243 lines
6.8 KiB
Markdown
243 lines
6.8 KiB
Markdown
---
|
||
title: Nextcloud
|
||
description: Install Nextcloud to self-host your files, photos, and calendar, a privacy-friendly alternative to Google Drive, OneDrive, and iCloud.
|
||
---
|
||
|
||
|
||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||
|
||
[Nextcloud](https://nextcloud.com/) is a self-hosted solution that allows you to access and synchronize your data across all your devices. It also includes collaboration features, calendar, and more. It’s a great alternative to services like Google Drive, iCloud, or OneDrive.
|
||
|
||
|
||
|
||
## Installation
|
||
::note{to="https://docs.linuxserver.io/images/docker-nextcloud/"}
|
||
|
||
We'll be using the Docker image maintained by **LinuxServer.io**
|
||
::
|
||
|
||
::file-tree
|
||
---
|
||
tree:
|
||
/:
|
||
- srv:
|
||
- docker:
|
||
- nextcloud:
|
||
- config/
|
||
- data/
|
||
- compose.yaml
|
||
- .env
|
||
---
|
||
::
|
||
|
||
::steps{level="3"}
|
||
### Deploy the stack
|
||
|
||
Open Dockge, click on `compose`, name the stack `nextcloud` and paste the following:
|
||
|
||
```yaml [compose.yaml]
|
||
---
|
||
services:
|
||
nextcloud:
|
||
image: lscr.io/linuxserver/nextcloud:latest
|
||
container_name: nextcloud
|
||
environment:
|
||
- PUID=${PUID}
|
||
- PGID=${GUID}
|
||
- TZ=Etc/UTC
|
||
volumes:
|
||
- /srv/docker/nextcloud/config:/config
|
||
- /srv/docker/nextcloud/data:/data
|
||
ports:
|
||
- ${PORT}:443
|
||
restart: unless-stopped
|
||
```
|
||
|
||
::note{to="/general/networking/samba"}
|
||
|
||
If you’re using a NAS or network-shared drive via **Samba**, replace `/srv/docker/nextcloud/data` with the path to your shared folder.
|
||
::
|
||
|
||
### Set your environment variables
|
||
|
||
Find your `PUID` and `GUID` by running the following command:
|
||
|
||
```bash [Terminal]
|
||
id username
|
||
```
|
||
|
||
Then fill out the `.env` file with your preferred port and the values found above, for example:
|
||
|
||
```properties [.env]
|
||
PUID=1000
|
||
GUID=1000
|
||
PORT=4545
|
||
```
|
||
|
||
Deploy the stack and visit `http://yourserverip:4545` to complete the setup.
|
||
|
||
### Done !
|
||
::
|
||
|
||
::caution
|
||
|
||
__If it fails:__ check your firewall rules.
|
||
::
|
||
|
||
## Exposing Nextcloud with Swag
|
||
The goal of this setup is to access Nextcloud remotely from all your devices. We’ll use Swag to expose the app.
|
||
|
||
::note
|
||
|
||
We assume you have a subdomain `nextcloud.yourdomain.com` with a `CNAME` pointing to `yourdomain.com` in your [DNS zone](/general/networking/dns). And unless you’re using [Cloudflare Zero Trust](/serveex/security/cloudflare), port `443` on your router must be forwarded to port `443` on your server using [NAT rules](/general/networking/nat).
|
||
::
|
||
|
||
::steps{level="3"}
|
||
### Add Nextcloud's network to SWAG
|
||
|
||
In Dockge, go to your SWAG stack and edit the compose to add Nextcloud's network:
|
||
|
||
```yaml [compose.yaml]
|
||
---
|
||
services:
|
||
swag:
|
||
container_name: # ...
|
||
# ...
|
||
networks:
|
||
# ...
|
||
- nextcloud
|
||
|
||
networks:
|
||
# ...
|
||
nextcloud:
|
||
name: nextcloud_default
|
||
external: true
|
||
```
|
||
|
||
::note
|
||
|
||
We assume the Nextcloud network is named `nextcloud_default`. You can confirm connectivity by visiting the SWAG dashboard at http://yourserverip:81.
|
||
::
|
||
|
||
Redeploy the stack and wait for SWAG to become fully operational.
|
||
|
||
### Configure trusted proxies
|
||
|
||
In Nextcloud’s files, edit the `config.php` file:
|
||
|
||
::tip{icon="" to="/serveex/files/file-browser-quantum"}
|
||
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit files instead of using terminal commands.
