Self-host Nextcloud on a VPS

Arct Cloud provides the unmanaged Linux VPS for this deployment. Nextcloud is not preinstalled or managed by Arct Cloud. You are responsible for the application, user data, access controls, backups, and updates.

A synced copy is not a backup. Keep encrypted, tested backups outside the VPS before storing important files in Nextcloud.

Choose a Plan

Nextcloud AIO’s upstream resource guidance reports a minimum of 2 CPU cores, 2 GB RAM, and 40 GB system storage when any optional container is enabled. Some optional services require at least 3 GB RAM; enabling the full set requires at least 4 cores and 5 GB RAM, with 1 GB additional RAM recommended by upstream.

Profile	vCPU	RAM	NVMe storage	Guidance
Official AIO minimum with optional containers	2	2 GB	40 GB	A technical floor, not a sizing recommendation
Practical Arct starting point	4	8 GB	75 GB or more	Small teams with room for previews and selected add-ons

Your file library, previews, versions, trash, and backups determine storage needs. Size the disk for growth rather than only the initial upload.

Before You Begin

Prepare the following:

A fresh Ubuntu 24.04 server
A dedicated hostname such as cloud.example.com
An A record pointing the hostname to the server’s public IPv4 address
Docker Engine with the Docker Compose plugin, installed from Docker’s official Ubuntu repository
An off-server destination for encrypted backups

Remove a stale AAAA record unless IPv6 is configured and reachable. The standard AIO setup expects its own ports and should run on a VPS without another web server or reverse proxy.

Install Nextcloud AIO

Nextcloud All-in-One is the official deployment method. The Compose configuration below follows the upstream production layout and binds the AIO management interface to loopback so it is reachable only through an SSH tunnel.

Deploy and Connect

Deploy an Ubuntu server, then connect over SSH.

Verify Docker

Install Docker Engine and Compose from the official Docker repository, not the Ubuntu Snap package. Then verify both components:

sudo docker version
sudo docker compose version
sudo docker info | grep "Docker Root Dir"

Stop if the last command shows /var/snap/docker/; Snap-based Docker is not supported by Nextcloud AIO.

Create the Compose Project

sudo install -d -m 0750 -o "$USER" -g "$USER" /opt/nextcloud-aio
cd /opt/nextcloud-aio

Create /opt/nextcloud-aio/compose.yaml with the following content:

compose.yaml

name: nextcloud-aio

services:
  nextcloud-aio-mastercontainer:
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    network_mode: bridge
    ports:
      - "80:80"
      - "127.0.0.1:8080:8080"
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

Do not rename the container or the nextcloud_aio_mastercontainer volume. AIO relies on both names for lifecycle management and backups.

Start the Mastercontainer

cd /opt/nextcloud-aio
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps

Open the Private AIO Interface

On your local computer, create an SSH tunnel and leave the session open:

ssh -L 8080:127.0.0.1:8080 ubuntu@YOUR_SERVER_IP

Open https://127.0.0.1:8080 in your browser. The self-signed certificate warning on port 8080 is expected. Use the IP address, not your Nextcloud hostname, for this management interface.

Complete AIO Setup

Save the AIO passphrase in a password manager, enter cloud.example.com, and select only the optional containers you need. AIO creates the PostgreSQL, Redis, application, and web containers and obtains a public TLS certificate automatically.DNS must already resolve to the VPS, and public ports 80 and 443 must be reachable for certificate issuance and normal access.

Secure the First Login

Use the initial Nextcloud credentials shown by AIO to sign in at https://cloud.example.com. Immediately change the administrator password, set a recovery email, enable two-factor authentication, and review Administration settings → Overview for security warnings.Keep the AIO passphrase separate from the Nextcloud administrator password. Do not share either credential or expose the Docker socket through a TCP API.

Verify the Deployment

curl -fsS https://cloud.example.com/status.php
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

The status endpoint should report installed as true, and the AIO containers should remain running or healthy.

Firewall and Port Safety

Allow SSH before enabling UFW:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw enable
sudo ufw status

Port 443/udp enables HTTP/3 and is optional. Do not open 8080; it is intentionally bound to loopback. Port 8443 is unnecessary when you administer AIO through the SSH tunnel. If you enable Nextcloud Talk, also allow 3478/tcp and 3478/udp for its TURN server. Docker-published ports can bypass some UFW forwarding rules, so publish only the ports you intend to expose and verify reachability from another network.

