File Sync with Nextcloud

Planning Your Homelab named photo backup, password management, and general file sync as the three most common reasons people start a homelab. Vaultwarden and Immich covered the first two - Nextcloud is the answer to the third: a Dropbox or Google Drive replacement that syncs regular files (not just photos) across your devices, backed by your own storage instead of a subscription.

What Nextcloud actually is

Nextcloud is a self-hosted file sync and collaboration platform: desktop clients for Windows/Mac/Linux and mobile apps for iOS/Android keep a folder in sync with the server, a web UI lets you browse and share files from anywhere on your network, and optional built-in apps add calendar (CalDAV) and contacts (CardDAV) sync on top - useful if you'd rather not depend on a third-party account for those either. It's a considerably bigger piece of software than anything else in this tier (it's a full PHP web application with a database behind it, not a single lightweight container), which is the trade-off for being general-purpose rather than single-purpose the way Immich or Vaultwarden are.

Running it

services:
  nextcloud-db:
    image: mariadb:11
    container_name: nextcloud-db
    environment:
      - MARIADB_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
      - MARIADB_DATABASE=nextcloud
      - MARIADB_USER=nextcloud
      - MARIADB_PASSWORD=${DB_PASSWORD}
    volumes:
      - ./db:/var/lib/mysql
    restart: unless-stopped

  nextcloud:
    image: nextcloud:apache
    container_name: nextcloud
    ports:
      - "8083:80"
    environment:
      - MYSQL_HOST=nextcloud-db
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - ./html:/var/www/html
      - ./data:/var/www/html/data
    depends_on:
      - nextcloud-db
    restart: unless-stopped

• The nextcloud:apache image bundles its own web server, so there's no separate reverse proxy needed to get it running locally - just the one container plus its database.
• First run walks you through an admin account and the database connection details above in a setup wizard at http://server-ip:8083.

Resource expectations: noticeably heavier at idle than Vaultwarden or a single Immich container - budget at least 1GB RAM for the app container plus the database, and expect the first sync of a large existing file collection to be genuinely CPU- and disk-I/O-intensive for a while (thumbnail generation, file indexing). Comfortable on a typical mini PC once past that initial sync.

The same TLS requirement as Vaultwarden

Nextcloud's desktop and mobile sync clients have the same requirement Vaultwarden's apps do: a secure context (HTTPS) to connect. See Vaultwarden's TLS section for the full explanation and your two options for now - the web UI works fine over plain HTTP on your LAN in the meantime, and full client sync support is one of the more common reasons people jump ahead to Reverse Proxy and TLS in Intermediate.

Don't over-scope it on day one

Nextcloud's app store adds a large amount beyond file sync - office document editing, a Kanban board, a mail client, dozens more. Resist installing more than calendar/contacts to start: each additional app is more surface area to keep updated and more that can break during a Nextcloud version upgrade, for value you may not actually need. Add apps as a specific need comes up, not because they're one click away.

Backing it up

Two things matter, same shape as Immich:

• The database - shares, permissions, calendar/contacts data, and file metadata. Without it, the files in ./data are just an unsorted pile with no record of who they belonged to or were shared with.
• The ./data folder - the actual file contents. Treat this the same way Backups 101 treats Immich's library: if what you're syncing is genuinely irreplaceable (not just a convenient copy of files that exist elsewhere too), it belongs in your highest-priority backup scope, not an afterthought.

Nextcloud also ships a built-in maintenance mode (occ maintenance:mode --on) worth putting a backup script around - running it briefly before a backup snapshot avoids capturing the database mid-write.

Next: Networking Basics.