|
||
::
|
||
|
||
```bash [Terminal]
|
||
sudo nano /srv/docker/nextcloud/config/www/nextcloud/config/config.php
|
||
```
|
||
|
||
Paste the following before the final `);`:
|
||
|
||
```php [config.php]
|
||
'trusted_proxies' => [gethostbyname('swag')],
|
||
'overwrite.cli.url' => 'https://nextcloud.example.com/',
|
||
'overwritehost' => 'nextcloud.example.com',
|
||
'overwriteprotocol' => 'https',
|
||
```
|
||
|
||
Also add your domain in the `array` section. It should look like this:
|
||
|
||
```php [config.php]
|
||
array (
|
||
0 => '192.168.0.1:444', # This line may differ, don’t change it!
|
||
1 => 'nextcloud.yourdomain.com', # Add your domain here
|
||
),
|
||
```
|
||
|
||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||
|
||
### Create the subdomain.conf file
|
||
|
||
In Swag’s folders, create the file `nextcloud.subdomain.conf`:
|
||
|
||
```bash [Terminal]
|
||
sudo nano /srv/docker/swag/config/nginx/proxy-confs/nextcloud.subdomain.conf
|
||
```
|
||
|
||
Paste the following:
|
||
|
||
```nginx [nextcloud.subdomain.conf]
|
||
## Version 2024/04/25
|
||
server {
|
||
listen 443 ssl;
|
||
listen [::]:443 ssl;
|
||
|
||
server_name nextcloud.*;
|
||
|
||
include /config/nginx/ssl.conf;
|
||
|
||
client_max_body_size 0;
|
||
|
||
location / {
|
||
include /config/nginx/proxy.conf;
|
||
include /config/nginx/resolver.conf;
|
||
set $upstream_app nextcloud;
|
||
set $upstream_port 443;
|
||
set $upstream_proto https;
|
||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||
|
||
# Hide proxy response headers from Nextcloud that conflict with ssl.conf
|
||
proxy_hide_header Referrer-Policy;
|
||
proxy_hide_header X-Content-Type-Options;
|
||
proxy_hide_header X-Frame-Options;
|
||
proxy_hide_header X-XSS-Protection;
|
||
|
||
# Disable proxy buffering
|
||
proxy_buffering off;
|
||
}
|
||
}
|
||
```
|
||
|
||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||
|
||
### Done !
|
||
::
|
||
|
||
That’s it! You’ve exposed Nextcloud! Don’t forget to install [the desktop and mobile apps](https://nextcloud.com/install/).
|
||
|
||
## Protecting Nextcloud with Pocket ID
|
||
Nextcloud can also delegate login to an OIDC provider instead of (or alongside) its own accounts.
|
||
|
||
::steps{level="3"}
|
||
### Install the OpenID Connect app
|
||
|
||
In Nextcloud, go to _Apps > Integration_ and install __OpenID Connect user backend__ (`user_oidc`).
|
||
|
||
### Register Nextcloud as an OIDC client
|
||
|
||
[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Nextcloud`, with this callback URL:
|
||
|
||
```text
|
||
https://nextcloud.yourdomain.com/apps/user_oidc/code
|
||
```
|
||
|
||
### Add the provider in Nextcloud
|
||
|
||
In Nextcloud, go to _Administration > OpenID Connect_, click the `+` button, and fill in:
|
||
|
||
| Field | Value |
|
||
|-------|-------|
|
||
| Identifier | `PocketID` |
|
||
| Client ID | The client ID copied from Pocket ID |
|
||
| Client secret | The client secret copied from Pocket ID |
|
||
| Discovery endpoint | Pocket ID's OIDC discovery URL |
|
||
| Scope | `openid email profile groups` |
|
||
|
||
### Done !
|
||
::
|
||
|
||
::tip{icon="" to="/serveex/advanced/authentik"}
|
||
✨ You can use **Authentik** instead of Pocket ID:
|
||
|
||
1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Nextcloud`, with a redirect URI (type `Strict`) of `https://nextcloud.yourdomain.com/apps/user_oidc/code`.
|
||
2. Note the provider's __Client ID__, __Client Secret__, and __Slug__.
|
||
3. In Nextcloud's OpenID Connect settings, set the Discovery endpoint to `https://authentik.yourdomain.com/application/o/<slug>/.well-known/openid-configuration`, then fill in the Client ID and Client Secret.
|
||
::
|