Hi selfhosted! Hope you’re having a good day :)
I’m pretty new to self-hosting and have been traipsing through a minefield attempting to make NextCloud AIO work inside Docker. The instance runs for a few days/weeks and then starts getting extremely slow on the website, then dies entirely. Usually, either the ClamAV or Apache containers get stuck in an unhealthy state that no number of reboots or reinstalls can fix.
Quick context for how this all works. I have one machine that runs Proxmox and a group of VMs for various purposes. One such VM runs my Nextcloud. This VM is running Ubuntu 23.10, Docker, and the NextCloud AIO package.
Another VM hosts OpenMediaVault, which contains a set of SMB Shares mounted to the host VM that act as storage for NextCloud. The symlinks (I think I’m using that word right) on the host VM have user and group permissions updated according to AIO’s documentation. Proxmox is configured to boot this VM first, then boot the rest in sequence once the files are available.
Right now I’ve got Nextcloud handling Synchronization of Files, Calendars, Contacts, and Kanban boards via the Deck Extension. Everything else can be abandoned at this point, these are the only functions I’m truly using. If this gives you an idea for an alternative app I’d love to hear it.
So after AIO broke for about the 5th time in the 8 months since I started trying to self-host it, I’ve been looking at alternatives. Before I go that route, I want to try installing Nextcloud without Docker. Some of the posts I’ve read here suggest that the Docker distribution of NextCloud has serious issues with stability and safely installing updates.
I plan to make a new VM entirely for this, Distro undecided. I still want to run it as a VM and still use my SMB shares for bulk storage.
So where would I begin if I planned to install NextCloud directly to the VM rather than through Docker?
Nextcloud AIO is not the only way to run Nextcloud in docker. For example you can use the Nextcloud docker repository and docker-compose for which there are many examples. I’ve been running Nextcloud this way for many years now without any un-recoverable issues, and no issues at all that weren’t caused by me. Upgrading is also very easy since you simply increment the version in docker-compose.yml and restart the service.
That said the NixOS suggestion from @StrawberryPigtails@lemmy.sdf.org looks really neat and I may try that out soon my self since I’ve never played with NixOS before and it seems like a good excuse to do so.
Keeping this in the back pocket in case the NixOS ideas don’t work out, thanks for sharing!
Nextcloud is just a php app. As long as you can run postgres and apache, you’re golden. How to do that depends on your distro, but usually just involves installing apache and postgres from your package manager.
Once you have apache and postgres installed, consult this page on how to run nextcloud. It’s not too hard, just copy nextcloud files to apache directory and edit some configuration file.
You don’t even need Apache, you can run it with Nginx or Caddy, all you need is a webserver that supports interactions with php-fpm.
Using apache is smoother for beginner though because nextcloud can configure some of the webserver configuration it needs by generating a .htaccess file by itself without user intervention. On nginx you might need to tweak the webserver configuration yourself every once in a while when you update nextcloud, which OP seems to hate to do.
The original appeal of the AIO package is that it handles all that for you, but I’m beginning to think this is the only way forward that doesn’t break the bank on hosting costs or break the software on update.
Sincerely appreciate your input!
One thing to watch for is file permissions. Just make sure it’s all set to
www-dataand you’re golden.This is very much what messed up my last install. Errors kept telling me that I needed to update file owners to 33:0, despite having done that on every mount point on the Ubuntu server. I even tried updating the ACLs from inside OpenMediaVault, but no dice. In hindsight I’m pretty sure that was stupid but it was already broken at that point and I was trying anything.
Some distro actually do not map
www-datauser to UID 33, so if you’re on one of those distro, changing file owner to UID 33 won’t help you. Pretty sure Ubuntu use UID 33 though, but I’ve seen people on other distros getting bitten by this. Also, some container systems can remap file ownership when mounting a volume.
Might look into running NextCloud on NixOS. Haven’t tried it myself yet but noticed NextCloud referenced in NixOS’s documentation pretty heavily. If I remember correctly it was as simple as
service.nextcloud.enable = true;
in the configuration.nix file to get it started.
