> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arct.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-host Nextcloud on a VPS

> Deploy Nextcloud All-in-One on an Ubuntu VPS with automatic HTTPS, private administration, backups, and safe updates.

Arct Cloud provides the unmanaged Linux VPS for this deployment. Nextcloud is not preinstalled or managed by Arct Cloud. You are responsible for the application, user data, access controls, backups, and updates.

<Warning>
  A synced copy is not a backup. Keep encrypted, tested backups outside the VPS before storing important files in Nextcloud.
</Warning>

## Choose a Plan

Nextcloud AIO's [upstream resource guidance](https://github.com/nextcloud/all-in-one/discussions/1335) reports a minimum of 2 CPU cores, 2 GB RAM, and 40 GB system storage when any optional container is enabled. Some optional services require at least 3 GB RAM; enabling the full set requires at least 4 cores and 5 GB RAM, with 1 GB additional RAM recommended by upstream.

| Profile                                           | vCPU |  RAM |  NVMe storage | Guidance                                                |
| ------------------------------------------------- | ---: | ---: | ------------: | ------------------------------------------------------- |
| **Official AIO minimum with optional containers** |    2 | 2 GB |         40 GB | A technical floor, not a sizing recommendation          |
| **Practical Arct starting point**                 |    4 | 8 GB | 75 GB or more | Small teams with room for previews and selected add-ons |

Your file library, previews, versions, trash, and backups determine storage needs. Size the disk for growth rather than only the initial upload.

## Before You Begin

Prepare the following:

* A fresh Ubuntu 24.04 server
* A dedicated hostname such as `cloud.example.com`
* An `A` record pointing the hostname to the server's public IPv4 address
* Docker Engine with the Docker Compose plugin, installed from Docker's [official Ubuntu repository](https://docs.docker.com/engine/install/ubuntu/)
* An off-server destination for encrypted backups

Remove a stale `AAAA` record unless IPv6 is configured and reachable. The standard AIO setup expects its own ports and should run on a VPS without another web server or reverse proxy.

## Install Nextcloud AIO

Nextcloud All-in-One is the official deployment method. The Compose configuration below follows the upstream production layout and binds the AIO management interface to loopback so it is reachable only through an SSH tunnel.

<Steps>
  <Step title="Deploy and Connect">
    [Deploy an Ubuntu server](/compute/virtual-machines/deploy), then [connect over SSH](/compute/virtual-machines/connect-ssh).
  </Step>

  <Step title="Verify Docker">
    Install Docker Engine and Compose from the official Docker repository, not the Ubuntu Snap package. Then verify both components:

    ```bash theme={null}
    sudo docker version
    sudo docker compose version
    sudo docker info | grep "Docker Root Dir"
    ```

    Stop if the last command shows `/var/snap/docker/`; Snap-based Docker is not supported by Nextcloud AIO.
  </Step>

  <Step title="Create the Compose Project">
    ```bash theme={null}
    sudo install -d -m 0750 -o "$USER" -g "$USER" /opt/nextcloud-aio
    cd /opt/nextcloud-aio
    ```

    Create `/opt/nextcloud-aio/compose.yaml` with the following content:

    ```yaml compose.yaml theme={null}
    name: nextcloud-aio

    services:
      nextcloud-aio-mastercontainer:
        image: ghcr.io/nextcloud-releases/all-in-one:latest
        init: true
        restart: always
        container_name: nextcloud-aio-mastercontainer
        network_mode: bridge
        ports:
          - "80:80"
          - "127.0.0.1:8080:8080"
        volumes:
          - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
          - /var/run/docker.sock:/var/run/docker.sock:ro

    volumes:
      nextcloud_aio_mastercontainer:
        name: nextcloud_aio_mastercontainer
    ```

    Do not rename the container or the `nextcloud_aio_mastercontainer` volume. AIO relies on both names for lifecycle management and backups.
  </Step>

  <Step title="Start the Mastercontainer">
    ```bash theme={null}
    cd /opt/nextcloud-aio
    sudo docker compose pull
    sudo docker compose up -d
    sudo docker compose ps
    ```
  </Step>

  <Step title="Open the Private AIO Interface">
    On your local computer, create an SSH tunnel and leave the session open:

    ```bash theme={null}
    ssh -L 8080:127.0.0.1:8080 ubuntu@YOUR_SERVER_IP
    ```

    Open `https://127.0.0.1:8080` in your browser. The self-signed certificate warning on port `8080` is expected. Use the IP address, not your Nextcloud hostname, for this management interface.
  </Step>

  <Step title="Complete AIO Setup">
    Save the AIO passphrase in a password manager, enter `cloud.example.com`, and select only the optional containers you need. AIO creates the PostgreSQL, Redis, application, and web containers and obtains a public TLS certificate automatically.

    DNS must already resolve to the VPS, and public ports `80` and `443` must be reachable for certificate issuance and normal access.
  </Step>

  <Step title="Secure the First Login">
    Use the initial Nextcloud credentials shown by AIO to sign in at `https://cloud.example.com`. Immediately change the administrator password, set a recovery email, enable two-factor authentication, and review **Administration settings → Overview** for security warnings.

