Installing on a Linux server #

After these twelve steps, owncloud.online runs on your server with HTTPS. All you need is SSH access with administrator rights. Every command can be copied and pasted.

The commands are for Ubuntu 24.04 LTS. Where Debian 12 differs, a note says so. The guide was tested with owncloud.online 11.0.25 on fresh installations of both systems.

Replace these placeholders in the commands:

The steps at a glance:

1. Prepare the server
2. Install the software
3. Configure PHP
4. Create the database
5. Download and verify owncloud.online
6. Unpack and set permissions
7. Install
8. Set up the web server
9. Turn on HTTPS
10. Set up background jobs
11. Turn on caching
12. Log in and check

The installation in step 7 runs on the command line before the web server serves the site. This way, the setup wizard is never exposed on the internet.

1. Prepare the server #

apt install -y sudo
usermod -aG sudo YOUR_USER

Install updates #

Bring the system up to date before you install anything:

sudo apt update
sudo apt full-upgrade -y
sudo reboot

If a dialog about services or the kernel appears during the update, confirm it with Enter. After the reboot, log in again over SSH.

Set up the address #

Browsers and Let's Encrypt find the server by its name. For that, it needs a DNS record.

1. Find the public IP address of the server. Your provider shows it in the customer portal. On most servers, this command shows it as well, the first address is the IPv4 address:

   bashCopy

   hostname -I
   

2. At your domain provider, create an A record, for example with the name cloud and the IPv4 address as the target. Only create an AAAA record for IPv6 if the server is reachable at that IPv6 address.

3. Check the record on your own computer:

   bashCopy

   nslookup cloud.example.com
   

   The answer shows the IP address of the server. New records can take up to an hour until they are known everywhere.

Turn on the firewall #

The firewall only lets SSH, HTTP, and HTTPS through. The first command installs it if it is missing:

sudo apt install -y ufw
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Answer the question Command may disrupt existing ssh connections. Proceed with operation (y|n)? with y. Check the result:

sudo ufw status

The output starts with Status: active and lists 22/tcp, 80/tcp, and 443/tcp with ALLOW.

2. Install the software #

Add the package source for PHP 8.4 #

Ubuntu 24.04 ships PHP 8.3. PHP 8.4 comes from the ondrej/php package source. Ondřej Surý also maintains the PHP packages in Debian.

sudo apt install -y software-properties-common
sudo add-apt-repository -y ppa:ondrej/php

The second command prints a description of the package source. It says that the source is moving to packages.sury.org. For Ubuntu 24.04, it remains valid.

Check that PHP 8.4 is now offered:

apt-cache policy php8.4-fpm

The Candidate: line shows a version that starts with 8.4..

sudo apt install -y lsb-release ca-certificates curl
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/php.list
sudo apt update

Install the packages #

One command installs the Apache web server, the MariaDB database, Redis, PHP with all required extensions, Certbot for the HTTPS certificate, and the tools cron, curl, and nano if they are missing:

sudo apt install -y apache2 mariadb-server redis-server \
  php8.4-fpm php8.4-cli php8.4-mysql php8.4-curl php8.4-gd php8.4-intl \
  php8.4-mbstring php8.4-xml php8.4-zip php8.4-bcmath php8.4-imagick \
  php8.4-apcu php8.4-redis certbot python3-certbot-apache cron curl nano

Along the way, lines starting with NOTICE recommend running a2enconf php8.4-fpm. You do not need to: step 8 sets up PHP-FPM in the site configuration.

Check the result:

php8.4 -v
systemctl is-active apache2 mariadb redis-server php8.4-fpm

The first line starts with PHP 8.4. The second command prints active four times.

3. Configure PHP #

For large uploads and for updates, owncloud.online needs longer time limits and more OPcache space than PHP's defaults. These commands create a small settings file each for PHP-FPM and for the command line:

sudo tee /etc/php/8.4/fpm/conf.d/90-owncloud-online.ini > /dev/null <<'EOF'
max_execution_time = 3600
max_input_time = 3600
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 32
opcache.max_accelerated_files = 24000
EOF
echo 'apc.enable_cli = 1' | sudo tee /etc/php/8.4/cli/conf.d/90-owncloud-online.ini > /dev/null
sudo systemctl restart php8.4-fpm

Check that PHP-FPM uses the new values:

sudo php-fpm8.4 -i | grep max_execution_time

The output is max_execution_time => 3600 => 3600.

