nextcloud 调用onlyoffice要求onlyoffice ssl

onlyoffice 
关闭jwt
```
sudo docker run -i -t -d -p 443:443 --restart=always \
-v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  -e JWT_ENABLED=false onlyoffice/documentserver-de
```

开启jwt

```
sudo docker run -i -t -d -p 443:443 --restart=always \
-v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data -e JWT_ENABLED=true -e JWT_SECRET=【这里写自己的秘钥】 onlyoffice/documentserver-de
```

安装证书
```
openssl genrsa -out onlyoffice.key 2048
openssl req -new -key onlyoffice.key -out onlyoffice.csr
openssl x509 -req -days 365 -in onlyoffice.csr -signkey onlyoffice.key -out onlyoffice.crt
openssl dhparam -out dhparam.pem 2048
mkdir -p /app/onlyoffice/DocumentServer/data/certs
cp onlyoffice.key /app/onlyoffice/DocumentServer/data/certs/
cp onlyoffice.crt /app/onlyoffice/DocumentServer/data/certs/
cp dhparam.pem /app/onlyoffice/DocumentServer/data/certs/
chmod 400 /app/onlyoffice/DocumentServer/data/certs/onlyoffice.key
chmod -R 755 /app/onlyoffice/DocumentServer/data/certs
```
重启容器

nextcloud 调用onlyoffice


当docker ip暴露为0.0.0.0开头时，会无视ufw规则，外部就可以进行访问，如图
![feeb51b0-76bb-46d5-adac-9cfaf791840d.png](/static/img/9b53f7272adfbf4bfb4027cdc7e25389.feeb51b0-76bb-46d5-adac-9cfaf791840d.webp)
我设置了12345拒绝状态
![image.png](/static/img/6c297888569493addb42984ce5da4ecf.image.webp)

以下是telnet结果，说明端口已被打开
![image.png](/static/img/107fd25beef64e826346f84eb360e3b5.image.webp)

原因在于`iptable -L`中，docker规则高于ufw规则，导致请求直接被转发。所以ufw无用。

![image.png](/static/img/ec3a72635937a81ba2eb21f1869adc8c.image.webp)


## **解决方案**

`vi /etc/docker/daemon.json`

增加"iptables": false

```
{
        "registry-mirrors": [
                "https://docker.1panel.live"
        ],
        "iptables": false
}
```

重新检查

![ebed20a6-d583-4bac-8694-5bbebeeabc4d.png](/static/img/0b645c1775508b38471fcfdacc52af7f.ebed20a6-d583-4bac-8694-5bbebeeabc4d.webp)

当你打开ufw端口时，可以重新访问。

docker禁止修改iptables

以mcsmanager为例


### 新建目录`resourcepacks`

![9af3e273-2c73-488e-aa98-7ba5f4ace34b.png](/static/img/1c774f819e00710ee97920c6b3ca1f50.9af3e273-2c73-488e-aa98-7ba5f4ace34b.webp)

上传数据包文件（我这里是ChoppingBlock资源包配套的数据包ChoppingBlockResourcePack.zip）

![image.png](/static/img/6e68d57cedbc80aa096a300e725454ca.image.webp)
然后路径下

![image.png](/static/img/25249bf57957b85938772f553cdac06e.image.webp)

### 修改server.properties中的两个选项如图：

resource-pack 地址就是刚才上传文件的地址，如图`/
resourcepackse/ChoppingBlockResourcePack.zip`

![image.png](/static/img/7ae8fb2b399a39fee95cc0b05c4ab40b.image.webp)


### 上传地图
新建world文件夹，然后上传地图包并解压。

![image.png](/static/img/b98464916802fc35ba1ed8b5886dd7ea.image.webp)


