NextCloud + Aria2 + Transmission 搭建私有云盘 +下载服务器

本文的方法以 LNMP 架构为基础，使用 NextCloud 作为私有云平台，aria2 / transmission作为下载器，搭建一个类似百度云功能的私有云盘+下载服务器。本文以Ubuntu 16.04 LTS操作系统为例。NextCloud的服务端文件存储在 /var/www/nextcloud ，nextcloud用户数据存储在 /var/www/nextcloud_data ，aria/transmission的下载文件夹设置在 /var/www/storage 。

Changelog

[2017.09.20] v0.1 | 初稿

[2017.09.20] v0.2 | 增加aria2的init.d脚本

目前阶段本文可能错误较多，仅供参考！

1. mysql

安装

sudo apt-get update
sudo apt-get install mysql-server
# 期间会提示设置root密码
# 完成后继续
sudo mysql_secure_installation
# 接下来按照提示设置密码强度检查插件、
# root用户密码、移除匿名用户、删除test数据库、
# 限制mysql的root用户只能本地登录，
# 最后重新读取权限表生效。

sudo apt-get update

sudo apt-get install mysql-server

# 期间会提示设置root密码

# 完成后继续

sudo mysql_secure_installation

# 接下来按照提示设置密码强度检查插件、

# root用户密码、移除匿名用户、删除test数据库、

# 限制mysql的root用户只能本地登录，

# 最后重新读取权限表生效。

登入mysql：

sudo mysql -uroot -p
# 输入密码后回车 进入mysql命令行

1 2	sudo mysql -uroot -p # 输入密码后回车进入mysql命令行

接下来再mysql命令行中操作，新建nextcloud的数据库：

# 为nextcloud新建一个mysql的用户（用户名为nextcloud_username，密码为database_passwoard）
CREATE USER 'nextcloud_username'@'localhost' IDENTIFIED BY 'database_password';
# 新建一个数据库（名字为nextcloud）
CREATE DATABASE IF NOT EXISTS nextcloud;
# 将nextcloud数据库的权限分配给nextcloud_username用户
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextcloud_username'@'localhost' IDENTIFIED BY 'database_password';
FLUSH PRIVILEGES;
quit;

# 为nextcloud新建一个mysql的用户（用户名为nextcloud_username，密码为database_passwoard）

CREATE USER 'nextcloud_username'@'localhost' IDENTIFIED BY 'database_password';

# 新建一个数据库（名字为nextcloud）

CREATE DATABASE IF NOT EXISTS nextcloud;

# 将nextcloud数据库的权限分配给nextcloud_username用户

GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextcloud_username'@'localhost' IDENTIFIED BY 'database_password';

FLUSH PRIVILEGES;

quit;

2. PHP

安装与配置

sudo apt-get install php7.0 php7.0-fpm \
    php7.0-gd php7.0-json php7.0-mysql php7.0-mbstring \
    php7.0-intl php7.0-mcrypt php-imagick php7.0-xml php7.0-zip \
    php7.0-curl php7.0-bz2 php7.0-imap php7.0-intl

sudo apt-get install php7.0 php7.0-fpm \

php7.0-gd php7.0-json php7.0-mysql php7.0-mbstring \

php7.0-intl php7.0-mcrypt php-imagick php7.0-xml php7.0-zip \

php7.0-curl php7.0-bz2 php7.0-imap php7.0-intl

/etc/php/7.0/fpm/pool.d/www.conf 中下面几行去掉注释，并更改PATH：

env[HOSTNAME] = $HOSTNAME
env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
env[TMP] = /tmp
env[TMPDIR] = /tmp
env[TEMP] = /tmp

env[HOSTNAME] = $HOSTNAME

env[PATH] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

env[TMP] = /tmp

env[TMPDIR] = /tmp

env[TEMP] = /tmp

修改 /etc/php/7.0/fpm/php.ini 中 [opcache] 字段中如下内容（去掉注释并修改部分值 cache大小请根据机子内存酌情给），其他字段不要动：

[opcache]
; Determines if Zend OPCache is enabled
opcache.enable=1

; Determines if Zend OPCache is enabled for the CLI version of PHP
opcache.enable_cli=1

; The OPcache shared memory storage size.
opcache.memory_consumption=512

; The amount of memory for interned strings in Mbytes.
opcache.interned_strings_buffer=8

; The maximum number of keys (scripts) in the OPcache hash table.
; Only numbers between 200 and 100000 are allowed.
opcache.max_accelerated_files=10000

