Alma Linux – setup / install software

/ code-commands, SprUng, KEEPERS, CODE-NOW-NOW-NOW / 1 minute of reading
Concise BuildExtendedUpdating Alma

A More Controlled Rebuild Plan

  1. Back to the Basics: Start Fresh Completely remove the existing Nextcloud and MariaDB setup, along with any configurations, data directories, and temporary files. We will reinstall everything cleanly.

    Commands:

    sudo systemctl stop mariadb httpd
sudo dnf remove -y mariadb-server httpd php*
sudo rm -rf /var/lib/mysql /var/www/html/nextcloud /var/www/html/dbtest.php
sudo rm -rf /etc/my.cnf /etc/my.cnf.d

  2. Verify Clean System State Check that nothing related to MariaDB or Nextcloud remains:

    ls -ld /var/lib/mysql /var/www/html

    3. Follow this simple layout for the external drive:

     

    Mount PointSizeFilesystemPurposecreate partitionsformat partitionsmount essential (pre-gui alma installer)installer
    /boot/efi512MBFAT32Required
    for
    UEFI systems    		mkpart ESP fat32 1MiB 513MiB
    set 1 boot on    		mkfs.fat -F32 /dev/sdx1mkdir -p /mnt/boot/efi
    mount /dev/sdx1 /mnt/boot/efi    		/dev/sdd1→/boot/efi
    /boot1GBEXT4Stores boot
    loader and kernel    		mkpart primary ext4 513MiB 2GiBmkfs.ext4 /dev/sdx2mkdir -p /mnt/boot
    mount /dev/sdx2 /mnt/boot    		/boot: /dev/sdd2 → /boot
    /RemainingEXT4Root filesystemmkpart primary ext4 19GiB 99%mkfs.ext4 /dev/sdx3mount /dev/sdx3 /mnt/ (root): /dev/sdd3 → /
    Swap16GBSwapOptional but recom
    mended    		mkpart primary linux-swap 3GiB 19GiBmkswap /dev/sdx4swapon /dev/sdx4/dev/sdd4 → swap area

     

    image-20250103145740086

  3. DO we have to check if seleinux is still disabled?

  4. HERE WE TAKE THIS DRIVE OVER TO THE 2023 mac-mini and start

    at this point I ALMOST want to try running the cli installer – it own't work it it mihg tset permissions?

     

    sudo -u apache php occ maintenance:install \
  --database "mysql" \
  --database-name "nextcloud2" \
  --database-user "nxtcld" \
  --database-pass "passpass" \
  --admin-user "nxtuser" \
  --admin-pass "passpass"

     

    1. Reinstall Core Packages Only Focus only on the essentials:

      sudo dnf install -y mariadb-server httpd php php-mysqlnd php-gd php-mbstring php-intl php-xml php-zip
sudo systemctl enable --now mariadb httpd

    2. Initialize MariaDB Safely Run the secure installation process and create a simple database setup:

      sudo mysql_secure_installation
mysql -u root -p

      SQL Commands:

      CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'nxtcloudspiffy'@'localhost' IDENTIFIED BY 'your_secure_password';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nxtcloudspiffy'@'localhost';
FLUSH PRIVILEGES;

  5. Test Database Connection with PHP Before doing anything with Nextcloud, confirm the PHP connection using the earlier dbtest.php method. This ensures PHP, MariaDB, and permissions are all working properly.

  6. Download and Setup Nextcloud Again Redo the Nextcloud installation step:

    wget https://download.nextcloud.com/server/releases/latest.tar.bz2
sudo tar -xjf latest.tar.bz2 -C /var/www/html/
sudo chown -R apache:apache /var/www/html/nextcloud
sudo chmod -R 750 /var/www/html/nextcloud

  7. Run Nextcloud Installer (CLI or Web) If everything checks out, proceed to the installer:

    sudo -u apache php occ maintenance:install \
  --database "mysql" \
  --database-name "nextcloud" \
  --database-user "nxtcloudspiffy" \
  --database-pass "your_secure_password" \
  --admin-user "admin_user" \
  --admin-pass "admin_password"

Why This Should Work

  • Selinux Disabled: We’re avoiding selinux entirely for simplicity.
  • Minimal Steps: Focus on a simple install with no unnecessary complexity.
  • Incremental Testing: Each step builds upon the last, ensuring nothing is broken before moving forward.

If something breaks again, we’ll catch it at its source and know exactly which step caused it. Let’s do this methodically!

 

 

You said:

we shoud not set ANY PERMISSIONS AT ALL.

