How to Setup Nextcloud on NixOS
Introduction🔗
I love Nextcloud. Not only does can it be a self-hosted "cloud" storage system, but also has a ton of useful apps to further enhance the experience, and makes it an actual alternative to the Google Suite of apps. Recently I have also been playing with NixOS. As I start to further learn Nix and NixOS, I am pretty confident I will write about its glory. In that future post, and here, one large negative will be mentioned: the lack of documentation/tutorials, especially compared to other distributions. There is the manual and unofficial wiki but much of it is surface-level and/or basic configuration. The manual has a Nextcloud sample configuration, but it even admits it is "very basic." There is more you must configure to get it to work. I owe a great thanks to the #nixos irc (on Freenode)/Matrix chat for helping me. Without further ado, time to install Nextcloud on NixOS!
Disclaimer🔗
This guide is how to install Nextcloud on NixOS. Nothing more and nothing less. It is up to you to take basic and general security measures on your server. Furthermore, while this process worked for me when I wrote it, I cannot guarantee it is the best or most up-to-date version. I am not liable for any damage, security vulnerabilities, or anything else that occurs. Anything I say here is provided as-is with no warranty whatsoever. Please, do not blindly trust what I, or any blog post, has to say. If you do notice something wrong or not a best practice, do let me know. Not just for my sake, but anyone else who stumbles upon this.
Prerequisites🔗
DNS Record🔗
I'll use the domain name nextcloud.example.com
. Point an A
record to your server IP address for your subdomain.
Firewall🔗
Ports 80 and 443 need to be open in the NixOS firewall. Open them by putting this in your /etc/nixos/configuration.nix
:
networking.firewall.allowedTCPPorts = [ 80 443 ];
Let's Encrypt🔗
We need to agree to Let's Encrypt's terms in order to generate a certificate. Add this to your /etc/nixos/configuration.nix
:
security.acme = {
acceptTerms = true;
# Replace the email here!
email = "email@example.com";
};
As the comment states, replace the email there!
Modularity🔗
If you want, you can put everything in the /etc/nixos/configuration.nix
file, but NixOS supports modularity, so we should take advantage of it. Plus, it will make everything easier to manage. Therefore, let's make a nextcloud.nix
file in the same directory. You can do this by running:
`sudo -i nano /etc/nixos/nextcloud.nix`
Then, in there
{config, pkgs, ...}:
{
}
Then, click Control+X, Control+Y, then Enter. Now that is setup, so we need to actually put stuff in the /etc/nixos/nextcloud.nix
We'll actually add more in the next part!
Configuration🔗
I have published a GitHub Gist with the configuration with the full configuration besides the prerequisites mentioned above. I have commented the code, so you can get a "TL;DR" through that. Do note, there are steps/commands to preform afterwards, so go to Post-Setup if you go this route.
If you want to see a more step-by-step configuration, keep reading:
Note🔗
Everything here will go in between those two curly brackets we put in the "Modularity" section.
Nginx🔗
The first thing to setup is Nginx to make a reverse-proxy with HTTPS, so we can actually access our installation:
services.nginx = {
enable = true;
# Use recommended settings
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
# Only allow PFS-enabled ciphers with AES256
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
# Setup Nextcloud virtual host to listen on ports
virtualHosts = {
"nextcloud.example.com" = {
## Force HTTP redirect to HTTPS
forceSSL = true;
## LetsEncrypt
enableACME = true;
};
};
};
You may have noticed that there is no configuration besides the HTTPS/Let's Encrypt, not even an HTTP header, how will anything work!? Rest assured, Nextcloud specifically has an option (services.nextcloud.nginx.enable
) to do the pretty complicated config for us. Speaking of, time to setup Nextcloud itself.