; How often (in seconds) to check file timestamps for changes to the shared
; memory storage allocation. ("1" means validate once per second, but only
; once per request. "0" means always validate)
opcache.revalidate_freq=1

; If disabled, all PHPDoc comments are dropped from the code to reduce the
; size of the optimized code.
opcache.save_comments=1

[opcache]

; Determines if Zend OPCache is enabled

opcache.enable=1

; Determines if Zend OPCache is enabled for the CLI version of PHP

opcache.enable_cli=1

; The OPcache shared memory storage size.

opcache.memory_consumption=512

; The amount of memory for interned strings in Mbytes.

opcache.interned_strings_buffer=8

; The maximum number of keys (scripts) in the OPcache hash table.

; Only numbers between 200 and 100000 are allowed.

opcache.max_accelerated_files=10000

; How often (in seconds) to check file timestamps for changes to the shared

; memory storage allocation. ("1" means validate once per second, but only

; once per request. "0" means always validate)

opcache.revalidate_freq=1

; If disabled, all PHPDoc comments are dropped from the code to reduce the

; size of the optimized code.

opcache.save_comments=1

重启php7.0-fpm：

sudo service php7.0-fpm restart

1	sudo service php7.0-fpm restart

3. nginx 与 NextCloud 安装

# 安装nginx
sudo apt install nginx
# 新建一个临时目录
mkdir temp
cd temp
# 下载NextCloud
wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2
# 检查sha256sum
wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2.sha256
sha256sum -c latest-12.tar.bz2.sha256 < latest-12.tar.bz2
# 检查pgp签名
wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2.asc
wget https://nextcloud.com/nextcloud.asc
gpg --import nextcloud.asc
gpg --verify latest-12.tar.bz2.asc latest-12.tar.bz2
# 解压
tar -xjf latest-12.tar.bz2
# 复制到production directory
sudo cp -r nextcloud /var/www
# 修复权限
sudo chown -R www-data:www-data /var/www/nextcloud
# 删除临时文件
cd ..
rm -r temp

# 安装nginx

sudo apt install nginx

# 新建一个临时目录

mkdir temp

cd temp

# 下载NextCloud

wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2

# 检查sha256sum

wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2.sha256

sha256sum -c latest-12.tar.bz2.sha256 < latest-12.tar.bz2

# 检查pgp签名

wget https://download.nextcloud.com/server/releases/latest-12.tar.bz2.asc

wget https://nextcloud.com/nextcloud.asc

gpg --import nextcloud.asc

gpg --verify latest-12.tar.bz2.asc latest-12.tar.bz2

# 解压

tar -xjf latest-12.tar.bz2

# 复制到production directory

sudo cp -r nextcloud /var/www

# 修复权限

sudo chown -R www-data:www-data /var/www/nextcloud

# 删除临时文件

cd ..

rm -r temp

上面的例子用的是Nextcloud 12.0.2版本，如果有更新版本了，记得上面命令中的版本号替换一下。另外，nginx使用源码编译安装的话默认配置和Ubuntu官方repo里nginx的配置有较大差别，因此如果你从nginx源码编译安装，则需要酌情修改配置（比如nginx以www-data身份运行，又比如nginx.conf的内容等）

nextcloud的用户文件最好存到另一个目录中，这里新建一个：

cd /var/www
sudo -u www-data mkdir nextcloud-data

1 2	cd /var/www sudo -u www-data mkdir nextcloud-data

4. nginx配置

配置web服务器，并且全局严格HTTPS（HSTS）。

在 /etc/nginx/sites-available 下新建文件 001-nextcloud ，写入配置，举例如下（例子中开启了HTTPS并使用了ECC证书，如果不是ECC证书，请酌情修改ssl_ciphers）：

upstream php-handler {
    #server 127.0.0.1:9000;
    server unix:/run/php/php7.0-fpm.sock;
}

server {
    listen 80 default_server;
    server_name cloud.yourdomain.com;
    # enforce https
    rewrite ^(.*) https://cloud.yourdomain.com$1 permanent;
}

server {
    listen 443 ssl http2 default_server;
    server_name cloud.yourdomain.com;

    ssl_certificate            /etc/nginx/chained.crt;
    ssl_certificate_key        /etc/nginx/domain.key;
    ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers  on;
    ssl_ciphers                EECDH+ECDSA+AES128:EECDH+aRSA+AES128:EECDH+CHACHA20:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:!MD5:!aNULL:!EDH:!RC4:!DSS;
    ssl_stapling               on;
    ssl_stapling_verify        on;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    #
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
    root /var/www/nextcloud/;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
    gzip on;
    gzip_vary on;
    gzip_comp_level 4;
    gzip_min_length 256;
    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    location / {
        rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
        deny all;
    }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
    }

