Self-Hosted Cloud Storage

Write docker-compose.yml

The compose file defines four services: Nextcloud (PHP-FPM), MariaDB, Redis, and Nginx. Named volumes are defined for the files data, MariaDB data, and Nginx config. All services are placed on a shared internal network, and only Nginx exposes ports 80 and 443 to the host.

# .env (next to this file, never committed): real secrets live here
# MYSQL_ROOT_PASSWORD=...
# MYSQL_PASSWORD=...
# NC_ADMIN_PASS=...

services:
  db:
    image: mariadb:10.11
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set in .env}
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: ncuser
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set in .env}
    volumes:
      - db_data:/var/lib/mysql

  redis:
    image: redis:7-alpine
    restart: unless-stopped

  app:
    build: .
    image: nextcloud:28-fpm-alpine
    restart: unless-stopped
    depends_on: [db, redis]
    environment:
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: ncuser
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set in .env}
      REDIS_HOST: redis
      NEXTCLOUD_TRUSTED_DOMAINS: cloud.tyfsadik.org
    volumes:
      - nc_data:/var/www/html

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - nc_data:/var/www/html:ro
      - ./certs:/etc/letsencrypt:ro

volumes:
  db_data:
  nc_data:

Nginx Config with Large File Upload Support

The Nginx configuration proxies PHP requests to the Nextcloud FPM container and raises the upload body size limit to support large file uploads. WebDAV methods are enabled for the sync clients. Headers required by Nextcloud (X-Frame-Options, X-Content-Type) are added for security compliance.

# nginx.conf (server block excerpt)
server {
    listen 443 ssl;
    server_name cloud.tyfsadik.org;

    ssl_certificate /etc/letsencrypt/live/cloud.tyfsadik.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.tyfsadik.org/privkey.pem;

    # Large file upload support
    client_max_body_size 10G;
    client_body_timeout 300s;
    fastcgi_read_timeout 300s;

    root /var/www/html;
    index index.php;

    # Serve ACME challenges from the webroot so certbot --webroot works
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # Nextcloud well-known redirects (required by the security scan)
    location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; }
    location = /.well-known/caldav  { return 301 $scheme://$host/remote.php/dav; }

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }

    location ~ \.php$ {
        fastcgi_pass app:9000;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    # Nextcloud required headers
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
}

Provision SSL Certificate

Certbot is run in webroot mode so it can validate domain ownership through the running Nginx container without stopping the server. The certificate is stored on the host and bind-mounted into the Nginx container.

apt install certbot -y

# Use webroot mode (Nginx handles /.well-known/acme-challenge)
certbot certonly --webroot \
  -w /var/lib/docker/volumes/nextcloud_nc_data/_data \
  -d cloud.tyfsadik.org \
  --agree-tos --email [email protected]

# Renew hook to reload Nginx
echo '#!/bin/bash
docker exec nextcloud-nginx-1 nginx -s reload' \
  > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Nextcloud Initial Setup

After bringing the stack up, the Nextcloud installer is run via the web UI or occ CLI to create the admin account and confirm the database connection. Trusted domains are set so Nextcloud accepts requests from the public hostname.

docker compose up -d

# Run setup via CLI (recommended for automation)
docker exec --user www-data nextcloud-app-1 php occ maintenance:install \
  --database mysql \
  --database-host db \
  --database-name nextcloud \
  --database-user ncuser \
  --database-pass "${MYSQL_PASSWORD:?set in .env}" \
  --admin-user admin \
  --admin-pass "${NC_ADMIN_PASS:?set in .env}" \
  --data-dir /var/www/html/data

# Add trusted domain
docker exec --user www-data nextcloud-app-1 php occ \
  config:system:set trusted_domains 1 --value=cloud.tyfsadik.org

Install Sync Clients on Devices

The official Nextcloud desktop client is installed on Linux and Windows machines. On mobile, the Nextcloud app is installed from the App Store / Play Store. Each client is pointed to https://cloud.tyfsadik.org with the admin credentials. Selective folder sync keeps only relevant directories synchronized locally.

# Linux desktop client (Debian/Ubuntu)
sudo apt install nextcloud-desktop

# Or AppImage from official releases:
wget https://github.com/nextcloud-releases/desktop/releases/latest/download/Nextcloud-x.x.x-x86_64.AppImage
chmod +x Nextcloud-*.AppImage && ./Nextcloud-*.AppImage

# Verify sync via CLI
nextcloudcmd -u admin -p pass /local/sync/folder https://cloud.tyfsadik.org

Configure APCu and Redis Caching

APCu is configured as the local cache and Redis as the distributed cache and file-locking backend in Nextcloud's config.php, following Nextcloud's documented caching layout. This eliminates database-level file locks and significantly improves performance when multiple clients sync simultaneously.

APCu needs a custom image: the stock nextcloud:28-fpm-alpine image does not ship the APCu PHP extension (upstream's own .examples/README.md lists it as a package to add yourself), so the memcache.local setting above fails until a thin Dockerfile installs it. The nextcloud:28-fpm-alpine image bundles PHP 8.2, which satisfies Nextcloud 28's PHP 8.1/8.2 requirement.

# Dockerfile (referenced by "build: ." in the compose file)
FROM nextcloud:28-fpm-alpine
RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS \
    && pecl install apcu \
    && docker-php-ext-enable apcu \
    && apk del --no-cache .build-deps

# Add to /var/www/html/config/config.php
# (edit inside the app container or on the bind-mounted config volume)

'memcache.local' => '\OC\Memcache\APCu',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'redis' => [
    'host' => 'redis',
    'port' => 6379,
    'timeout' => 0.0,
],

# Apply config and run maintenance repair
docker exec --user www-data nextcloud-app-1 php occ maintenance:repair
docker exec --user www-data nextcloud-app-1 php occ db:add-missing-indices