{"id":40656,"date":"2020-03-23T08:49:45","date_gmt":"2020-03-23T08:49:45","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=e417addfdf8ac7756abbd45cc036392b"},"modified":"2020-03-23T08:49:45","modified_gmt":"2020-03-23T08:49:45","slug":"build-your-own-cloud-infrastructure-with-nextcloud-and-collabora","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/build-your-own-cloud-infrastructure-with-nextcloud-and-collabora\/","title":{"rendered":"Build your own cloud infrastructure with Nextcloud and Collabora"},"content":{"rendered":"


\n Andy Webb<\/a><\/span>
\n K.G. Orphanides<\/a><\/span>
\n <\/span><\/p>\n

\n
\n
30 Mar, 2020<\/span><\/div>\n<\/p><\/div>\n<\/div>\n

\n<\/a><\/p>\n

\n

Cloud services<\/a> have revolutionised the way we work, providing easy paths for collaboration over a distance<\/a> and business-critical features such as automatic off-site backups<\/a> and version control.\u00a0<\/p>\n

However, potential issues range from not wanting to entrust data to the uncanny tentacles of global megacorporations, to very limited options for intranet-only deployments and the cost of per-user licensing for bundled services that not all users need.<\/p>\n

Setting up your own cloud services can \u2013 in some cases \u2013 provide financial savings, but it will certainly provide greater control over the data you\u2019re responsible for and the way your users can access it.\u00a0<\/p>\n

That can be a distinct advantage when it comes to data protection<\/a> and financial services regulation. Note, though, that you will be responsible for securing and updating the software that runs your cloud, rather than being able to leave that to a third party.<\/p>\n

We\u2019ll guide you through setting up open source cloud storage suite Nextcloud and Collabora Online, which adds online collaborative document editing to Nextcloud, as well as a few more common business cloud features. For brevity and convenience, we\u2019ll be using containerised versions of the software distributed using Snap and Docker<\/a>.<\/p>\n

The latest version, Nextcloud 18 Hub, includes support for an integrated OnlyOffice editing environment on the same server. This is bleeding edge stuff, so for both this reason and because the OnlyOffice Community Edition it uses supports just 20 simultaneous open documents, we’ve opted not to use this approach for our tutorial.<\/p>\n

Instead, we\u2019ll guide you through setting up the current stable version 16 snap release of Nextcloud and the more fully-featured Collabora document editing environment on a dedicated server, as this is more appropriately scaleable to the needs of most businesses.<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

In our example deployment, we\u2019ve given Nextcloud and Collabora\u2019s servers each a dedicated VM. The required spec will vary depending on how many users you have, how much they need to store and how frequently they\u2019ll access storage and edit documents.<\/p>\n

A very basic setup – suitable for a small business or department of three to ten people – works smoothly with a single core and 1GB RAM for the Nextcloud server, and two cores and 2GB RAM for Collabora. The extra memory is particularly important here if you expect multiple users to work on their documents at the same time.<\/p>\n

Unless you have very high storage capacity requirements, we suggest using an SSD-based system to improve responsiveness. This tutorial was written using virtual servers hosted on Vultr and that service\u2019s default Ubuntu 18.04 image, but applies to any comparable virtual<\/a> or hardware server configuration.<\/p>\n

Nextcloud installation<\/h2>\n

Set up an Ubuntu 18.04 server. If your install image doesn\u2019t prompt you to do so, create a new user, add them to the sudoers group and update the server. You\u2019ll be logging in as that new user, rather than as root, whenever you need command line access to the Nextcloud server.<\/p>\n\n\n\n
adduser username
\nadduser username sudo
\nsu username
\nsudo apt update
\nsudo apt dist-upgrade<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Now, we\u2019re ready to install the Nextcloud snap package, which packs in all required dependencies.<\/p>\n\n\n\n
sudo snap install nextcloud<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

To configure your Nextcloud, connect to your server\u2019s IP address in a web browser and follow the prompts to create an admin account. Congratulations, you now have a basic cloud storage server.<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

To make it easily accessible and appropriately professional-looking, we\u2019ll want a domain name for it \u2013 either a new domain or a subdomain of your existing web address will work well. \u00a0<\/p>\n

With an appropriate domain name registered or subdomain selected, create an A record in your registrar\u2019s DNS management portal pointing at your new Nextcloud server’s IP address.<\/p>\n

Now we\u2019ll have to tell your Nextcloud instance what its domain name is. Log in to the server at the command line.<\/p>\n\n\n\n
sudo nano \/var\/snap\/nextcloud\/current\/nextcloud\/config\/config.php<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Add your new domain name under trusted_domains, save changes and you should now be able to immediately access your Nextcloud from that URL.<\/p>\n