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        #Avoid sending the security headers twice
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
        try_files $uri/ =404;
        index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js|woff|svg|gif)$ {
        try_files $uri /index.php$uri$is_args$args;
        add_header Cache-Control "public, max-age=7200";
        # Add headers to serve security related headers (It is intended to
        # have those duplicated to the ones above)
        # Before enabling Strict-Transport-Security headers please read into
        # this topic first.
        # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
        #
        # WARNING: Only add the preload option once you read about
        # the consequences in https://hstspreload.org/. This option
        # will add the domain to a hardcoded list that is shipped
        # in all major browsers and getting removed from this list
        # could take several months.
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;
        # Optional: Don't log access to assets
        access_log off;
    }

    location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

upstream php-handler {

#server 127.0.0.1:9000;

server unix:/run/php/php7.0-fpm.sock;

}

server {

listen 80 default_server;

server_name cloud.yourdomain.com;

# enforce https

rewrite ^(.*) https://cloud.yourdomain.com$1 permanent;

}

server {

listen 443 ssl http2 default_server;

server_name cloud.yourdomain.com;

ssl_certificate /etc/nginx/chained.crt;

ssl_certificate_key /etc/nginx/domain.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers EECDH+ECDSA+AES128:EECDH+aRSA+AES128:EECDH+CHACHA20:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:!MD5:!aNULL:!EDH:!RC4:!DSS;

ssl_stapling on;

ssl_stapling_verify on;

# Add headers to serve security related headers

# Before enabling Strict-Transport-Security headers please read into this

# topic first.

# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# WARNING: Only add the preload option once you read about

# the consequences in https://hstspreload.org/. This option

# will add the domain to a hardcoded list that is shipped

# in all major browsers and getting removed from this list

# could take several months.

add_header X-Content-Type-Options nosniff;

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

# Path to the root of your installation

root /var/www/nextcloud/;

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# The following 2 rules are only needed for the user_webfinger app.

# Uncomment it if you're planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;

#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json

# last;

location = /.well-known/carddav {

return 301 $scheme://$host/remote.php/dav;

}

location = /.well-known/caldav {

return 301 $scheme://$host/remote.php/dav;

}

# set max upload size

client_max_body_size 512M;

fastcgi_buffers 64 4K;

# Enable gzip but do not remove ETag headers

gzip on;

gzip_vary on;

gzip_comp_level 4;

gzip_min_length 256;

gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;

gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

# Uncomment if your server is build with the ngx_pagespeed module

# This module is currently not supported.

#pagespeed off;

location / {

rewrite ^ /index.php$uri;

}

location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {

deny all;

}

location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {

deny all;

}

location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {

fastcgi_split_path_info ^(.+\.php)(/.*)$;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param PATH_INFO $fastcgi_path_info;

fastcgi_param HTTPS on;

#Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

fastcgi_param front_controller_active true;

fastcgi_pass php-handler;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

}

location ~ ^/(?:updater|ocs-provider)(?:$|/) {

try_files $uri/ =404;

index index.php;

}

# Adding the cache control header for js and css files

# Make sure it is BELOW the PHP block

location ~* \.(?:css|js|woff|svg|gif)$ {

try_files $uri /index.php$uri$is_args$args;

add_header Cache-Control "public, max-age=7200";

# Add headers to serve security related headers (It is intended to

# have those duplicated to the ones above)

# Before enabling Strict-Transport-Security headers please read into

# this topic first.

# add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

# WARNING: Only add the preload option once you read about

# the consequences in https://hstspreload.org/. This option

# will add the domain to a hardcoded list that is shipped

# in all major browsers and getting removed from this list

# could take several months.

add_header X-Content-Type-Options nosniff;

add_header X-Frame-Options "SAMEORIGIN";

add_header X-XSS-Protection "1; mode=block";

add_header X-Robots-Tag none;

add_header X-Download-Options noopen;

add_header X-Permitted-Cross-Domain-Policies none;

# Optional: Don't log access to assets

access_log off;

