{"id":49,"date":"2016-12-09T11:32:55","date_gmt":"2016-12-09T09:32:55","guid":{"rendered":"http:\/\/devblog.viking-studios.net\/en\/?p=49"},"modified":"2017-02-14T13:48:49","modified_gmt":"2017-02-14T11:48:49","slug":"your-own-cloud-nextcloud-optimization-on-a-synology-diskstation-and-dsm-6","status":"publish","type":"post","link":"https:\/\/blog.viking-studios.net\/en\/your-own-cloud-nextcloud-optimization-on-a-synology-diskstation-and-dsm-6\/","title":{"rendered":"Your own cloud: Nextcloud optimization on a Synology DiskStation and DSM 6"},"content":{"rendered":"

In my\u00a0last article<\/a>\u00a0I wrote about installing Nextcloud on a DiskStation. After that, you should do some improvements, to ensure that Nextcloud is operating perfectly and to increase security. Also, there could be some error messages, depending on the runtime environment. This article explains the most common and important settings.<\/p>\n

Hint:<\/strong> This tutorial works also with Owncloud 8 and Owncloud 9 as Nextcloud 9 is a fork of Owncloud 9.
\n <\/p>\n

Preperation<\/h2>\n

 
\nNextcloud\u00a0has to be installed and executed on your DiskStation.
\n <\/p>\n

Optimization and error handling<\/h2>\n

 
\nFirst, enter the Nextcloud \u00a0web interface and switch to the admin panel. In the admin panel, Nextcloud executes some basic tests and reports errors and optimization hints.<\/p>\n

\"Nextcloud\u00a0security<\/a>
Nextcloud\u00a0security warnings in the admin panel<\/figcaption><\/figure>\n

The shown security warnings depend on how Nextcloud got installed and which settings on the web server were already done. I’M going to explain the most common ones and how to get rid of them. Another small hint, this warnings don’t mean that Nextcloud isn’t working, they are just notifications about security holes and possible improvements.<\/p>\n

Hint:<\/strong>\u00a0Always use putty or WinSCP to change config files or permissions. One reason is, that the\u00a0DSM text editor always enters the root user as owner whenever you change or create a file. Another reason is, that not all users and groups are available withing the DSM permission settings.<\/p>\n

Data folder<\/h4>\n

You shouldn’t see this message, if you have used this article<\/a>\u00a0or the official Nextcloud documentation.\u00a0If you haven’t used a custom folder for your data,\u00a0Nextcloud uses the default data folder within the \\web directory of your DiskStation. In this case, the message\u00a0“Your data directory and your files are probably accessible from the internet.” is shown. You can restrict the access to the data folder, but it is way more secure to move the data folder out of the web root.<\/p>\n

HSTS<\/h4>\n

This is the most common message since DSM 6: “The \u201cStrict-Transport-Security\u201d HTTP header is not configured to least \u201c15768000\u201d seconds. For enhanced security we recommend enabling HSTS as described in our security tips.”
\nIt’s a bit tricky to solve this issue. Since\u00a0DSM 6, ngingx is used as default web server. If you don’t have experience with nginx, it takes a while till you find the correct place to enable HSTS. In DSM 5 there was on option that could have been enabled. A big “Thank you”\u00a0goes to FalkenaugeMihawk and the German Synology forum for this solution.<\/p>\n

    \n
  1. Connect to your DiskStation over ssh and log in as admin.<\/li>\n
  2. Get root access by entering sudo su –<\/em>\u00a0and password.<\/li>\n
  3. Create a new file in\u00a0\/etc\/nginx\/conf.d and name it “http.*.conf” (the star should be replaced with something that sounds logical). Open the file\u00a0(e.g. command vi \/etc\/nginx\/conf.d\/http.hsts.conf<\/em>).<\/li>\n
  4. Add this line: add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;<\/em><\/li>\n
  5. Save and close the file.<\/li>\n
  6. Reload nginx config:\u00a0nginx -s reload<\/em><\/li>\n<\/ol>\n
    \"HSTS<\/a>
    HSTS\u00a0enable in nginx<\/figcaption><\/figure>\n

    Alternatively you could create an virtual host and enable HSTS there.<\/p>\n

    Memcache<\/h4>\n

    Also the following hint is very common.<\/p>\n

    \"Memory-Cache<\/a>
    Memory cache warning in the admin panel<\/figcaption><\/figure>\n

