[How-To] Nextcloud with swag (Letsencrypt) using OMV and docker-compose

Docker Container set up by this method can be managed by Portainer or from CLI.

Pre-requisites
In order to be able to reach nextcloud from the internet you need an external IPv4 address and a hostname.
Regarding external IPv4 address check you router or ask your internet service provider.
To register a hostname you can use services like duckdns, selfhost.eu, strato.de or many others.
Make sure to use strong passwords!!!

Preparation

• Install and fully update OMV (a restart might be needed if the kernel has been updated)
• install omv-extras
• install the omv-docker-compose plugin
• create a user dedicated for docker in the GUI of OMV, let's call him "docker1"
• in the CLI determine UID (user ID) and GID (group ID) of user "docker1" id docker1

Installation of Nextcloud and SWAG (Letsencrypt) in Docker

• forward ports in your router (check user manual of your router how to to this)
  • port extern 443 to port 444 intern (IP of your NAS)
  • port extern 80 to port 81 intern (IP of your NAS)
• if you prefer to deploy the stack from CLI (and not use the docker-compose-plugin):
  • mkdir /home/docker1 create a folder for user docker1 in home directory
  • mkdir /home/docker1/nextcloud create a folder where we will put the docker-compose.yml file to setup nextcloud
  • cd /home/docker1/nextcloud change in that directory
  • nano docker-compose.yml create an empty file and start the editor
  • copy the content of the Source Code box below in the editor, edit the relevant entries and save the file with Ctrl+X and y; name must be "docker-compose.yml"
    • to copy the content of the Source Code box use the small icon in the top right corner of the box ("Copy Contents")
    • text after "#" are comments and indicate where you need to make adjustments to the file
    • PUID is the UID of your docker1 user; PGID is the GID of you docker1 user
    • it is not required that the folders ("appdata", "appdata/nextcloud" etc) in "volumes:" exist; they will be created when we run docker-compose
    • do not place the config folders on a mergerfs mount point

  As alternative you can also deploy the stack in Portainer: [How-To] Use docker-compose files in Portainer

version: "2"
services:
  nextcloud:
    image: ghcr.io/linuxserver/nextcloud
    container_name: nextcloud
    environment:
      - PUID=1000 #change PUID if needed
      - PGID=100  #change PGID if needed
      - TZ=Europe/Berlin #change Time Zone if needed
    volumes:
      - /srv/dev-disk-by-label-disk1/appdata/nextcloud/config:/config #/srv/dev-disk-by-label-disk1 needs to be adjusted
      - /srv/dev-disk-by-label-disk1/appdata/nextcloud/data:/data     #/srv/dev-disk-by-label-disk1 needs to be adjusted
    depends_on:
      - mariadb
#    ports: # uncomment this and the next line if you want to bypass the proxy
#      - 450:443
    restart: unless-stopped
  mariadb:
    image: ghcr.io/linuxserver/mariadb
    container_name: nextclouddb
    environment:
      - PUID=1000 #change PUID if needed
      - PGID=100  #change PGID if needed
      - MYSQL_ROOT_PASSWORD=mariadbpassword  #change password
      - TZ=Europe/Berlin #Change Time Zone if needed
    volumes:
      - /srv/dev-disk-by-label-disk1/appdata/nextclouddb:/config    #/srv/dev-disk-by-label-disk1 needs to be adjusted
    restart: unless-stopped
  swag:
    image: linuxserver/swag         #swag is the replacement for letsencrypt (see link below)
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000 #change PUID if needed
      - PGID=100  #change PGID if needed
      - TZ=Europe/Berlin # change Time Zone if needed
      - URL=xxxx.de #insert your domain name - yourdomain.url
      - SUBDOMAINS=www,
      - VALIDATION=http
      - EMAIL=xxx.yyy@provider.com # define email; required to renew certificate
    volumes:
      - /srv/dev-disk-by-label-disk1/appdata/swag:/config  #/srv/dev-disk-by-label-disk1 needs to be adjusted
    ports:
      - 444:443
      - 81:80
    restart: unless-stopped

• after you saved the file, run docker-compose up -d in the directory where the docker-compose.yml file is located; this will download the needed images and start the container
• when finished, run docker logs -f swag and check for errors

Configuration of proxy

• cd /srv/dev-disk-by-label-disk1/appdata/swag/nginx/proxy-confs /srv/dev-disk-by-label-disk1 has to be adjusted
• cp nextcloud.subfolder.conf.sample nextcloud.subfolder.conf this will copy the sample configuration file for nextcloud and removes the .sample so that the file will become active
• nano /srv/dev-disk-by-label-disk1/appdata/nextcloud/config/www/nextcloud/config/config.php and insert the text from the box below at the end, but befor the ");" - change "your.url" to your domain

'trusted_proxies' => 
  array (
    0 => 'swag',
  ),
  'overwritewebroot' => '/nextcloud',
  'overwrite.cli.url' => 'https://your.url/nextcloud',
  'trusted_domains' => 
  array (
    0 => 'your.url:443',
  ),

• docker restart swag to restart the swag container
• docker logs -f swag to check for errors
• docker restart nextcloud

