CentOS 7 搭建 WebDav 服务器

大部分参考了这篇文章：https://blog.acesheep.com/index.php/archives/834/

本文对其中的关键点进行记录，并调整了部分配置，解决mac os finder连接上之后，无法新建和修改文件的问题

1、安装编译环境

yum install epel-release expat-devel httpd-tools unzip wget centos-release-scl git libxslt-devel libxml2-devel -yyum install devtoolset-9-gcc* -yyum groupinstall "Development tools" -yyum -y install ghostscript

增加了ghostscript，后面zlib会依赖到

2、创建非特权账户

groupadd nginxuseradd -g nginx -c "nginx user" -d /var/cache/nginx -s /sbin/nologin nginx

这里和原文的区别是第一条命令移除了-g 994参数，第二条命令移除了-g 994 -u 996参数，换成了-g nginx，这么做的原因是因为：-g和-u是指定用户id和组id为994和996，但是实际情况下这两个id可能被占用了，导致创建失败。

3、下载源代码

# 创建目录mkdir nginx-webdavcd nginx-webdav# 下载nginx 1.20.2wget wget https://nginx.org/download/nginx-1.20.2.tar.gz# download pcre 8.45 / zlib 1.2.11 / openssl 1.1.1m dependencywget https://sourceforge.net/projects/pcre/files/pcre/8.45/pcre-8.45.tar.gzwget http://zlib.net/zlib-1.2.11.tar.gzgit clone https://github.com/madler/zlib.git && cd $(basename https://github.com/madler/zlib.git .git) && git checkout v1.2.11 && cd .. && mv zlib zlib-1.2.11wget http://www.openssl.org/source/openssl-1.1.1m.tar.gz# download nginx-dav-ext-module git.r112.f5e3088git clone https://github.com/arut/nginx-dav-ext-module.git# download headers-more-nginx-module git.r259.a4a0686git clone https://github.com/openresty/headers-more-nginx-module.git# Extract source filetar -zxf pcre-8.45.tar.gztar -zxf openssl-1.1.1m.tar.gztar -zxf nginx-1.20.2.tar.gz

调整了下zlib的下载方式，因为1.2.11版本在官网已经下载不到了。

文件列表

➜  nginx-webdav tree -L 1  .├── headers-more-nginx-module├── nginx-1.20.2├── nginx-1.20.2.tar.gz├── nginx-dav-ext-module├── openssl-1.1.1m├── openssl-1.1.1m.tar.gz├── pcre-8.45├── pcre-8.45.tar.gz└── zlib-1.2.117 directories, 3 files

4、修改源码

sed -i 's/NGX_HTTP_AUTOINDEX_PREALLOCATE  50/NGX_HTTP_AUTOINDEX_PREALLOCATE  110/g' nginx-1.20.2/src/http/modules/ngx_http_autoindex_module.csed -i 's/NGX_HTTP_AUTOINDEX_NAME_LEN     50/NGX_HTTP_AUTOINDEX_NAME_LEN     110/g' nginx-1.20.2/src/http/modules/ngx_http_autoindex_module.c

5、编译

cd nginx-1.20.2scl enable devtoolset-9 "./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-zlib=../zlib-1.2.11 --with-zlib-opt='-g -Ofast -fPIC -m64 -march=native -fstack-protector-strong -D_FORTIFY_SOURCE=2' --with-pcre=../pcre-8.45 --with-pcre-opt='-g -Ofast -fPIC -m64 -march=native -fstack-protector-strong -D_FORTIFY_SOURCE=2' --with-pcre-jit --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --add-module=../nginx-dav-ext-module --add-module=../headers-more-nginx-module --with-openssl=../openssl-1.1.1m --with-http_xslt_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'"scl enable devtoolset-9 "make -j"./objs/nginx -Vmake install

安装完成后，可以使用 nginx -V 检查安装的nginx版本

6、创建系统服务

cat  /usr/lib/systemd/system/nginx.service[Unit]Description=nginx - high performance web serverDocumentation=http://nginx.org/en/docs/After=network-online.target remote-fs.target nss-lookup.targetWants=network-online.target[Service]Type=forkingPIDFile=/var/run/nginx.pidExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.confExecReload=/bin/sh -c "/bin/kill -s HUP $(/bin/cat /var/run/nginx.pid)"ExecStop=/bin/sh -c "/bin/kill -s TERM $(/bin/cat /var/run/nginx.pid)"[Install]WantedBy=multi-user.targetEOFsystemctl enable nginxsystemctl start nginx