Linux unplugged had an episode on it recently and said they were surprised how performative it was. Sounded like they were going to be moving their instance over to it.
There’s a little more to it, but that’s how i run it, and my experience has been considerably better, than with the docker AIO. That being said, i’m worried about the potential security implications of this running on my home network. I don’t know enough of this yet to make an educated statement
I’m just guessing myself, but I suspect it’s probably ok-ish. NextCloud is probably better security wise than most things I self host.
Follow security best practices and things should be fine.
- Don’t expose to the public net anything that doesn’t need to be.
- Keep it updated.
- Make sure it can’t see anything it doesn’t need to on your home network.
- Use strong passwords and don’t reuse them.
- Keep backups (RAID is not a backup!)
Gonna be reading into Nixos, this may be the way forward I’m looking for. Thank you both for your responses!
Join the Matrix support channel if have any problems getting started! The documentation can be very scattered and NixOS throws a lot of new concepts at you :P
in theory it should be somewhat more responsive because there’s no sandboxing or containerization going on, nix operates with tools that are much more straightforward
If you’re willing to use snaps, the next cloud snap is pretty great and easy to set up.
I’m not a fan of snaps nor how canonical push them, but this one gets a pass
Can confirm, I’ve been using it for about three years now. With some minimal tweaks for my own us case.
It auto updates itself, can use LetsEncrypt. I’ve had an A to A+ rating from their own security thing. It does usually stay a few minor point releases behind, but that’s never been an issue for me.
Trying not to learn another deployment scheme, but keeping this on the list. Thank you for sharing!
Here’s the documentation páge I remember
I‘m running a stack of containers for nc and it runs without issue. Not saying your experience is invalid but stuff breaks and usually, the solution is either reading or posting issues for the community to fix them. NC has a giant forum which also is helpful. Good luck to you though. :)
If this gives you an idea for an alternative app I’d love to hear it.
I don’t have any direct experiences with kanban, but I ditched nc because I found that no-one used the web UI and it was just a complex file, calendar and contact sync. Replacing nc with syncthing and radicale made no impact to the users and saved me a whole heap of misery upgrading and maintaining nc. If those can support your kanban needs, then… just sayin’…
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System Git Popular version control system, primarily for code HTTP Hypertext Transfer Protocol, the Web LAMP Linux-Apache-MySQL-PHP stack for webhosting LXC Linux Containers NFS Network File System, a Unix-based file-sharing protocol known for performance and efficiency PiHole Network-wide ad-blocker (DNS sinkhole) RAID Redundant Array of Independent Disks for mass storage SMB Server Message Block protocol for file and printer sharing; Windows-native SSH Secure Shell for remote terminal access nginx Popular HTTP server
[Thread #650 for this sub, first seen 1st Apr 2024, 22:35] [FAQ] [Full list] [Contact] [Source code]
I did it from scratch following a guide from Linux Magazine from a few months ago. I had to do some modifying and it was a lot of work, but it runs pretty seamlessly now, so the effort was worth it. I’ll see if I can find it and tell you which month’s issue it was in.
You got me thinking, so I did a search and ran across this page: https://www.hanssonit.se/nextcloud-vm/ I’m not sure how old these releases are, but at the very least it might provide some hints for building your own? I’m going to keep looking to see if I can find an image built on Debian, but at least now I know some options are out there.
[Edit] I also ran across across this page which builds a VM for you using an Ubuntu machine, so I’m guessing I could probably adjust it to a Debian setup fairly easily. https://github.com/nextcloud/vm
Yunohost.
If you’re going to start from the default Nextcloud instead of AIO you might as well try it on docker. Setting it up is easy regardless, but if you don’t install it using docker keeping it up to date is a pain in the ass.
How are you running Docker on your Ubuntu host? I had weird errors happening and realized that while I had installed Docker manually using the convenience script, at some point the Snap version got installed and that was a mess.