4. Create the database #

owncloud.online stores accounts, shares, and the file list in MariaDB. It gets its own database and its own database account.

First, generate a random password for the database account:

openssl rand -hex 20

Write down the output. You need it in a moment and in step 7. Then open the MariaDB console:

sudo mariadb

In these lines, replace DATABASE_PASSWORD with the password you wrote down. Keep the quotes. Then paste the lines:

CREATE DATABASE owncloud_online CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'owncloud'@'localhost' IDENTIFIED BY 'DATABASE_PASSWORD';
GRANT ALL PRIVILEGES ON owncloud_online.* TO 'owncloud'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Each line answers with Query OK, EXIT with Bye.

5. Download and verify owncloud.online #

Download the release and the checksums, and verify that the file arrived unchanged:

cd /tmp
curl -fLO https://github.com/BWTECH-github/owncloud.online/releases/download/v11.0.25/owncloud-online-11.0.25.tar.gz
curl -fLO https://github.com/BWTECH-github/owncloud.online/releases/download/v11.0.25/SHA256SUMS.txt
sha256sum --ignore-missing -c SHA256SUMS.txt

The last line reads owncloud-online-11.0.25.tar.gz: OK.

If https://github.com/BWTECH-github/owncloud.online/releases lists a newer version, replace 11.0.25 everywhere in this step and the next one with the new number.

6. Unpack and set permissions #

The archive contains a single folder owncloud. It is unpacked to /var/www and renamed. The data directory lives outside of it, so the web server never serves it. Both belong to the www-data user that the web server and PHP run as:

sudo tar -xzf /tmp/owncloud-online-11.0.25.tar.gz -C /var/www
sudo mv /var/www/owncloud /var/www/owncloud.online
sudo mkdir -p /var/oco-data
sudo chown -R www-data:www-data /var/www/owncloud.online /var/oco-data
sudo chmod 750 /var/oco-data

Check the result:

ls /var/www/owncloud.online

The list includes apps, config, core, index.php, and occ, among others.

7. Install #

The installation creates the tables, creates the administrator account, and writes the configuration to config/config.php:

cd /var/www/owncloud.online
sudo -u www-data php8.4 occ maintenance:install \
  --database mysql \
  --database-name owncloud_online \
  --database-user owncloud \
  --admin-user admin \
  --data-dir /var/oco-data

The command asks for two passwords. What you type stays hidden.

1. What is the password to access the database with user <owncloud>?: the database password from step 4.
2. What is the password you like to use for the admin account <admin>?: a new, long password for the administrator account. Write it down.

Shortly after, owncloud.online was successfully installed appears.

The installation does not know your address yet. Enter it and turn on addresses without index.php:

sudo -u www-data php8.4 occ config:system:set trusted_domains 0 --value cloud.example.com
sudo -u www-data php8.4 occ config:system:set overwrite.cli.url --value https://cloud.example.com
sudo -u www-data php8.4 occ config:system:set htaccess.RewriteBase --value /
sudo -u www-data php8.4 occ maintenance:update:htaccess

Each config:system:set command confirms with a line that starts with System config value. The last one reports .htaccess has been updated.

sudo rm /var/www/owncloud.online/config/config.php
sudo mariadb -e "DROP DATABASE owncloud_online; CREATE DATABASE owncloud_online CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;"

8. Set up the web server #

Apache serves owncloud.online at your address and hands PHP files to PHP-FPM. First, turn on the required modules:

sudo a2enmod rewrite headers env dir mime setenvif proxy_fcgi ssl

Then open a new configuration file in the nano editor:

sudo nano /etc/apache2/sites-available/owncloud-online.conf

Paste this content and replace cloud.example.com with your address. Save with Ctrl+O and Enter, exit nano with Ctrl+X.

