How to Self-Host Nextcloud on a VPS

Nextcloud is a self-hosted file sync and sharing platform with desktop and mobile clients, plus apps for calendars, contacts, chat and office documents. This guide installs it by hand on Ubuntu 24.04 with Nextcloud All-in-One (AIO), which its README calls "the official Nextcloud installation method". You start one Docker container, the mastercontainer, and it creates and manages the rest: Nextcloud, PostgreSQL, Redis, a web server with automatic Let's Encrypt certificates, and an optional backup tool based on BorgBackup.

Prefer one click? Deploy Nextcloud from the VeloxaHost marketplace and skip the manual steps; this guide is for when you want to run every command yourself.

What you need

• A server running Ubuntu 24.04 LTS with root access. You can work over SSH or in the browser terminal on the server's page.
• A domain or subdomain, such as cloud.example.com. AIO does not accept an IP address instead of a domain.
• A dedicated IPv4 address. AIO serves Nextcloud on port 443 only, and its FAQ says other ports are not supported. Ports 80 and 443 are not available on VeloxaHost's shared IPv4 address, so add a dedicated IPv4, a paid add-on. Choose it under "Network access" when you create the server, or take one later from the IP addresses page and attach it. The console shows the current price. If none is free in the region, the request is refused.

Nextcloud's system requirements say memory needs vary with users, apps and files, and recommend at least 512 MB of RAM per PHP process, which is AIO's default limit. A Veloxa 2 (2 vCPU, 4 GB RAM, 80 GB disk) at $15 a month, billed at $0.03 an hour and capped at the monthly price, is a good start for a small team. Optional features such as Office, Talk or ClamAV each add a container, so for those consider a Veloxa 4 (4 vCPU, 8 GB RAM, 160 GB disk) at $30 a month, billed at $0.05 an hour and capped at the monthly price. Size the disk for your files.

Install Nextcloud

1. Install Docker Engine from Docker's apt repository. The AIO README says snap-based Docker is not supported.

   # Add Docker's official GPG key:
   sudo apt update
   sudo apt install ca-certificates curl
   sudo install -m 0755 -d /etc/apt/keyrings
   sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
   sudo chmod a+r /etc/apt/keyrings/docker.asc
   
   # Add the repository to Apt sources:
   sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
   Types: deb
   URIs: https://download.docker.com/linux/ubuntu
   Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
   Components: stable
   Architectures: $(dpkg --print-architecture)
   Signed-By: /etc/apt/keyrings/docker.asc
   EOF
   
   sudo apt update
   sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
   sudo docker run hello-world
   

2. Make the server answer on its dedicated IPv4 address. Add it to the interface now, and to the network configuration so it survives a reboot. Use your own address.

   ip addr add 198.51.100.5/32 dev eth0
   

3. At your DNS provider, point an A record for cloud.example.com at that address.

4. Attach a VeloxaHost firewall before anything listens on port 8080. The rules are under "Secure it" below.

5. Start the mastercontainer with the README's command. Do not change the container or volume name; updates and backups depend on them.

   sudo docker run \
     --init \
     --sig-proxy=false \
     --name nextcloud-aio-mastercontainer \
     --restart always \
     --publish 80:80 \
     --publish 8080:8080 \
     --publish 8443:8443 \
     --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
     --volume /var/run/docker.sock:/var/run/docker.sock:ro \
     ghcr.io/nextcloud-releases/all-in-one:latest
   

   The README also offers an example compose.yaml and suggests it for production, since it makes later changes easier.

6. Check that it is running.

   sudo docker ps
   sudo docker logs nextcloud-aio-mastercontainer
   

First login

The AIO interface runs on port 8080 with a self-signed certificate, which your browser asks you to accept. The README says to open it by IP address, not by domain, because HSTS can block the domain later. Either open https://198.51.100.5:8080 with port 8080 allowed from your IP only, or use an SSH tunnel through the first port of your block (shown under "How to connect") and open https://localhost:8080.

ssh -p 20000 -L 8080:127.0.0.1:8080 root@203.0.113.10

The first page shows the AIO passphrase. Write it down, then log in with it. Type your domain and click Submit domain; it cannot be changed from the interface later. AIO checks that the domain reaches this server on port 443, so DNS and the firewall must be ready. Pick the optional containers you want and your timezone, then click Download and start containers.

