Install Nextcloud on VPS

Configuration

Now that Docker and Docker Compose are installed, we can proceed with creating the configuration for Nextcloud. We will define services for Nextcloud, the database (MariaDB), caching (Redis), and a reverse proxy (Nginx) with Let's Encrypt.

1. Creating the Environment Variables File (.env)

Secrets and variables that may change are best stored in a separate file .env. This enhances security and simplifies management.

nano .env

Contents of the .env file:

# Nextcloud
NEXTCLOUD_TRUSTED_DOMAINS=your.domain.com
NEXTCLOUD_OVERWRITECLIURL=https://your.domain.com
NEXTCLOUD_DATA_DIR=/var/www/html/data

# Database
MYSQL_DATABASE=nextcloud
MYSQL_USER=nextclouduser
MYSQL_PASSWORD=YOUR_STRONG_DB_PASSWORD
MYSQL_ROOT_PASSWORD=YOUR_STRONG_ROOT_DB_PASSWORD

# Redis
REDIS_HOST=redis

# Nginx
NGINX_HOST=your.domain.com

# Let's Encrypt
[email protected]

Be sure to replace:

• your.domain.com with your actual domain.
• YOUR_STRONG_DB_PASSWORD and YOUR_STRONG_ROOT_DB_PASSWORD with strong, unique passwords.
• [email protected] with your active email address for Let's Encrypt.

2. Creating the docker-compose.yml file

This file defines all services, their images, ports, volumes, and dependencies.

nano docker-compose.yml

Contents of the docker-compose.yml file (current for 2026, using the latest stable images):

version: '3.8'

services:
  db:
    image: mariadb:11.3.2 # Current stable version of MariaDB for 2026
    restart: always
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    volumes:
      - db_data:/var/lib/mysql
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    networks:
      - nextcloud_network

  redis:
    image: redis:7.2.4-alpine # Current stable version of Redis for 2026
    restart: always
    networks:
      - nextcloud_network

  app:
    image: nextcloud:29.0.0-fpm-alpine # Current stable version of Nextcloud for 2026
    restart: always
    volumes:
      - nextcloud_data:/var/www/html
      - nextcloud_config:/var/www/html/config
      - nextcloud_apps:/var/www/html/apps
      - nextcloud_custom_apps:/var/www/html/custom_apps
      - nextcloud_themes:/var/www/html/themes
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_HOST: db
      REDIS_HOST: redis
      PHP_UPLOAD_LIMIT: 16G # Maximum file upload size
      PHP_MEMORY_LIMIT: 512M
      NEXTCLOUD_OVERWRITECLIURL: ${NEXTCLOUD_OVERWRITECLIURL}
      NEXTCLOUD_TRUSTED_DOMAINS: ${NEXTCLOUD_TRUSTED_DOMAINS}
      NEXTCLOUD_DATA_DIR: ${NEXTCLOUD_DATA_DIR}
    depends_on:
      - db
      - redis
    networks:
      - nextcloud_network

  nginx:
    image: nginx:1.26.0-alpine # Current stable version of Nginx for 2026
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - nextcloud_data:/var/www/html:ro # Only for Nextcloud static files
      - certbot_certs:/etc/letsencrypt # For Let's Encrypt certificates
    depends_on:
      - app
    networks:
      - nextcloud_network

  certbot:
    image: certbot/certbot:2.9.0 # Current stable version of Certbot for 2026
    volumes:
      - certbot_certs:/etc/letsencrypt
      - certbot_www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $!; done;'"
    networks:
      - nextcloud_network

volumes:
  db_data:
  nextcloud_data:
  nextcloud_config:
  nextcloud_apps:
  nextcloud_custom_apps:
  nextcloud_themes:
  certbot_certs:
  certbot_www:

networks:
  nextcloud_network:
    driver: bridge

3. Creating the Nginx Configuration

For Nginx, we will need two files: the main nginx.conf and the configuration for our domain nextcloud.conf. Create the directories:

mkdir -p nginx/conf.d

Create the nginx/nginx.conf file:

nano nginx/nginx.conf

Contents of nginx/nginx.conf:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    include /etc/nginx/conf.d/*.conf;
}