7、配置nginx

# 创建配置目录mkdir /etc/nginx/conf.d

修改nginx配置：vim /etc/nginx/nginx.conf

这里与原文的区别是，增加了dav_ext_lock_zone zone=foo:10m;配置。

用于解决mac finder无法新增和修改文件的问题

user nginx;worker_processes auto;error_log /var/log/nginx/error.log warn;pid /var/run/nginx.pid;# Specifies the value for maximum file descriptors that can be opened by this process.worker_rlimit_nofile 51200;# PCRE JIT can speed up processing of regular expressions significantly.pcre_jit on;events {    use epoll;    worker_connections 51200;    multi_accept on;}http {    log_format main '$remote_addr - $remote_user [$time_local] "$request" '    '$status $body_bytes_sent "$http_referer" '    '"$http_user_agent" "$http_x_forwarded_for"';    include /etc/nginx/mime.types;    default_type application/octet-stream;    server_names_hash_bucket_size 128;    client_header_buffer_size 32k;    large_client_header_buffers 4 32k;    client_max_body_size 50m;    charset utf-8;    sendfile on;    server_tokens off;    tcp_nodelay on;    tcp_nopush on;    real_ip_header X-Forwarded-For;    types_hash_max_size 2048;    keepalive_timeout 60;    access_log /var/log/nginx/access.log main;    fastcgi_connect_timeout 300;    fastcgi_send_timeout 300;    fastcgi_read_timeout 300;    fastcgi_buffer_size 64k;    fastcgi_buffers 4 64k;    fastcgi_busy_buffers_size 128k;    fastcgi_temp_file_write_size 256k;    gzip on;    gzip_min_length 1k;    gzip_buffers 4 16k;    gzip_http_version 1.1;    gzip_comp_level 2;    gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;    gzip_vary on;    gzip_proxied expired no-cache no-store private auth;    gzip_disable "MSIE [1-6]\.";        dav_ext_lock_zone zone=foo:10m;    server {        listen 80 default_server;        listen [::]:80 default_server;        if ($host ~ "\d+\.\d+\.\d+\.\d+") {            return 404;        }        return 301 https://$host$request_uri;    }    include /etc/nginx/conf.d/*.conf;}

修改文件 vim /etc/nginx/conf.d/webdav.conf

这里与原文的区别是，增加了dav_ext_lock zone=foo;配置，并调整了dav_ext_methods配置为PROPFIND OPTIONS LOCK UNLOCK 这四个参数，原文只有前两个，导致mac无法修改文件。这些配置也是为了解决mac无法新增和修改文件的问题。

注意修改下ssl的证书和key，替换成自己的

server {    listen 443 ssl http2;    listen [::]:443 ssl http2;    server_name example.com;    ssl_certificate "/home/SSL/example.com.crt";    ssl_certificate_key "/home/SSL/example.com.key";    ssl_session_cache shared:SSL:20m;    ssl_session_timeout 30m;    ssl_session_tickets off;    ssl_protocols TLSv1.2 TLSv1.3;    ssl_ciphers TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:EECDH+CHACHA20:EECDH+AESGCM:EECDH+AES;    ssl_prefer_server_ciphers on;    access_log /var/log/nginx/access-example.com.log main;    error_log /var/log/nginx/error-example.com.log error;    location / {        # 设置webdav目录，注意Nginx worker用户对该目录需有读/写/执行权限        root /home/nginx;        auth_basic "closed site";        auth_basic_user_file /etc/nginx/conf.d/webdav.htpasswd;        dav_methods PUT DELETE MKCOL COPY MOVE;        dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK;        dav_ext_lock zone=foo;        # 启用完整的创建目录支持        create_full_put_path on;        dav_access user:rw group:rw;        autoindex on;        autoindex_localtime on;        autoindex_exact_size off;        # 不限制文件大小        client_max_body_size 0;        # 为各种方法的URI后加上斜杠，解决各平台webdav客户端的兼容性问题        set $dest $http_destination;        if (-d $request_filename) {            rewrite ^(.*[^/])$ /;            set $dest $dest/;        }        if ($request_method ~ (MOVE|COPY)) {            more_set_input_headers 'Destination: $dest';        }        if ($request_method ~ MKCOL) {            rewrite ^(.*[^/])$ / break;        }    }    # Mac挂载webdav后会自动写入很多文件，可以通过nginx配置屏蔽掉，保持webdav目录的干净    location ~ \.(_.*|DS_Store|Spotlight-V100|TemporaryItems|Trashes|hidden|localized)$ {        access_log off;        error_log off;        if ($request_method = PUT) {            return 403;        }        return 404;    }    location ~ \.metadata_never_index$ {        return 200 "Don't index this drive, Finder!";    }}

创建完配置之后，执行下nginx -s reload重新加载下配置

8、配置账户

yum install httpd-tools -y# 其中nginx是用户名，可以自行修改htpasswd执行完之后，会要求输入密码。htpasswd -c /etc/nginx/conf.d/webdav.htpasswd 'nginx'

9、创建目录添加权限

mkdir /home/nginxchown nginx:nginx /home/nginxchmod -R 774 /home/nginx

此时应该就可以用finder进行连接了。

注意，如果域名没有备案，是连不上的，换成ip进行连接即可。

参考：

大部分内容参考自：https://blog.acesheep.com/index.php/archives/834/

https链接不上的问题：https://blog.csdn.net/weixin_42290927/article/details/124346467

mac os finder无法修改的问题：

https://macosx-admin.omnigroup.narkive.com/Kd9g8jKF/finder-mounts-my-webdav-share-always-readonly

mac os finder无法修改的问题：

http://netlab.dhis.org/wiki/ru:software:nginx:webdav

mac os finder无法修改的问题：

https://hev.cc/posts/2020/nginx-webdav-service/