}

location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {

try_files $uri /index.php$uri$is_args$args;

# Optional: Don't log access to other assets

access_log off;

}

删掉 /etc/nginx/sites-enabled 中默认的 default 的符号链接，并新建nextcloud的符号链接：

sudo ln -s /etc/nginx/sites-available/001-nextcloud /etc/nginx/sites-enabled/001-nextcloud

1	sudo ln -s /etc/nginx/sites-available/001-nextcloud /etc/nginx/sites-enabled/001-nextcloud

测试nginx配置文件是否正确：

sudo nginx -t

1	sudo nginx -t

如果有误，按照提示的错误修改；如果没有问题，那么重载入nginx配置文件：

sudo nginx -s reload

1	sudo nginx -s reload

5. 初始化NextCloud

访问NextCloud网站，进入Installation Wizard：

上面设置管理员账户的用户名和密码，然后点开Storage & database：

第一个框填入数据文件的目录，文中使用的是 /var/www/nextcloud-data

接下来数据库类型选择”MySQL/MariaDB”，下面的四个框分别是：

1) nextcloud的数据库的用户名，本文使用的是：nextcloud_username

2) nextcloud的数据库的密码，本文使用的是： database_password

3) 指定nextcloud所用数据库的名称，本文使用的是：nextcloud

4) 数据库服务器地址，本文中数据库服务器和web服务器在同一台机器上，因此填localhost即可

填写完毕后点击完成安装，稍等数分钟完成初始化配置，即可进入NextCloud中了。简单测试一下功能是否正常，没问题就继续下一步。

6. memory cache：apcu

也是官方文档的建议，配置这个可以增强性能，过程很简单：

sudo apt-get install php-apcu
sudo phpenmod apcu
sudo service php7.0-fpm reload

sudo apt-get install php-apcu

sudo phpenmod apcu

sudo service php7.0-fpm reload

然后在 /var/www/nextcloud/config/config.php 中增加下面高亮的那一行：

<?php
$CONFIG = array (
...
'maintenance' => false,
'memcache.local' => '\OC\Memcache\APCu',
);

<?php

$CONFIG = array (

...

'maintenance' => false,

'memcache.local' => '\OC\Memcache\APCu',

);

重启web服务器：

sudo service nginx restart

1	sudo service nginx restart

在NextCloud管理页面查看，不再有配置memcache等的提示的话就表示成功了。

至此，单纯的NextCloud部分配置完毕。下面配置下载服务器。

7. Aria2

直接安装ubuntu官方repo中的版本（不是最新）：

sudo apt-get install aria2

1	sudo apt-get install aria2

还可以下载最新版本源码编译安装：

mkdir aria2_build_dir
cd aria2_build_dir
wget https://github.com/aria2/aria2/releases/download/release-1.32.0/aria2-1.32.0.tar.gz
tar zxf aria2-1.32.0.tar.gz
cd aria2-1.32.0
sudo apt-get install libssl-dev libssh2-1-dev libc-ares-dev libxml2-dev \
zlib1g-dev libsqlite3-dev pkg-config
./configure && make
sudo make install

mkdir aria2_build_dir

cd aria2_build_dir

wget https://github.com/aria2/aria2/releases/download/release-1.32.0/aria2-1.32.0.tar.gz

tar zxf aria2-1.32.0.tar.gz

cd aria2-1.32.0

sudo apt-get install libssl-dev libssh2-1-dev libc-ares-dev libxml2-dev \

zlib1g-dev libsqlite3-dev pkg-config

./configure && make

sudo make install

如果没有出错，则执行一下命令查看一下aria2的版本号，如果正常返回了结果并显示版本为1.32.0，则说明没有问题。

aria2c -v

aria2c -v

请注意不要混用从源码编译安装和从官方repo安装两种方式，因为二者的安装位置可能不同，这样的话可能会造成在不同目录安装了不同的两个版本。

新建aria2/transmission的下载目录：

cd /var/www
sudo mkdir storage
sudo mkdir storage/aria2
sudo mkdir storage/transmission
sudo chown -R www-data:www-data storage