 

ChatGPT said:

ChatGPT

If you want to completely avoid manually setting permissions, then we’ll rely on default system behaviors and only use commands that do not involve custom permissions. This approach ensures we’re not inadvertently introducing conflicts.

Updated Plan: No Permission Changes

  1. Start Fresh: Remove Everything Related to Previous Installs

    
sudo systemctl stop mariadb httpd
sudo dnf remove -y mariadb-server httpd php*
sudo rm -rf /var/lib/mysql /var/www/html/nextcloud
sudo rm -rf /etc/my.cnf /etc/my.cnf.d

  2. Reinstall Essential Packages Install only the bare minimum:

    
sudo dnf install -y mariadb-server httpd php php-mysqlnd php-gd php-mbstring php-intl php-xml php-zip
sudo systemctl enable --now mariadb httpd

  3. Initialize MariaDB with Default Settings

    
sudo mysql_secure_installation
mysql -u root -p

    Inside MariaDB:

    
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'nxtcloudspiffy'@'localhost' IDENTIFIED BY 'your_secure_password';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nxtcloudspiffy'@'localhost';
FLUSH PRIVILEGES;

  4. Test the Database Connection Use PHP to test if the database works without permission changes:

    
echo "<?php
\$conn = new mysqli('localhost', 'nxtcloudspiffy', 'your_secure_password', 'nextcloud');
if (\$conn->connect_error) { die('Connection failed: ' . \$conn->connect_error); }
echo 'Connected successfully';
?>" > /var/www/html/dbtest.php

    Access the file in your browser: http://your-server-ip/dbtest.php. If it says "Connected successfully," the database is working fine.

  5. Download and Extract Nextcloud

    
wget https://download.nextcloud.com/server/releases/latest.tar.bz2
sudo tar -xjf latest.tar.bz2 -C /var/www/html/

  6. Run the Nextcloud Web Installer Open your browser and go to: http://your-server-ip/nextcloud. Enter the database details:

    • Database User: nxtcloudspiffy
    • Database Password: your_secure_password
    • Database Name: nextcloud
    • Host: localhost

What Happens Without Permissions Changes

  • Default permissions will be used as set by tar, httpd, and mariadb.
  • No custom permissions mean fewer chances of conflicting setups.
  • If there are issues, we’ll know it’s unrelated to manual permissions adjustments.

Let’s see how far this gets us without touching permissions.

 

 

You said:

we shoudl run the installe rsuooner?ugh I should look at theier docs actually –

 

ChatGPT said:

ChatGPT

Yes, consulting Nextcloud's official documentation is a great idea—it often includes steps tailored for the latest versions and common configurations. Here’s a streamlined approach based on their guidelines, which avoids unnecessary complexity and sticks to defaults:

1. Check Nextcloud Documentation

Before proceeding, verify their official installation guide here.

2. Streamlined Setup Steps

A. Prepare Your System

  • Update the OS and install required packages.

    
sudo dnf update -y
sudo dnf install -y mariadb-server httpd php php-mysqlnd php-gd php-mbstring php-intl php-xml php-zip wget tar

  • Start and enable required services:

    
sudo systemctl enable --now mariadb httpd

B. Configure MariaDB

  • Secure the installation:

    
sudo mysql_secure_installation

  • Log in as root:

    
mysql -u root -p

  • Create a database and user for Nextcloud:

    
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'nxtcloudspiffy'@'localhost' IDENTIFIED BY 'your_secure_password';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nxtcloudspiffy'@'localhost';
FLUSH PRIVILEGES;

C. Download and Extract Nextcloud

  • Download the latest version:

    
wget https://download.nextcloud.com/server/releases/latest.tar.bz2

  • Extract it into /var/www/html:

    
sudo tar -xjf latest.tar.bz2 -C /var/www/html/

  • Change ownership of the Nextcloud directory:

    
sudo chown -R apache:apache /var/www/html/nextcloud
sudo chmod -R 750 /var/www/html/nextcloud

D. Run the Installer

  • Access the Nextcloud web installer: Open a browser and navigate to: http://<your-server-ip>/nextcloud.

  • Enter the database details:

    • Database User: nxtcloudspiffy
    • Database Password: your_secure_password
    • Database Name: nextcloud
    • Host: localhost

3. Why Run the Installer Early?

  • The installer initializes tables and configurations.
  • Skipping this early can lead to permission and database mismatch errors later.
  • Nextcloud’s CLI and web installers are designed to handle configuration, so delaying them might complicate troubleshooting.

