Deployment guide

Nextcloud

Overview

Nextcloud is a popular open-source content-collaboration platform. It provides file sync and share, calendar, contacts, collaborative documents and a rich app ecosystem, all self-hosted inside your own Azure VNet for data residency and compliance.

The SecureAnyCloud image installs Nextcloud 30.0.14 (AGPL-3.0), served by nginx and PHP 8.3-FPM. It is backed by a local PostgreSQL 16 database and by Redis for file locking and caching. The Nextcloud data directory and the PostgreSQL datadir both live on a dedicated 60 GiB Azure data disk. The image generates a unique admin password and database password on the first boot of every VM, and SecureAnyCloud backs it with 24/7 support.

What you get:

Nextcloud 30.0.14 (web root /var/www/nextcloud), served by nginx on :80
PHP 8.3-FPM with every extension that Nextcloud requires (gd, curl, mbstring, intl, bcmath, gmp, imagick, apcu, pdo_pgsql, zip, exif, bz2)
A local PostgreSQL 16 database and Redis for the distributed and file-locking cache
A dedicated Azure data disk at /var/lib/nextcloud, which holds both the Nextcloud data/ directory and the PostgreSQL datadir
A per-VM admin account and database password, generated on first boot and recorded in a root-only file
nginx.service, php8.3-fpm.service, postgresql.service and redis-server.service as enabled systemd units, plus a 5-minute background-jobs timer
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point. Configure the NSG to allow inbound 22/tcp from your management network and 80/tcp for the web interface.

Nextcloud serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain and a certificate (for example with certbot).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nextcloud by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated 60 GiB data disk on the Disks tab. Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nextcloud-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name nextcloud \
  --image sac1647283583153:nextcloud-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nextcloud --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The web tier, PHP runtime, database and cache all run as systemd units:

systemctl is-active nginx.service php8.3-fpm.service postgresql.service redis-server.service

Each line reports active. On first boot, the VM rotates the Nextcloud admin password and the database password to values unique to your instance.

Step 5 - Confirm the health endpoint

nginx serves an unauthenticated health probe, separate from the Nextcloud web root, which redirects to the sign-in page:

curl -s http://localhost/health

It returns ok.

Step 6 - Confirm Nextcloud is installed and healthy

Nextcloud's status.php endpoint reports the install state and version without requiring a login:

curl -s http://localhost/status.php

The JSON response contains "installed":true and "version":"30.0.14...".

Step 7 - Retrieve your admin password

The first boot of your VM generates a unique admin password and database password and writes them to a root-only file:

sudo cat /root/nextcloud-credentials.txt

This file contains NEXTCLOUD_ADMIN_USER (admin), NEXTCLOUD_ADMIN_PASSWORD, and the database name, user and password. Store the admin password somewhere safe.

Trust your VM's public address

First boot adds the address that Azure reports to Nextcloud's trusted domains. With a Standard SKU public IP (the Azure default, and the --public-ip-sku Standard in Step 2), the current image finds only the VM's private address (10.0.0.x). A browser at the public IP then shows Nextcloud's Access through untrusted domain page instead of the sign-in page. Check the list:

sudo -u www-data php /var/www/nextcloud/occ config:system:get trusted_domains

If the list holds only localhost, 127.0.0.1 and a 10. address, add the public IP on the VM. Azure's instance metadata service reports the public IP to the VM itself, and nothing leaves the VM:

PUBLIC_IP=$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/loadbalancer?api-version=2020-10-01' | grep -o '"frontendIpAddress":"[^"]*"' | head -1 | cut -d'"' -f4)
PRIV=$(hostname -I | awk '{print $1}'); echo "public $PUBLIC_IP, private $PRIV"
sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value "$PUBLIC_IP"
sudo -u www-data php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value "http://$PUBLIC_IP/"
sudo sed -i "s/\b$PRIV\b/$PUBLIC_IP/g; s/<ip>/$PUBLIC_IP/g" /root/nextcloud-credentials.txt

The change applies at once and survives reboots. The private address stays trusted too. Add a DNS name with the trusted_domains 3 command below.

