Why self-host Nextcloud
Every file you drop into a mainstream cloud drive is stored, indexed and often scanned by a company whose business is knowing things about you. Nextcloud flips that: it’s an open-source suite — files, calendar, contacts, notes, photos — that runs on your server. You decide who has an account, where the data lives, and when it’s deleted. Nobody trains a model on your documents and nobody hands your folder tree to a third party on request, because there is no third party.
Pairing that with a private host closes the loop. Because the VPS is no-KYC and payable in Monero, renting the machine doesn’t create another identity record, and our no-logs policy means we’re not keeping a diary of what your server does. The result is a personal cloud that answers to you alone.
Install Nextcloud with Docker
The fastest route is Nextcloud All-in-One (AIO) — a single mastercontainer that provisions the database, Redis, the reverse-proxy hooks and backup tooling for you. On a fresh Ubuntu server:
# on a fresh VPS (Ubuntu 24.04)
sudo apt update && sudo apt install -y docker.io
sudo docker run -d \
--name nextcloud-aio-mastercontainer \
--restart always \
-p 8080:8080 \
-v nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
nextcloud/all-in-one:latestOpen https://SERVER-IP:8080, copy the one-time passphrase it prints, and finish
setup in the browser: enter your domain, let AIO pull the remaining containers, and
it hands you the admin login. If you prefer to wire things yourself, the classic
docker-compose stack (the nextcloud:apache image plus a mariadb service and a
named volume for /var/www/html) works just as well — AIO simply automates the
parts most people get wrong.
Point a domain and terminate TLS
Nextcloud needs a real hostname and a valid certificate; browsers and the sync
clients refuse to trust a bare IP. Create an A record for something like
cloud.example.com pointing at your VPS, then let a reverse proxy handle HTTPS.
Either AIO’s bundled reverse proxy or your own works.
A minimal Caddy config in front of AIO is two lines and gets you an auto-renewing Let’s Encrypt certificate:
cloud.example.com {
reverse_proxy localhost:11000
}AIO exposes its Apache container on port 11000 for exactly this. Once TLS is live,
set your domain as a trusted domain during the AIO setup screen and Nextcloud is
reachable over HTTPS from anywhere.
Encryption at rest and backups
Two layers matter. In transit is covered by the TLS you just set up. At rest is optional but worth it on a shared physical host: in the admin area, enable the server-side encryption module so files land on disk encrypted. Understand the trade-off first — it protects data if the disk is imaged, but it does not hide file contents from a fully compromised running server, and it complicates recovery if you lose the keys. Read Nextcloud’s encryption docs before flipping it on.
Backups are non-negotiable. AIO includes a Borg-based backup you can schedule to a
second volume or an off-site target from the admin interface. For a compose stack,
snapshot the data directory and mysqldump the database on a cron, then copy both
somewhere that isn’t this VPS. A backup you have never restored is a hope, not a
backup — do a test restore once.
Sizing your storage
Documents, contacts and calendar entries are trivial in size; you could run those on the smallest plan for years. The variable is media. If you mirror your phone’s photo roll or keep a video library, storage is the constraint that decides your plan, not CPU or RAM. Start on the Standard plan and move up to Pro when your library outgrows it — see the disk on the Standard and Pro plans on the pricing page. Adding disk later is straightforward, so it’s fine to begin conservatively.
What you own — and what you’re responsible for
Self-hosting is a fair trade, and honesty about both sides matters. You gain complete ownership: no scanning, no account suspensions, no feature you rely on disappearing because a product team reprioritised. In return, you are the admin. Updates, backups and the occasional log check are yours now. None of it is hard — Docker keeps upgrades to pulling a new image and AIO smooths the rough edges — but it is real work, and pretending otherwise would be dishonest.
If that trade appeals, spin up a Standard VPS paid in Monero, point a domain at it, and you’ll have a private cloud running this afternoon.