4. Key Considerations

  • No SELinux Adjustments (Since It’s Disabled) Let’s leave SELinux out entirely unless explicitly needed later.
  • Default Directories Stick to /var/lib/mysql and /var/www/html/nextcloud to avoid path-related issues.
  • Simplified Ownership Set directory ownership only once, to avoid unnecessary complications.

Let’s follow these simplified steps and consult the Nextcloud docs for any specific clarifications. If you run into issues, we’ll tackle them incrementally!

 

 

You said:

maybe I should build this drive on the 2023 mac-mini – instead of the 2012 – it will run onteh 2012 correct?

 

ChatGPT said:

ChatGPT

Yes, you can build the drive on the 2023 Mac Mini and then run it on the 2012 Mac Mini, provided:

  1. Compatible Architecture: Both the 2023 and 2012 Mac Minis use x86_64 architecture, so the software and OS should work seamlessly.

  2. BIOS/UEFI Compatibility:

    • The 2012 Mac Mini uses a traditional BIOS-like system, whereas the 2023 version might use UEFI.
    • Ensure the drive is formatted and set up to boot in a mode compatible with the 2012 Mac Mini's firmware. This may involve checking the bootloader and partition table (GPT vs MBR).

  3. OS and Kernel Version:

    • AlmaLinux and similar OS distributions are not hardware-specific as long as the kernel supports the hardware.
    • The 2012 Mac Mini is older, so confirm the kernel version supports its hardware (e.g., GPU, Wi-Fi, etc.).

  4. Performance Considerations:

    • The 2023 Mac Mini will likely handle the setup faster due to better hardware. Once configured, the drive should work fine on the 2012 Mac Mini, albeit with reduced performance.

  5. Dependencies:

    • Avoid hardware-specific dependencies during setup (e.g., drivers for hardware only present in the 2023 Mac Mini). Use generic configurations.

Steps for Building on 2023 Mac Mini:

  1. Prepare the Drive:

    • Partition and format the drive as required (ext4 for Linux root, swap, etc.).

  2. Install and Configure AlmaLinux:

    • Perform the installation and configuration on the 2023 Mac Mini.
    • Set up the bootloader and confirm it’s compatible with both systems.

  3. Install Required Software:

    • Install MariaDB, Apache, Nextcloud, and other dependencies.
    • Configure these tools as per the requirements.

  4. Test Boot on the 2023 Mac Mini:

    • Ensure the drive boots and runs correctly on the 2023 system.

  5. Move to the 2012 Mac Mini:

    • Connect the drive to the 2012 Mac Mini.
    • Ensure the system boots and runs as expected.

Advantages of Building on the 2023 Mac Mini:

  • Faster setup due to modern hardware.
  • Easier troubleshooting with better peripherals and tools.

Once the system is running smoothly, transitioning to the 2012 Mac Mini should be seamless.

>

Steps to Partition and Install AlmaLinux

1. Boot into the AlmaLinux Installer

  • Use your bootable USB to start the installation process.
  • Select Custom Partitioning during the disk configuration step.

Partition Layout for 240GB External Drive

STEPS

Wipe Disk

sudo dd if=/dev/zero of=/dev/sdX bs=1M status=progress

 

  1. Open parted:

    parted /dev/sdx (replace x with correct drive)

  2. Set partition table to GPT:

    mklabel gpt

     

  3. Make Partitons

Follow this simple layout for the external drive:

 

Mount PointSizeFilesystemPurposecreate partitionsformat partitionsmount essential (pre-gui alma installer)installer
/boot/efi512MBFAT32Required
for
UEFI systems		mkpart ESP fat32 1MiB 513MiB
set 1 boot on		mkfs.fat -F32 /dev/sdx1mkdir -p /mnt/boot/efi
mount /dev/sdx1 /mnt/boot/efi		/dev/sdd1→/boot/efi
/boot1GBEXT4Stores boot
loader and kernel		mkpart primary ext4 513MiB 2GiBmkfs.ext4 /dev/sdx2mkdir -p /mnt/boot
mount /dev/sdx2 /mnt/boot		/boot: /dev/sdd2 → /boot
/RemainingEXT4Root filesystemmkpart primary ext4 19GiB 99%mkfs.ext4 /dev/sdx3mount /dev/sdx3 /mnt/ (root): /dev/sdd3 → /
Swap16GBSwapOptional but recom
mended		mkpart primary linux-swap 3GiB 19GiBmkswap /dev/sdx4swapon /dev/sdx4/dev/sdd4 → swap area

 

image-20250103145740086

NEXT PostInstallUpdates

 

<VirtualHost *:80>
    DocumentRoot "/var/www/html/nextcloud"
    ServerName "nxtcld.shawnpalmer.dev"

