┌──────────────────────────────────────────┐
│         User's Browser/Mobile App        │
└────────────────┬─────────────────────────┘
                 │
      ┌──────────▼───────────┐
      │   Nginx Web Server   │  (Serves PHP application)
      └──────────┬───────────┘
                 │
      ┌──────────▼───────────┐
      │   PHP-FPM Process    │  (Executes Nextcloud code)
      └──────────┬───────────┘
                 │
    ┌────────────┼────────────┐
    │            │            │
    ▼            ▼            ▼
┌────────┐  ┌────────┐  ┌────────┐
│Postgres│  │ Redis  │  │  Files │
│Database│  │ Cache  │  │/Storage│
└────────┘  └────────┘  └────────┘

ssh labadmin@10.0.50.13

sudo apt update
sudo apt install -y nginx

nginx -v

nginx version: nginx/1.24.0 (Ubuntu)

sudo systemctl status nginx

curl http://localhost

sudo apt install -y \
  php8.3-fpm \
  php8.3-cli \
  php8.3-common \
  php8.3-curl \
  php8.3-gd \
  php8.3-mbstring \
  php8.3-xml \
  php8.3-zip \
  php8.3-bcmath \
  php8.3-intl \
  php8.3-bz2 \
  php8.3-gmp \
  php8.3-imagick \
  php8.3-pgsql \
  php8.3-redis \
  php8.3-apcu \
  unzip

php -v

PHP 8.3.2 (cli) (built: Jan 16 2024 16:40:08) (NTS)

sudo nano /etc/php/8.3/fpm/php.ini

# Memory and upload limits
memory_limit = 512M
upload_max_filesize = 10G
post_max_size = 10G
max_execution_time = 3600
max_input_time = 3600

# File uploads
file_uploads = On

# Timezone (adjust for your location)
date.timezone = America/Toronto

# OPcache (performance)
opcache.enable = 1
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 60
opcache.save_comments = 1

sudo nano /etc/php/8.3/fpm/pool.d/www.conf

# Process manager
pm = dynamic
pm.max_children = 120
pm.start_servers = 12
pm.min_spare_servers = 6
pm.max_spare_servers = 18
pm.max_requests = 500

# Environment variables
env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp

sudo systemctl restart php8.3-fpm

sudo systemctl status php8.3-fpm

cd /tmp
wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2

ls -lh nextcloud-28.0.0.tar.bz2

wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2.sha256
sha256sum -c nextcloud-28.0.0.tar.bz2.sha256

# Extract
sudo tar -xjf nextcloud-28.0.0.tar.bz2 -C /var/www/

# Set ownership (www-data is Nginx/PHP user)
sudo chown -R www-data:www-data /var/www/nextcloud

ls -la /var/www/nextcloud/

drwxr-xr-x  apps/       # Applications
drwxr-xr-x  config/     # Configuration
drwxr-xr-x  core/       # Core code
drwxr-xr-x  data/       # User data (will be created)
-rw-r--r--  index.php   # Entry point

sudo nano /etc/nginx/sites-available/nextcloud

upstream php-handler {
    server unix:/run/php/php8.3-fpm.sock;
}

# Redirect HTTP to HTTPS (when behind Traefik)
server {
    listen 80;
    listen [::]:80;
    server_name cloud.lab.local;

    # Security headers
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Download-Options "noopen" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;
    add_header X-Robots-Tag "noindex, nofollow" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Path to Nextcloud
    root /var/www/nextcloud;

    # Specify how to handle directories
    index index.php index.html /index.php$request_uri;

    # Default charset
    charset utf-8;

    # Disable gzip to avoid potential security issues
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Pagespeed is not supported
    pagespeed off;

    # Disable access to hidden files
    location ~ /\.(?!well-known) {
        deny all;
    }

    # Make sure special directories are accessible
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # .well-known URLs for Let's Encrypt, CalDAV, CardDAV
    location ^~ /.well-known {
        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }
        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
        return 301 /index.php$request_uri;
    }

    # Deny access to certain paths
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

    # Main PHP handler
    location ~ \.php(?:$|/) {
        # Required for legacy support
        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;

        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;

        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;

        fastcgi_read_timeout 3600;
        fastcgi_send_timeout 3600;
        fastcgi_connect_timeout 3600;

        fastcgi_max_temp_file_size 0;
    }

    # Serve static files directly
    location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463, immutable";
        access_log off;

        location ~ \.wasm$ {
            default_type application/wasm;
        }
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri;
        expires 7d;
        access_log off;
    }

