Nextcloud AIO: Going Deeper

Chapter 12 of Be Your Own Cloud explains why the book uses Nextcloud All-in-One, and why its compose file sets reverse-proxy mode and skips domain validation. This page is the sequence of clicks that follows, plus the two things you’ll want straight after: AIO’s own backup, and your calendar on your phone.

Nextcloud is the heaviest service in the book. On a Raspberry Pi it will run, slowly; on Chapter 2’s used mini PC it’s comfortable.

Before the first start

Create the service folder and the data folder on bulk storage. The data folder has to exist before AIO starts for the first time, because AIO won’t move your files later:

mkdir -p /opt/stacks/nextcloud
sudo mkdir -p /mnt/media/nextcloud-data
cd /opt/stacks/nextcloud

The compose file:

services:
  nextcloud-aio-mastercontainer:
    # the one deliberate :latest in this book -- see below
    image: ghcr.io/nextcloud-releases/all-in-one:latest
    container_name: nextcloud-aio-mastercontainer
    restart: unless-stopped
    ports:
      - '8080:8080'   # AIO's own setup wizard -- one-time use
    environment:
      # reverse-proxy mode: NPM forwards here
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=0.0.0.0
      # files on bulk storage (Chapter 7)
      - NEXTCLOUD_DATADIR=/mnt/media/nextcloud-data
      # your subdomain is LAN-only -- see below
      - SKIP_DOMAIN_VALIDATION=true
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

Start the mastercontainer:

docker compose up -d
docker compose logs -f

This one container starts AIO’s management interface. It will start Nextcloud’s own containers (the app, its database, Redis and more) later, when you tell it to from the wizard.

The proxy host first

Add the proxy host before running the wizard, so the domain works the moment the wizard finishes. In Nginx Proxy Manager:

Unlike Vaultwarden, the forward host is the server’s IP rather than a container name. AIO starts its Apache container on its own network, not on proxy, and publishes it on the host’s port 11000 instead — that’s what APACHE_PORT=11000 and APACHE_IP_BINDING=0.0.0.0 in the compose file do.

Large uploads through the proxy also need the upload limit lifted. On the same proxy host, the Advanced tab — in Nginx Proxy Manager 2.16, the gear icon at the right-hand end of the tabs:

client_max_body_size 0;
proxy_read_timeout 3610s;

These are the two lines AIO’s guide gives for Nginx Proxy Manager. 0 lifts the upload limit entirely; the timeout is ten seconds longer than Nextcloud’s own one-hour limit, so Nextcloud always times out first, not the proxy.

The setup wizard

Open https://192.168.1.50:8080 from a machine at home. Your browser will warn about the certificate — AIO uses a self-signed one for this interface, and it’s expected here, on your own network. Then:

1. AIO shows a passphrase. Save it in Vaultwarden now. It’s the only way back into this interface.
2. Enter your domain: nextcloud.home.yourdomain.com.
3. Choose optional containers. On modest hardware, leave the heavier ones (ClamAV, full-text search) off; you can add them later. Nextcloud Talk needs ports open to the internet to work outside your house, which this book avoids — leave it off unless you know you want it.
4. Set your timezone and start the containers. The first start downloads several images and takes a while.
5. When it finishes, AIO shows the initial admin password for Nextcloud. Save that too.

Then log in at https://nextcloud.home.yourdomain.com.

Port 8080 stays: it’s how you’ll reach AIO’s interface for updates and backups. It’s only reachable on your own network — never forward it on your router.

Turn on AIO’s backup

Chapter 18 notes that Restic backs up your files in /mnt/media/nextcloud-data, but Nextcloud’s database lives inside AIO’s Docker volumes, and AIO’s built-in backup is how that gets covered.

In AIO’s interface (https://192.168.1.50:8080), under Backup and restore:

1. Set a backup location on the host. The external drive from Chapter 18 is a good home: for example /mnt/backup/nextcloud-aio.
2. AIO generates an encryption password for the backup. Save it in Vaultwarden — without it the backup can’t be restored.
3. Create the first backup, then turn on the daily automatic backup.

AIO’s backup covers the database and configuration; your files are backed up twice then, once by AIO and once by Restic. That’s fine.

Calendar and contacts on your phone

Install Calendar and Contacts from Apps in Nextcloud (Chapter 12 explains why these matter).

• iPhone or iPad: Settings → Apps → Calendar → Calendar Accounts → Add Account → Other → Add CalDAV Account. Server: nextcloud.home.yourdomain.com, with your Nextcloud username and an app password (Nextcloud Settings → Security → Devices & sessions → Create new app password). Repeat with Add CardDAV Account for contacts.
• Android: use the free DAVx⁵ app with the base URL https://nextcloud.home.yourdomain.com/remote.php/dav, then choose which calendars and address books to sync.

An app password per device means you can revoke a lost phone without changing your main password.

Updating

AIO is the book’s one deliberate :latest, and Chapter 12 explains why. Updates happen in AIO’s interface, not with docker compose pull: it tells you when a new version is available, you read the notes, stop the containers, and it updates the mastercontainer and then everything under it as a matched set. Take a backup from the same page first.

Official documentation

• Nextcloud All-in-One — especially its reverse proxy guide
• Nextcloud user manual — including syncing calendars and contacts
• DAVx⁵ for Android

Stuck on a step? Get in touch.