Step 8 - Sign in to the web interface

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 7. On first boot, the image adds the VM's detected public and private IPv4 addresses to Nextcloud's trusted domains, so you can reach it immediately on the VM's public IP.

If you front the instance with your own DNS name and see an "access through untrusted domain" page, add the name to the allowlist once with:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 3 --value your.domain.com

This host-header allowlist is a deliberate security control, and the image does not use a wildcard.

After you sign in, you land in the Files app, where you upload, organise and share files and folders. The left rail gives quick access to Recent, Favorites, Shares and Tags.

The Administration settings give you a system overview, security and setup warnings, background-jobs mode, logging and more.

The Apps area is where you enable, disable and update Nextcloud apps, including calendar, contacts, collaborative editing, and hundreds more from the app store.

Step 9 - Confirm the version from the command line

The occ command-line tool manages Nextcloud from the shell. Confirm the running version:

sudo -u www-data php /var/www/nextcloud/occ status

It prints installed: true and versionstring: 30.0.14.

Step 10 - Verify authentication over the API

Nextcloud's OCS user endpoint rejects unauthenticated requests and accepts your per-VM admin password. An unauthenticated request returns HTTP 401:

curl -s -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' http://localhost/ocs/v2.php/cloud/user

To prove end-to-end authentication, read your admin password from /root/nextcloud-credentials.txt (Step 7) and run this command from a shell: curl -u admin:<password> -H 'OCS-APIRequest: true' http://<vm-public-ip>/ocs/v2.php/cloud/user. It returns HTTP 200 with your user record as XML. A wrong password returns 401.

Step 11 - Confirm where your data and database live

Both the Nextcloud data directory and the PostgreSQL datadir sit on the dedicated Azure data disk. You can grow or snapshot them independently of the OS disk:

df -h /var/lib/nextcloud | tail -1

The mount /var/lib/nextcloud holds data/ (user files) and pgsql/main (the PostgreSQL cluster).

Step 12 - Maintenance

Admin CLI: run any management command with sudo -u www-data php /var/www/nextcloud/occ <command> (for example occ user:list or occ app:list).
Background jobs: a systemd timer runs cron.php every 5 minutes, which is Nextcloud's recommended mode. No action is needed.
TLS: put a reverse proxy or certbot in front of port 80 with your own domain before you expose the instance to the internet.
Backups: back up /var/lib/nextcloud/data, the PostgreSQL database, and /var/www/nextcloud/config/config.php.
Updates: unattended-upgrades applies OS security updates automatically. Upgrade Nextcloud itself with its built-in updater or occ.

Support

SecureAnyCloud maintains this image and provides 24/7 support. Contact sales@secureanycloud.com for assistance.

Deploy on Azure

Launch Nextcloud on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Nextcloud is a popular open-source content-collaboration platform for file sync and share, calendar, contacts and collaborative documents. This image runs Nextcloud behind nginx, with PHP-FPM 8.3 and OPcache enabled. It is ready to use on first boot, with no manual setup.

MariaDB provides the database, and Redis provides distributed caching and transactional file locking. Both run on the same instance and are bound to the loopback interface only. Nextcloud's background jobs run every five minutes through a systemd timer in cron mode, the configuration that Nextcloud recommends for production.