With that done, it\u2019s time to run through Nextcloud\u2019s recommended server security tweaks<\/a>, most importantly HTTPS support<\/a>.
\n\u00a0
\nThe Nextcloud snap comes with built-in support for generating a LetsEncrypt certificate, so just run:<\/p>\n\n\n\n
sudo nextcloud.enable-https lets-encrypt<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Then follow through the certificate creation process for your domain name. The Nextcloud Snap includes an integrated auto-renewal routine, but you can also renew your certificates at any point by re-running the creation command above.<\/p>\n

Configure Nextcloud<\/h2>\n

Nextcloud needs to be able to communicate with your users for everything from registration emails to editing invitations, so you\u2019ll need an SMTP server<\/a> that it can send outbound emails through.<\/p>\n

In this example, we\u2019re integrating Nextcloud with a business that uses G-Suite<\/a>, so we\u2019ll use Gmail as our SMTP server. However, third-party SMTP providers of this kind may require some extra configuration on their end to work. In this instance, we had to reduce security to allow access. If users aren\u2019t allowed to manage their own less secure apps, you\u2019ll have to grand them this permission in the G-Suite admin panel\u2019s Advanced Security Settings.<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

If you\u2019re testing Nextcloud and using a standard Gmail account for SMTP, you\u2019ll find the same setting in your personal Google Account Security options.<\/p>\n

If you run your own mail server, you\u2019ll want to create a user for Nextcloud and point it at that.\u00a0<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

At this point, you should add a recovery email address and ideally enable two-factor authentication for your admin account. Once you roll Nextcloud out to your users, you should strongly encourage them to do the same.<\/p>\n

If all you need is online storage, you’re ready to invite users, but if you want to provide more advanced cloud services and apps, such as document editing, \u00a0you\u2019ll want to add a few more features.<\/p>\n

Click on your profile icon and select Apps. Here, you’ll see all the default features of Nextcloud, such as its gallery display for images, plain text editor and PDF viewer, as well as any pending updates for them.\u00a0<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

In the pane on the left, a category list lets you view a full range of official and third-party Nextcloud apps. There’s a lot here, so you’ll want to take a look through everything to see what your users are likely to need.<\/p>\n

Nextcloud’s app library includes Google Drive, Microsoft OneDrive and Dropbox integrations that can help users transfer files from third-party cloud services to Nextcloud, multimedia file playback and conversion, single sign-on and additional two-factor authentication support, web form creation, WebRTC-based video and voice conferencing, end-to-end encryption and real-time tracking of associated mobile devices, as well as more traditional office suite functionality.<\/p>\n

For this tutorial, we’re going to add a calendar, task list, and contact management. Go to Office & text and select Download and enable on Calendar, Contacts and Tasks. You may be prompted to enter your password. Once you’ve added these and returned to the main Nextcloud interface, you’ll be able to access these via extra buttons that’ll appear on the interface’s top bar.<\/p>\n

Nextcloud includes a simple integrated text editor by default, but if you need proper online document creation and editing, the Nexcloud Collabora Online app is an elegant solution. To use it, however, you’ll need to set up a Collabora Online server.\u00a0<\/p>\n

Based on LibreOffice, Collabora\u2019s features include full version control, commenting, collaborative document editing, and it allows you to create word processor documents, spreadsheets and presentations. Documents are saved in standard Open Document formats, and the synced versions that\u2019ll be saved on users\u2019 devices can be opened in any compatible word processor, although you only get access to collaborative editing via the web interface.<\/p>\n

Collabora is available as a Docker image. As it can become rather memory-hungry if you’ve got lots of users editing documents at the same time, we recommend giving it its own server, which also makes life a little easier when it comes to setup and configuration.<\/p>\n

Collabora installation<\/h2>\n

Spin up a fresh Ubuntu 18.04 server and update it. We’ll be expanding on Nextcloud’s official Collabora deployment instructions<\/a>\u00a0for this section and working on the assumption that Collabora will only need to serve a single Nextcloud instance.<\/p>\n

While some previous iterations of Docker liked to run as root, which is reflected in the Collabora setup instructions linked above, you can and should use a normal user in the sudoers group. So, if your installation image doesn\u2019t do this for you by default:<\/p>\n\n\n\n
adduser username
\nadduser username sudo
\nsu username
\nsudo apt update
\nsudo apt dist-upgrade<\/p>\n

sudo apt install docker.io
\nsudo docker pull collabora\/code
\nsudo docker run -t -d -p 127.0.0.1:9980:9980 -e ‘domain=subdomain\\\\.yournextclouddomain\\\\.tld’ -e ‘dictionaries=en en-gb’ –restart always –cap-add MKNOD collabora\/code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