cd /var/www

sudo mkdir storage

sudo mkdir storage/aria2

sudo mkdir storage/transmission

sudo chown -R www-data:www-data storage

接下来配置aria2配置文件 /etc/aria2/aria2.conf ，举例如下：

disable-ipv6=true
#最大同时下载数(任务数), 路由建议值: 3
max-concurrent-downloads=10
#断点续传
continue=true
#同服务器连接数
max-connection-per-server=10
#最小文件分片大小, 下载线程数上限取决于能分出多少片, 对于小文件重要
min-split-size=10M
#单文件最大线程数, 路由建议值: 5
split=20
#下载速度限制
max-overall-download-limit=0
#单文件速度限制
max-download-limit=0
#上传速度限制
max-overall-upload-limit=0
#单文件速度限制
max-upload-limit=0
#断开速度过慢的连接
#lowest-speed-limit=0
#默认下载路径
dir=/var/www/storage/aria2
#Log
#log=/var/log/aria2c.log

ftp-pasv=true

input-file=/var/lib/aria2/aria2.session
save-session=/var/lib/aria2/aria2.session
#定时保存会话，需要1.16.1之后的release版
save-session-interval=60

#BT下载相关
#启用DHT
enable-dht=true
#启用本地节点查找
bt-enable-lpd=true
# 种子交换, PT需要禁用, 默认:true
enable-peer-exchange=true
#添加额外的tracker
#bt-tracker=<URI>,…
#单种子最大连接数
#bt-max-peers=55
#强制加密, 防迅雷必备
bt-require-crypto=true
#当下载的文件是一个种子(以.torrent结尾)时, 自动下载BT
follow-torrent=true
#BT监听端口, 当端口屏蔽时使用
listen-port=5232
# 客户端伪装, PT需要
peer-id-prefix=-TR2770-
user-agent=Transmission/2.77
# 当种子的分享率达到这个数时, 自动停止做种, 0为一直做种, 默认:1.0
seed-ratio=2
# BT校验相关, 默认:true
#bt-hash-check-seed=true
# 继续之前的BT任务时, 无需再次校验, 默认:false
#bt-seed-unverified=true
# 保存磁力链接元数据为种子文件(.torrent文件), 默认:false
#bt-save-metadata=true

#允许rpc
enable-rpc=true
#允许所有来源, web界面跨域权限需要
rpc-allow-origin-all=true
#允许非外部访问
rpc-listen-all=true
#RPC端口, 仅当默认端口被占用时修改
rpc-listen-port=6800
#RPC TOKEN
rpc-secret=xxxxxxxxxxxxxxxxxxx
#RPC服务器证书及私钥
rpc-certificate=/etc/nginx/chained.crt
rpc-private-key=/etc/nginx/domain.key
rpc-secure=true