Create the nginx/conf.d/nextcloud.conf file:

nano nginx/conf.d/nextcloud.conf

Contents of nginx/conf.d/nextcloud.conf:

upstream php-handler {
    server app:9000;
}

server {
    listen 80;
    listen [::]:80;
    server_name ${NGINX_HOST};

    # Redirect all HTTP requests to HTTPS
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ${NGINX_HOST};

    ssl_certificate /etc/letsencrypt/live/${NGINX_HOST}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/${NGINX_HOST}/privkey.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    # HSTS (optional, but recommended)
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/${NGINX_HOST}/chain.pem;

    # root of your Nextcloud installation
    root /var/www/html;

    index index.php index.html /index.php$request_uri;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        log_not_found off;
        access_log off;
    }

    # Make sure reverse proxy is configured correctly
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
        deny all;
    }
    location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
        deny all;
    }

    # Block access to all files that begin with a dot
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    location / {
        # The following 2 rules are only needed for the folders that are created
        # as part of the installation if they are not already there.
        # Make sure the root parameter is set appropriately
        # when your Nextcloud installation is not in the root directory.
        if (!-e $request_filename){
            rewrite ^/(.*)$ /index.php$request_uri;
        }
    }

    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;

        fastcgi_pass php-handler;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }
}

This Nginx config redirects HTTP to HTTPS, uses variables from .env for the domain, and is configured to work with Let's Encrypt and Nextcloud FPM.

4. Starting Containers and Obtaining SSL Certificates

Before starting all services, we will first launch only Nginx and Certbot to obtain Let's Encrypt certificates.

sudo docker compose up -d nginx certbot # Start Nginx and Certbot

Wait for the containers to come up. Now, let's request the certificates. Make sure your domain already points to the VPS IP address.

sudo docker compose run --rm certbot certonly --webroot -w /var/www/certbot \
    --email ${LETSENCRYPT_EMAIL} \
    -d ${NGINX_HOST} \
    --agree-tos \
    --non-interactive

If the certificates are successfully obtained, you will see a success message. Now you can stop Nginx and Certbot to start all services.

sudo docker compose down

Now let's start all services, including Nextcloud and the database:

sudo docker compose up -d

Wait for all services to come up. This may take a few minutes.

5. Configuring Nextcloud via Browser

Open your domain (e.g., https://your.domain.com) in your browser. You will see the Nextcloud welcome page.

• Create an administrator account (username and password).
• Specify the data directory: ${NEXTCLOUD_DATA_DIR} (it is already configured in docker-compose.yml).
• In the "Database" section, select "MariaDB/MySQL".
• Specify the database details from your .env file:
  • DB username: nextclouduser
  • DB password: YOUR_STRONG_DB_PASSWORD
  • DB name: nextcloud
  • DB host: db (service name in docker-compose.yml)

Click "Finish setup". Nextcloud will install and redirect you to the main page.

6. Additional Nextcloud Configuration (config.php)

For optimization and enhanced security, you can make changes to the config/config.php file inside the Nextcloud container. For example, configure caching with Redis.

sudo docker exec -it app bash
nano /var/www/html/config/config.php

Add the following lines to the 'config' array:

  'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => [
     'host' => 'redis',
     'port' => 6379,
     'timeout' => 0.0,
     'dbindex' => 0,
  ],
  'overwritehost' => '${NGINX_HOST}',
  'overwriteprotocol' => 'https',
  'overwrite.cli.url' => 'https://${NGINX_HOST}',
  'trusted_proxies' => ['nginx'], // If Nginx is in the same Docker network

Save and exit the file (Ctrl+O, Enter, Ctrl+X), then exit the container (exit). Restart the Nextcloud container to apply the changes:

sudo docker compose restart app

7. Verifying Functionality

Ensure that Nextcloud is accessible via your domain over HTTPS.

curl -I https://${NGINX_HOST}            # Check HTTP headers

You should see an HTTP/2 200 status and headers indicating Nextcloud. Also, verify functionality by uploading a file through the web interface.

