Nextcloud: my own Dropbox and Google Drive

Nextcloud is my replacement for Dropbox and Google Drive: file sync and sharing, running on my own server, with the files stored on my own disks.

What Nextcloud gives you

• Desktop sync clients for Windows, macOS and Linux, and mobile apps for Android and iOS
• Sharing links with passwords and expiry dates
• Optional apps for calendars, contacts, notes, tasks, photos and office documents
• No storage plan to pay for: the limit is your hard drive

My setup

Nextcloud runs as four containers: the app, a MariaDB database, Redis for caching and file locking, and a cron container for background jobs. My compose file looks like this (passwords removed):

services:
  db:
    image: mariadb:10.11
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
    environment:
      - MARIADB_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_PASSWORD=change-me
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
    labels:
      - com.centurylinklabs.watchtower.monitor-only=true

  redis:
    image: redis:alpine
    restart: always

  app:
    image: nextcloud:apache
    restart: always
    ports:
      - "8080:80"
    volumes:
      - /media/ExtStorage/nextcloud:/var/www/html/data
      - nextcloud:/var/www/html
    environment:
      - MYSQL_PASSWORD=change-me
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db
      - REDIS_HOST=redis
      - TRUSTED_PROXIES=192.168.0.10
      - OVERWRITEPROTOCOL=https
      - OVERWRITEHOST=nextcloud.example.com
    depends_on:
      - db
      - redis

  cron:
    image: nextcloud:apache
    restart: always
    volumes:
      - nextcloud:/var/www/html:z
    entrypoint: /cron.sh
    depends_on:
      - db
      - redis

volumes:
  nextcloud:
  db:

A few choices worth explaining:

• Data on a big disk. The app lives in a Docker volume, but the actual files (/var/www/html/data) are on my large external storage drive.
• Database settings. READ-COMMITTED and row-based binary logging are what Nextcloud recommends for MariaDB.
• The cron container runs Nextcloud’s background jobs every five minutes. Set Background jobs to Cron in the admin settings so Nextcloud uses it.
• Behind a reverse proxy. OVERWRITEPROTOCOL and OVERWRITEHOST tell Nextcloud its public address is HTTPS. TRUSTED_PROXIES must be the IP address of your reverse proxy. Get it wrong and Nextcloud thinks every visitor is the proxy, which confuses its brute-force protection.
• Watchtower monitor-only on the database, so I’m told about updates but apply them myself.

Useful commands

Nextcloud’s admin tool, occ, runs inside the app container as the web server user:

docker exec -u www-data nextcloud-app-1 php occ status
docker exec -u www-data nextcloud-app-1 php occ files:scan --all
docker exec -u www-data nextcloud-app-1 php occ db:add-missing-indices

Tips

• Check Administration settings → Overview after every update. Nextcloud lists exactly what it wants fixed.
• Update one major version at a time. Nextcloud can’t skip major versions, so don’t jump from, say, 28 to 30 in one go.
• Put it behind Nginx Proxy Manager with HTTPS, and set a sensible upload size limit in the proxy for big files.
• Back up both the data folder and the database. See my backup plan.