Switched to Debian, docker installed with convenience script, Nextcloud AIO has worked like a top since. All running as a VM on Proxmox as well, the host runs dozens of containers including a mailcow instance and several other stack beside the AIO, zero issues. I snapshot the VM before I do anything major like update NC so I can rollback easily. I might lose a few emails if I had to roll back, but never had to. Besides, everything is backed up via PBS hourly, so if I had to restore just the NC stack, that wouldn’t be hard.
I would also do the storage for NC locally, you can mount another dataset/virtual drive into the instance, but using Openmediavault Samba shares for your data store seems like a recipe for disaster. Samba on Linux is a convenience for interoperability with Windows, but using it as a backend for an app as complicated as NC is really not going to end well. I’m surprised you get it to work for more than a few hours, and I could see it losing data so easily.
I’ve only ever used the official repositories, basically followed the install documentation to get the letter. I do management of it through Portainer but that’s just a convenience for testing. Once I got the Compose file just right I’d docker up -d inside the folder on the VMs main drive.
The actual files were saved to a mounted SMB share, and I’m not sure if it’s related or not but I also had a media folder mounted as SMB and configured to be shared as External Storage within Nextcloud itself. I keep wondering if the database isn’t killing itself trying to read everything in there…
Yah, I just don’t think the SMB subsystem is robust enough to be used for that purpose. I can see pulling a few files on and off, but expecting the PHP backend to work with it to manage file locks etc on SMB is probably optimistic. Plus because docker is involved, I believe overlayfs would be involved there, unless it’s a bind mount. Then you have a layer between OMV managing the communication between it’s underlying filesystem to the samba server it implements. I’m really not 100% sure what the pipeline to the actual files would look like. But it seems horrendous.
I’d really just try it stock before you throw that baby out, because I’ve run NC every way you can possibly imagine since about V.8, and I’ve not had so little problems with it as with using the AIO. It’s head and shoulders above straight installation, somewhat better than NC-Pi. Snap was by far the worst for management and upgrade. And I would avoid Ubuntu as the host system, because I have no idea how docker snap got installed, but I don’t trust that it wouldn’t happen again. I sure as hell didn’t install the snap version, but there it was.
Also, with the AIO, I would avoid managing anything outside the interface of the master container, like by using portainer on the child containers.
I was really just using SMB for convenience sake, one less protocol for me to turn on and configure. I initially thought about NFS but when I realized how little I know about actually securing NFS I decided against it. Though, I suppose that’s led me to this point here.
Trying it stock is exactly what I was thinking, though what folks have said about NixOS makes me think that’s going to be the first thing I try.
Very first experience was NC-Pi, right before that project got canned. Loved it so much I spent a couple hundred on shared hosting and set v24 up there, but I’ve been trying to move to my homelab because A) One less bill B) I can use the 72TB RAID Array for storage instead of the 30GB storage I paid way too much for.
Honestly have had great experiences with Portainer so far, with Nextcloud being the only real exception. PiHole, Dashy, an introducer for Syncthing, and StashApp all run without a hitch via Compose files dropped into Portainer. Though I am definitely going to take Docker out of the picture for the next NC install which means taking Portainer out as well.
What’s really neat to do in Portainer is set up your compose stack off a git repo and set the webhook so it fires a pull and restart on the new docker-compose.yml when you update it in git.
I don’t use Portainer much anymore, I do my compose files manually with bind mounts locally to the compose file, and if I want an interface for the docker service, I run Lazydocker on the machine over SSH.
I’m running Nextcloud from a Turnkey LXC template that’s available in Proxmox. Runs solid, I have no complaints for performance or stability. But upgrades are manual and very involved. It’s not too complicated, but there is always something that needs extra attention or troubleshooting. I also wasn’t able to figure out Turnkey migration toolset that they suggest to use for major upgrades, such as to new version of OS.
I tried that first, actually. Gave up on it, perhaps too quickly. I’ll give it another peek.
Thanks for sharing!