启动服务器即可


mc开服加数据包教程

ssh 用root先登录vcenter
我这里是vcenter 6.7

```bash
root@momen-server [ /var/log/vmware/vsphere-ui/logs ]# /usr/lib/vmware-vmca/bin/certificate-manager
                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
                |                                                                     |
                |      *** Welcome to the vSphere 6.7 Certificate Manager  ***        |
                |                                                                     |
                |                   -- Select Operation --                            |
                |                                                                     |
                |      1. Replace Machine SSL certificate with Custom Certificate     |
                |                                                                     |
                |      2. Replace VMCA Root certificate with Custom Signing           |
                |         Certificate and replace all Certificates                    |
                |                                                                     |
                |      3. Replace Machine SSL certificate with VMCA Certificate       |
                |                                                                     |
                |      4. Regenerate a new VMCA Root Certificate and                  |
                |         replace all certificates                                    |
                |                                                                     |
                |      5. Replace Solution user certificates with                     |
                |         Custom Certificate                                          |
                |                                                                     |
                |      6. Replace Solution user certificates with VMCA certificates   |
                |                                                                     |
                |      7. Revert last performed operation by re-publishing old        |
                |         certificates                                                |
                |                                                                     |
                |      8. Reset all Certificates                                      |
                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 4
Do you wish to generate all certificates using configuration file : Option[Y/N] ? :
Please enter any value with in [Y/N]. : Option[Y/N] ? : y

Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : y

Press Enter key to skip optional parameters or use Previous value.

Enter proper value for 'Country' [Previous value : CN] :

Enter proper value for 'Name' [Previous value : CA] :

Enter proper value for 'Organization' [Previous value : VMware] :

Enter proper value for 'OrgUnit' [Previous value : VMware Engineering] :

Enter proper value for 'State' [Previous value : California] :

Enter proper value for 'Locality' [Previous value : Palo Alto] :

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] :

Enter proper value for 'Email' [Previous value : email@acme.com] :

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : momen-server.momen.world

Enter proper value for VMCA 'Name' :momen-server.momen.world

You are going to regenerate Root Certificate and all other certificates using VMCA
Continue operation : Option[Y/N] ? : y
Get site nameCompleted [Replacing Machine SSL Cert...]
default-site
Lookup all services
······
······
Updated 34 service(s)
Status : 85% Completed [starting services...]
Status : 100% Completed [All tasks completed successfully]

root@momen-server [ /var/log/vmware/vsphere-ui/logs ]#

```

vcenter证书过期导致无法登录解决方案

https://[vcenter ip]:5480/login

使用5480端口连接到vcenter管理口。

![a09d852c-4b74-45e1-a6ce-6a6d602e2262.png](/static/img/5bf65d2d058cf42221fe1b1e214846cc.a09d852c-4b74-45e1-a6ce-6a6d602e2262.webp)

点击更新可以获得更新列表（此处我已经更新到最新，没有图了，记忆中选中更新过后点击转储并安装。

![8dfb0bf0-6732-4a07-adf4-d65de7c63245.png](/static/img/ee8c98d12a9e2371d40c7c5a494e715d.8dfb0bf0-6732-4a07-adf4-d65de7c63245.webp)

然后会让你备份系统（其实一般会装到esxi上，所以拍个快照我觉得就行，但是保险起见，还是备个份吧）

支持：FTPS、HTTPS、SCP、FTP、NFS、SMB 和 HTTP。
![image.png](/static/img/c3b364c6b3a35137fa4dd9288c985cf0.image.webp)

然后顺着按钮就更新了。


更新完毕会出现无法登录情况（且证书没有过期），此时需要用root账户ssh连接到服务器，手动修改密码。


![2a60bb32-4a11-4625-a479-b073c3f80cc6.png](/static/img/c0f29f3d22e6f2d034b91b26afb95bbf.2a60bb32-4a11-4625-a479-b073c3f80cc6.webp)

#### `/usr/lib/vmware-vmdir/bin/vdcadmintool`修改密码
![659e0c8f-7717-4945-9d74-99f1307a5b73.png](/static/img/16ec0c7a1eb253ef2ba6ef2caa231c0f.659e0c8f-7717-4945-9d74-99f1307a5b73.webp)

然后就可以登录了。

新建目录resourcepacks

新建目录`resourcepacks`