    <Directory "/var/www/html/nextcloud">
        Require all granted
        AllowOverride All
        Options FollowSymLinks MultiViews
    </Directory>

    ErrorLog /var/log/httpd/nextclould-error.log
    CustomLog /var/log/httpd/nextclould-access.log combined
</VirtualHost>

 

 

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name nxtcld.shawnpalmer.dev;

    return 301 https://$host$request_uri;
}

# HTTPS Configuration
server {
    listen 443 ssl;
    server_name nxtcld.shawnpalmer.dev;

    ssl_certificate /etc/letsencrypt/live/nxtcld.shawnpalmer.dev/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/nxtcld.shawnpalmer.dev/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

#    ssl_protocols TLSv1.2 TLSv1.3;
 #   ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://192.168.1.26/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;


        # Security headers
       	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
        add_header Content-Security-Policy 'frame-ancestors https://nxtcld.shawnpalmer.dev';
        add_header X-Content-Type-Options nosniff;
        add_header Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com>
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "origin";

    }
}

 

 

Here’s a checklist to verify and finalize the setup:

 

 

Step 1: Prepare Your Environment

Before installing Nextcloud, install the necessary dependencies and configure your environment.

  1. Update the System:

    sudo dnf update -y

  2. Install Required Packages: Nextcloud requires a web server (Apache or NGINX), a database (MariaDB/MySQL), and PHP:

    sudo dnf install httpd mariadb-server php php-mysqlnd php-dom php-gd php-intl php-mbstring php-xml php-zip unzip -y

    Required by NextClould

    Web Server and PHP

    1. Install Apache (Web Server):

      sudo dnf install httpd -y
sudo systemctl enable --now httpd

    2. Install PHP and Extensions: Nextcloud requires several PHP modules. Install them all at once:

      sudo dnf install php php-mysqlnd php-dom php-gd php-intl php-mbstring php-xml php-zip php-cli php-json php-pdo -y

    3. Verify PHP Version: Check that PHP is installed and working:

      php --version

    ### MariaDB (Database Server)

    You already have MariaDB installed and running, so ensure you’ve:

    • Created the nextcloud database.
    • Granted privileges to nextclouduser.

    If you need to reverify:

    sudo mysql -u root -p

    Archive Tools

    1. Ensure these tools are installed to handle compressed files:

      sudo dnf install tar bzip2 unzip -y

1. Apache Setup

  • Apache is installed and running:

    sudo systemctl status httpd

    If it’s not running, start it:

    sudo systemctl start httpd
sudo systemctl enable httpd

  • Apache logs are writing to /var/log/httpd or /apache-logs as expected.

2. PHP Setup

Ensure PHP and required extensions are installed:

php -m

You should see these modules:

  • gd
  • mbstring
  • curl
  • zip
  • xml
  • json
  • pdo
  • mysqli

If any are missing, install them:

sudo dnf install php php-{gd,mbstring,curl,zip,xml,json,pdo,mysqli}
sudo systemctl restart httpd

3. MariaDB Setup

  • Confirm MariaDB is running:

    sudo systemctl status

  • Verify the Nextcloud database and user were created:

    sudo mysql -u spiffy-root -p

    Inside the MariaDB monitor, run:

    SHOW DATABASES;

    You should see nextcloud. If not, create it:

    CREATE DATABASE nextcloud;
CREATE USER 'nextclouduser'@'localhost' IDENTIFIED BY 'yourpassword';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextclouduser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 3: Download and Configure Nextcloud

  1. Download Nextcloud: Get the latest version from the official site:

    cd /tmp
wget https://download.nextcloud.com/server/releases/latest.tar.bz2
tar -xjf latest.tar.bz2

  2. Move Nextcloud to the Web Root:

    sudo mv nxtcloud /var/www/html/

  3. Set Proper Permissions: Ensure Apache can access the files:

    sudo chown -R apache:apache /var/www/html/nextcloud
sudo chmod -R 755 /var/www/html/nextcloud

     

4. Nextcloud Directory Setup

  • Ensure the Nextcloud files are in /var/www/html/nextcloud:

    ls -l /var/www/html/nextcloud

  • Verify permissions:

    sudo chown -R apache:apache /var/www/html/nextcloud
sudo chmod -R 755 /var/www/html/nextcloud

5. Data Directory Setup

  • Verify the data directory is mounted and exists:

    ls -l /mnt/data

  • Create a directory for Nextcloud data:

    sudo mkdir -p /mnt/data/nextcloud
sudo chown -R apache:apache /mnt/data/nextcloud