    To get rid of this message, you have to enable one of the 4 possible mem cache option. Luckily the DiskStation offers 2 of them:\u00a0APC und APCu. To enable mem caching, log into your DSM. Open the web server via the menu\u00a0and go to PHP settings, there you have to tick\u00a0“Enable PHP cache” and save the changes.<\/p>\n

    \"PHP<\/a>
    PHP cache enabled via\u00a0DSM<\/figcaption><\/figure>\n

    Now you have to modify the Nextcloud config file.<\/p>\n

      \n
    1. Connect to your DiskStation over ssh and log in as admin.<\/li>\n
    2. Get root access by entering sudo su –<\/em>\u00a0and password.<\/li>\n
    3. Open the Nextcloud config file using\u00a0vi \/volumeX\/web\/Nextcloud\/config\/config.php<\/em><\/li>\n
    4. Add the following line within the brackets: ‘memcache.local’ => ‘\\\\OC\\\\Memcache\\\\APCu’,<\/em><\/li>\n
    5. Save and close the file.<\/li>\n<\/ol>\n
      \"Nextcloud<\/a>
      Nextcloud config.php<\/figcaption><\/figure>\n

      Permissions and\u00a0ownership<\/h4>\n

      The last step we have to do is, altering the permissions and owner of all files and folders of our Nextcloud installation. The permissions should be as strict as possible.\u00a0The best solution is, to create a script(ends with .sh) on your DS. To perform an uptade you have to loosen the permissions. Using a script you could alter the permissions quickly. This is how the script should look like:<\/p>\n

      #!\/bin\/bash\r\nncpath='\/volume1\/web\/nextcloud'\r\nhtuser='http'\r\nhtgroup='http'\r\nrootuser='root'\r\n\r\nprintf \"chmod Files and Directories\\n\"\r\nfind ${ncpath}\/ -type f -print0 | xargs -0 chmod 0640\r\nfind ${ncpath}\/ -type d -print0 | xargs -0 chmod 0750\r\nfind \/volume1\/ncdata\/ -type f -print0 | xargs -0 chmod 0640\r\nfind \/volume1\/ncdata\/ -type d -print0 | xargs -0 chmod 0750\r\n\r\nprintf \"chown Directories\\n\"\r\nchown -R ${rootuser}:${htgroup} ${ncpath}\/\r\nchown -R ${htuser}:${htgroup} ${ncpath}\/apps\/\r\nchown -R ${htuser}:${htgroup} ${ncpath}\/config\/\r\nchown -R ${htuser}:${htgroup} ${ncpath}\/themes\/\r\nchown -R ${htuser}:${htgroup} ${ncpath}\/updater\/\r\nchmod +x ${ncpath}\/occ\r\n\r\nprintf \"chmod\/chown .htaccess\\n\"\r\nif [ -f ${ncpath}\/.htaccess ]\r\nthen\r\nchmod 0644 ${ncpath}\/.htaccess\r\nchown ${htuser}:${htgroup} ${ncpath}\/.htaccess\r\nfi\r\n\r\nchown ${htuser}:${htgroup} ${ncpath}\/.user.ini<\/pre>\n
      To execute the script enter sh \/volumeX\/Pfad\/zum\/Script.sh<\/em><\/p>\n
      You have done the most important settings now. Enter the admin panel again and get sure that all the messages disappeared.
      \n <\/p>\n
      Possible mistakes<\/h2>\n
       
      \nIf the data folder has the wrong permissions and is not readable by Nextcloud, there is a message about this in your admin panel.
      \nIf you get a blank page or an error 500 if you want to enter Nextcloud, then it is most likely that there is an error in your Nextcloud config file.\u00a0Nextcloud can’t read the file if the format is broken. Get sure that all changes are added within the brackets.\u00a0Also get sure that every line ends with a comma, if there is another line afterwards.
      \nCheck the permissions and owner of the Nextcloud folders and files.
      \nPersonally, I had a problem with permissions. I already applied strict permission and changed config.php (via putty). Although the permissions were still correct afterwards, Nextcloud couldn’t read the file. After undoing the changes the file was \u00a0OK again. To apply the changes anyway, I used the script (from       this article<\/a>) to apply the loose permissions.\u00a0Then I change the config file and applied the strict permissions again.<\/p>\n
      In my next article<\/a> I’ll explain how to update Nextcloud.<\/p>\n
       <\/p>\n
      Your own Cloud: Nextcloud on a Synology DiskStation<\/h3>\n