    # Rule borrowed from .htaccess
    location /remote {
        return 301 /remote.php$request_uri;
    }

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }
}

# Create symbolic link to enable
sudo ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/

# Remove default site
sudo rm /etc/nginx/sites-enabled/default

# Test configuration
sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo systemctl restart nginx

cd /var/www/nextcloud

sudo -u www-data php occ maintenance:install \
  --database="pgsql" \
  --database-name="nextcloud" \
  --database-host="10.0.50.12:5432" \
  --database-user="nextcloud" \
  --database-pass="NextcloudDB2024!" \
  --admin-user="admin" \
  --admin-pass="LabAdmin2024!" \
  --data-dir="/var/www/nextcloud/data"

Nextcloud was successfully installed

# Add cloud.lab.local
sudo -u www-data php occ config:system:set trusted_domains 0 --value=cloud.lab.local

# Add IP address (for direct access)
sudo -u www-data php occ config:system:set trusted_domains 1 --value=10.0.50.13

# Add proxy hostname (for Traefik)
sudo -u www-data php occ config:system:set trusted_domains 2 --value=lab-proxy1.lab.local

sudo -u www-data php occ config:system:get trusted_domains

0: cloud.lab.local
1: 10.0.50.13
2: lab-proxy1.lab.local

# Configure Redis server
sudo -u www-data php occ config:system:set redis host --value=10.0.50.12
sudo -u www-data php occ config:system:set redis port --value=6379
sudo -u www-data php occ config:system:set redis password --value='LabRedis2024!'

# Set cache backends
sudo -u www-data php occ config:system:set memcache.local --value='\\OC\\Memcache\\APCu'
sudo -u www-data php occ config:system:set memcache.distributed --value='\\OC\\Memcache\\Redis'
sudo -u www-data php occ config:system:set memcache.locking --value='\\OC\\Memcache\\Redis'

# Set background jobs to cron
sudo -u www-data php occ background:cron

# Edit crontab for www-data user
sudo crontab -u www-data -e

*/5  *  *  *  * php -f /var/www/nextcloud/cron.php

sudo -u www-data php occ config:system:set default_phone_region --value="CA"

# Add database indexes for performance
sudo -u www-data php occ db:add-missing-indices

# Convert database to big int (for large file IDs)
sudo -u www-data php occ db:convert-filecache-bigint

curl -I http://localhost

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=utf-8
...

10.0.50.13  cloud.lab.local

sudo -u www-data php occ app:install user_ldap

# Create LDAP configuration
sudo -u www-data php occ ldap:create-empty-config

# This creates config "s01" (server 01)

# Configure LDAP server
sudo -u www-data php occ ldap:set-config s01 ldapHost "ldap://10.0.50.11"
sudo -u www-data php occ ldap:set-config s01 ldapPort 389

# Bind DN (service account)
sudo -u www-data php occ ldap:set-config s01 ldapAgentName "uid=admin,cn=users,cn=accounts,dc=lab,dc=local"
sudo -u www-data php occ ldap:set-config s01 ldapAgentPassword "LabAdmin2024!"

# Base DN (where to search)
sudo -u www-data php occ ldap:set-config s01 ldapBase "cn=accounts,dc=lab,dc=local"

# User filter (which users to import)
sudo -u www-data php occ ldap:set-config s01 ldapUserFilter "(&(objectClass=person)(uid=*))"

# Login filter (how to authenticate)
sudo -u www-data php occ ldap:set-config s01 ldapLoginFilter "(&(objectClass=person)(uid=%uid))"

# Attributes
sudo -u www-data php occ ldap:set-config s01 ldapEmailAttribute "mail"
sudo -u www-data php occ ldap:set-config s01 ldapUserDisplayName "displayName"
sudo -u www-data php occ ldap:set-config s01 ldapGroupDisplayName "cn"

# Group filter
sudo -u www-data php occ ldap:set-config s01 ldapGroupFilter "(&(objectClass=groupOfNames)(cn=*))"

# Enable configuration
sudo -u www-data php occ ldap:set-config s01 ldapConfigurationActive 1

# Test connectivity
sudo -u www-data php occ ldap:test-config s01

The configuration is valid and the connection could be established!