Nextcloud can now be reached with https://your.url/nextcloud

• on the welcome screen of nextcloud (see picture below) we need to configure the database
• click on "Storage&Database"
• select MySQL/MariaDB
  • Database user --> "root"
  • Database password --> password which has been specified in the docker-compose file with MYSQL_ROOT_PASSWORD
  • Database name --> "nextcloud"
  • localhost host --> "nextclouddb"

  then click "finish setup"

• Selection_044.jpg

Please note: the configuration of the proxy is highly dependent on how you set up your domain. For further details check the available documentation for letsencrypt. E.g.
https://blog.linuxserver.io/20…domainreverseproxyexample
https://hub.docker.com/r/linuxserver/letsencrypt

Trouble shooting letsencrypt image and port forwarding:

Troubleshooting Letsencrypt Image Port Mapping and Forwarding | LinuxServer.io

SWAG as replacement of letsencrypt

Introducing SWAG - Secure Web Application Gateway | LinuxServer.io

https://docs.linuxserver.io/general/swag

Q&A for my HOWTO: forum.openmediavault.org/index…V-and-docker-compose-Q-A/

Here is a specific guide for the implementation with duckDNS:

RE: Nextcloud Bad Gateway

If you want to use subdomain instead of subfolder:

Nextcloud with Letsencrypt using errorOMV and docker-compose - Q&A

subfolder: https://your.url/nextcloud
subdomain: https://nextcloud.your.url/

Thanks to @Morlan

If you want to use duckdns:

https://docs.linuxserver.io/ge…tion-with-a-wildcard-cert

Nextcloud with Letsencrypt using errorOMV and docker-compose - Q&A

you do not need the duckdns container, if you choose validation = duckdns

Thanks to @Morlan also for this.

If you get a warning in Nextcloud regarding "Strict Transport-Security" do the following:

in "yourconfigfolder/swag/nginx" open ssl.conf and remove the "#" in front of

#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

docker restart swag

In case your certificate is not renewed automatically by swag:

• open a ssh connection to OMV
• docker exec -it swag /bin/bash to be able to execute commands within the container
• certbot renew to renew the certificate
• exit to leave the container

Thanks to @emerenel

In case you get this error:
nextcloudDB.PNG

Try this: Nextcloud with Letsencrypt using OMV and docker-compose - Q&A

Thanks to @gett

In case you want to add onlyoffice to nextcloud

[How-To] onlyoffice in nextcloud docker

Thanks to @draddy

In case you have issues with the update of the Nextcloud container try this method from draddy

[How-To]Upgrade Nextcloud in docker

Some further comments and hints from wiegell

1) If people are having trouble with HDD spinups, it turns out, that the cronjob file in the linuxserver/nextcloud image has only recently been made editable. It's required to recreate the container from a newer image, if one want's to edit this file and change nextcloud settings to AJAX.

2) If anyone should have webdav issues (airplay in my case), HTTP2 might be the problem.

3) I got "server reached pm.max_children" errors from the php log, which were solved by increasing the max_children in a similar fashion to what's being explained here. I would add, that it can be good to check with "top" (while doing demanding work), that the increase in threads doesn't start using memory cache, which in my case is on a slow SD card. In general this has sped up cpu/memory intensive tasks e.g. creation of thumbnails.

Thanks to wiegell

If you want to speed up Nextcloud as suggested by monsen in this post: nextcloud fast video feedback

Quote

Furthermore i would suggest to add redis to the installation to speed up nextcloud.

This can be done by adding the following to the stack script:

Code

  redis:
    image: redis
    container_name: redis
    hostname: redis
    volumes:
      - /srv/dev-disk-by-label-SSD_Data/appdata/redisDocker:/data    #--> needs to be changed to your config
    restart: unless-stopped

The nextcloud config (.../www/nextcloud/config/config.php) must be adapted to use redis as described here: https://docs.nextcloud.com/ser…aching_configuration.html

add this:

  'memcache.local' => '\OC\Memcache\APCu',
  'memcache.distributed' => '\OC\Memcache\Redis',
  'memcache.locking' => '\OC\Memcache\Redis',
  'redis' =>
  array (
     'host'     => 'redis',
     'port'     => 6379,
  ),

Don't forget to restart the nextcloud container after the change of config-php has been saved.

Thanks to monsen and riff-raff

You can share any shared folder you added to the smb/cifs service by using the External Storage App of Nextcloud

https://docs.nextcloud.com/ser…ge_configuration_gui.html

Tip from vcdwelt:

If Nextcloud shows an error Message "ERROR 413 REQUEST ENTITY TOO LARGE". Try adding a line to

/srv/dev-disk-by-label-disk1/appdata/nextcloud/config/php/php-local.ini

after the timezone:

upload_max_filesize=16384M #sets the limit to 16GB e.g.

If you get this error in Nextcloud in Administration >> Overview

Quote

The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow".

Edit .../nextcloud/nginx/site-confs/default.conf

and change line

add_header X-Robots-Tag "none" always;

to

add_header X-Robots-Tag "noindex, nofollow" always;

and restart the nextcloud container.

Or delete default.conf and restart nextcloud. The new version of default.conf will be put in place.