<VirtualHost *:80>
    ServerName cloud.example.com
    DocumentRoot /var/www/owncloud.online

    <Directory /var/www/owncloud.online>
        Require all granted
        AllowOverride All
        Options FollowSymLinks
    </Directory>

    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.4-fpm.sock|fcgi://localhost"
    </FilesMatch>

    # Large uploads: no size limit, time to assemble the chunks
    TimeOut 3600
    LimitRequestBody 0

    ErrorLog  ${APACHE_LOG_DIR}/owncloud-online-error.log
    CustomLog ${APACHE_LOG_DIR}/owncloud-online-access.log combined
</VirtualHost>

Turn on the new configuration and turn off Apache's default site:

sudo a2ensite owncloud-online
sudo a2dissite 000-default
sudo apache2ctl configtest
sudo systemctl restart apache2

configtest reports Syntax OK. You can ignore a warning that starts with AH00558. Then check that owncloud.online answers:

curl -s http://cloud.example.com/status.php

The answer starts with {"installed":true. Do not log in through the browser yet. Without HTTPS, your password would travel over the network unencrypted.

9. Turn on HTTPS #

Certbot gets a free certificate from Let's Encrypt, adds it to Apache, and redirects HTTP to HTTPS:

sudo certbot --apache --redirect -d cloud.example.com

The first time, Certbot asks three questions:

1. for an email address for notices about the certificate,
2. for your consent to the Let's Encrypt terms of service: Y,
3. whether Certbot may share your address with the Electronic Frontier Foundation. This is optional, N is fine.

At the end, it prints Congratulations! You have successfully enabled HTTPS on https://cloud.example.com.

Certbot renews the certificate on its own from then on. This dry run checks that renewal will work:

sudo certbot renew --dry-run

It ends with Congratulations, all simulated renewals succeeded.

10. Set up background jobs #

Every 15 minutes, owncloud.online does work in the background: it cleans up deleted files and old versions, removes expired shares, and sends notifications and emails. Without this schedule, the instance grows without limit and sends no email.

echo '*/15 * * * * /usr/bin/php8.4 /var/www/owncloud.online/occ system:cron' | sudo crontab -u www-data -
sudo -u www-data php8.4 /var/www/owncloud.online/occ background:cron

The second command answers with Set mode for background jobs to 'cron'. The first one replaces an existing schedule of the www-data user. A new server has none. Check the entry:

sudo crontab -u www-data -l

Within 15 minutes, Settings → Admin → General shows the line "Last cron job execution: …" with a green dot in the Cron section.

The Cron option is selected. It means that the system's cron service starts the background jobs.

sudo -u www-data php8.4 /var/www/owncloud.online/occ system:cron

11. Turn on caching #

APCu keeps frequently read data in PHP's memory. Redis manages the file locks, so that simultaneous access to the same file does not collide:

cd /var/www/owncloud.online
sudo -u www-data php8.4 occ config:system:set memcache.local --value '\OC\Memcache\APCu'
sudo -u www-data php8.4 occ config:system:set memcache.locking --value '\OC\Memcache\Redis'
sudo -u www-data php8.4 occ config:system:set redis host --value 127.0.0.1
sudo -u www-data php8.4 occ config:system:set redis port --value 6379 --type integer

Each command confirms with a line that starts with System config value. Check that Redis answers:

redis-cli ping

The answer is PONG.

12. Log in and check #

Open https://cloud.example.com in your browser. Under Username or email, enter the name of the administrator account from step 7, below it the Password, and click Login.

Then open Settings from your name at the top right, and Admin → General on the left. After following this guide, the Security & setup warnings section shows no warning, only "All checks passed." For what other messages mean, see Security and setup warnings.

Finally, check the state on the command line:

cd /var/www/owncloud.online
sudo -u www-data php8.4 occ status
sudo -u www-data php8.4 occ check

occ status shows installed: true and versionstring: 11.0.25. occ check prints nothing if all requirements are met.

sudo -u www-data php8.4 /var/www/owncloud.online/occ user:resetpassword admin

Stricter permissions (optional) #

To lock out other users on the server completely, set stricter permissions now. Repeat both commands after every update:

sudo find /var/www/owncloud.online -type d -exec chmod 750 {} \;
sudo find /var/www/owncloud.online -type f -exec chmod 640 {} \;

After that, only www-data can open the program directory. Your own account gets Permission denied for cd /var/www/owncloud.online. Therefore, run occ with its full path:

sudo -u www-data php8.4 /var/www/owncloud.online/occ status

What comes next #

nginx instead of Apache #

nginx does not read .htaccess files. Everything in there must therefore be in the nginx configuration. The process differs in four places:

1. Step 2: Install nginx instead of apache2 and python3-certbot-nginx instead of python3-certbot-apache.

2. Step 7: Skip the last two commands for htaccess.RewriteBase and maintenance:update:htaccess. With nginx, the line fastcgi_param front_controller_active true; turns on short addresses.

