--- title: Nextcloud description: Install Nextcloud to self-host your files, photos, and calendar, a privacy-friendly alternative to Google Drive, OneDrive, and iCloud. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} [Nextcloud](https://nextcloud.com/) is a self-hosted solution that allows you to access and synchronize your data across all your devices. It also includes collaboration features, calendar, and more. It’s a great alternative to services like Google Drive, iCloud, or OneDrive. ![Picture](/img/serveex/nextcloud.png) ## Installation ::note{to="https://docs.linuxserver.io/images/docker-nextcloud/"} We'll be using the Docker image maintained by **LinuxServer.io** :: ::file-tree --- tree: /: - srv: - docker: - nextcloud: - config/ - data/ - compose.yaml - .env --- :: ::steps{level="3"} ### Deploy the stack Open Dockge, click on `compose`, name the stack `nextcloud` and paste the following: ```yaml [compose.yaml] --- services: nextcloud: image: lscr.io/linuxserver/nextcloud:latest container_name: nextcloud environment: - PUID=${PUID} - PGID=${GUID} - TZ=Etc/UTC volumes: - /srv/docker/nextcloud/config:/config - /srv/docker/nextcloud/data:/data ports: - ${PORT}:443 restart: unless-stopped ``` ::note{to="/general/networking/samba"} If you’re using a NAS or network-shared drive via **Samba**, replace `/srv/docker/nextcloud/data` with the path to your shared folder. :: ### Set your environment variables Find your `PUID` and `GUID` by running the following command: ```bash [Terminal] id username ``` Then fill out the `.env` file with your preferred port and the values found above, for example: ```properties [.env] PUID=1000 GUID=1000 PORT=4545 ``` Deploy the stack and visit `http://yourserverip:4545` to complete the setup. ### Done ! :: ::caution __If it fails:__ check your firewall rules. :: ## Exposing Nextcloud with Swag The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use Swag to expose the app. ::note We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/networking/nat). :: ::steps{level="3"} ### Add Nextcloud's network to SWAG In Dockge, go to your SWAG stack and edit the compose to add Nextcloud's network: ```yaml [compose.yaml] --- services: swag: container_name: # ... # ... networks: # ... - nextcloud networks: # ... nextcloud: name: nextcloud_default external: true ``` ::note We assume the Nextcloud network is named `nextcloud_default`. You can confirm connectivity by visiting the SWAG dashboard at http://yourserverip:81. :: Redeploy the stack and wait for SWAG to become fully operational. ### Configure trusted proxies In Nextcloud’s files, edit the `config.php` file: ::tip{icon="" to="/serveex/files/file-browser-quantum"} ✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands. :: ```bash [Terminal] sudo nano /srv/docker/nextcloud/config/www/nextcloud/config/config.php ``` Paste the following before the final `);`: ```php [config.php] 'trusted_proxies' => [gethostbyname('swag')], 'overwrite.cli.url' => 'https://nextcloud.example.com/', 'overwritehost' => 'nextcloud.example.com', 'overwriteprotocol' => 'https', ``` Also add your domain in the `array` section. It should look like this: ```php [config.php] array ( 0 => '192.168.0.1:444', # This line may differ, don’t change it! 1 => 'nextcloud.yourdomain.com', # Add your domain here ), ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Create the subdomain.conf file In Swag’s folders, create the file `nextcloud.subdomain.conf`: ```bash [Terminal] sudo nano /srv/docker/swag/config/nginx/proxy-confs/nextcloud.subdomain.conf ``` Paste the following: ```nginx [nextcloud.subdomain.conf] ## Version 2024/04/25 server { listen 443 ssl; listen [::]:443 ssl; server_name nextcloud.*; include /config/nginx/ssl.conf; client_max_body_size 0; location / { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app nextcloud; set $upstream_port 443; set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; # Hide proxy response headers from Nextcloud that conflict with ssl.conf proxy_hide_header Referrer-Policy; proxy_hide_header X-Content-Type-Options; proxy_hide_header X-Frame-Options; proxy_hide_header X-XSS-Protection; # Disable proxy buffering proxy_buffering off; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Done ! :: That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/). ## Protecting Nextcloud with Pocket ID Nextcloud can also delegate login to an OIDC provider instead of (or alongside) its own accounts. ::steps{level="3"} ### Install the OpenID Connect app In Nextcloud, go to _Apps > Integration_ and install __OpenID Connect user backend__ (`user_oidc`). ### Register Nextcloud as an OIDC client [Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Nextcloud`, with this callback URL: ```text https://nextcloud.yourdomain.com/apps/user_oidc/code ``` ### Add the provider in Nextcloud In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and fill in: | Field | Value | |-------|-------| | Identifier | `PocketID` | | Client ID | The client ID copied from Pocket ID | | Client secret | The client secret copied from Pocket ID | | Discovery endpoint | Pocket ID's OIDC discovery URL | | Scope | `openid email profile groups` | ### Done ! :: ::tip{icon="" to="/serveex/advanced/authentik"} ✨ You can use **Authentik** instead of Pocket ID: 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`. 2. Note the provider's __Client ID__, __Client Secret__, and __Slug__. 3. In Nextcloud's OpenID Connect settings, set the Discovery endpoint to `https://authentik.yourdomain.com/application/o//.well-known/openid-configuration`, then fill in the Client ID and Client Secret. ::