Backups and Maintenance

Regular backups and timely maintenance are critically important for any production service. Nextcloud is no exception.

What to back up:

• Nextcloud Data: User files stored in the nextcloud_data volume.
• Nextcloud Database: The entire MariaDB database, storing information about users, files, settings, etc. (db_data volume).
• Nextcloud Configuration Files: The config/config.php file and other settings (nextcloud_config volume).
• Docker Compose Configuration: The docker-compose.yml and .env files.
• Let's Encrypt Certificates: The /etc/letsencrypt directory (certbot_certs volume).

Simple Auto-Backup Script

Let's create a simple script that will perform backups of all necessary components. For storing backups, it is recommended to use external storage, such as S3-compatible cloud storage or another VPS.

Create a directory for backup scripts:

mkdir -p ~/scripts
nano ~/scripts/backup_nextcloud.sh

Contents of ~/scripts/backup_nextcloud.sh:

#!/bin/bash

# --- Конфигурация ---
BACKUP_DIR="/mnt/backups/nextcloud" # Каталог для временного хранения бэкапов на VPS
NEXTCLOUD_PROJECT_DIR="/home/nextcloudadmin/nextcloud_data" # Путь к вашему docker-compose.yml
DATE=$(date +%Y%m%d%H%M%S)
DB_BACKUP_FILE="${BACKUP_DIR}/nextcloud_db_${DATE}.sql"
DATA_BACKUP_FILE="${BACKUP_DIR}/nextcloud_data_${DATE}.tar.gz"
CONFIG_BACKUP_FILE="${BACKUP_DIR}/nextcloud_config_${DATE}.tar.gz"
CERT_BACKUP_FILE="${BACKUP_DIR}/nextcloud_certs_${DATE}.tar.gz"
COMPOSE_BACKUP_FILE="${BACKUP_DIR}/nextcloud_compose_${DATE}.tar.gz"

# Переменные из .env
source "${NEXTCLOUD_PROJECT_DIR}/.env"

# --- Создание каталога бэкапов ---
mkdir -p "${BACKUP_DIR}" || { echo "Ошибка: Не удалось создать каталог бэкапов."; exit 1; }

echo "--- Начинаем резервное копирование Nextcloud ---"

# 1. Бэкап базы данных MariaDB
echo "Бэкапим базу данных..."
sudo docker compose -f "${NEXTCLOUD_PROJECT_DIR}/docker-compose.yml" exec db sh -c \
    "exec mariadb-dump -u${MYSQL_USER} -p${MYSQL_PASSWORD} ${MYSQL_DATABASE}" > "${DB_BACKUP_FILE}" || \
    { echo "Ошибка: Бэкап базы данных не удался."; exit 1; }
echo "Бэкап базы данных завершен: ${DB_BACKUP_FILE}"

# 2. Бэкап данных Nextcloud (файлов пользователей)
echo "Бэкапим данные Nextcloud..."
sudo docker compose -f "${NEXTCLOUD_PROJECT_DIR}/docker-compose.yml" exec app tar -czf - -C /var/www/html/data . > "${DATA_BACKUP_FILE}" || \
    { echo "Ошибка: Бэкап данных Nextcloud не удался."; exit 1; }
echo "Бэкап данных Nextcloud завершен: ${DATA_BACKUP_FILE}"

