diff --git a/admin_manual/configuration_database/linux_database_configuration.rst b/admin_manual/configuration_database/linux_database_configuration.rst index b907b1f87fd..94efd84d9b5 100644 --- a/admin_manual/configuration_database/linux_database_configuration.rst +++ b/admin_manual/configuration_database/linux_database_configuration.rst @@ -191,9 +191,11 @@ Adjust the paths to the pem files for your environment. .. tip:: The encrypted connection can also be set up during the installation, so that no unencrypted connection is used at any point. See - :ref:`autoconfig_database_encryption_label` when installing with an - autoconfig file, or :ref:`command_line_installation_ssl_label` when - installing with ``occ maintenance:install``. + :ref:`installation_wizard_database_encryption_label` when installing with the + Installation Wizard, :ref:`autoconfig_database_encryption_label` when + installing with an autoconfig file, or + :ref:`command_line_installation_ssl_label` when installing with + ``occ maintenance:install``. .. _db-config-postgresql-label: @@ -324,9 +326,11 @@ issued for the hostname used to connect. Adjust the paths to the pem files for y .. tip:: The encrypted connection can also be set up during the installation, so that no unencrypted connection is used at any point. See - :ref:`autoconfig_database_encryption_label` when installing with an - autoconfig file, or :ref:`command_line_installation_ssl_label` when - installing with ``occ maintenance:install``. + :ref:`installation_wizard_database_encryption_label` when installing with the + Installation Wizard, :ref:`autoconfig_database_encryption_label` when + installing with an autoconfig file, or + :ref:`command_line_installation_ssl_label` when installing with + ``occ maintenance:install``. .. _db-troubleshooting-label: diff --git a/admin_manual/installation/automatic_configuration.rst b/admin_manual/installation/automatic_configuration.rst index 22d133cc76a..4c4cb108de9 100644 --- a/admin_manual/installation/automatic_configuration.rst +++ b/admin_manual/installation/automatic_configuration.rst @@ -68,7 +68,9 @@ Nextcloud, so that the credentials and all queries are not sent in plaintext. The following parameters are independent of the database backend. Nextcloud translates them into the corresponding :file:`config.php` settings before the first connection is opened, so the installation itself already uses an -encrypted connection. +encrypted connection. If the setup form is displayed, the values prefill the +fields of its **Encrypted database connection** section, see +:ref:`installation_wizard_database_encryption_label`. .. list-table:: Connection encryption parameters :header-rows: 1 diff --git a/admin_manual/installation/command_line_installation.rst b/admin_manual/installation/command_line_installation.rst index 995cf7d6632..2676dd547d3 100644 --- a/admin_manual/installation/command_line_installation.rst +++ b/admin_manual/installation/command_line_installation.rst @@ -132,7 +132,8 @@ server against a CA certificate: Nextcloud writes the resulting configuration to ``dbdriveroptions`` (MySQL/MariaDB) or ``pgsql_ssl`` (PostgreSQL) in ``config.php``, see :doc:`../configuration_server/config_sample_php_parameters`. The same -connection can be configured for the Installation Wizard, see -:ref:`autoconfig_database_encryption_label`. +connection can be configured in the Installation Wizard, see +:ref:`installation_wizard_database_encryption_label`, or prefilled with an +autoconfig file, see :ref:`autoconfig_database_encryption_label`. See :ref:`command_line_installation_label` for more information. diff --git a/admin_manual/installation/images/install-wizard-a1.png b/admin_manual/installation/images/install-wizard-a1.png deleted file mode 100644 index 11491ad12f5..00000000000 Binary files a/admin_manual/installation/images/install-wizard-a1.png and /dev/null differ diff --git a/admin_manual/installation/images/install-wizard-a4.png b/admin_manual/installation/images/install-wizard-a4.png deleted file mode 100644 index b612b14c4ab..00000000000 Binary files a/admin_manual/installation/images/install-wizard-a4.png and /dev/null differ diff --git a/admin_manual/installation/images/install-wizard-firstrunwizard.png b/admin_manual/installation/images/install-wizard-firstrunwizard.png index 