    Keep the AIO passphrase separate from the Nextcloud administrator password. Do not share either credential or expose the Docker socket through a TCP API.
  </Step>

  <Step title="Verify the Deployment">
    ```bash theme={null}
    curl -fsS https://cloud.example.com/status.php
    sudo docker ps --format 'table {{.Names}}\t{{.Status}}'
    ```

    The status endpoint should report `installed` as `true`, and the AIO containers should remain running or healthy.
  </Step>
</Steps>

## Firewall and Port Safety

Allow SSH before enabling UFW:

```bash theme={null}
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw enable
sudo ufw status
```

Port `443/udp` enables HTTP/3 and is optional. Do not open `8080`; it is intentionally bound to loopback. Port `8443` is unnecessary when you administer AIO through the SSH tunnel.

If you enable Nextcloud Talk, also allow `3478/tcp` and `3478/udp` for its TURN server. Docker-published ports can bypass some UFW forwarding rules, so publish only the ports you intend to expose and verify reachability from another network.

<Warning>
  The read-only Docker socket mount still gives the AIO mastercontainer broad control over Docker through the socket API. Use only the official AIO image, keep this deployment on a dedicated VPS, and never expose the Docker daemon remotely. Upstream documents a manual socket-free deployment, but it removes AIO management and backup features.
</Warning>

## Persistent Data and Secrets

AIO stores the application, PostgreSQL database, configuration, and user files in Docker volumes that it manages. Do not run `docker system prune --volumes`, delete AIO volumes, or manually edit files inside them.

Protect these recovery-critical items:

* The AIO passphrase
* The Borg backup encryption password
* The complete Borg backup archive
* Any external storage mounted through the Nextcloud External Storage app, which is not included automatically in an AIO backup

## Back Up and Restore

Configure the built-in BorgBackup section in the AIO interface before uploading important data. Choose a destination with enough free space, save its encryption password outside the VPS, run the first backup, and use AIO's integrity check.

AIO backups include the database, files, and configuration required for a full restore. External storage configured through the External Storage app is excluded and needs its own backup. Copy or synchronize the Borg archive to another system using the [upstream lock-file guidance](https://github.com/nextcloud/all-in-one#sync-local-backups-regularly-to-another-drive) so a transfer cannot race an active backup.

To test recovery, create a fresh AIO deployment, choose **Restore former AIO instance from backup**, and supply the archive location and encryption password. A backup is not proven until a restore has completed successfully.

## Update and Roll Back Safely

Use the AIO interface rather than manually updating its child containers:

1. Read the AIO and Nextcloud release notes.
2. Run and verify a complete AIO backup.
3. Select **Stop containers**.
4. Apply any offered mastercontainer update.
5. Select **Start and update containers**.
6. Verify login, file upload, sync, background jobs, and **Administration settings → Overview**.

AIO's `latest` channel is its tested stable channel. Do not switch to `beta` for a production instance. If an update fails, restore the full pre-update AIO backup; manually downgrading individual containers can leave the database and application versions incompatible.

## Troubleshooting

| Symptom                                  | Check                                                                                                                                                                      |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AIO cannot validate the domain           | Confirm the `A` record, remove an incorrect `AAAA` record, ensure ports `80` and `443` are reachable, and temporarily disable a DNS proxy that interferes with validation. |
| `https://127.0.0.1:8080` does not open   | Confirm the SSH tunnel is still connected and `nextcloud-aio-mastercontainer` is running. The certificate warning is expected.                                             |
| The public certificate is not issued     | Check DNS propagation, port conflicts, and `sudo docker logs nextcloud-aio-mastercontainer`.                                                                               |
| A container will not start               | Review it in the AIO interface, check free RAM and disk space, and inspect its logs before restarting it.                                                                  |
| Talk calls fail                          | Verify both TCP and UDP port `3478`; DNS proxies and tunnels can prevent TURN from working.                                                                                |
| Updates are unavailable after a long gap | Follow AIO's manual-upgrade documentation rather than skipping several supported upgrade steps.                                                                            |

## Official Resources

<CardGroup cols={2}>
  <Card title="Nextcloud AIO Installation" icon="book-open" href="https://github.com/nextcloud/all-in-one#how-to-use-this">
    Official installation, network, security, backup, and update guidance.
  </Card>

  <Card title="Nextcloud AIO Repository" icon="github" href="https://github.com/nextcloud/all-in-one">
    Source, Compose example, security policy, and issue tracker.
  </Card>

  <Card title="Nextcloud AIO Releases" icon="clock-rotate-left" href="https://github.com/nextcloud/all-in-one/releases">
    Stable release notes and upgrade information.
  </Card>

  <Card title="Server Administration Manual" icon="server" href="https://docs.nextcloud.com/server/stable/admin_manual/">
    Current Nextcloud administration and hardening reference.
  </Card>
</CardGroup>

<Note>Nextcloud is developed by Nextcloud GmbH and its community. Arct Cloud is an independent infrastructure provider and is not affiliated with, sponsored by, or endorsed by Nextcloud GmbH.</Note>