Nextcloud Kurulumu: Self-Hosted Bulut Depolama ve İşbirliği

mkdir -p /opt/nextcloud/{data,db,redis}
cd /opt/nextcloud

version: '3.8'

services:
  db:
    image: postgres:16-alpine
    container_name: nextcloud-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: guclu-db-sifresi
    volumes:
      - ./db:/var/lib/postgresql/data
    networks:
      - nextcloud-net

  redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    command: redis-server --requirepass redis-sifresi
    volumes:
      - ./redis:/data
    networks:
      - nextcloud-net

  app:
    image: nextcloud:28-fpm-alpine
    container_name: nextcloud-app
    restart: unless-stopped
    depends_on:
      - db
      - redis
    environment:
      POSTGRES_HOST: db
      POSTGRES_DB: nextcloud
      POSTGRES_USER: nextcloud
      POSTGRES_PASSWORD: guclu-db-sifresi
      NEXTCLOUD_ADMIN_USER: admin
      NEXTCLOUD_ADMIN_PASSWORD: admin-sifresi
      NEXTCLOUD_TRUSTED_DOMAINS: cloud.example.com
      REDIS_HOST: redis
      REDIS_HOST_PASSWORD: redis-sifresi
      PHP_MEMORY_LIMIT: 512M
      PHP_UPLOAD_LIMIT: 10G
    volumes:
      - ./data:/var/www/html
    networks:
      - nextcloud-net

  nginx:
    image: nginx:alpine
    container_name: nextcloud-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./data:/var/www/html:ro
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/ssl/nextcloud:ro
    depends_on:
      - app
    networks:
      - nextcloud-net

  cron:
    image: nextcloud:28-fpm-alpine
    container_name: nextcloud-cron
    restart: unless-stopped
    volumes:
      - ./data:/var/www/html
    entrypoint: /cron.sh
    depends_on:
      - db
      - redis
    networks:
      - nextcloud-net

networks:
  nextcloud-net:
    driver: bridge

nano /opt/nextcloud/nginx.conf

worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    upstream php-handler {
        server nextcloud-app:9000;
    }

    server {
        listen 80;
        server_name cloud.example.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name cloud.example.com;

        ssl_certificate /etc/ssl/nextcloud/fullchain.pem;
        ssl_certificate_key /etc/ssl/nextcloud/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;

        root /var/www/html;
        index index.php index.html;

        client_max_body_size 10G;
        fastcgi_buffers 64 4K;

        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_types application/javascript application/json text/css text/plain;

        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options SAMEORIGIN always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy no-referrer always;

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }

        location ^~ /.well-known {
            location = /.well-known/carddav { return 301 /remote.php/dav/; }
            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
            location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
            location /.well-known/pki-validation { try_files $uri $uri/ =404; }
            return 301 /index.php$request_uri;
        }

        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
            set $path_info $fastcgi_path_info;
            try_files $fastcgi_script_name =404;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_param HTTPS on;
            fastcgi_param modHeadersAvailable true;
            fastcgi_param front_controller_active true;
            fastcgi_pass php-handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
            fastcgi_read_timeout 3600;
        }

        location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
            try_files $uri /index.php$request_uri;
            expires 6M;
            access_log off;
        }

        location ~ \.woff2?$ {
            try_files $uri /index.php$request_uri;
            expires 7d;
            access_log off;
        }

        location / {
            try_files $uri $uri/ /index.php$request_uri;
        }
    }
}

# Certbot ile Let's Encrypt sertifikası
apt install certbot -y
certbot certonly --standalone -d cloud.example.com

# Sertifikaları kopyala
mkdir -p /opt/nextcloud/ssl
cp /etc/letsencrypt/live/cloud.example.com/fullchain.pem /opt/nextcloud/ssl/
cp /etc/letsencrypt/live/cloud.example.com/privkey.pem /opt/nextcloud/ssl/

# Otomatik yenileme için cron
echo "0 3 * * * certbot renew --quiet && cp /etc/letsencrypt/live/cloud.example.com/*.pem /opt/nextcloud/ssl/ && docker restart nextcloud-nginx" | crontab -

cd /opt/nextcloud
docker compose up -d

# Logları takip et
docker compose logs -f app

# Kurulum tamamlandığında erişin:
# https://cloud.example.com

# occ komutunu çalıştırma
docker exec -u www-data nextcloud-app php occ [komut]

# Sistem durumunu kontrol et
docker exec -u www-data nextcloud-app php occ status

# Bakım modunu aç/kapat
docker exec -u www-data nextcloud-app php occ maintenance:mode --on
docker exec -u www-data nextcloud-app php occ maintenance:mode --off

# Eksik indeksleri ekle
docker exec -u www-data nextcloud-app php occ db:add-missing-indices

# Dosya taraması (yeni dosyaları algıla)
docker exec -u www-data nextcloud-app php occ files:scan --all

# Önbelleği temizle
docker exec -u www-data nextcloud-app php occ cache:clear

# Kullanıcı listesi
docker exec -u www-data nextcloud-app php occ user:list

# Yeni kullanıcı oluştur
docker exec -u www-data nextcloud-app php occ user:add --password-from-env --display-name="Ad Soyad" kullanici_adi

# Mevcut uygulamaları listele
docker exec -u www-data nextcloud-app php occ app:list

# Uygulama kur
docker exec -u www-data nextcloud-app php occ app:install calendar
docker exec -u www-data nextcloud-app php occ app:install contacts
docker exec -u www-data nextcloud-app php occ app:install talk
docker exec -u www-data nextcloud-app php occ app:install onlyoffice

# Uygulamayı etkinleştir/devre dışı bırak
docker exec -u www-data nextcloud-app php occ app:enable deck
docker exec -u www-data nextcloud-app php occ app:disable activity

docker exec -u www-data nextcloud-app php occ config:system:set redis host --value="redis"
docker exec -u www-data nextcloud-app php occ config:system:set redis port --value=6379 --type=integer
docker exec -u www-data nextcloud-app php occ config:system:set redis password --value="redis-sifresi"
docker exec -u www-data nextcloud-app php occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu"
docker exec -u www-data nextcloud-app php occ config:system:set memcache.distributed --value="\\OC\\Memcache\\Redis"
docker exec -u www-data nextcloud-app php occ config:system:set memcache.locking --value="\\OC\\Memcache\\Redis"

# Nextcloud cron container zaten çalışıyor
# Cron modunu ayarla
docker exec -u www-data nextcloud-app php occ background:cron

# PHP limitlerini artır (docker-compose.yml environment'a ekle)
PHP_MEMORY_LIMIT=1G
PHP_UPLOAD_LIMIT=10G

# Güvenilir domain ekle
docker exec -u www-data nextcloud-app php occ config:system:set trusted_domains 1 --value="cloud.example.com"

# Brute force koruması
docker exec -u www-data nextcloud-app php occ config:system:set auth.bruteforce.protection.enabled --value=true --type=boolean

# 2FA zorunlu kıl
docker exec -u www-data nextcloud-app php occ twofactorauth:enforce --on