Self-host Nextcloud on a VPS

To self-host Nextcloud, install Nextcloud All-in-One (AIO), the method Nextcloud recommends: one Docker container that sets up Nextcloud, its database, Redis and HTTPS, then keeps them updated and backed up. You open AIO's setup page, give it a domain that points at your server, and it starts Nextcloud on that domain with a Let's Encrypt certificate.

On VPSNine the one-click app installs AIO with its setup page kept private, so the steps below are mostly about claiming it safely.

What you need#

• A server with room for it. Standard (2 vCPU, 4 GB) is the smallest plan we offer it on: Nextcloud, its database, Redis and AIO's helpers run at once, and each PHP worker may use up to 512 MB. Choose Extreme for several active users, Office editing or Talk calls.
• Enough disk for everything you sync: 80 GB on Standard and 160 GB on Extreme, less the system and the containers. Nextcloud's External storage app can mount S3-compatible, SFTP or WebDAV storage if you outgrow it.
• A domain or subdomain of its own, such as cloud.example.com. AIO only starts Nextcloud for a domain that points at the server, and it can't move Nextcloud to another domain from its interface later, so pick one you'll keep.
• The server to itself. AIO manages its own containers and wants nothing else on ports 443 and 3478.

Install it with the one-click app#

Order a server with the Nextcloud one-click app. On the first boot it installs Docker and runs AIO's mastercontainer as AIO's README says, with one change: the setup page listens on 127.0.0.1:8080 instead of every address, and AIO's ports 80 and 8443 aren't published at all. That matters because the setup page shows its login passphrase to whoever opens it first.

1. Point cloud.example.com at the server with an A record for its IPv4 address, and allow port 443 in the panel firewall. If you'll use Talk, allow 3478 over both TCP and UDP too.
2. From your computer, open a tunnel to the setup page:

ssh -L 8080:127.0.0.1:8080 root@203.0.113.10

3. Browse to https://localhost:8080. AIO uses a self-signed certificate here, so accept the browser's warning. Copy the passphrase it shows, keep it somewhere safe, and log in.
4. Enter cloud.example.com, choose the optional apps you want (such as Talk or Office) and start the containers. This takes a few minutes. When AIO is done, it shows Nextcloud's initial admin password: save it, log in at https://cloud.example.com, and turn on two-factor login.
5. Back in AIO, set a backup location and turn on daily backups.

Put it on your domain with HTTPS#

Unlike most of our one-click apps, Nextcloud has no vps9-https command, because AIO does this part itself. When you start Nextcloud for your domain, AIO publishes port 443 with its own Let's Encrypt certificate and renews it. It checks first that the domain points at the server and that port 443 reaches it, which is why the firewall step comes before you enter the domain.

The mastercontainer controls Docker through its socket, as AIO requires. That is as powerful as root on the server, so treat the AIO passphrase like a root password.

Doing it by hand on another server#

On a server with Docker (Install Docker) and no other web server, AIO's README gives one command:

docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

Then open https://203.0.113.10:8080, log in with the passphrase, and continue as above. In that setup, port 80 is for certificate challenges and 8443 serves the AIO interface with a real certificate once you have a domain. Port 8080 is open to the internet from the moment the container starts, so do the setup straight away, or publish it as 127.0.0.1:8080:8080 and use an SSH tunnel as we do. If another reverse proxy already runs on the server, follow AIO's reverse proxy documentation instead of this command.

Updates and backups#

AIO updates Nextcloud and its containers when you press its update button in the setup page, or every night if you turn on daily backups with automatic updates. Its backups use BorgBackup to a directory you choose; copy that directory off the server, because a backup on the same disk doesn't survive the disk. Backups you should run shows how to do that every night.

We turn on the operating system's automatic security updates (security fixes only); the server never reboots by itself.

When it goes wrong#

• AIO won't accept your domain: it checks that the domain points at this server and that port 443 reaches it. Check the A record with getent hosts cloud.example.com, and that 443 is allowed in the panel firewall. A new DNS record can take a while to be seen everywhere.
• The setup page doesn't load: the tunnel isn't open, or you used http://. It's https://localhost:8080, with a certificate warning you accept. On the server, docker ps should list nextcloud-aio-mastercontainer.
• Talk calls connect but carry no audio or video: port 3478 is closed. Allow it over both TCP and UDP in the panel firewall.