---
title: Nextcloud
description: Install Nextcloud to self-host your files, photos, and calendar, a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

[Nextcloud](https://nextcloud.com/) is a self-hosted solution that allows you to access and synchronize your data across all your devices. It also includes collaboration features, calendar, and more. It’s a great alternative to services like Google Drive, iCloud, or OneDrive.

![Picture](/img/serveex/nextcloud.png)

## Installation
::note{to="https://docs.linuxserver.io/images/docker-nextcloud/"}

We'll be using the Docker image maintained by **LinuxServer.io**
::

::file-tree
---
tree:
  /:
    - srv:
      - docker:
        - nextcloud:
          - config/
          - data/
          - compose.yaml
          - .env
---
::

::steps{level="3"}
### Deploy the stack

Open Dockge, click on `compose`, name the stack `nextcloud` and paste the following:

```yaml [compose.yaml]
---
services:
  nextcloud:
    image: lscr.io/linuxserver/nextcloud:latest
    container_name: nextcloud
    environment:
      - PUID=${PUID}
      - PGID=${GUID}
      - TZ=Etc/UTC
    volumes:
      - /srv/docker/nextcloud/config:/config
      - /srv/docker/nextcloud/data:/data
    ports:
      - ${PORT}:443
    restart: unless-stopped
```

::note{to="/general/networking/samba"}

If you’re using a NAS or network-shared drive via **Samba**, replace `/srv/docker/nextcloud/data` with the path to your shared folder.
::

### Set your environment variables

Find your `PUID` and `GUID` by running the following command:

```bash [Terminal]
id username
```

Then fill out the `.env` file with your preferred port and the values found above, for example:

```properties [.env]
PUID=1000
GUID=1000
PORT=4545
```

Deploy the stack and visit `http://yourserverip:4545` to complete the setup.

### Done !
::

::caution

__If it fails:__ check your firewall rules.
::

## Exposing Nextcloud with Swag
The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use Swag to expose the app.

::note

We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/networking/nat).
::

::steps{level="3"}
### Add Nextcloud's network to SWAG

In Dockge, go to your SWAG stack and edit the compose to add Nextcloud's network:

```yaml [compose.yaml]
---
services:
  swag:
     container_name: # ...
      # ... 
     networks:               
      # ...           
      - nextcloud            
    
networks:                    
  # ...
  nextcloud:                 
    name: nextcloud_default  
    external: true           
```

::note

We assume the Nextcloud network is named `nextcloud_default`. You can confirm connectivity by visiting the SWAG dashboard at http://yourserverip:81.
::

Redeploy the stack and wait for SWAG to become fully operational.

### Configure trusted proxies

In Nextcloud’s files, edit the `config.php` file:

::tip{icon="" to="/serveex/files/file-browser-quantum"}
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
::

```bash [Terminal]
sudo nano /srv/docker/nextcloud/config/www/nextcloud/config/config.php
```

Paste the following before the final `);`:

```php [config.php]
'trusted_proxies' => [gethostbyname('swag')],
'overwrite.cli.url' => 'https://nextcloud.example.com/',
'overwritehost' => 'nextcloud.example.com',
'overwriteprotocol' => 'https',
```

Also add your domain in the `array` section. It should look like this:

```php [config.php]
array (
   0 => '192.168.0.1:444', # This line may differ, don’t change it!
   1 => 'nextcloud.yourdomain.com', # Add your domain here
),
```

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

### Create the subdomain.conf file

In Swag’s folders, create the file `nextcloud.subdomain.conf`:

```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/nextcloud.subdomain.conf
```

Paste the following:

```nginx [nextcloud.subdomain.conf]
## Version 2024/04/25
server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name nextcloud.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app nextcloud;
        set $upstream_port 443;
        set $upstream_proto https;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        # Hide proxy response headers from Nextcloud that conflict with ssl.conf
        proxy_hide_header Referrer-Policy;
        proxy_hide_header X-Content-Type-Options;
        proxy_hide_header X-Frame-Options;
        proxy_hide_header X-XSS-Protection;

        # Disable proxy buffering
        proxy_buffering off;
    }
}
```

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

### Done !
::

That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).

## Protecting Nextcloud with Pocket ID
Nextcloud can also delegate login to an OIDC provider instead of (or alongside) its own accounts.

::steps{level="3"}
### Install the OpenID Connect app

In Nextcloud, go to _Apps > Integration_ and install __OpenID Connect user backend__ (`user_oidc`).

### Register Nextcloud as an OIDC client

[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Nextcloud`, with this callback URL:

```text
https://nextcloud.yourdomain.com/apps/user_oidc/code
```

### Add the provider in Nextcloud

In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and fill in:

| Field | Value |
|-------|-------|
| Identifier | `PocketID` |
| Client ID | The client ID copied from Pocket ID |
| Client secret | The client secret copied from Pocket ID |
| Discovery endpoint | Pocket ID's OIDC discovery URL |
| Scope | `openid email profile groups` |

### Done !
::

::tip{icon="" to="/serveex/advanced/authentik"}
✨ You can use **Authentik** instead of Pocket ID:

1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`.
2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
3. In Nextcloud's OpenID Connect settings, set the Discovery endpoint to `https://authentik.yourdomain.com/application/o/<slug>/.well-known/openid-configuration`, then fill in the Client ID and Client Secret.
::