These parameters include British, as well as US, English dictionaries – you can add others as needed. The path specified in the docker run command above must match the URL that your users will be using to connect to Nextcloud.<\/p>\n

You\u2019ll also need Apache to act as a forward proxy for the Docker images.\u00a0<\/p>\n\n\n\n
sudo apt-get install apache2\u00a0
\nsudo a2enmod proxy\u00a0
\nsudo a2enmod proxy_wstunnel\u00a0
\nsudo a2enmod proxy_http\u00a0
\nsudo a2enmod ssl\u00a0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Before you can configure it properly, though, we\u2019ll need to set up TLS certificates for the subdomain it\u2019ll be using. We\u2019re again using Let\u2019s Encrypt certificates in this tutorial.<\/p>\n

In this particular configuration, the easiest option is to stop Apache before using the Lets Encrypt certbot\u2019s certificate-only generation mode.<\/p>\n\n\n\n
sudo service apache2 stop
\nsudo apt install certbot
\nsudo certbot certonly –standalone<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Enter the domain name you want to use for the Collabora server – \u00a0we suggest using a subdomain on the same domain you\u2019re using for your Nextcloud server. Remember to create an A record in your DNS settings to point the subdomain at your new Collabora server before you try to generate the certificate.<\/p>\n

Certbot automatically sets up a cron job to handle the required three-monthly renewals of Let\u2019s Encrypt certificates, but we\u2019ll have to make a couple of modifications to make sure it stops and restarts Apache properly. First, test renewal, as it\u2019ll have to stop your server.<\/p>\n\n\n\n
sudo certbot renew –dry-run –pre-hook “service apache2 stop” –post-hook “service apache2 start”<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

If that runs without any errors, we need to create scripts for those pre and post hooks into the appropriate directories.<\/p>\n\n\n\n
sudo nano \/etc\/letsencrypt\/renewal-hooks\/pre\/stop_apache
\n#!\/bin\/bash
\nservice apache2 stop<\/p>\n

sudo nano \/etc\/letsencrypt\/renewal-hooks\/post\/start_apache
\n#!\/bin\/bash
\nservice apache2 start<\/p>\n

sudo chmod u+x \/etc\/letsencrypt\/renewal-hooks\/post\/start_apache
\nsudo chmod u+x \/etc\/letsencrypt\/renewal-hooks\/pre\/stop_apache<\/p>\n

See if these are working by running
\nsudo certbot renew –dry-run<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

You can also confirm that there\u2019s a systemd timer in place for certbot thus:<\/p>\n\n\n\n
systemctl list-timers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

We\u2019re using Apache as a proxy here, so you\u2019ll need to enter the URL of the Collabora Online server \u2013 the one you just got a certificate for \u2013 and the path to the certificates we created earlier.<\/p>\n\n\n\n
<VirtualHost *:443>
\nServerName your.collabora.subdomain:443<\/p>\n

# SSL configuration, you may want to take the easy route instead and use Lets Encrypt!
\nSSLEngine on
\nSSLCertificateFile \/etc\/letsencrypt\/live\/certificate.domain.here\/cert.pem
\nSSLCertificateChainFile \/etc\/letsencrypt\/live\/certificate.domain.here\/chain.pem
\nSSLCertificateKeyFile \/etc\/letsencrypt\/live\/certificate.domain.here\/privkey.pem
\nSSLProtocol \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 all -SSLv2 -SSLv3
\nSSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-G$
\nSSLHonorCipherOrder \u00a0 \u00a0 on<\/p>\n

# Encoded slashes need to be allowed
\nAllowEncodedSlashes NoDecode<\/p>\n

# Container uses a unique non-signed certificate
\nSSLProxyEngine On
\nSSLProxyVerify None
\nSSLProxyCheckPeerCN Off
\nSSLProxyCheckPeerName Off<\/p>\n

# keep the host
\nProxyPreserveHost On<\/p>\n

# static html, js, images, etc. served from loolwsd
\n# loleaflet is the client part of LibreOffice Online
\nProxyPass \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/loleaflet https:\/\/127.0.0.1:9980\/loleaflet<\/a> retry=0
\nProxyPassReverse \u00a0 \u00a0\/loleaflet https:\/\/127.0.0.1:9980\/loleaflet<\/a><\/p>\n

# WOPI discovery URL
\nProxyPass \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/hosting\/discovery https:\/\/127.0.0.1:9980\/hosting\/discovery<\/a> retry=0
\nProxyPassReverse \u00a0 \u00a0\/hosting\/discovery https:\/\/127.0.0.1:9980\/hosting\/discovery<\/a><\/p>\n

