Making The Cloud Your Own Computer
When it comes to cloud storage, there is little guarantee of your files being private from the server admin.
Nextcloud does allow end-to-end-encryption (E2EE), which allows this, but it is opt-in - the server admin must first enable the integration, then the user must select it for every folder they intend to keep private, on every client simultaneously. Further, the convenient web interface cannot decrypt E2E-encrypted files, so that is a real downside, and it is intended only for your most sensitive files.
Apps like Cryptomator are a viable replacement for servers that don't implement E2EE, but the app for mobile phones is read-only without payment.
Options For Self-Hosting Nextcloud
The community-maintained Snap package is the simplest to install and manage, but tends to be inaccessible intermittently. Snap packages are also very bloaty, taking up a lot of storage space and RAM.
The suggested option is an All-In-One (AIO) Docker Container cluster, which is a bit of a pain to install and manage. In terms of performance, it seems to run lighter on resources while also being reliable.
The ultimate option is the archive installation, where you download the core software and manage all the dependencies yourself. I judged this to be way beyond my skill level, and if it is within yours, please find a better blog to follow than mine.
Installing Nextcloud AIO
Reverse Proxy Configuration
If you intend to run multiple server software on the same server hardware, you will need to set up a reverse proxy, which can act as a traffic cop to direct each request to the right port.
- First, choose a domain name to access your cloud at. It is
cloud.allsparkinfinite.name for me. Set up any DNS entries and localhost tunnels needed to ensure that the address points to the machine where you're installing Nextcloud. Typing the address in your browser, you should get an error page served up by your web server, since it does not know what to do with requests on that domain name.
- Next, shut off your reverse proxy. As I was using NGINX, I ran
sudo systemctl stop nginx to free up the ports 80 and 443 temporarily - all network communication happens on these ports.
- Install certbot. To set up certificate renewal, you will also need to install the certbot plugin needed for your web server. On an Ubuntu system with an NGINX web server, I had to run
sudo apt-get install certbot python3-certbot-nginx.
- Get the certificates for your desired domain name by running
sudo certbot certonly (ports 80 and 443 are needed to generate certificates, and they can only be accessed by superuser). Select the option that starts with "Run an HTTP server locally...", and then enter the domain name on the next step. The certificates should then be generated and stored in your computer.
- Add a new reverse proxy config in
/etc/nginx/sites-enabled as laid out here. The provided configs contain a placeholder for your domain name in various places, which you will need to swap out. For example, the NGINX sample configuration has a line server_name <your-nc-domain>;, which I swapped out with server_name cloud.allsparkinfinite.name;, and I made the same substitution in a couple of more places too. One of the lines also had a comment (any text starting with a # symbol and running till the end of the line, which is ignored when the config is being read) with a curl command. Running the provided command downloaded a required file to a location where the NGINX config file could read it. Also make sure to check your web server version (nginx --version for me) and comment/uncomment any lines that mention which version accepts those lines. You may also adjust the apache port if you wish, but the defaults work fine.
- Restart your web server and keep an eye on the logs for any errors. For NGNIX, you would run
sudo systemctl start nginx and sudo systemctl status nginx respectively.