6. Apache Configuration

  • Verify or create the virtual host file:

    sudo nano /etc/httpd/conf.d/nextcloud.conf

    Add this:

    <VirtualHost *:80>
    DocumentRoot "/var/www/html/nextcloud"
    ServerName your-server-ip-or-domain

    <Directory "/var/www/html/nextcloud">
        Require all granted
        AllowOverride All
        Options FollowSymLinks MultiViews
    </Directory>

    ErrorLog /var/log/httpd/nextcloud-error.log
    CustomLog /var/log/httpd/nextcloud-access.log combined
</VirtualHost>

  • Restart Apache:

    sudo systemctl restart httpd

  1. Initialize Database Schema:

    • Navigate to the Nextcloud installation directory:

      cd /var/www/html/nextcloud

    • Trigger the Nextcloud setup process manually using the CLI tool:

      sudo -u apache php occ maintenance:install \
  --database "mysql" \
  --database-name "nextcloud" \
  --database-user "nxtcloudspiffy" \
  --database-pass "passwordfornxtclouldspiffy" \
  --admin-user "spiffy" \
  --admin-pass "adminuserpw"

      Replace 

      passwordfornxtclouldspiffy

      with the actual database user password and update the admin credentials as desired.

  2. Check SELinux Configuration (If Enabled): Ensure that SELinux permissions are properly set for the nextcloud data directory:

    sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/data(/.*)?"
sudo restorecon -R /var/www/html/nextcloud/data

  3. Test the Setup: After running the command, try accessing the Nextcloud web interface or log in with the newly created admin credentials.

  4. Verify Tables: Recheck the database tables:

    USE nextcloud;
SHOW TABLES;

If the issue persists, confirm that:

  • The nextcloud database is accessible.
  • The database user nxtcloudspiffy has the necessary privileges.

7. Access Nextcloud in the Browser

  • Navigate to:

    http://<your-server-ip>/nextcloud

  • In the setup form:

    1. Admin Account: Create a username and password.

    2. Data Directory: Enter /mnt/data/nextcloud.

    3. Database

      :

      • User: nextclouduser
      • Password: yourpassword
      • Database Name: nextcloud
      • Database Host: localhost

  • Click "Finish Setup."

8. Optional: Enable HTTPS

For a secure connection:

sudo dnf install certbot python3-certbot-apache
sudo certbot --apache

Double-Check

If anything fails, test:

  1. Apache configuration:

    sudo apachectl configtest

  2. MariaDB connectivity:

    mysql -u nextclouduser -p

Things to check

 

Step 1: Check MariaDB is Running

Ensure the MariaDB service is running:


sudo systemctl status mariadb

  • If it's not running, start it:

    sudo systemctl start mariadb

Step 2: Verify the MySQL Socket

The error indicates Nextcloud is trying to use a Unix socket (/var/lib/mysql/mysql.sock) but cannot find it. Confirm the socket file exists:

ls -l /var/lib/mysql/mysql.sock

  • If it doesn't exist, something might be wrong with your MariaDB configuration. Restart MariaDB to regenerate the socket:

    
sudo systemctl restart mariadb

Step 3: Confirm Database Credentials

Verify the database, user, and password you've provided in Nextcloud.

  1. Log in to MariaDB using the credentials:

    mysql -u spiffy-root -p

  2. Check that the database 

    nextcloud

    exists:

    SHOW DATABASES;

  3. Ensure the user has permissions on the 

    nextcloud

    database:

    GRANT ALL PRIVILEGES ON nextcloud.* TO 'spiffy-root'@'localhost' IDENTIFIED BY 'your_password';
FLUSH PRIVILEGES;
EXIT;

    Create New DB User

  • If the system is already set up and working, it’s not an urgent problem, but consider creating a new database user with a unique name:

    CREATE USER 'dbnewuser'@'localhost' IDENTIFIED BY 'securepw';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'dbnewuser'@'localhost';
FLUSH PRIVILEGES;

Then update your Nextcloud database configuration to use the new user.

Step 4: Update Nextcloud Database Host

If the socket path is incorrect or you're still getting the error, use 127.0.0.1 instead of localhost as the database host. This forces Nextcloud to connect via TCP instead of the Unix socket.

In the Nextcloud setup form, change:

Database host: localhost

To:

Database host: 127.0.0.1

Step 5: Check SELinux (if Enabled)

SELinux can block connections. Allow MariaDB connections for Apache:

sudo setsebool -P httpd_can_network_connect_db 1

Step 6: Test Connection

Reload the Nextcloud setup page and try again. If the error persists, let me know, and we'll dive deeper!