# Main websocket
\nProxyPassMatch “\/lool\/(.*)\/ws$” wss:\/\/127.0.0.1:9980\/lool\/$1\/ws nocanon<\/p>\n

# Admin Console websocket
\nProxyPass \u00a0 \/lool\/adminws wss:\/\/127.0.0.1:9980\/lool\/adminws<\/p>\n

# Download as, Fullscreen presentation and Image upload operations
\nProxyPass \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/lool https:\/\/127.0.0.1:9980\/lool<\/a>
\nProxyPassReverse \u00a0 \u00a0\/lool https:\/\/127.0.0.1:9980\/lool<\/a><\/p>\n

# Endpoint with information about availability of various features
\nProxyPass \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/hosting\/capabilities https:\/\/127.0.0.1:9980\/hosting\/capabilities<\/a> retry=0
\nProxyPassReverse \u00a0 \u00a0\/hosting\/capabilities https:\/\/127.0.0.1:9980\/hosting\/capabilities<\/a>
\n\u00a0<\/VirtualHost><\/p>\n

sudo service apache2 restart<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Your Collabora server should now be good to go. Log into your Nextcloud web interface as an admin, open the Settings screen and scroll down the left-hand pane until you get to Collabora Online Development Edition.<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

Click on that and enter the URL and port of your Collabora subdomain \u2013 your.collabora.subdomain:443 \u2013 and click apply.<\/p>\n

User experience<\/h2>\n

With all your apps up and running, it\u2019s finally time to invite your users. In the Nextcloud web interface, click on your profile icon on the top right of the interface and select users.\u00a0<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

Create new users by clocking the +New user button in the left-hand pane then filling in the account settings you want to give them in the entry that appears at the to of the user list on the right.\u00a0<\/p>\n

You can set a password for them, which they should change after first logging in, and inform them of it. Alternately you can leave this password field blank and have them use the password reset feature to create their own password.<\/p>\n

When they first log in, users should set their language and locale preferences in the Personal info section of the settings screen, again accessible by clicking on the user icon at top right. Locale determines the first day of the week for the calendar, which is set to the US Sunday-first system by default, and the language in which days are named.<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

As well as the website, client applications are available for Windows, Linux, macOS, Android and iOS. Users will be prompted to download these when they first connect, and they’re always available via the Mobile & desktop entry in the settings screen, accessible by selecting settings from the menu that appears when you click on your user icon at top right.\u00a0<\/p>\n

Users can also search for Nextcloud clients in mobile app stores and link them by manually entering your cloud server’s URL. This section also includes links to information for syncing calendar and contact data.<\/p>\n

If you want your Android users to be able to edit documents from the Nextcloud mobile app, you should use your device management system to roll out the apk file that can be downloaded directly from Nextcloud or have them install the app from the F-Droid store, as the Google Play version is, at time of writing, lagging behind when it comes to support for Collabora Office.<\/p>\n

\u00a0<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

The mobile apps\u2019 Auto upload options allow you to select specific directories on your phone to be automatically backed up to Nextcloud, whether that\u2019s your photo gallery or critical document folder.<\/p>\n

Assuming you\u2019ve enabled the contacts app for Nextcloud, the mobile clients will be able to automatically back up your contacts to the service every day, and you can use Bitfire\u2019s DAVx5 app for real-time calendar and contact syncing \u2013 once added, Nextcloud calendars and contacts can be accessed via your preferred app.\u00a0<\/p>\n

Tasklist management for the Tasks feature is supported in DAVx5 via OpenTasks for Android, which users are prompted to install. Sync schedules can be customised as needed, with features including the option of only syncing over Wi-Fi, and everything works seamlessly in the background.<\/p>\n

\u00a0<\/p>\n

\n
\"\" <\/div>\n<\/div>\n

The desktop clients let you configure file syncing and create a default Nextcloud folder, whose contents will be automatically kept in sync with your Nextcloud server. You’ll want to set it to launch on system startup. You can also apply bandwidth limits and throttling, which may be helpful to those working from home or on the road.<\/p>\n

Nextcloud and its broad range of apps and connectivity tools have great potential for any business that wishes to either switch away from or supplement third-party cloud services.\u00a0<\/p>\n

For a more customised installation or to support large numbers of users, you may wish to build from source once you\u2019ve familiarised yourself with Nextcloud\u2019s systems, but the containerised versions of Nextcloud and Collabora are regularly updated and meet the core requirements for a small self-managed business cloud. <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Andy Webb
\n K.G. Orphanides<\/p>\n

30 Mar, 2020 <\/p>\n

Cloud services have revolutionised the way we work, providing easy paths for collaboration over a distance and business-critical features such as automatic off-site backups an…<\/p>\n","protected":false},"author":639,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40656","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/639"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=40656"}],"version-history":[{"count":1,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40656\/revisions"}],"predecessor-version":[{"id":40657,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40656\/revisions\/40657"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=40656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=40656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=40656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}