What you get:

Nextcloud behind nginx, with PHP-FPM 8.3 and OPcache enabled
MariaDB and Redis on the same instance, bound to the loopback interface only
Per-instance Nextcloud administrator and MariaDB credentials, generated on the first boot of every deployed instance. Two instances launched from the same Amazon Machine Image never share passwords. The initial administrator password and the MariaDB password are written to /root/nextcloud-credentials.txt with mode 0600, so that only the root user can read them.
The Nextcloud application code under /var/www/nextcloud and user data under /var/www/nextcloud/data, on a dedicated EBS volume separate from the operating system disk
The MariaDB data directory at /var/lib/mysql, on its own EBS volume. You can resize each tier independently of the others.
A systemd timer that runs Nextcloud's background jobs every five minutes in cron mode

Prerequisites

Before you deploy this image, make sure that you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks that your users will reach Nextcloud on
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Nextcloud. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. The Nextcloud workload is PHP, MariaDB and Redis heavy, and file operations benefit from memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks that your users use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud Nextcloud Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80, and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=nextcloud-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve Initial Credentials

Connect over SSH with the key pair that you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant that you launched. For the Nextcloud 33 on Ubuntu 24.04 variant, the login user is ubuntu.

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/nextcloud-credentials.txt

The file is plain text. It contains the Nextcloud URL, the administrator username (admin), the administrator password, and the MariaDB database name, user, and password. Copy these values somewhere secure, such as a password manager or encrypted vault. Do not commit them to source control.

From the same SSH session, you can confirm that the deployment is healthy. The status endpoint is open and returns JSON:

curl -fsS http://127.0.0.1/status.php

{"installed":true,"maintenance":false,"needsDbUpgrade":false,"version":"33.0.5.1","versionstring":"33.0.5","edition":"","productname":"Nextcloud","extendedSupport":false}

An "installed":true response with a 33.x version confirms that the full stack (nginx, PHP, MariaDB and Redis) is serving Nextcloud.

Trusted Domains

Nextcloud answers only requests whose Host header is listed in its trusted_domains configuration. Any other host receives an "access through untrusted domain" page.

The image ships localhost and 127.0.0.1 as trusted. On first boot, the instance's own public and private IPv4 addresses are added automatically, so the site works immediately on its launch address.

When you put Nextcloud behind a custom domain name or a load balancer, add that hostname to the trusted domains list. From an SSH session, run:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value <your-domain>

List the current trusted domains at any time with sudo -u www-data php /var/www/nextcloud/occ config:system:get trusted_domains.

First Login to the Nextcloud Web Interface

Open a web browser and go to http://<public-ip>/. Nextcloud presents its sign-in page. Enter the administrator username (admin) and the administrator password from /root/nextcloud-credentials.txt, then select the arrow to log in.

On first sign-in, Nextcloud shows a short welcome dialog with links to the desktop and mobile apps. Close it to reach the Files view, which is the heart of the platform. Here you upload, organise, share and synchronise files and folders.

Change the Administrator Password

For a production deployment, rotate the administrator password that was generated on first boot. Select your avatar at the top right, choose Settings, then Security, and use the password change controls.

In Personal information, set a real email address on the account so that password recovery and system notifications reach you.

You can also reset the administrator password from the command line. Either run sudo -u www-data php /var/www/nextcloud/occ user:resetpassword admin interactively and type the new password when prompted, or set it non-interactively from an environment variable:

OC_PASS='<new-password>'
sudo -u www-data php /var/www/nextcloud/occ user:resetpassword --password-from-env admin

Create Users and Groups

Open the avatar menu and choose Administration settings, then Users. Select New user to create an account. Set a display name, password and email, and optionally assign the user to one or more groups and set a storage quota.

Groups let you target shares and apply quotas to teams. The Users screen is also where you disable or remove accounts.

Install Apps

Apps extend Nextcloud's functionality. Open the avatar menu and choose Apps. The catalogue is grouped by category: Files, Office & text, Organization, Multimedia, Security and more.

Useful additions for a fresh deployment include Calendar, Contacts, Notes, Deck (kanban boards) and Nextcloud Office for collaborative document editing. Select Download and enable on any app.

You can also manage apps from the command line. List the installed apps, then enable one by its id (for example occ app:enable calendar):

sudo -u www-data php /var/www/nextcloud/occ app:list

Connect Desktop and Mobile Clients

Nextcloud keeps your files in sync across devices. Install the desktop sync client (Windows, macOS, Linux) from https://nextcloud.com/install/#install-clients, and the iOS or Android app from the respective app store. Point each client at your instance address, sign in as a Nextcloud user, and choose which folders to synchronise.