To confirm the actual location of MariaDB's database files:

  1. Open the MariaDB configuration file:

    
sudo nano /etc/my.cnf

will tell you to look in

    Or check the included configuration directory:

    
sudo ls /etc/my.cnf.d/

  2. Look for the datadir directive. It will look something like this:

    
datadir=/var/lib/mysql

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
log-error=/var/log/mariadb/mariadb.log
pid-file=/run/mariadb/mariadb.pid

  3. If datadir is not explicitly set, MariaDB defaults to /var/lib/mysql.

What Should Be in /var/lib/mysql

When you list the files in the datadir directory, you should see something like this:


ls -l /var/lib/mysql

Example output:


drwx------ 2 mysql mysql 4096 Jan 1 12:00 nextcloud
-rw-r----- 1 mysql mysql  56 Jan 1 12:00 ib_buffer_pool
-rw-r----- 1 mysql mysql  12 Jan 1 12:00 auto.cnf
-rw-r----- 1 mysql mysql  24 Jan 1 12:00 ib_logfile0
-rw-r----- 1 mysql mysql  24 Jan 1 12:00 ib_logfile1
  • The nextcloud directory contains the tables for your nextcloud database.

What to Do if /var/lib/mysql Is Empty

If /var/lib/mysql is empty, this could mean:

  1. MariaDB is using a different datadir. Check /etc/my.cnf for the correct location.

  2. MariaDB didn’t initialize properly. Reinitialize the data directory:

    sudo mariadb-install-db --user=mysql --basedir=/usr --datadir=/var/lib/mysql

SElinux

 

Streamlined SELinux Configuration

1. Nextcloud Directory Setup

Ensure Apache has the proper access to Nextcloud directories:


sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html/nextcloud(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/data(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/config(/.*)?"
sudo restorecon -R /var/www/html/nextcloud

2. Apache SELinux Booleans

Enable necessary permissions for Apache:


sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P httpd_enable_homedirs 1
sudo setsebool -P httpd_can_network_connect_db 1
sudo setsebool -P httpd_unified 1

3. MariaDB (MySQL) Directory Setup

Ensure MariaDB has proper access:


sudo semanage fcontext -a -t mysqld_db_t "/var/lib/mysql(/.*)?"
sudo restorecon -R /var/lib/mysql

4. MariaDB SELinux Booleans

Enable additional permissions for MariaDB:


sudo setsebool -P allow_mysql_tmpdir 1
sudo setsebool -P mysql_connect_any 1

5. Custom Temporary Directories (if needed)

If MariaDB or Apache requires non-standard temporary directories:


sudo semanage fcontext -a -t mysqld_tmp_t "/custom/tmp/dir(/.*)?"
sudo restorecon -R /custom/tmp/dir

6. Audit to Address Remaining Issues

Generate a custom SELinux policy for any unhandled issues:


sudo audit2allow -a -M custom_httpd
sudo semodule -i custom_httpd.pp

Why This Streamlined Approach?

  • The repeated restorecon and semanage commands for the same paths aren't necessary if already configured.
  • Focuses on critical directories (/var/www/html/nextcloud and /var/lib/mysql) and expected SELinux booleans.
  • Avoids overcomplicating with settings like mysqld_etc_t unless there’s a specific issue with /etc/my.cnf.

 

1. Configure Key Paths for Apache and MariaDB

Run these commands to ensure the most essential file paths are allowed:

# Allow Apache access to Nextcloud files
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html/nextcloud(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/data(/.*)?"
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/config(/.*)?"
sudo restorecon -R /var/www/html/nextcloud

# Allow MariaDB access to its data directory
sudo semanage fcontext -a -t mysqld_db_t "/var/lib/mysql(/.*)?"
sudo restorecon -R /var/lib/mysql

2. Enable Required SELinux Booleans

These enable permissions for typical Nextcloud and MariaDB operations:


sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P httpd_can_network_connect_db 1
sudo setsebool -P httpd_unified 1

3. Use Permissive Mode for Troubleshooting

If issues persist, temporarily set SELinux to permissive mode:


sudo setenforce 0

Then, try running your setup again. Use audit2allow to gather logs and create custom policies only if needed.

4. Gradually Harden Security

Once your setup works:

  • Switch back to enforcing mode: sudo setenforce 1.
  • Address specific denials using audit2allow to generate custom policies.

