Posted inFedora

Nextcloud on Fedora Server: Building Your Own Storage ‘Fortress’ with SELinux

Fedora tutorial - IT technology blog
Fedora tutorial - IT technology blog

Why Fedora and Nextcloud at 2 AM?

The clock struck 2 AM, and I received a notification that my Google Drive was approaching the 15GB free limit. Instead of reaching for my wallet to pay a monthly fee, I decided to leverage the Fedora Server VPS I have running at home. I’ve been using Fedora as my primary dev machine for over two years, and its package update speed is truly impressive.

With Nextcloud, running it on a security-hardened distro like Fedora gives me peace of mind. You aren’t just storing files; you’re exposing personal data to the internet. Many people choose Ubuntu for a hassle-free experience. However, Fedora offers a different experience: always-fresh packages (PHP 8.3, MariaDB 10.11) and the robust armor of SELinux. If you prioritize security over just “making it work,” this is the number one choice.

Step 1: Setting up MariaDB and PHP 8.x

First, update the entire system. Fedora pushes new packages constantly, so don’t skip this step to avoid version conflicts.

sudo dnf update -y
sudo dnf install -y nginx mariadb-server mariadb php-fpm php-mysqlnd php-gd php-xml php-mbstring php-json php-intl php-pecl-apcu php-opcache php-process php-zip

Once installed, enable MariaDB. Never leave a database root password empty in a production environment. Run the security script immediately.

sudo systemctl enable --now mariadb
sudo mysql_secure_installation

Now it’s time to create a “home” for your data. Replace your_password with a complex string to prevent brute-force attacks:

sudo mysql -u root -p

CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'nextclouduser'@'localhost' IDENTIFIED BY 'your_password';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextclouduser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 2: Downloading and Extracting Nextcloud

I usually use wget to download the latest stable version. Nextcloud is currently highly optimized for PHP 8.x, making the interface response time about 20% faster than older versions.

cd /var/www/html
sudo wget https://download.nextcloud.com/server/releases/latest.zip
sudo unzip latest.zip
sudo chown -R apache:apache nextcloud
sudo rm latest.zip

There is a minor quirk on Fedora: Nginx runs under the nginx user, but PHP-FPM defaults to the apache user. To keep things running smoothly, I’ll assign permissions to apache and configure Nginx to run in the same group in a later step.

Step 3: Configuring Nginx – A Breath of Fresh Air for Performance

Create a separate configuration file instead of editing nginx.conf directly. This approach makes it easier to manage multiple websites on the same server.

sudo nano /etc/nginx/conf.d/nextcloud.conf

Paste the optimized configuration below. Remember to replace your_domain.com with your actual domain name:

server {
    listen 80;
    server_name your_domain.com;

    root /var/www/html/nextcloud/;
    index index.php index.html;

    client_max_body_size 512M; # Increase limit for large file uploads
    client_body_timeout 300s;
    fastcgi_buffers 64 4K;

    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    location / {
        rewrite ^ /index.php;
    }

    location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|settings\/apps\/handler|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) {
        fastcgi_split_path_info ^(.+?\.php)(\/.*)$;
        set $path_info $fastcgi_path_info;
        try_files $fastcgi_script_name =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_pass unix:/run/php-fpm/www.sock;
    }

    location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
        try_files $uri/ =404;
        index index.php;
    }

    location ~* \.(?:css|js|woff2?|svg|gif|map)$ {
        add_header Cache-Control "public, max-age=15778463";
        access_log off;
    }
}

Step 4: Configuring SELinux and Firewalld – Don’t Disable Them!

Many online tutorials tell you to type setenforce 0 for a quick fix. Don’t do that! SELinux is your last line of defense if Nginx is exploited by a hacker. Instead of disabling it, grant the correct permissions so it can protect you.

# Allow Nginx to write data to critical folders
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
sudo restorecon -Rv /var/www/html/nextcloud/

# Allow Nginx network connection to download apps from the store
sudo setsebool -P httpd_can_network_connect on

Open ports on Firewalld so the outside world can access your server:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Step 5: Let’s Encrypt SSL and Final Optimization

Without SSL, your passwords will float across the network in plain text. We’ll use Certbot to get a free certificate in just 30 seconds:

sudo dnf install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your_domain.com

Then, open the file /etc/php-fpm.d/www.conf. Check and ensure the following lines match the Nginx configuration:

user = apache
group = apache
listen.owner = nginx
listen.group = nginx

Restart all services to apply the changes:

sudo systemctl enable --now nginx php-fpm

Testing & Operation

Access your domain, and the Nextcloud interface will greet you. Enter the database information created in Step 1 to finish. Once you’re in the Dashboard, you should immediately handle these two tasks:

  1. Cron Configuration: Nextcloud needs to clean up temporary files periodically. Add this line to the apache user’s crontab using the command sudo crontab -u apache -e:
*/5  *  *  *  * php -f /var/www/html/nextcloud/cron.php
  1. Increase Memory Limit: If the system reports low RAM, edit the /etc/php.ini file. Find memory_limit and increase it to 512M or 1G if you have many photos.

The feeling of seeing photos from your phone automatically sync to your own server is fantastic. Fedora might be a bit stubborn at first with SELinux. However, once you master it, you own an incredibly solid data fortress.

If you encounter a 500 or 403 error, don’t panic. Check the logs immediately with tail -f /var/log/nginx/error.log. Most errors on Fedora simply revolve around permissions or SELinux not recognizing the correct context.

Share:
Tags: