onlyoffice+nectcloud在線協同做業

協同辦公是目前比較流行的辦公方式。Web office就是一種很好的選擇，經過Web office 你能夠選擇在
任什麼時候間任何地點與團隊進行協做。本教程介紹如何使用Nextcloud和ONLYOFFICE構建一個私有的web
Office辦公環境，實現文檔的實時管理、編輯和協做。這種基於開源和自託管的工具都提供了極高的安全
特性來保持文檔的私密性，並同時擁有云盤的功能。

實現Nextcloud與ONLYOFFICE的組合有如下三種形式：
1，安裝獨立的Nextcloud服務器和獨立的ONLYOFFICE服務器，再將兩者進行融合。
2，使用Docker compose安裝Nextcloud並與ONLYOFFICE集成在一塊兒。
3，使用Univention app appliance來部署包含Univention Server、Nextcloud和ONLYOFFICE的VM。

這裏咱們獨立安裝nectcloud,onlyoffice.（在不一樣的服務器上安裝）域名都要https的並且必須是機構加密的證書。
首先安裝nectcloud，我用的環境是lnmp安裝的nectcloud-16.0.3（PHP版本必須7.1以上）
LNMP安裝我就不說了，直接貼nginx的配置
upstream php-handler {
#server 127.0.0.1:9000;
server unix:/dev/shm/php-cgi.sock;
}

server {
listen 80;
listen [::]:80;
server_name nexcloud.test.com;

enforce https

#return 301 https://$server_name$request_uri;
}

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name nexcloud.test.com;

Use Mozilla’s guidelines for SSL/TLS settings

https://mozilla.github.io/server-side-tls/ssl-config-generator/

NOTE: some settings below might be redundant

ssl_certificate /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/nexcloud.test.com.key;

Add headers to serve security related headers

Before enabling Strict-Transport-Security headers please read into this

topic first.

add_header Strict-Transport-Security 「max-age=15768000; includeSubDomains; preload;」;

#

WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option

will add the domain to a hardcoded list that is shipped

in all major browsers and getting removed from this list

could take several months.

add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection 「1; mode=block」;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;

Remove X-Powered-By, which is an information leak

fastcgi_hide_header X-Powered-By;

Path to the root of your installation

root /data/wwwroot/nexcloud.test.com;

location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

The following 2 rules are only needed for the user_webfinger app.

Uncomment it if you’re planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}

set max upload size

client_max_body_size 512M;
fastcgi_buffers 64 4K;

Enable gzip but do not remove ETag headers

gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

Uncomment if your server is build with the ngx_pagespeed module

This module is currently not supported.

#pagespeed off;

location / {
rewrite ^ /index.php$request_uri;
}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) {
deny all;
}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+).php(?:$|/) {
fastcgi_split_path_info ^(.+?.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}

Adding the cache control header for js and css files

Make sure it is BELOW the PHP block

location ~ .(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control 「public, max-age=15778463」;

Add headers to serve security related headers (It is intended to

have those duplicated to the ones above)

Before enabling Strict-Transport-Security headers please read into

this topic first.

add_header Strict-Transport-Security 「max-age=15768000; includeSubDomains; preload;」;

#

WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option

will add the domain to a hardcoded list that is shipped

in all major browsers and getting removed from this list

could take several months.

add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection 「1; mode=block」;
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;

Optional: Don’t log access to assets

access_log off;
}

location ~ .(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$request_uri;

Optional: Don’t log access to other assets

access_log off;
}
}
這裏nectcloud就安裝完成了。
第二步安裝onlyoffice
/etc/selinux/config
禁止SELINUX=disabled
systemctl stop firewalld
systemctl disable firewalld
curl -sL https://rpm.nodesource.com/setup_6.x | sudo bash –
yum -y install gcc-c++ make
yum -y install nodejs

/etc/yum.repos.d/nginx.repo添加nginx源

[nginx]

name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

yum install -y epel-release
yum install postgresql postgresql-server -y
postgresql-setup initdb

systemctl enable postgresql
/var/lib/pgsql/data/pg_hba.conf 修改
host all all 127.0.0.1/32 trust

host all all ::1/128 trust

systemctl start postgresql

sudo -u postgres psql -c 「CREATE DATABASE onlyoffice;」
sudo -u postgres psql -c 「CREATE USER onlyoffice WITH password ‘onlyoffice’;」
sudo -u postgres psql -c 「GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;」

yum -y install redis
systemctl start redis
systemctl enable redis

yum -y install rabbitmq-server
systemctl start rabbitmq-server
systemctl enable rabbitmq-server

yum -y install https://downloads.sourceforge.net/project/mscorefonts2/rpms/msttcore-fonts-installer-2.6-1.noarch.rpm

rpm –import 「http://keyserver.ubuntu.com/pks/lookup?op=get&search=0x8320CA65CB2DE8E5」

[onlyoffice]
name=onlyoffice repo
baseurl=http://download.onlyoffice.com/repo/centos/main/noarch/
gpgcheck=0
enabled=1

yum -y install onlyoffice-documentserver

systemctl start supervisord
systemctl enable supervisord
systemctl start nginx
systemctl enable nginx

bash documentserver-configure.sh

For Postgresql
Host: localhost
Database: onlyoffice
User: onlyoffice
Password: onlyoffice
For Redis
Host: localhost
For RabbitMQ
Host: localhost
User: guest
Password: guest

http://localhost or http://<FQDN>;
修改nginx支持https
vim /etc/onlyoffice/documentserver/nginx/ds.conf

貼出個人nginx配置

include /etc/nginx/includes/http-common.conf;
server {
listen 0.0.0.0:80;
listen [::]:80 default_server;
server_name onlyoffice.test.com;
server_tokens off;
include /etc/nginx/includes/ds-*.conf;
location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}
}
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ssl default_server;
server_name onlyoffice.test.com;
server_tokens off;
#root /var/www/onlyoffice/documentserver;

Strong SSL Security

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

#ssl on;
ssl_certificate /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/nginx/onlyoffice.test.com.key;
ssl_verify_client off;

ssl_ciphers 「EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH」;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache builtin:1000 shared:SSL:10m;

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=31536000;

add_header X-Frame-Options SAMEORIGIN;

add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

location ~ /.well-known/acme-challenge {
root /var/www/onlyoffice/;
allow all;
}

include /etc/nginx/includes/ds-*.conf;
}
https://域名，如圖說明安裝成功

上傳個文件測試在線打開

能夠打開編輯 並且，能夠同時幾個編輯一個文件，協同做業很好用.