disable-ipv6=true

#最大同时下载数(任务数), 路由建议值: 3

max-concurrent-downloads=10

#断点续传

continue=true

#同服务器连接数

max-connection-per-server=10

#最小文件分片大小, 下载线程数上限取决于能分出多少片, 对于小文件重要

min-split-size=10M

#单文件最大线程数, 路由建议值: 5

split=20

#下载速度限制

max-overall-download-limit=0

#单文件速度限制

max-download-limit=0

#上传速度限制

max-overall-upload-limit=0

#单文件速度限制

max-upload-limit=0

#断开速度过慢的连接

#lowest-speed-limit=0

#默认下载路径

dir=/var/www/storage/aria2

#Log

#log=/var/log/aria2c.log

ftp-pasv=true

input-file=/var/lib/aria2/aria2.session

save-session=/var/lib/aria2/aria2.session

#定时保存会话，需要1.16.1之后的release版

save-session-interval=60

#BT下载相关

#启用DHT

enable-dht=true

#启用本地节点查找

bt-enable-lpd=true

# 种子交换, PT需要禁用, 默认:true

enable-peer-exchange=true

#添加额外的tracker

#bt-tracker=<URI>,…

#单种子最大连接数

#bt-max-peers=55

#强制加密, 防迅雷必备

bt-require-crypto=true

#当下载的文件是一个种子(以.torrent结尾)时, 自动下载BT

follow-torrent=true

#BT监听端口, 当端口屏蔽时使用

listen-port=5232

# 客户端伪装, PT需要

peer-id-prefix=-TR2770-

user-agent=Transmission/2.77

# 当种子的分享率达到这个数时, 自动停止做种, 0为一直做种, 默认:1.0

seed-ratio=2

# BT校验相关, 默认:true

#bt-hash-check-seed=true

# 继续之前的BT任务时, 无需再次校验, 默认:false

#bt-seed-unverified=true

# 保存磁力链接元数据为种子文件(.torrent文件), 默认:false

#bt-save-metadata=true

#允许rpc

enable-rpc=true

#允许所有来源, web界面跨域权限需要

rpc-allow-origin-all=true

#允许非外部访问

rpc-listen-all=true

#RPC端口, 仅当默认端口被占用时修改

rpc-listen-port=6800

#RPC TOKEN

rpc-secret=xxxxxxxxxxxxxxxxxxx

#RPC服务器证书及私钥

rpc-certificate=/etc/nginx/chained.crt

rpc-private-key=/etc/nginx/domain.key

rpc-secure=true

按照自己需求更改即可，可以参考这里或者官方文档；同时注意，这里准备使用与nginx相同的www-data用户注意目录及文件的权限问题。同时建议开启rcp-secure，配置好服务器证书，这样RPC通过HTTPS加密，更加安全。

开机自启：

新建 /etc/init.d/aria2 文件，所有者设置为root，权限为0755，写入以下内容：

#!/bin/sh
### BEGIN INIT INFO
# Provides: aria2
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Should-Start: $network
# Should-Stop: $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: aria2c init script.
# Description: Starts and stops aria2 daemon.
### END INIT INFO

USER="www-data"
DAEMON=/usr/local/bin/aria2c
CONF=/etc/aria2/aria2.conf

start() {
    if [ -f $CONF ]; then
        echo "Starting aria2 daemon"
        start-stop-daemon -S --quiet -c $USER -x $DAEMON -- -D --conf-path $CONF
    else
        echo "Couldn't start aria2 daemon for $USER (no $CONF found)"
    fi
}

stop() {
    start-stop-daemon -o -c $USER -K -u $USER -x $DAEMON
}

status() {
    dbpid=`pgrep -fu $USER $DAEMON`
    if [ -z "$dbpid" ]; then
        echo "aria2c daemon for USER $btsuser: not running."
    else
        echo "aria2c daemon for USER $btsuser: running (pid $dbpid)"
    fi
}

case "$1" in
    start)
    start
        ;;
    stop)
    stop
        ;;
    restart|reload|force-reload)
        stop
        start
        ;;
    status)
    status
        ;;
    *)
        echo "Usage: /etc/init.d/aria2 {start|stop|reload|force-reload|restart|status}"
    exit 1
esac

exit 0

#!/bin/sh

### BEGIN INIT INFO

# Provides: aria2

# Required-Start: $local_fs $remote_fs

# Required-Stop: $local_fs $remote_fs

# Should-Start: $network

# Should-Stop: $network

# Default-Start: 2 3 4 5

# Default-Stop: 0 1 6

# Short-Description: aria2c init script.

# Description: Starts and stops aria2 daemon.

### END INIT INFO

USER="www-data"

DAEMON=/usr/local/bin/aria2c

CONF=/etc/aria2/aria2.conf

start() {

if [ -f $CONF ]; then

echo "Starting aria2 daemon"

start-stop-daemon -S --quiet -c $USER -x $DAEMON -- -D --conf-path $CONF

else

echo "Couldn't start aria2 daemon for $USER (no $CONF found)"

}

stop() {

start-stop-daemon -o -c $USER -K -u $USER -x $DAEMON

}

status() {

dbpid=`pgrep -fu $USER $DAEMON`

if [ -z "$dbpid" ]; then

echo "aria2c daemon for USER $btsuser: not running."

else

echo "aria2c daemon for USER $btsuser: running (pid $dbpid)"

}

case "$1" in

start)

start

;;

stop)

stop

;;

restart|reload|force-reload)

stop

start

;;

status)

status

;;

echo "Usage: /etc/init.d/aria2 {start|stop|reload|force-reload|restart|status}"

exit 1

esac

exit 0

然后执行下面的命令添加开机自启项：

sudo update-rc.d aria2 defaults

1	sudo update-rc.d aria2 defaults

最后启动服务：

sudo service aria2 start

1	sudo service aria2 start

如此以来，使用一个YAAW等工具即可通过RPC来控制远程服务器下载了。

8. Transmission

安装

sudo apt-get install software-properties-common
sudo add-apt-repository ppa:transmissionbt/ppa
sudo apt-get update
sudo apt-get install transmission-cli transmission-common transmission-daemon

