ownCloud Infinite Scale

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for ownCloud Infinite Scale. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Choose an instance type of m5.large or larger. oCIS runs its full microservice suite in one process, so give it adequate memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger, because the product data lives on the dedicated data volume.

Select Launch instance. First-boot initialization rotates the secrets and creates the administrator. It takes a minute or two after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud ownCloud Infinite Scale Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described in the prerequisites.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options "HttpTokens=required,HttpEndpoint=enabled" \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=owncloud-infinite-scale}]'

Connect to the instance over SSH as the login user for your variant. Replace <vm-ip> with the instance public IP and <key.pem> with your private key:

ssh -i <key.pem> ubuntu@<vm-ip>

The administrator login is generated on first boot and written to a root-only file. Read it with sudo:

sudo cat /root/owncloud-infinite-scale-credentials.txt

The file contains the site URL, the administrator username (admin) and the per-instance password. These values are unique to your instance.

Browse to https://<vm-ip>/. oCIS is served over HTTPS on port 443.

The image ships with a per-instance self-signed certificate, so your browser warns you on the first visit. Accept the certificate to continue, and replace it with a trusted certificate for production (see Step 8). Sign in with the username admin and the password from the credentials file.

To confirm that the service is healthy, run the following command on the instance at any time. The status endpoint is public and reports the running product and version:

curl -k -s https://localhost/status.php

After you sign in, you land in your Personal space. Browse, upload, download and organize files through the web interface.

oCIS replaces the legacy folder-share model with Spaces. Spaces are dedicated, permissioned areas for projects and teams, and you manage them from the Spaces entry in the left navigation.

Select a file or folder and open the Shares panel to share it. You can share with other users and set a role such as Can view or Can edit. You can also create public links for people who do not have an account. The details panel shows activity and metadata for the selected item.

oCIS exposes the ownCloud-compatible OCS and WebDAV APIs over TLS. Basic authentication is enabled on the proxy, so the official desktop and mobile sync clients and your own scripts can authenticate with the per-instance administrator password. The OCS user endpoint returns the signed-in user. Without credentials, it returns HTTP 401.

curl -k -s -u "admin:<OCIS_ADMIN_PASSWORD>" -H 'OCS-APIRequest: true' https://localhost/ocs/v1.php/cloud/user

To connect the official ownCloud desktop or mobile client, point it at https://<vm-ip>/ and sign in as admin. For production, install a trusted certificate (Step 8) so that clients validate the connection without a manual exception.

For production, use a trusted certificate and your own DNS name instead of the per-instance self-signed certificate. Point a DNS record at the instance. Then obtain a certificate for your-domain.example.com, for example with certbot and the nginx plugin:

sudo certbot --nginx -d your-domain.example.com

After you issue the certificate, edit /etc/ocis/ocis.env and set OCIS_URL=https://your-domain.example.com. Then run sudo systemctl restart ocis nginx. oCIS derives its OpenID Connect issuer and web base URL from OCIS_URL, so the value must match the address your users visit.

All identity and user data lives under /var/lib/ocis on the dedicated EBS volume. The simplest durable backup is an EBS snapshot of that volume. Take snapshots on a schedule that matches your recovery objectives. To capture a consistent copy, stop oCIS for the duration of the snapshot and start it again afterward:

sudo systemctl stop ocis
# take an EBS snapshot of the /var/lib/ocis volume here (aws ec2 create-snapshot)
sudo systemctl start ocis

The oCIS binary is at /usr/local/bin/ocis. To upgrade it, take a snapshot, replace the binary with a newer release and restart the service.

Two systemd units keep the platform running. Check their status with:

sudo systemctl status ocis nginx --no-pager

ocis.service runs the oCIS server, and nginx.service terminates TLS and reverse-proxies to it. oCIS logs are in the journal (sudo journalctl -u ocis).

To resize storage, grow the /var/lib/ocis EBS volume and extend the filesystem. The mount is independent of the OS disk.

To integrate single sign-on, point oCIS at an external OpenID Connect provider such as Keycloak. Set the relevant OCIS_OIDC_* variables in /etc/ocis/ocis.env.