# 3. Бэкап конфигурации Nextcloud
echo "Бэкапим конфигурацию Nextcloud..."
sudo docker compose -f "${NEXTCLOUD_PROJECT_DIR}/docker-compose.yml" exec app tar -czf - -C /var/www/html config > "${CONFIG_BACKUP_FILE}" || \
    { echo "Ошибка: Бэкап конфигурации Nextcloud не удался."; exit 1; }
echo "Бэкап конфигурации Nextcloud завершен: ${CONFIG_BACKUP_FILE}"

# 4. Бэкап сертификатов Let's Encrypt
echo "Бэкапим сертификаты Let's Encrypt..."
sudo tar -czf "${CERT_BACKUP_FILE}" -C /var/lib/docker/volumes/nextcloud_data_certbot_certs/_data . || \
    { echo "Ошибка: Бэкап сертификатов не удался."; exit 1; }
echo "Бэкап сертификатов завершен: ${CERT_BACKUP_FILE}"

# 5. Бэкап Docker Compose файлов
echo "Бэкапим Docker Compose файлы..."
tar -czf "${COMPOSE_BACKUP_FILE}" -C "${NEXTCLOUD_PROJECT_DIR}" docker-compose.yml .env || \
    { echo "Ошибка: Бэкап Docker Compose файлов не удался."; exit 1; }
echo "Бэкап Docker Compose файлов завершен: ${COMPOSE_BACKUP_FILE}"

echo "--- Резервное копирование завершено ---"

# --- Очистка старых бэкапов (оставляем последние 7 дней) ---
echo "Очистка старых бэкапов..."
find "${BACKUP_DIR}" -type f -name "nextcloud_*.sql" -mtime +7 -delete
find "${BACKUP_DIR}" -type f -name "nextcloud_*.tar.gz" -mtime +7 -delete
echo "Очистка завершена."

# --- Загрузка бэкапов на внешнее хранилище (пример с rclone на S3) ---
# Установите rclone и настройте его для вашего S3-хранилища
# Например, rclone config
# rclone sync "${BACKUP_DIR}" "s3_remote:nextcloud-backups"
# echo "Бэкапы синхронизированы с S3."

exit 0

Make the script executable:

chmod +x ~/scripts/backup_nextcloud.sh

To run this script, you may need to mount an external drive or configure /mnt/backups. Also, ensure that the nextcloudadmin user has read/write permissions to /var/lib/docker/volumes/nextcloud_data_certbot_certs/_data or use sudo for the tar command for certificates.

Where to store backups:

• External S3-compatible service: AWS S3, Backblaze B2, DigitalOcean Spaces. This is a reliable and relatively inexpensive option. Use utilities like rclone for automatic synchronization.
• Separate VPS: Rent a small VPS exclusively for storing backups. Synchronize via SSH/rsync.
• Local NAS/server: If you have your own hardware.

Never store backups on the same VPS as the main service! In case of server failure, you will lose both the service and the backups.

Automating Backups with Cron

Add the script to the Cron scheduler for daily execution (e.g., at 3 AM).

sudo crontab -e

Add the following line to the end of the file:

0 3 * * * /home/nextcloudadmin/scripts/backup_nextcloud.sh >> /var/log/nextcloud_backup.log 2>&1

This will run the script every day at 03:00 and record the output to the log file /var/log/nextcloud_backup.log.

Updates: rolling vs maintenance window

• OS Updates: Regularly run sudo apt update && sudo apt upgrade -y. It is recommended to do this once a month or when critical updates are released.
• Docker Image Updates:
  • Rolling (continuous): For Nextcloud and the database, this is not always the best option, as updates may require database migration or API changes.
  • Maintenance window: It is recommended to schedule Nextcloud, MariaDB, and Redis Docker image updates during off-peak hours.

    
    cd ~/nextcloud_data
    sudo docker compose pull                  # Загрузить новые версии образов
    sudo docker compose down                  # Остановить все сервисы
    sudo docker compose up -d                 # Запустить сервисы с новыми образами
    sudo docker exec -it app occ upgrade      # Выполнить обновление Nextcloud через его CLI
    sudo docker exec -it app occ maintenance:mode --off # Выключить режим обслуживания
                        

• Certbot Updates: Let's Encrypt certificates are automatically renewed by the certbot container, which runs in docker-compose.yml.