sudo apt-get install software-properties-common

sudo add-apt-repository ppa:transmissionbt/ppa

sudo apt-get update

sudo apt-get install transmission-cli transmission-common transmission-daemon

每次修改配置文件之前，需要先停止transmission的服务才可以修改：

sudo service transmission-daemon stop

1	sudo service transmission-daemon stop

修改配置文件 /etc/transmission-daemon/settings.json ，举例：

{
    "alt-speed-down": 50,
    "alt-speed-enabled": false,
    "alt-speed-time-begin": 540,
    "alt-speed-time-day": 127,
    "alt-speed-time-enabled": false,
    "alt-speed-time-end": 1020,
    "alt-speed-up": 50,
    "bind-address-ipv4": "0.0.0.0",
    "bind-address-ipv6": "::",
    "blocklist-enabled": false,
    "blocklist-url": "http://www.example.com/blocklist",
    "cache-size-mb": 4,
    "dht-enabled": false,
    "download-dir": "/var/www/storage/transmission",
    "download-limit": 100,
    "download-limit-enabled": 0,
    "download-queue-enabled": true,
    "download-queue-size": 5,
    "encryption": 2,
    "idle-seeding-limit": 30,
    "idle-seeding-limit-enabled": false,
    "incomplete-dir": "/var/lib/transmission-daemon/Downloads",
    "incomplete-dir-enabled": false,
    "lpd-enabled": false,
    "max-peers-global": 200,
    "message-level": 1,
    "peer-congestion-algorithm": "",
    "peer-id-ttl-hours": 6,
    "peer-limit-global": 200,
    "peer-limit-per-torrent": 100,
    "peer-port": 5231,
    "peer-port-random-high": 65535,
    "peer-port-random-low": 49152,
    "peer-port-random-on-start": false,
    "peer-socket-tos": "default",
    "pex-enabled": false,
    "port-forwarding-enabled": false,
    "preallocation": 0,
    "prefetch-enabled": true,
    "queue-stalled-enabled": true,
    "queue-stalled-minutes": 30,
    "ratio-limit": 10,
    "ratio-limit-enabled": true,
    "rename-partial-files": true,
    "rpc-authentication-required": true,
    "rpc-bind-address": "127.0.0.1",
    "rpc-enabled": true,
    "rpc-password": "yourpassword",
    "rpc-port": 9090,
    "rpc-url": "/transmission/",
    "rpc-username": "cokebar",
    "rpc-whitelist": "127.0.0.1",
    "rpc-whitelist-enabled": true,
    "scrape-paused-torrents-enabled": true,
    "script-torrent-done-enabled": false,
    "script-torrent-done-filename": "",
    "seed-queue-enabled": false,
    "seed-queue-size": 10,
    "speed-limit-down": 100,
    "speed-limit-down-enabled": false,
    "speed-limit-up": 100,
    "speed-limit-up-enabled": false,
    "start-added-torrents": true,
    "trash-original-torrent-files": false,
    "umask": 2,
    "upload-limit": 100,
    "upload-limit-enabled": 0,
    "upload-slots-per-torrent": 14,
    "utp-enabled": true
}