Nextcloud🔗
The NixOS Manual provides a "very basic" Nextcloud configuration, but it is just that: basic. Here is my recommended config:
services.nextcloud = {
enable = true;
hostName = "nextcloud.example.com";
# Enable built-in virtual host management
# Takes care of somewhat complicated setup
# See here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/nextcloud.nix#L529
nginx.enable = true;
# Use HTTPS for links
https = true;
# Auto-update Nextcloud Apps
autoUpdateApps.enable = true;
# Set what time makes sense for you
autoUpdateApps.startAt = "05:00:00";
config = {
# Further forces Nextcloud to use HTTPS
overwriteProtocol = "https";
# Nextcloud PostegreSQL database configuration, recommended over using SQLite
dbtype = "pgsql";
dbuser = "nextcloud";
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
dbname = "nextcloud";
dbpassFile = "/var/nextcloud-db-pass";
adminpassFile = "/var/nextcloud-admin-pass";
adminuser = "admin";
};
};
The changes I made are furthering HTTPS support and usage, auto-updating apps, and password file locations. The latter, password files, is extremely important. To properly set them up, we need to enable Nextcloud, but some further configuration is needed: setting up PostgreSQL.
PostgreSQL🔗
Nextcloud can use SQLite, but that is highly unrecommended. As you can see in the Nextcloud config, we'll use PostgreSQL instead. We create the database and user in the Nextcloud config, but we still need to enable PostgreSQL and ensue the database, user, and permissions always exist. Manual removal will be required to change it, preventing accidental loss. Here is the config:
services.postgresql = {
enable = true;
# Ensure the database, user, and permissions always exist
ensureDatabases = [ "nextcloud" ];
ensureUsers = [
{ name = "nextcloud";
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
}
];
};
Now, we have to make sure PostgreSQL is running before the Nextcloud setup. This is accomplished by this config:
systemd.services."nextcloud-setup" = {
requires = ["postgresql.service"];
after = ["postgresql.service"];
};
After adding that, we can finally run the setup with this command:
sudo nixos-rebuild switch
There should not be any errors and eventually the command will complete! Congrats! Wait, there is still some required configuration left.
Post-Setup🔗
Password Files🔗
In NixOS, configuration files are symlinked the read-only, but world-readable, /nix/store/
. Therefore, we do not want to put the database or admin password in the /etc/nixos/nextcloud.nix
file. Instead we will create the files under /var/
and change the permissions. First, let's change the permissions so only the owner can read/write by running:
umask 077
Next, let's create the file by running:
sudo -i nano /var/nextcloud-db-pass
And insert a randomly generated password (use your password manager!) and save the file. Finally, let's change ownership to the nextcloud
user so it has access by running:
sudo -i chown nextcloud /var/nextcloud-db-pass
Now the same, but for the admin password file. Important: This will be the password you use to login! Same commands as before, but replace db
with admin
like so:
umask 077
sudo -i nano /var/nextcloud-admin-pass
sudo -i chown nextcloud /var/nextcloud-admin-pass
To apply the changes, let's rebuild again!:
sudo nixos-rebuild switch
Nextcloud Maintenance🔗
You should now be able to login to your Nextcloud. If you go to https://nextcloud.example.com/settings/admin/overview
, you will most likely see some setup warnings regarding your database. The first is probably be about missing indices. Fix it by running this command
sudo -i nextcloud-occ db:add-missing-indices
The other issue regards some columns missing a conversion to big int. To fix this, we need to take the instance offline by putting it into maintenance mode:
sudo -i nextcloud-occ maintenance:mode --on
Now we can run:
sudo -i nextcloud-occ db:convert-filecache-bigint
And type "y"
to confirm. Now take Nextcloud out of maintenance mode:
sudo -i nextcloud-occ maintenance:mode --off
and refresh the page. It should now say "All checks passed" with a green checkmark. Nextcloud is now up and running on NixOS!
Conclusion🔗
NixOS and Nextcloud are both excellent pieces of software. When trying to combine the two, I ran into many issues, that took some time, trial and error, and asking for help to fix. Hopefully the next person who wants to set it up will come across this post, and will be saved a lot of hassle. Should you notice anything wrong, incorrect, or does not work, contact me to let me know, and I'll update the post!