Troubleshooting + FAQ

This section covers typical problems and frequently asked questions when installing and operating Nextcloud on a VPS.

Nginx returns 502 Bad Gateway

What to check: This means that Nginx cannot communicate with the backend application (in our case, the Nextcloud FPM container).

• Ensure that the app container is running: sudo docker compose ps.
• Check the logs of the app container: sudo docker compose logs app. Look for PHP-FPM errors.
• Ensure that Nginx is correctly configured to proxy to app:9000.
• Check that the containers are on the same Docker network.

How to fix: If app is not running, check the logs for startup errors. If it is running but not responding, PHP-FPM may be stuck or Nextcloud may not be initialized. Try restarting the app container: sudo docker compose restart app.

Cannot obtain an SSL certificate from Let's Encrypt

What to check:

• Ensure that your domain correctly points to your VPS's IP address (A/AAAA records). Use dig your.domain.com.
• Ensure that ports 80 and 443 are open in the firewall (sudo ufw status).
• Check the logs of the certbot container: sudo docker compose logs certbot.
• Ensure that Nginx is configured for .well-known/acme-challenge/.

How to fix: Correct DNS records, open ports in UFW, check Nginx configuration. If there is a problem with Certbot, request limits may have been reached (rare for new domains) or there may be a file system issue.

Nextcloud is running slowly

What to check:

• VPS Resources: Insufficient CPU or RAM. Check resource usage: htop or docker stats.
• Caching: Ensure that Redis is configured and running (see "Configuration" section and config/config.php).
• Database: Slow database performance. Check MariaDB logs for errors or slow queries.
• Disk: Slow disk I/O. SSD is mandatory for Nextcloud.
• Internal Nextcloud settings: Go to "Settings" -> "Overview" in Nextcloud for performance recommendations.

How to fix: Increase VPS resources (RAM, CPU), ensure correct Redis caching setup, consider database optimization or migration to a faster SSD.

Cannot log in to Nextcloud after installation

What to check:

• Correctness of the administrator username and password you specified during the initial setup.
• Check the app container logs for authentication errors.
• Ensure that the database is running and accessible to Nextcloud (db container).

How to fix: If you forgot the administrator password, you can reset it via the Nextcloud CLI: sudo docker exec -it app occ user:resetpassword admin_username. Ensure that the db container is running and there are no errors in its logs.

What is the minimum suitable VPS configuration?

For a single user or a very small family (up to 3-5 people) with basic usage (file storage, synchronization), a VPS with 1 vCPU, 2 GB RAM, and 100 GB SSD is minimally suitable. However, for more comfortable work and the possibility of expanding functions (e.g., video calls, document editing), 2 vCPU, 4 GB RAM, and 200 GB SSD are recommended. This will provide better performance and system stability.

What to choose — VPS or dedicated for this task?

For most Nextcloud use cases (personal cloud, small or medium team up to 50-100 users), a VPS is the optimal choice. It offers sufficient performance, flexibility, and is significantly lower in cost than a dedicated server. A dedicated server should only be chosen for very high loads, a significant number of users (more than 100), specific hardware requirements, or when complete physical isolation is required.

"Trusted domain" error in Nextcloud

What to check: This error means that Nextcloud does not trust the domain from which you are trying to access it.

• Ensure that NEXTCLOUD_TRUSTED_DOMAINS in your .env file contains the correct domain.
• Check that in config/config.php inside the Nextcloud container, your domain is also listed as trusted.

How to fix: Edit the .env file and/or config/config.php, adding your domain to the list of trusted domains. After changing .env, you need to recreate the container: sudo docker compose down && sudo docker compose up -d. After changing config.php inside the container, it is sufficient to restart the app container: sudo docker compose restart app.