{

"alt-speed-down": 50,

"alt-speed-enabled": false,

"alt-speed-time-begin": 540,

"alt-speed-time-day": 127,

"alt-speed-time-enabled": false,

"alt-speed-time-end": 1020,

"alt-speed-up": 50,

"bind-address-ipv4": "0.0.0.0",

"bind-address-ipv6": "::",

"blocklist-enabled": false,

"blocklist-url": "http://www.example.com/blocklist",

"cache-size-mb": 4,

"dht-enabled": false,

"download-dir": "/var/www/storage/transmission",

"download-limit": 100,

"download-limit-enabled": 0,

"download-queue-enabled": true,

"download-queue-size": 5,

"encryption": 2,

"idle-seeding-limit": 30,

"idle-seeding-limit-enabled": false,

"incomplete-dir": "/var/lib/transmission-daemon/Downloads",

"incomplete-dir-enabled": false,

"lpd-enabled": false,

"max-peers-global": 200,

"message-level": 1,

"peer-congestion-algorithm": "",

"peer-id-ttl-hours": 6,

"peer-limit-global": 200,

"peer-limit-per-torrent": 100,

"peer-port": 5231,

"peer-port-random-high": 65535,

"peer-port-random-low": 49152,

"peer-port-random-on-start": false,

"peer-socket-tos": "default",

"pex-enabled": false,

"port-forwarding-enabled": false,

"preallocation": 0,

"prefetch-enabled": true,

"queue-stalled-enabled": true,

"queue-stalled-minutes": 30,

"ratio-limit": 10,

"ratio-limit-enabled": true,

"rename-partial-files": true,

"rpc-authentication-required": true,

"rpc-bind-address": "127.0.0.1",

"rpc-enabled": true,

"rpc-password": "yourpassword",

"rpc-port": 9090,

"rpc-url": "/transmission/",

"rpc-username": "cokebar",

"rpc-whitelist": "127.0.0.1",

"rpc-whitelist-enabled": true,

"scrape-paused-torrents-enabled": true,

"script-torrent-done-enabled": false,

"script-torrent-done-filename": "",

"seed-queue-enabled": false,

"seed-queue-size": 10,

"speed-limit-down": 100,

"speed-limit-down-enabled": false,

"speed-limit-up": 100,

"speed-limit-up-enabled": false,

"start-added-torrents": true,

"trash-original-torrent-files": false,

"umask": 2,

"upload-limit": 100,

"upload-limit-enabled": 0,

"upload-slots-per-torrent": 14,

"utp-enabled": true

}

以上选项按需修改即可，可以参考这里或者官方文档

需要注意的是， "rpc-password": "yourpassword", 这里，你修改了这里的rpc密码并保存后，在transmission运行后会将此处密码做Hash，并替换此处文本为Hash值，以“｛”开头，因此如果看到此处变成了“｛”开头的一长串字符不要觉得有问题。

最后启动：

sudo service transmission-daemon start

1	sudo service transmission-daemon start

此时即可使用Transmission Remote等类似工具，通过RPC来管理transmission服务器下载了。或者也可以直接用浏览器访问transmission的rpc地址。不过transmission的rpc没有自带https，此时可以利用nginx做前端反向代理来实现https。

新建 /etc/nginx/sites-available/002-transmission ，写入反向代理的配置，举例如下（请酌情修改）：

server {
    listen 9091 ssl http2;
    server_name cloud.yourdomain.com;

    ssl_certificate             /etc/nginx/chained.crt;
    ssl_certificate_key         /etc/nginx/domain.key;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers                 EECDH+ECDSA+AES128:EECDH+aRSA+AES128:EECDH+CHACHA20:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:!MD5:!aNULL:!EDH:!RC4:!DSS;
    ssl_stapling                on;
    ssl_stapling_verify         on;
    ssl_prefer_server_ciphers   on;

    location /transmission {
        proxy_pass    http://127.0.0.1:9090/transmission;
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header Authorization $http_authorization;
    }
}

server {

listen 9091 ssl http2;

server_name cloud.yourdomain.com;

ssl_certificate /etc/nginx/chained.crt;

ssl_certificate_key /etc/nginx/domain.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers EECDH+ECDSA+AES128:EECDH+aRSA+AES128:EECDH+CHACHA20:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:!MD5:!aNULL:!EDH:!RC4:!DSS;

ssl_stapling on;

ssl_stapling_verify on;

ssl_prefer_server_ciphers on;

location /transmission {

proxy_pass http://127.0.0.1:9090/transmission;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header Authorization $http_authorization;

}

建立符号链接：

ln -s /etc/nginx/sites-available/002-transmission /etc/nginx/sites-enabled/002-transmission

1	ln -s /etc/nginx/sites-available/002-transmission /etc/nginx/sites-enabled/002-transmission

测试nginx配置文件是否正确：

sudo nginx -t

1	sudo nginx -t

如果有误，按照提示的错误修改；如果没有问题，那么重载入nginx配置文件：

sudo nginx -s reload

1	sudo nginx -s reload

至此，可以使用nginx反向代理的9091端口访问transmission的RPC功能，并且使用了HTTPS加密连接。

不过还遗留一个问题，transmission默认使用transmission-daemon用户启动，而nginx是www-data，这样就造成了nextcloud下只对transmission下载目录有读权限，无权修改。下面命令尝试解决这个问题，不过由于隔了好一段时间来写的这篇文章，不清楚是否这一条命令就够了（当时自己配置时候可能还做了别的修改）

sudo chmod 6774 /var/www/storage/transmission

1	sudo chmod 6774 /var/www/storage/transmission

9. NextCloud管理Aria2/Transmission的下载目录

在nextcloud管理面板里的“外部存储”中，添加本地存储目录 /var/www/storage 即可

aria2，nextcloud，transmission，云盘，离线下载，私有云

飞羽博客

一个专注于IT互联网的博客