What Nextcloud Is#
Nextcloud is a well-known open-source platform for running your own cloud storage and collaboration setup. It handles files, documents, and photos, syncs everything across your devices, and comes with a bunch of built-in services on top:
- calendar and tasks;
- video calls (Nextcloud Talk);
- office documents (Nextcloud Office / Collabora);
- notes and real-time collaborative editing.
People often describe Nextcloud as a self-hosted stand-in for Google Workspace or Microsoft 365 - one that’s entirely yours to control, running on your own server, with zero dependence on anyone else’s cloud.
What Nextcloud AIO Is#
Nextcloud AIO (All-in-One) is the official build the Nextcloud team itself puts out specifically to make installing and updating as painless as possible.
A classic install has you hand-configuring Apache/Nginx, PHP, Redis, MariaDB, and cron jobs one by one. AIO skips all of that by running on Docker and bundling everything into its own containers:
- Nextcloud (the web interface);
- PostgreSQL (the database);
- Redis (caching);
- Collabora Online (document editing);
- OnlyOffice (optional);
- a backup container (automatic backups).
The real selling point of AIO is that every component updates itself automatically, and you can have a fully working cloud running in just a few minutes. It’s a great fit for home servers, LXC containers on Proxmox, or a VPS - anywhere simplicity and stability matter more than fine-grained control.
When You’d Actually Want Nextcloud AIO#
When you want Nextcloud up and running fast, with as little manual configuration of individual pieces as possible.
What You’ll Need First#
Before diving in, make sure you’ve got:
- Docker and Docker Compose (2.0+);
- a server with at least 2 GB of RAM;
- a domain name with HTTPS access (ideally through Traefik, Caddy, or Nginx Proxy Manager).
The Docker Compose File#
Here’s a minimal docker-compose.yml for running Nextcloud AIO behind Traefik, matching what’s shown in the video at the top of the article:
services:
nextcloud-aio-mastercontainer:
image: ghcr.io/nextcloud-releases/all-in-one:v13.3.1 # The official image moved from Docker Hub (nextcloud/all-in-one) to ghcr.io due to new Docker Hub download restrictions - if you find an old nextcloud/all-in-one link, it's outdated. It's better to pin the version and check the latest one at https://github.com/nextcloud/all-in-one/releases rather than using latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
- /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
#network_mode: bridge # add to the same network as docker run would do
ports:
#- 80:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- 8087:8080
#- 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
environment: # Is needed when using any of the options below
AIO_DISABLE_BACKUP_SECTION: false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
APACHE_PORT: 11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
APACHE_IP_BINDING: 0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
BORG_RETENTION_POLICY: --keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
# COLLABORA_SECCOMP_DISABLED: false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
NEXTCLOUD_DATADIR: /media/nextcloud # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
NEXTCLOUD_MOUNT: /media # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
# NEXTCLOUD_UPLOAD_LIMIT: 10G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
# NEXTCLOUD_MAX_TIME: 3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
# NEXTCLOUD_MEMORY_LIMIT: 512M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
# NEXTCLOUD_TRUSTED_CACERTS_DIR: /path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
# NEXTCLOUD_STARTUP_APPS: deck twofactor_totp tasks calendar contacts notes # Allows to modify the Nextcloud apps that are installed on starting AIO the first time. See https://github.com/nextcloud/all-in-one#how-to-change-the-nextcloud-apps-that-are-installed-on-the-first-startup
NEXTCLOUD_ADDITIONAL_APKS: imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
# NEXTCLOUD_ENABLE_DRI_DEVICE: true # This allows to enable the /dev/dri device in the Nextcloud container. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
# NEXTCLOUD_KEEP_DISABLED_APPS: false # Setting this to true will keep Nextcloud apps that are disabled in the AIO interface and not uninstall them if they should be installed. See https://github.com/nextcloud/all-in-one#how-to-keep-disabled-apps
# TALK_PORT: 3478 # This allows to adjust the port that the talk container is using. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
# WATCHTOWER_DOCKER_SOCKET_PATH: /var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
# security_opt: ["label:disable"] # Is needed when using SELinux
networks:
- nextcloud