This image serves the same OCS APIs that the apps use. You can verify that the API is live and gated:

# Without credentials the API returns 401 curl -s -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' http://127.0.0.1/ocs/v1.php/cloud/user
# With the admin credentials it returns 200 curl -s -o /dev/null -w '%{http_code}\n' -u admin:<new-password> -H 'OCS-APIRequest: true' http://127.0.0.1/ocs/v1.php/cloud/user

Configure Outbound Email

Nextcloud needs to send mail for share notifications, password resets and activity digests. Open Administration settings, then Basic settings, and complete the Email server section.

For reliable delivery on a cloud instance, route mail through an SMTP provider such as Amazon SES, SendGrid, or Mailgun. Set the send mode to SMTP, enter the provider host, port, encryption and credentials, then send a test email.

Enable HTTPS with Let's Encrypt

For any production Nextcloud deployment, serve the site over HTTPS so that session cookies and file transfers cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following steps assume that you have a DNS record pointing your fully qualified domain name at the instance's public IP address, and that you have added that domain to trusted_domains (step 4).

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d nextcloud.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set Nextcloud's public URL so that it generates HTTPS links throughout:

sudo -u www-data php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value https://<your-domain>
sudo -u www-data php /var/www/nextcloud/occ config:system:set overwriteprotocol --value https

Backups and Maintenance

Back up three things together: the MariaDB database, the config/config.php file, and the user data in /var/www/nextcloud/data. Put the instance into maintenance mode while you snapshot, so that the database and files are consistent:

sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --on sudo mysqldump --single-transaction nextcloud > /var/backups/nextcloud-db-$(date +%F).sql
sudo tar --acls --xattrs -czf /var/backups/nextcloud-files-$(date +%F).tgz \
  -C /var/www nextcloud/config nextcloud/data
sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off

Ship both backup files to an Amazon S3 bucket or another object store. Because the data and database tiers are on their own EBS volumes, you can also take coordinated EBS snapshots while in maintenance mode. The background-jobs timer installed with the image runs Nextcloud's scheduled tasks every five minutes in cron mode.

For kernel and package updates, Ubuntu's unattended-upgrades is enabled by default, so security patches apply automatically. To update Nextcloud core and apps, use the built-in updater under Administration settings, then Overview. You can also use the occ upgrade command-line workflow documented at https://docs.nextcloud.com/.

Scaling Beyond a Single Instance

For larger deployments, decouple Nextcloud from the single-instance pattern:

Move MariaDB to Amazon RDS for MariaDB and update the database host in /var/www/nextcloud/config/config.php
Move the data directory to Amazon EFS or configure Nextcloud's primary object storage against an Amazon S3 bucket
Move Redis to Amazon ElastiCache for Redis and point Nextcloud's redis configuration at the cluster endpoint
Put the web tier behind an Application Load Balancer and scale horizontally with an Auto Scaling group, adding each instance's hostname to trusted_domains
Serve static assets through Amazon CloudFront

Each of these is documented in the official Nextcloud administration manual at https://docs.nextcloud.com/server/latest/admin_manual/.

Screenshots

The Nextcloud sign-in page, served on first boot with a per-instance administrator password and no manual setup.

The Nextcloud dashboard after signing in as the administrator.

The Files app, where you upload, organise, share and synchronise files and folders. It is the core of the platform.

The administration overview, showing Nextcloud Hub 26 (33.0.5) running and up to date on the SecureAnyCloud AMI.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image, with a guaranteed response within 24 hours and a one-hour average for critical issues. Contact sales@secureanycloud.com.

For general Nextcloud administration questions consult the documentation at https://docs.nextcloud.com/ and the community at https://help.nextcloud.com/.

Deploy on AWS

Launch Nextcloud on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS