kz-note

A notebook

NextCloud with Docker on Raspberry Pi 3B+

要るもの

環境

A. Setting the connection between Raspberry Pi and VPS

ブリッジ

root@raspberrypi:/home/pi# brctl show
bridge name bridge id       STP enabled interfaces
br0     8000.0a28c97e46f9   no      tap_vpn0
                            veth1c7c20c
                            veth6da5996
                            veth702dd27

iptables

iptables -A FORWARD -i br0 -o eth0 -s 192.168.2.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.0/24 -j MASQUERADE

B. Setting NextCloud on Docker

1. Install docker & docker compose on Raspberry Pi OS

docker-composeはpip3でインストールしない方がきれいな感じもしますが，うまく行かなかったのでpip3でインストールしました．

dev.to

2. Setting up docker-compose.yml

version: '3'
volumes:
  redis:
services:
  mysql:
    image: jsurf/rpi-mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /home/pi/docker/mysql:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=pass
      - MYSQL_PASSWORD=pass
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
    networks:
      nextcloud-network:
        ipv4_address: 192.168.2.6

  nextcloud:
    image: nextcloud:latest
    volumes:
      - /home/pi/docker/nextcloud/html:/var/www/html
## setting up resource limitation
#    deploy:
#      resources:
#        limits:
#          cpus: "4"
#          memory: 1g
    restart: always
    links:
      - mysql
    depends_on:
      - mysql
      - redis
    ports:
      - 8080:80
    environment:
      - REDIS_HOST=redis
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=pass
      - MYSQL_HOST=mysql:3306
    networks:
      nextcloud-network:
        ipv4_address: 192.168.2.5
  redis:
    image: redis
    restart: always
    volumes:
      - redis:/data
    networks:
      nextcloud-network:
        ipv4_address: 192.168.2.4
# 仮想スイッチに任意の名前とIPを振る
networks:
  nextcloud-network:
    name: nextcloud-network
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet:  192.168.2.0/24
          gateway: 192.168.2.1
    driver_opts:
      com.docker.network.bridge.name: br0

docker-compose up -d

C. Setting up VPS

Let's Encrypt

www.nginx.com

まず，以下を/etc/nginx/sites-availableに置く

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    root /var/www/html;
    server_name example.com www.example.com;
}

sites-enabledにエイリアスを作成して，以下のように実行する

# certbot --nginx -d kz-notebook.xyz -d www.kz-notebook.xyz 
root@160-251-9-71:/etc/nginx/sites-available# ls
bw.kz-notebook.xyz.conf  default.old   git.kz-notebook.xyz.conf
default                  default.old2  kz-notebook.xyz.conf
root@160-251-9-71:/etc/nginx/sites-enabled# ls
bw.kz-notebook.xyz.conf  git.kz-notebook.xyz.conf  kz-notebook.xyz.conf
root@160-251-9-71:/etc/nginx/sites-enabled# cat kz-notebook.xyz.conf 
server {
    root /var/www/html/nc;
    server_name kz-notebook.xyz www.kz-notebook.xyz;

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/git.kz-notebook.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/git.kz-notebook.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        proxy_pass http://192.168.2.5:80;
    }

}

server {
    if ($host = www.kz-notebook.xyz) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = kz-notebook.xyz) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80;
    server_name kz-notebook.xyz www.kz-notebook.xyz;
    return 404; # managed by Certbot

}

Nginx

D. Raspberry Pi 3B+に見合った設定にする

Raspberry Pi 3B+だとNextCloud+VPNServerを動かすには少し非力なので，いくつか設定を変えます

VPNServerのプロセス優先度を上げる

vpnserverのプロセスが殺されると困るので，殺されないように設定します

#!/bin/bash

/usr/local/vpnserver/vpnserver start
sleep 3

declare -a arr=(`ps aux | grep /usr/local/vpnserver/vpnserver`)
echo "${arr[1]} ${arr[13]}"
echo "-17" > /proc/${arr[1]}/oom_adj
echo "-17" > /proc/${arr[13]}/oom_adj

apache2のMaxRequestWorkersを減らす

help.nextcloud.com

pi@raspberrypi:~ $ docker exec -it docker_nextcloud_1 bash
/var/www/html# apt update && apt install nano
/var/www/html# nano /etc/apache2/mods-enabled/mpm_prefork.conf
/var/www/html# cat /etc/apache2/mods-enabled/mpm_prefork.conf
# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxRequestWorkers: maximum number of server processes allowed to start
# MaxConnectionsPerChild: maximum number of requests a server process serves

<IfModule mpm_prefork_module>
    StartServers             2
    MinSpareServers       2
    MaxSpareServers      3
    MaxRequestWorkers     10
    MaxConnectionsPerChild   0
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

iOSアプリでストリーミング再生ができるようにする

HTTPSに対応させるとiOSアプリからストリーミング再生ができなくなりました． おそらくif (PHP_INT_SIZE > 4)の文は，32bitのOSには必要ないということなんだと思います． 下のように書き換えます．

help.nextcloud.com

Raspberry Pi : /var/www/html/3rdparty/sabre/http/lib/Sapi.php

        $contentLength = $response->getHeader('Content-Length');
        if (null !== $contentLength) {
            $output = fopen('php://output', 'wb');
            if (is_resource($body) && 'stream' == get_resource_type($body)) {
//                if (PHP_INT_SIZE > 4) {
                  if (PHP_INT_SIZE !== 0) {
                    // use the dedicated function on 64 Bit systems
                    // a workaround to make PHP more possible to use mmap based copy, see https://github.com/sabre-io/http/pull/119
                    $left = (int) $contentLength;

こんな感じで設定して、快適なサーバを構築できました。