ~/.bashrc
exit

# rootユーザも
vi ~/.bashrc
---
# 以下1行を追加
alias lsphp='/usr/local/lsws/lsphp81/bin/php -c /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini'
---
source ~/.bashrc

vi /usr/local/lsws/conf/httpd_config.conf
---
# 追加する。
virtualhost httpPort {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            0
  restrained              1
}
# 修正する。
listener Default {
  address                 *:80
  secure                  0
  map                     httpPort nc.you.com, lool.you.com
}
---

# 新規作成
vi /usr/local/lsws/conf/vhosts/httpPort/vhconf.conf
---
docRoot                   /var/www/80/

errorlog $SERVER_ROOT/logs/$VH_NAME_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10k
  keepDays                90
}

accesslog $SERVER_ROOT/logs/$VH_NAME_access.log {
  useServer               0
  logFormat               %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"
  rollingSize             10k
  keepDays                90
}
---
chown lsadm:www-data /usr/local/lsws/conf/vhosts/httpPort/vhconf.conf

apt install certbot -y

# メールアドレスは自分のものに変更のこと
certbot certonly --non-interactive --agree-tos -m yourmail@mail.com --webroot -w /var/www/80/ -d nc.you.com -d lool.you.com

vi /etc/cron.d/certbot
---
# 変更
#0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --deploy-hook "systemctl restart lshttpd"
---

vi /usr/local/lsws/admin/conf/admin_config.conf
---
listener adminListener {
  address               *:7080
  # この行から下3行を変更
  secure                1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  clientVerify          0
}
---

vi /usr/local/lsws/conf/httpd_config.conf
---
# 上部のグローバルなエリア（user/groupの設定）のあたりに追加
statDir                   /tmp/ram/

# 真ん中ぐらい・・
indexFiles                index.html, index.phpi, index.htm
autoIndex                 0

# このセクションの以下3行をなければ追加、あれば修正
extprocessor lsphp {
  maxConns                200
  env                     PHP_LSAPI_CHILDREN=200
  env                     LSAPI_AVOID_FORK=200M
}
---

mkdir ~/src/
cd ~/src/

# 環境は最新のものを選んで。以下は24.0.4のケース
wget https://download.nextcloud.com/server/releases/nextcloud-24.0.4.tar.bz2
tar xf nextcloud-24.0.4.tar.bz2
cp -r ./nextcloud/. /var/www/nextcloud/

mkdir /var/www/nextcloud/{data,.well-known}
mkdir /var/www/nextcloud/.well-known/{carddav,caldav,webfinger,nodeinfo}

chown -R www-data:www-data /var/www/nextcloud/

vi /var/www/nextcloud/config/config.php
---
# 修正箇所のみ
$CONFIG = array (
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'redis' =>
  array (
    'host' => '/var/run/redis/redis-server.sock',
    'port' => 0,
    'timeout' => 0.0,
  ),
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'overwrite.cli.url' => 'https://nc.you.com/',
  'htaccess.RewriteBase' => '/',
---

su - www-data
lsphp /var/www/nextcloud/occ maintenance:update:htaccess
exit

vi /usr/local/lsws/conf/httpd_config.conf
---
# お尻のほうに以下を追加
virtualhost nextcloud {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            1
  restrained              1
}

listener nextcloud {
  address                 *:443
  secure                  1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  map                     nextcloud nc.you.com
}
---

vi /usr/local/lsws/conf/vhosts/nextcloud/vhconf.conf
---
docRoot                   /var/www/nextcloud/
enableGzip                1

errorlog $SERVER_ROOT/logs/nextcloud_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10M
  keepDays                30
}

accesslog $SERVER_ROOT/logs/nextcloud_access.log {
  useServer               0
  logFormat               %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"
  rollingSize             10M
  keepDays                30
}

index  {
  useServer               0
}
errorpage 403 {
  url                     /
}

errorpage 404 {
  url                     /
}
context / {
  allowBrowse             1
  extraHeaders            Strict-Transport-Security "max-age=15552000; includeSubDomains;preload"

  rewrite  {

  }
  addDefaultCharset       off

  phpIniOverride  {

  }
}
rewrite  {
  enable                  1
  autoLoadHtaccess        0
  rules                   <<<END_rules
RewriteRule ^/data/.*$ - [F,L]
RewriteRule ^/config/.*$ - [F,L]