# Count users available
sudo -u www-data php occ ldap:check-user guard1

guard1 maps to LDAP UID: <ldap-unique-id>

sudo -u www-data php occ user:list

# Background job will sync hourly
sudo -u www-data php occ background:job:list | grep LDAP

# Calendar
sudo -u www-data php occ app:install calendar

# Contacts
sudo -u www-data php occ app:install contacts

# Tasks
sudo -u www-data php occ app:install tasks

# Kanban board
sudo -u www-data php occ app:install deck

# Forms (surveys)
sudo -u www-data php occ app:install forms

# Talk (video chat)
sudo -u www-data php occ app:install spreed

# PDF viewer
sudo -u www-data php occ app:install files_pdfviewer

# Text editor
sudo -u www-data php occ app:install files_texteditor

# Two-factor authentication
sudo -u www-data php occ app:install twofactor_totp

# Admin audit log
sudo -u www-data php occ app:install admin_audit

sudo -u www-data php occ app:list

sudo apt install -y docker.io docker-compose
sudo systemctl enable docker
sudo systemctl start docker

sudo docker run -d \
  --name collabora \
  --restart unless-stopped \
  -p 9980:9980 \
  -e "domain=cloud\\.lab\\.local" \
  -e "username=admin" \
  -e "password=LabCollabora2024!" \
  -e "extra_params=--o:ssl.enable=false --o:ssl.termination=true" \
  collabora/code

sudo docker ps | grep collabora

# Install app
sudo -u www-data php occ app:install richdocuments

# Configure Collabora URL
sudo -u www-data php occ config:app:set richdocuments wopi_url --value="http://10.0.50.13:9980"

┌──────────────────────────────────┐
│   Users (Web, Desktop, Mobile)   │
└────────────┬─────────────────────┘
             │
      ┌──────▼───────┐
      │   Nginx      │
      └──────┬───────┘
             │
      ┌──────▼───────┐
      │  Mattermost  │  (Go binary)
      │   Server     │
      └──────┬───────┘
             │
    ┌────────┼────────┐
    │                 │
    ▼                 ▼
┌──────────┐    ┌──────────┐
│PostgreSQL│    │  Redis   │
│ Database │    │  Cache   │
└──────────┘    └──────────┘

ssh labadmin@10.0.50.13

cd /tmp
wget https://releases.mattermost.com/9.3.0/mattermost-9.3.0-linux-amd64.tar.gz

ls -lh mattermost-9.3.0-linux-amd64.tar.gz

# Extract
tar -xzf mattermost-9.3.0-linux-amd64.tar.gz

# Move to /opt
sudo mv mattermost /opt/

# Create data directory
sudo mkdir /opt/mattermost/data

# Create system user
sudo useradd --system --user-group mattermost

# Set ownership
sudo chown -R mattermost:mattermost /opt/mattermost

# Set permissions
sudo chmod -R g+w /opt/mattermost

ls -la /opt/mattermost/

drwxr-xr-x bin/        # Mattermost binary
drwxr-xr-x config/     # Configuration
drwxr-xr-x data/       # User uploads
drwxr-xr-x i18n/       # Translations
drwxr-xr-x plugins/    # Plugins

sudo nano /opt/mattermost/config/config.json

"ServiceSettings": {
    "SiteURL": "http://chat.lab.local",
    "ListenAddress": ":8065",
    "ConnectionSecurity": "",
    "TLSCertFile": "",
    "TLSKeyFile": "",
    "TLSMinVer": "1.2",
    "TLSStrictTransport": false,
    "TLSStrictTransportMaxAge": 63072000,
    "TLSOverwriteCiphers": [],
    "UseLetsEncrypt": false,
    "Forward80To443": false,
    "ReadTimeout": 300,
    "WriteTimeout": 300,
    "IdleTimeout": 60,
    "MaximumLoginAttempts": 10,
    "EnableDeveloper": false,
    "EnableInsecureOutgoingConnections": false
},

"SqlSettings": {
    "DriverName": "postgres",
    "DataSource": "postgres://mattermost:MattermostDB2024!@10.0.50.12:5432/mattermost?sslmode=disable&connect_timeout=10",
    "DataSourceReplicas": [],
    "DataSourceSearchReplicas": [],
    "MaxIdleConns": 20,
    "ConnMaxLifetimeMilliseconds": 3600000,
    "MaxOpenConns": 300,
    "Trace": false,
    "QueryTimeout": 30
},