Alternative: Fully Disable SELinux

If SELinux continues to interfere and you want to disable it entirely:

  1. Edit the SELinux configuration:

    
sudo nano /etc/selinux/config

  2. Set SELINUX=disabled.

  3. Reboot the server:

    
sudo reboot

This disables SELinux but leaves your system more vulnerable to misconfigurations or malicious activity.

Post-Reboot Behavior

  • Run getsebool -a | grep "httpd\|mysql" to confirm booleans are persistent.
  • Check ls -lZ on the directories to ensure contexts are still applied.

Let me know if you need further adjustments!

 

1. Where Does SELinux Exist?

  • SELinux is a Linux-specific security feature.
  • It’s part of the Linux kernel and is included in many Linux distributions by default (like AlmaLinux, CentOS, Fedora, and RHEL).
  • It has nothing to do with macOS—macOS uses its own security frameworks, such as SIP (System Integrity Protection).

2. How SELinux Affects Your Setup

Since you’re running AlmaLinux on an external drive attached to your Mac Mini:

  • SELinux is enabled only on AlmaLinux.
  • If you boot into macOS or another OS on the same machine, SELinux has no impact.

3. Does SELinux Care About External Drives?

SELinux doesn’t differentiate between internal and external drives. As long as the external drive is formatted with a Linux-compatible filesystem (e.g., ext4, XFS), SELinux enforces policies on it. For example:

  • If your external drive hosts /var/www/html/nextcloud, SELinux applies the same policies as it would for an internal drive.

4. Why SELinux Issues Appear on AlmaLinux

You’re encountering SELinux problems because:

  • Your Nextcloud installation and MariaDB database are on the AlmaLinux system.
  • SELinux is enforcing rules on all files and processes running on AlmaLinux.

5. Mac and SELinux?

macOS does not have SELinux. Even though your Linux installation is on an external drive attached to your Mac, SELinux is purely a Linux feature. Mac security tools (like SIP) operate independently and don’t affect your Linux setup.

TL;DR

SELinux only exists and operates within the AlmaLinux environment. macOS doesn’t use SELinux, so it has no impact on anything outside your Linux installation. 😊

1. Configure SELinux for Nextcloud

Run these commands to ensure all the required directories and files have the correct SELinux contexts:

sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html/nextcloud(/.*)?"
sudo restorecon -R /var/www/html/nextcloud
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/data(/.*)?"
sudo restorecon -R /var/www/html/nextcloud/data
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/config(/.*)?"
sudo restorecon -R /var/www/html/nextcloud/config

# Restore the contexts
sudo restorecon -R /var/www/html/nextcloud

2. Allow Apache Access in SELinux

Enable all the permissions Apache needs to run Nextcloud without issues:


### **1. Configure SELinux for Nextcloud**

Run these commands to ensure all the required directories and files have the correct SELinux contexts:

```
sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html/nextcloud(/.*)?"
sudo restorecon -R /var/www/html/nextcloud
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/data(/.*)?"
sudo restorecon -R /var/www/html/nextcloud/data
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/nextcloud/config(/.*)?"
sudo restorecon -R /var/www/html/nextcloud/config

# Restore the contexts
sudo restorecon -R /var/www/html/nextcloud
```

------

### **2. Allow Apache Access in SELinux**

Enable all the permissions Apache needs to run Nextcloud without issues:

```
sudo setsebool -P httpd_can_network_connect 1

# Allow Apache to write to user directories
sudo setsebool -P httpd_enable_homedirs 1

# Allow Apache to connect to the database
sudo setsebool -P httpd_can_network_connect_db 1

# Allow Apache to manage files in your Nextcloud directories
sudo setsebool -P httpd_unified 1
```

------

#### **

3. Debugging Further

If errors persist, try the following:

  • Check recent SELinux logs:

    sudo ausearch -m avc -ts recent

  • Recheck Apache logs for clues:

    sudo tail -n 50 /var/log/httpd/error_log

3. Check for Further SELinux Blocks*

3. Debugging Further

If errors persist, try the following:

  • Check recent SELinux logs:

    sudo ausearch -m avc -ts recent

  • Recheck Apache logs for clues:

    sudo tail -n 50 /var/log/httpd/error_log

If something still fails, look for SELinux errors in the logs:

sudo ausearch -m avc -ts recent | less

This will show any recent permissions SELinux blocked. For anything that looks legit but got blocked:

sudo audit2allow -a

It will suggest rules to allow what’s being blocked. Use it sparingly, though!

When to Use audit2allow

You can use audit2allow to generate a custom SELinux policy to allow the denied actions:

sudo audit2allow -a -M custom_httpd
sudo semodule -i custom_httpd.pp

However, this should be a last resort if you’re certain that allowing the denied actions is safe.