RewriteCond %{HTTP_USER_AGENT} DavClnt
RewriteRule ^$ /remote.php/webdav/ [L,R=302]
RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^\.well-known/carddav /remote.php/dav/ [R=301,L]
RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L]
RewriteRule ^remote/(.*) remote.php [QSA,L]
RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
RewriteRule ^\.well-known/(?!acme-challenge|pki-validation) /index.php [QSA,L]
RewriteRule ^(?:\.(?!well-known)|autotest|occ|issue|indie|db_|console).* - [R=404,L]

RewriteRule ^core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]
RewriteRule ^core/preview.png$ index.php [PT,E=PATH_INFO:$1]
RewriteCond %{REQUEST_FILENAME} !\.(css|js|svg|gif|png|html|ttf|woff2?|ico|jpg|jpeg|map|webm|mp4|mp3|ogg|wav|wasm|tflite)$
RewriteCond %{REQUEST_FILENAME} !/core/ajax/update\.php
RewriteCond %{REQUEST_FILENAME} !/core/img/(favicon\.ico|manifest\.json)$
RewriteCond %{REQUEST_FILENAME} !/(cron|public|remote|status)\.php
RewriteCond %{REQUEST_FILENAME} !/ocs/v(1|2)\.php
RewriteCond %{REQUEST_FILENAME} !/robots\.txt
RewriteCond %{REQUEST_FILENAME} !/(ocm-provider|ocs-provider|updater)/
RewriteCond %{REQUEST_URI} !^/\.well-known/(acme-challenge|pki-validation)/.*
RewriteCond %{REQUEST_FILENAME} !/richdocumentscode(_arm64)?/proxy.php$
RewriteRule . index.php [PT,E=PATH_INFO:$1]
  END_rules
}
---

# check the config files
/usr/local/lsws/bin/openlitespeed -t

systemctl restart lshttpd

cd /usr/share/keyrings
sudo wget https://collaboraoffice.com/downloads/gpg/collaboraonline-release-keyring.gpg

# ファイル作成
vi /etc/apt/sources.list.d/collaboraonline.sources
---
Types: deb
URIs: https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-ubuntu2204
Suites: ./
Signed-By: /usr/share/keyrings/collaboraonline-release-keyring.gpg
---

# インストール
apt update
apt install coolwsd code-brand -y

# 設定
loolconfig set ssl.enable false
loolconfig set ssl.termination true
loolconfig set storage.wopi.host nc.you.com
loolconfig set server_name lool.you.com

# adminパスワードを設定
loolconfig set-admin-password

# 設定ファイル修正
vi /etc/coolwsd/coolwsd.xml
---
# 修正は3か所
# net.protoをipv4のみに変更
# num_prespawn_childrenを10に変更
# allowed_languagesをen_USのみに変更
---

systemctl enable coolwsd
systemctl start coolwsd

# 動作しているか確認
systemctl status coolwsd

vi /usr/local/lsws/conf/httpd_config.conf
---
# お尻のほうに以下を追加
virtualhost loolProxy {
  vhRoot                  $SERVER_ROOT/vhosts/$VH_NAME/
  configFile              $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
  allowSymbolLink         1
  enableScript            1
  restrained              1
}

# 以下の箇所は修正（最後の1行を追加）
listener nextcloud {
  address                 *:443
  secure                  1
  keyFile                 /etc/letsencrypt/live/nc.you.com/privkey.pem
  certFile                /etc/letsencrypt/live/nc.you.com/fullchain.pem
  map                     nextcloud nc.you.com
  map                     loolProxy lool.you.com  
}
---

vi /usr/local/lsws/conf/vhosts/loolProxy/vhconf.conf
---
docRoot                   /var/www/80

errorlog $SERVER_ROOT/logs/$VH_NAME_error.log {
  useServer               0
  logLevel                ERROR
  rollingSize             10M
  keepDays                30
}

accesslog $SERVER_ROOT/logs/$VH_NAME_access.log {
  useServer               0
  logFormat               %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"
  rollingSize             10M
  keepDays                30
}

extprocessor lool {
  type                    proxy
  address                 127.0.0.1:9980
  maxConns                100
  pcKeepAliveTimeout      60
  initTimeout             60
  retryTimeout            0
  respBuffer              0
}

context / {
  type                    proxy
  handler                 lool
  addDefaultCharset       off
}

websocket / {
  address                 127.0.0.1:9980
}
---