"FileSettings": {
    "EnableFileAttachments": true,
    "EnableMobileUpload": true,
    "EnableMobileDownload": true,
    "MaxFileSize": 104857600,
    "DriverName": "local",
    "Directory": "/opt/mattermost/data",
    "EnablePublicLink": true,
    "PublicLinkSalt": "randomstringhere",
    "InitialFont": "luximbi.ttf",
    "AmazonS3AccessKeyId": "",
    "AmazonS3SecretAccessKey": ""
},

"EmailSettings": {
    "EnableSignUpWithEmail": true,
    "EnableSignInWithEmail": true,
    "EnableSignInWithUsername": true,
    "SendEmailNotifications": true,
    "UseChannelInEmailNotifications": false,
    "RequireEmailVerification": false,
    "FeedbackName": "Mattermost",
    "FeedbackEmail": "noreply@lab.local",
    "FeedbackOrganization": "Lab Company",
    "SMTPUsername": "noreply@lab.local",
    "SMTPPassword": "",
    "SMTPServer": "10.0.50.14",
    "SMTPPort": "587",
    "SMTPServerTimeout": 10,
    "ConnectionSecurity": "",
    "SendPushNotifications": true,
    "PushNotificationServer": "https://push.mattermost.com"
},

"TeamSettings": {
    "SiteName": "Lab Chat",
    "MaxUsersPerTeam": 500,
    "EnableTeamCreation": true,
    "EnableUserCreation": true,
    "EnableOpenServer": false,
    "RestrictCreationToDomains": "lab.local",
    "RestrictTeamNames": true,
    "EnableCustomBrand": false,
    "CustomBrandText": "",
    "CustomDescriptionText": "",
    "RestrictDirectMessage": "any",
    "MaxChannelsPerTeam": 2000,
    "MaxNotificationsPerChannel": 1000000,
    "TeammateNameDisplay": "username"
},

# Check for syntax errors
sudo -u mattermost /opt/mattermost/bin/mattermost config validate

The configuration is valid.

sudo nano /etc/systemd/system/mattermost.service

[Unit]
Description=Mattermost
After=network.target postgresql.service
Requires=network.target

[Service]
Type=notify
ExecStart=/opt/mattermost/bin/mattermost
TimeoutStartSec=3600
KillMode=mixed
Restart=always
RestartSec=10
WorkingDirectory=/opt/mattermost
User=mattermost
Group=mattermost
LimitNOFILE=49152

[Install]
WantedBy=multi-user.target

# Reload systemd
sudo systemctl daemon-reload

# Enable auto-start
sudo systemctl enable mattermost

# Start service
sudo systemctl start mattermost

sudo systemctl status mattermost

sudo journalctl -u mattermost -f

{"level":"info","msg":"Server is listening on :8065"}
{"level":"info","msg":"Pinging SQL","master":true}

sudo ss -tlnp | grep 8065

LISTEN 0  128  *:8065  *:*  users:(("mattermost",pid=12345))

sudo nano /etc/nginx/sites-available/mattermost

upstream mattermost_backend {
    server 127.0.0.1:8065;
    keepalive 32;
}

proxy_cache_path /var/cache/nginx/mattermost levels=1:2 keys_zone=mattermost_cache:10m max_size=3g inactive=120m use_temp_path=off;

server {
    listen 8065;
    server_name chat.lab.local;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    location ~ /api/v[0-9]+/(users/)?websocket$ {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        client_max_body_size 50M;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_buffers 256 16k;
        proxy_buffer_size 16k;
        client_body_timeout 60;
        send_timeout 300;
        lingering_timeout 5;
        proxy_connect_timeout 90;
        proxy_send_timeout 300;
        proxy_read_timeout 90s;
        proxy_http_version 1.1;
        proxy_pass http://mattermost_backend;
    }

    location / {
        client_max_body_size 50M;
        proxy_set_header Connection "";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_buffers 256 16k;
        proxy_buffer_size 16k;
        proxy_read_timeout 600s;
        proxy_cache mattermost_cache;
        proxy_cache_revalidate on;
        proxy_cache_min_uses 2;
        proxy_cache_use_stale timeout;
        proxy_cache_lock on;
        proxy_http_version 1.1;
        proxy_pass http://mattermost_backend;
    }
}

sudo ln -s /etc/nginx/sites-available/mattermost /etc/nginx/sites-enabled/

# Test config
sudo nginx -t

# Reload
sudo systemctl reload nginx

10.0.50.13  chat.lab.local

Create your first team

Choose your team name:
[Enter team name]

Let's create your first Mattermost workspace.
Team Name helps people find the right workspace.

[Continue]