The read-only Docker socket mount still gives the AIO mastercontainer broad control over Docker through the socket API. Use only the official AIO image, keep this deployment on a dedicated VPS, and never expose the Docker daemon remotely. Upstream documents a manual socket-free deployment, but it removes AIO management and backup features.

Persistent Data and Secrets

AIO stores the application, PostgreSQL database, configuration, and user files in Docker volumes that it manages. Do not run docker system prune --volumes, delete AIO volumes, or manually edit files inside them. Protect these recovery-critical items:

The AIO passphrase
The Borg backup encryption password
The complete Borg backup archive
Any external storage mounted through the Nextcloud External Storage app, which is not included automatically in an AIO backup

Back Up and Restore

Configure the built-in BorgBackup section in the AIO interface before uploading important data. Choose a destination with enough free space, save its encryption password outside the VPS, run the first backup, and use AIO’s integrity check. AIO backups include the database, files, and configuration required for a full restore. External storage configured through the External Storage app is excluded and needs its own backup. Copy or synchronize the Borg archive to another system using the upstream lock-file guidance so a transfer cannot race an active backup. To test recovery, create a fresh AIO deployment, choose Restore former AIO instance from backup, and supply the archive location and encryption password. A backup is not proven until a restore has completed successfully.

Update and Roll Back Safely

Use the AIO interface rather than manually updating its child containers:

Read the AIO and Nextcloud release notes.
Run and verify a complete AIO backup.
Select Stop containers.
Apply any offered mastercontainer update.
Select Start and update containers.
Verify login, file upload, sync, background jobs, and Administration settings → Overview.

AIO’s latest channel is its tested stable channel. Do not switch to beta for a production instance. If an update fails, restore the full pre-update AIO backup; manually downgrading individual containers can leave the database and application versions incompatible.

Troubleshooting

Symptom	Check
AIO cannot validate the domain	Confirm the `A` record, remove an incorrect `AAAA` record, ensure ports `80` and `443` are reachable, and temporarily disable a DNS proxy that interferes with validation.
`https://127.0.0.1:8080` does not open	Confirm the SSH tunnel is still connected and `nextcloud-aio-mastercontainer` is running. The certificate warning is expected.
The public certificate is not issued	Check DNS propagation, port conflicts, and `sudo docker logs nextcloud-aio-mastercontainer`.
A container will not start	Review it in the AIO interface, check free RAM and disk space, and inspect its logs before restarting it.
Talk calls fail	Verify both TCP and UDP port `3478`; DNS proxies and tunnels can prevent TURN from working.
Updates are unavailable after a long gap	Follow AIO’s manual-upgrade documentation rather than skipping several supported upgrade steps.

Official Resources

Nextcloud AIO Installation

Official installation, network, security, backup, and update guidance.

Nextcloud AIO Repository

Source, Compose example, security policy, and issue tracker.

Nextcloud AIO Releases

Stable release notes and upgrade information.

Server Administration Manual

Current Nextcloud administration and hardening reference.

Nextcloud is developed by Nextcloud GmbH and its community. Arct Cloud is an independent infrastructure provider and is not affiliated with, sponsored by, or endorsed by Nextcloud GmbH.

Getting Started

Virtual Machines

Migrations

Billing & Payments

Account

Self-host Nextcloud on a VPS

Choose a Plan

Before You Begin

Install Nextcloud AIO

Firewall and Port Safety

Persistent Data and Secrets

Back Up and Restore

Update and Roll Back Safely

Troubleshooting

Official Resources

Nextcloud AIO Installation

Nextcloud AIO Repository

Nextcloud AIO Releases

Server Administration Manual

​Choose a Plan

​Before You Begin

​Install Nextcloud AIO

​Firewall and Port Safety

​Persistent Data and Secrets

​Back Up and Restore

​Update and Roll Back Safely

​Troubleshooting

​Official Resources

Nextcloud AIO Installation

Nextcloud AIO Repository

Nextcloud AIO Releases

Server Administration Manual

Choose a Plan

Before You Begin

Install Nextcloud AIO

Firewall and Port Safety

Persistent Data and Secrets

Back Up and Restore

Update and Roll Back Safely

Troubleshooting

Official Resources