Install and maintain NextCloud on Ubuntu

Nextcloud is installed as the official snap on Ubuntu 24.04+, initialized from the command line, assigned trusted domains, and configured with Let’s Encrypt or a self-signed fallback.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• Ubuntu 24.04 or newer with snapd working.
• A strong first administrator password and a domain resolving to the server.

What the AppStore installation creates

• Nextcloud snap on the selected stable channel
• Snap-managed Apache, PHP, database, Redis, application, and data
• Trusted-domain and overwrite URL settings managed by nextcloud.occ
• Snap-managed HTTPS and UFW rules

1. Install and initialize the snap

sudo apt update
sudo apt install -y snapd ufw
sudo snap wait system seed.loaded
sudo snap install core
sudo snap install nextcloud --channel=stable
sudo nextcloud.manual-install CHANGE_ME_ADMIN 'CHANGE_ME_ADMIN_PASSWORD'
sudo nextcloud.occ status

2. Configure trusted domains and URL

Append rather than overwrite existing trusted-domain entries. Inspect the list after making changes.

sudo nextcloud.occ config:system:get trusted_domains
sudo nextcloud.occ config:system:set trusted_domains 1 --value=app.example.com
sudo nextcloud.occ config:system:set overwritehost --value=app.example.com
sudo nextcloud.occ config:system:set overwriteprotocol --value=https
sudo nextcloud.occ config:system:set overwrite.cli.url --value=https://app.example.com
sudo snap restart nextcloud

3. Enable HTTPS and the firewall

Public DNS must already return the server IP. Use the self-signed command only as a fallback.

sudo nextcloud.enable-https lets-encrypt
# Fallback when public validation is not possible:
# sudo nextcloud.enable-https self-signed
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable

4. Configure background jobs

Use the snap’s supported cron/background-job controls and confirm that Nextcloud’s administration overview reports no background-job errors.

sudo nextcloud.occ background:cron
sudo nextcloud.occ status

Important files and data

• Snap data: /var/snap/nextcloud/common/nextcloud/data
• Nextcloud configuration: /var/snap/nextcloud/current/nextcloud/config
• Snap logs and service state: inspect with snap services nextcloud
• Snap backups: created and restored with nextcloud.export/nextcloud.import

Health checks and logs

Run these checks after installation and after each upgrade:

sudo nextcloud.occ status
sudo nextcloud.occ config:system:get trusted_domains
sudo snap services nextcloud
sudo snap logs nextcloud -n 100

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo snap list nextcloud
sudo nextcloud.export
sudo snap refresh nextcloud --channel=stable
sudo nextcloud.occ status

Backup scope

• A successful sudo nextcloud.export archive copied off the server
• Any external storage not included by the snap export
• The installed snap channel/revision and trusted-domain/TLS configuration

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• If the snap reports an untrusted domain, append the exact hostname to trusted_domains.
• If Let’s Encrypt validation fails, verify public DNS and that no other service occupies ports 80/443.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.