Apply the correct SELinux context to /var/lib/mysql:

sudo semanage fcontext -a -t mysqld_db_t "/var/lib/mysql(/.*)?"
sudo restorecon -R /var/lib/mysql

This sets the directory and its contents to the SELinux type mysqld_db_t, which MariaDB requires.

MariaDB SELinux Settings

 

1. MariaDB Configuration Directory

The MariaDB configuration files, typically in /etc/my.cnf or /etc/my.cnf.d/, need to be accessible by the mysql process.

  • Set SELinux context:

    sudo semanage fcontext -a -t mysqld_etc_t "/etc/my.cnf"
sudo semanage fcontext -a -t mysqld_etc_t "/etc/my.cnf.d(/.*)?"
sudo restorecon -R /etc/my.cnf /etc/my.cnf.d

2. Custom Log Directories

If MariaDB logs are moved to a non-default directory (e.g., /mnt/var/log/mysql), SELinux needs to allow access.

  • Set SELinux context:

    sudo semanage fcontext -a -t mysqld_log_t "/var/log/mysql(/.*)?"
sudo restorecon -R /var/log/mysql

  • Check log permissions:

    
sudo chown -R mysql:mysql /var/log/mysql
sudo chmod 700 /var/log/mysql

3. Temporary Directories

MariaDB may use /tmp or custom temporary directories for operations.

  • Allow MariaDB to use /tmp:

    sudo setsebool -P allow_mysql_tmpdir 1

  • If using a custom temp directory, apply the correct SELinux context:

    sudo semanage fcontext -a -t mysqld_tmp_t "/custom/tmp/dir(/.*)?"
sudo restorecon -R /custom/tmp/dir

4. Replication or External Connections

If MariaDB is configured for replication or remote access:

  • Allow MariaDB to connect over the network:

    sudo setsebool -P mysql_connect_any 1

  • If MariaDB interacts with Apache, ensure Apache can connect to it:

    sudo setsebool -P httpd_can_network_connect_db 1

5. Ensure SELinux Booleans Are Set

Check the current SELinux booleans related to MariaDB:

sudo getsebool -a | grep mysql

Understanding the Output

  1. mysql_connect_any --> on:

    • This is good. It allows MariaDB to make any outgoing network connections, which is useful if you're using replication or external connections.

  2. mysql_connect_http --> off:

    • This is fine unless MariaDB needs to connect to HTTP resources (e.g., if you’re pulling data via HTTP).

  3. selinuxuser_mysql_connect_enabled --> off:

    • This only applies to SELinux user domains. If you’re not using SELinux-defined users to run MariaDB, this setting is irrelevant.

 

Relevant booleans to set:

sudo setsebool -P mysql_connect_any 1
sudo setsebool -P allow_mysql_tmpdir 1

6. Verify with SELinux Logs

After applying these changes, monitor SELinux logs to ensure there are no further denials:

sudo ausearch -m avc -ts recent | grep mysqld

If any additional denials are found, you can generate a custom policy:

sudo audit2allow -a -M mariadb_custom
sudo semodule -i mariadb_custom.pp

By addressing these areas, you ensure MariaDB operates smoothly under SELinux while maintaining security. Let me know if any specific part of your setup needs additional troubleshooting! 😊

 

SELinus for mysql

 

sudo chown -R mysql:mysql /var/lib/mysql
sudo chmod 700 /var/lib/mysql
sudo semanage fcontext -a -t mysqld_db_t "/var/lib/mysql(/.*)?"
sudo restorecon -R /var/lib/mysql

 

Steps to Update AlmaLinux

  1. Check for Updates: Run the following command to check for available updates:

    
sudo dnf check-update

  2. Update All Installed Packages: To update all installed packages, including the kernel:

    
sudo dnf update
    • You may be prompted to confirm the update process. Type y to proceed.
    • This will download and install the latest versions of all available packages.

  3. Reboot if Necessary: If the kernel or critical system components were updated, you’ll need to reboot the system for the updates to take effect:

    
sudo reboot

Additional Recommendations

  1. Enable Automatic Updates (Optional): To ensure your system stays up to date without manual intervention, you can enable automatic updates:

    
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

    This will periodically check for and apply updates automatically.

  2. Review and Clean Unused Packages: After updating, you can clean up unused packages:

    

sudo dnf autoremove

  3. Verify the Update: After the update and reboot, check the system status and kernel version:

    
uname -r  # Shows the running kernel version
cat /etc/almalinux-release  # Confirms the AlmaLinux version
Scroll to Top