Nextcloud on Linux: Self-Hosted File Cloud with Collabora Office

sudo apt update
sudo apt install -y nginx mariadb-server valkey \\
  php8.3-fpm php8.3-gd php8.3-mysql php8.3-curl php8.3-mbstring \\
  php8.3-xml php8.3-zip php8.3-intl php8.3-bcmath php8.3-gmp \\
  php8.3-redis php8.3-imagick php8.3-apcu unzip

sudo systemctl enable nginx mariadb valkey php8.3-fpm

sudo mysql <<'SQL'
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'nc_user'@'localhost' IDENTIFIED BY 'REPLACE_STRONG_PASSWORD';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'nc_user'@'localhost';
FLUSH PRIVILEGES;
SQL

cd /tmp
curl -LO https://download.nextcloud.com/server/releases/latest.zip
unzip latest.zip
sudo mv nextcloud /var/www/
sudo mkdir -p /mnt/nc-data
sudo chown -R www-data:www-data /var/www/nextcloud /mnt/nc-data

sudo tee /etc/nginx/sites-available/nextcloud.conf >/dev/null <<'EOF'
upstream php-handler {
    server unix:/run/php/php8.3-fpm.sock;
}

server {
    listen 443 ssl http2;
    server_name cloud.example.com;
    root /var/www/nextcloud;

    ssl_certificate /etc/letsencrypt/live/cloud.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cloud.example.com/privkey.pem;

    client_max_body_size 10G;
    fastcgi_buffers 64 4K;

    add_header Strict-Transport-Security "max-age=15552000" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ^~ /.well-known {
        allow all;
        try_files $uri $uri/ =404;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
        deny all;
    }

    location / {
        rewrite ^ /index.php$request_uri;
    }

    location ~ ^\\/(?:index|remote|public|cron|core\\/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|oc[ms]\\-.+\\.php)\\.php(?:$|\\/) {
        fastcgi_split_path_info ^(.+?\\.php)(\\/.*|)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
    }

    location ~ \\.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
        try_files $uri /index.php$request_uri;
        expires 6M;
        access_log off;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/nextcloud.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo -u www-data php /var/www/nextcloud/occ maintenance:install \\
  --database mysql \\
  --database-name nextcloud \\
  --database-user nc_user \\
  --database-pass 'REPLACE_STRONG_PASSWORD' \\
  --admin-user admin \\
  --admin-pass 'REPLACE_ADMIN_PASSWORD' \\
  --data-dir /mnt/nc-data

sudo -u www-data php /var/www/nextcloud/occ config:system:set memcache.local --value '\\OC\\Memcache\\APCu'
sudo -u www-data php /var/www/nextcloud/occ config:system:set memcache.distributed --value '\\OC\\Memcache\\Redis'
sudo -u www-data php /var/www/nextcloud/occ config:system:set memcache.locking --value '\\OC\\Memcache\\Redis'
sudo -u www-data php /var/www/nextcloud/occ config:system:set redis host --value '127.0.0.1'
sudo -u www-data php /var/www/nextcloud/occ config:system:set redis port --value 6379

sudo -u www-data php /var/www/nextcloud/occ background:cron

echo "*/5 * * * * www-data php -f /var/www/nextcloud/cron.php" | sudo tee /etc/cron.d/nextcloud

# Deploy Collabora CODE via Docker:
sudo docker run -d --name collabora \\
  -p 127.0.0.1:9980:9980 \\
  -e "domain=cloud\\.example\\.com" \\
  --restart unless-stopped \\
  collabora/code

# Install Nextcloud Office app:
sudo -u www-data php /var/www/nextcloud/occ app:install richdocuments
sudo -u www-data php /var/www/nextcloud/occ config:app:set richdocuments wopi_url --value="https://office.example.com"

# Enable HSTS and security headers (done in Nginx config above)
sudo -u www-data php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value='https://cloud.example.com'
sudo -u www-data php /var/www/nextcloud/occ config:system:set default_phone_region --value='DE'
sudo -u www-data php /var/www/nextcloud/occ config:system:set maintenance_window_start --value=3

# Run security scan:
sudo -u www-data php /var/www/nextcloud/occ security:bruteforce:reset

#!/usr/bin/env bash
# /usr/local/bin/nextcloud-backup.sh
set -euo pipefail
mysqldump --single-transaction nextcloud | gzip > /backup/nc-db-$(date +%F).sql.gz
rsync -a /mnt/nc-data/ /backup/nc-data/
rsync -a /var/www/nextcloud/config/ /backup/nc-config/