When the containers are up, reveal the initial Nextcloud credentials on the same page. The username is admin and the password is generated. Click Open your Nextcloud and log in. The README's fix for the "missing default phone region" warning is below; use your country code.

sudo docker exec --user www-data nextcloud-aio-nextcloud php occ config:system:set default_phone_region --value="US"

Secure it

VeloxaHost firewalls are network-level and stateful. Until you attach one, all traffic is allowed; once attached, inbound traffic no rule allows is dropped. Go to Firewalls, New Firewall, Add Rule, then attach it on the server's page. For AIO:

• Allow TCP 443 from 0.0.0.0/0, plus UDP 443 if you want HTTP/3.
• Allow TCP 80 from 0.0.0.0/0. AIO uses it to redirect to Nextcloud.
• Allow TCP and UDP 3478 only if you enable Talk.
• Allow TCP 22 and TCP 8080 only from YOUR.IP/32. Skip the 8080 rule if you use the tunnel.
• Leave 8443 closed. The README recommends limiting public exposure of the AIO interface.

Docker's docs warn that ports published by Docker bypass ufw rules, so rely on the VeloxaHost firewall here.

While Nextcloud runs, AIO blocks direct passphrase login. To reach it later, log in to Nextcloud as an admin and use the button at the top of https://cloud.example.com/settings/admin/overview.

Back it up

AIO's backup uses BorgBackup. Backups are incremental, compressed and encrypted, and cover the database, your files and the mastercontainer configuration, but not folders mounted through the external storage app. In the AIO interface, set a backup location and click Create backup. Save the encryption key AIO shows; you cannot restore without it. After the first backup you can enable daily backups.

The AIO docs suggest a different drive or a remote Borg repository, so one disk failure cannot take the backups too. For a remote repository, leave the local path blank, enter the repository URL, and add the public key AIO shows to the remote's authorized keys.

Add VeloxaHost's tools on top. Snapshots are instant and free up to your plan's limit (5 on Starter, 30 on Pay as you go) and are stored in the same region. Create one under Snapshots on the server page, or schedule them every hour, 6 hours, 12 hours, daily or weekly, kept 1 to 30 days. Restoring overwrites the server's current state. The Backups page schedules server backups (every 6 hours up to weekly, keeping 1 to 10); download one now and then for an off-site copy.

Update it

Take a snapshot first. Then, in the AIO interface:

1. When updates are listed under the containers section, click Stop containers.
2. Click Create backup.
3. If a mastercontainer update is shown, click Update mastercontainer and wait.
4. Click Start and update containers.

With daily backups on, AIO can also update containers, Nextcloud and its apps after each successful backup. AIO warns admins when the Nextcloud image is over 90 days old, so update at least every three months.

Troubleshooting

Domain validation fails. Check the A record, that the address is on the interface, and that TCP 443 is allowed. If you are completely sure everything is right, the README describes adding --env SKIP_DOMAIN_VALIDATION=true to the docker run command before the last line, then removing and recreating the mastercontainer. No data is lost.

"Internal or reserved ip-address" error. Add --add-host yourdomain.com:<public-ip-address> to the mastercontainer command, before the image line.

Locked out after failed logins. Nextcloud's brute-force protection blocked your IP. Run sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ security:bruteforce:reset <ip-address>.

A container keeps stopping. Open its logs from the AIO interface or with sudo docker logs <container-name>, and check memory use.

FAQ

Why does Nextcloud AIO need a dedicated IPv4 address on VeloxaHost?

AIO serves Nextcloud on port 443 and does not support other ports. VeloxaHost's shared IPv4 address only offers a block of high ports, so a dedicated IPv4 address, a paid add-on, is how your server gets ports 80 and 443.

How many users can I have?

The AIO README says up to 100 users are free, and more are possible with Nextcloud Enterprise.

What license is Nextcloud under?

Nextcloud Server and Nextcloud All-in-One are released under the AGPL-3.0 license. You can run them for any purpose without a license fee.

Which VeloxaHost size fits Nextcloud?

A Veloxa 2 (2 vCPU, 4 GB RAM, 80 GB disk) at $15 a month, billed at $0.03 an hour and capped at the monthly price, suits a small team. With Office, Talk or ClamAV enabled, a Veloxa 4 (4 vCPU, 8 GB RAM, 160 GB disk) at $30 a month gives those containers room.