3. Step 8: Instead of the Apache configuration, create this file:

   bashCopy

   sudo nano /etc/nginx/sites-available/owncloud-online
   

   Content, again with your address instead of cloud.example.com:

   nginxCopy

   upstream php-handler {
       server unix:/run/php/php8.4-fpm.sock;
   }
   
   server {
       listen 80;
       listen [::]:80;
       server_name cloud.example.com;
   
       root /var/www/owncloud.online;
       index index.php index.html;
   
       # Replaces the headers from .htaccess
       add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
       add_header X-Content-Type-Options "nosniff" always;
       add_header X-XSS-Protection "0" always;
       add_header X-Frame-Options "SAMEORIGIN" always;
       add_header X-Robots-Tag "none" always;
       add_header X-Download-Options "noopen" always;
       add_header X-Permitted-Cross-Domain-Policies "none" always;
   
       # Large uploads
       client_max_body_size 0;
       client_body_timeout 300s;
   
       # Redirects under /.well-known
       location = /.well-known/host-meta      { rewrite ^ /public.php?service=host-meta last; }
       location = /.well-known/host-meta.json { rewrite ^ /public.php?service=host-meta-json last; }
       location ^~ /.well-known/carddav { return 301 /remote.php/dav/; }
       location ^~ /.well-known/caldav  { return 301 /remote.php/dav/; }
       location ^~ /.well-known/acme-challenge/ { }
       location ^~ /.well-known/pki-validation/ { }
   
       # Blocked paths, as in .htaccess
       location ~ ^/(?:build|tests|config|lib|3rdparty|templates|changelog)/ { return 404; }
       location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
       location = /core/signature.json { return 404; }
       location ^~ /core/skeleton/ { return 404; }
       location ^~ /data/ { return 404; }
       location ~ ^/(?:core|apps|apps-external)/.*/(?:package|package-lock|composer|bower|\.bower|installed|testem)\.json$ { return 404; }
       location ~ ^/(?:core|apps|apps-external)/.*/(?:composer|yarn)\.lock$ { return 404; }
       location ~ ^/(?:apps|apps-external)/[^/]+/(?:vendor|tests)/ { return 404; }
   
       # Serve existing files directly, everything else through index.php
       location / {
           rewrite ^/remote/(.*) /remote.php last;
           try_files $uri /index.php$request_uri;
       }
   
       location ~ \.php(?:$|/) {
           fastcgi_split_path_info ^(.+?\.php)(/.*)$;
           try_files $fastcgi_script_name =404;
           include fastcgi_params;
           fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
           fastcgi_param PATH_INFO $fastcgi_path_info;
           fastcgi_param PATH /usr/local/bin:/usr/bin:/bin;
           fastcgi_param HTTPS $https if_not_empty;
           fastcgi_param HTTP_AUTHORIZATION $http_authorization;
           fastcgi_param front_controller_active true;
           fastcgi_param modHeadersAvailable true;
           fastcgi_pass php-handler;
           fastcgi_read_timeout 3600s;
           fastcgi_request_buffering off;
       }
   
       # Federation: these folders serve their own index.php
       location ~ ^/(?:ocs-provider|ocm-provider)(?:$|/) {
           try_files $uri/ =404;
           index index.php;
       }
   
       location ~ \.(?:css|js|mjs|woff2?|svg|gif|png|jpg|jpeg|ico|map)$ {
           try_files $uri /index.php$request_uri;
           access_log off;
           expires 7d;
       }
   }
   

   Turn on the configuration and turn off the default site:

   bashCopy

   sudo ln -s /etc/nginx/sites-available/owncloud-online /etc/nginx/sites-enabled/
   sudo rm /etc/nginx/sites-enabled/default
   sudo nginx -t
   sudo systemctl reload nginx
   

   nginx -t reports syntax is ok and test is successful.

4. Step 9: Run Certbot with --nginx:

   bashCopy

   sudo certbot --nginx --redirect -d cloud.example.com
   

Troubleshooting #

Most errors are logged with their cause in /var/oco-data/owncloud.log, web server errors in /var/log/apache2/owncloud-online-error.log. More under Server log and error messages.