# # Optional: Caddy reverse proxy. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# # You can find further examples here: https://github.com/nextcloud/all-in-one/discussions/588
# caddy:
# image: caddy:alpine
# restart: always
# container_name: caddy
# volumes:
# - ./Caddyfile:/etc/caddy/Caddyfile
# - ./certs:/certs
# - ./config:/config
# - ./data:/data
# - ./sites:/srv
# network_mode: "host"
go-vod:
image: radialapps/go-vod
restart: always
depends_on:
- nextcloud-aio-mastercontainer
environment:
- NEXTCLOUD_HOST=https://next.domain.ru
- NVIDIA_VISIBLE_DEVICES=all
volumes:
- /media/nextcloud:/mnt/ncdata:ro
runtime: nvidia
networks:
- nextcloud
volumes: # If you want to store the data on a different drive, see https://github.com/nextcloud/all-in-one#how-to-store-the-filesinstallation-on-a-separate-drive
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
networks:
nextcloud:
name: nextcloud
external: true Sample dynamic config for the Traefik reverse proxy:
http:
routers:
nextcloud:
entrypoints:
- "https"
rule: "Host(`subdomain.domain.ru`)"
middlewares:
- https-redirect
- nextcloud-secure-headers
tls:
domains:
- main: "subdomain.domain.ru"
service: nextcloud
services:
nextcloud:
loadBalancer:
servers:
- url: "http://your_vm_ip:11000"
passHostHeader: true
middlewares:
crowdsec-bouncer: #if you use crowdsec
forwardauth:
address: http://bouncer-traefik:8080/api/v1/forwardAuth
trustForwardHeader: true
# https://github.com/goauthentik/authentik/issues/2366
middlewares-authentik: # if you use authentik
forwardAuth:
address: "http://authentik_server:9000/outpost.goauthentik.io/auth/traefik"
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version
nextcloud-secure-headers:
headers:
hostsProxyHeaders:
- "X-Forwarded-Host"
referrerPolicy: "same-origin"
customResponseHeaders:
X-Robots-Tag: "noindex, nofollow" #changed from default "none" parameter
https-redirect:
redirectScheme:
scheme: https
permanent: true
nextcloud-chain:
chain:
middlewares:
# - ... (e.g. rate limiting middleware)
- https-redirect
- nextcloud-secure-headersWalking Through My Compose File#
Nextcloud AIO
Container: nextcloud-aio-mastercontainer
Don’t touch the container_name or the nextcloud_aio_mastercontainer volume name - the built-in backup depends on both staying exactly as they are.
Ports: 8087:8080 puts the web interface at http://host:8087. Everything else is commented out, which is exactly what you want once a reverse proxy is in the picture.
On the environment variables: NEXTCLOUD_DATADIR: /media/nextcloud paired with NEXTCLOUD_MOUNT: /media makes sure both Nextcloud and go-vod are looking at the same directory. APACHE_PORT and APACHE_IP_BINDING are set up for the reverse proxy. I’ve also added imagemagick and imagick via NEXTCLOUD_ADDITIONAL_APKS/NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS, which come in handy for image processing.
go-vod
It depends on Nextcloud AIO coming up first (depends_on), and it’s set up to use an NVIDIA GPU (runtime: nvidia plus NVIDIA_VISIBLE_DEVICES=all).
The /media/nextcloud:/mnt/ncdata:ro mount is read-only on purpose, so go-vod can process Nextcloud’s files without any chance of accidentally touching them. Just make sure NEXTCLOUD_HOST=https://next.domain.ru actually points at your real Nextcloud domain.
Networking
Both containers sit on the external nextcloud network, which lets them talk to each other by container name.
Volumes
nextcloud_aio_mastercontainer is critical for the built-in backup - leave it alone. Everything else Nextcloud stores lives under NEXTCLOUD_DATADIR.
A Few Things Worth Double-Checking#
GPU access for go-vod: make sure the NVIDIA driver and nvidia-container-toolkit are actually installed on the host, and confirm the container can see the GPU.
Directory permissions: /media/nextcloud needs to be reachable by both AIO and go-vod. For go-vod specifically, mounting it :ro (read-only) is the safe move.
Reverse proxy: since ports 80/443 are commented out, you’ll need an external reverse proxy - Nginx, Caddy, or Traefik - handling traffic. Make sure it’s actually forwarding to APACHE_PORT = 11000.
Backups: don’t mess with the nextcloud_aio_mastercontainer volume, and you can check on your backups directly through the AIO interface.
Getting It Running#
Save the file as
docker-compose.yml.Run:
docker compose up -d- Open your browser and head to:
http://<server_IP>:8087(port 8087, not the default 8080 - that’s exactly what’s set in the docker-compose.yml above)
- Follow the setup wizard from there:
Enter your domain (say, cloud.prohomelab.com),
Set up HTTPS (either the built-in Let’s Encrypt or through your proxy),
Let it finish deploying all the containers on its own.
Wrapping Up#
Nextcloud AIO is about as close as you’ll get to spinning up a full-featured cloud with one click. It combines the convenience of Docker, hands-off updates, and the backing of the Nextcloud team’s own official support. It’s a natural fit for a home server, an LXC container on Proxmox, or a VPS - anywhere simplicity, security, and self-sufficiency actually matter. If you’d rather have full control over the stack without Docker, check out the alternative install method in Nextcloud in an LXC.