89bc33c95cb..1cdf420a2ef 100644 Binary files a/admin_manual/installation/images/install-wizard-firstrunwizard.png and b/admin_manual/installation/images/install-wizard-firstrunwizard.png differ diff --git a/admin_manual/installation/images/install-wizard-initial.png b/admin_manual/installation/images/install-wizard-initial.png index 6de60b7100e..f641b7efc1a 100644 Binary files a/admin_manual/installation/images/install-wizard-initial.png and b/admin_manual/installation/images/install-wizard-initial.png differ diff --git a/admin_manual/installation/images/install-wizard-untrusted-domain.png b/admin_manual/installation/images/install-wizard-untrusted-domain.png new file mode 100644 index 00000000000..4f45cecf91c Binary files /dev/null and b/admin_manual/installation/images/install-wizard-untrusted-domain.png differ diff --git a/admin_manual/installation/installation_wizard.rst b/admin_manual/installation/installation_wizard.rst index 180e4a0a71f..c82f66e4c8e 100644 --- a/admin_manual/installation/installation_wizard.rst +++ b/admin_manual/installation/installation_wizard.rst @@ -98,6 +98,42 @@ fields: name (e.g., localhost:5432)."* * **Database tablespace** *(Oracle only)*: Shown only when Oracle is selected. +.. _installation_wizard_database_encryption_label: + +Encrypted database connection +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. versionadded:: 35 + +When the database does not run on the same host as Nextcloud, the connection should be encrypted so +that the credentials and all queries are not sent in plaintext. For MySQL/MariaDB and PostgreSQL the +wizard shows a collapsed **Encrypted database connection** section with the following fields. They +are applied before the first connection is opened, so the installation itself already uses an +encrypted connection. + +* **Encryption mode** *(PostgreSQL only)*: Encryption mode of the connection. Supported modes are + ``disable``, ``allow``, ``prefer``, ``require``, ``verify-ca``, and ``verify-full``. Only + ``verify-full`` verifies that the certificate of the database server was issued for the hostname + used to connect. +* **CA certificate path**: Path to the CA certificate the database server is verified against. +* **Client certificate path**: Path to the client certificate used to authenticate against the + database server. +* **Client certificate key path**: Path to the private key belonging to the client certificate. +* **Certificate revocation list path** *(PostgreSQL only)*: Path to the certificate revocation list. +* **Do not verify that the server certificate matches the database host** *(MySQL/MariaDB only)*: + MySQL and MariaDB verify this by default. Enable this option when the certificate of the database + server was not issued for the hostname used to connect. + +The client certificate and its key have to be provided together, and all certificates and keys have +to be readable by the web server. If a value is invalid, the wizard reports the error and the +installation does not proceed. + +Nextcloud stores the resulting configuration as ``dbdriveroptions`` (MySQL/MariaDB) or ``pgsql_ssl`` +(PostgreSQL) in ``config.php``, as described in +:doc:`../configuration_server/config_sample_php_parameters`. The same connection can be configured +without using the wizard, see :ref:`autoconfig_database_encryption_label` for autoconfig files and +:ref:`command_line_installation_ssl_label` for ``occ maintenance:install``. + Automatic database user creation ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -139,6 +175,9 @@ values from the config file."* The **Storage & database** section is automatically collapsed when the autoconfig provides valid values. For details on autoconfig files, see :doc:`automatic_configuration`. +The fields of the **Encrypted database connection** section are prefilled from an autoconfig file as +well, see :ref:`autoconfig_database_encryption_label`. + .. figure:: images/install-wizard-autoconfig.png :scale: 75% :alt: Nextcloud wizard screen when an autoconfig file is detected @@ -187,6 +226,6 @@ A typical configuration looks like this:: When a user tries a URL that is not whitelisted the following error appears: -.. figure:: images/install-wizard-a4.png +.. figure:: images/install-wizard-untrusted-domain.png :scale: 75% :alt: Error message when URL is not whitelisted