# Self-Hosting Nextcloud with Docker and NetBird Set up Nextcloud All-in-One with Docker on Ubuntu, configure storage with volumes or NFS/SMB mounts, and expose it securely through the NetBird reverse proxy with automatic TLS. Written by [Brandon Hopkins](https://www.linkedin.com/in/hopki/) Published on April 9th, 2026 ## On this page: - Prerequisites - Planning Your Storage - Setting Up the NetBird Peer - Configuring the Domain - Creating the Nextcloud Stack - Initial Nextcloud AIO Setup - Closing the Admin Port - What's Next Nextcloud is one of the most popular self-hosted platforms out there, and for good reason. It gives you file sync, calendars, contacts, office document editing, video calls, and a whole ecosystem of apps, all running on your hardware. Think of it as your own private Google Workspace or iCloud replacement. We're going to set up Nextcloud using the official All-in-One (AIO) Docker image on Ubuntu Server, get storage sorted out (whether you're using a simple Docker volume or mounting network storage like NFS or SMB), install a NetBird client on the machine, and expose it securely through NetBird's built-in reverse proxy with automatic TLS. No port forwarding, no Nginx configs, no Cloudflare tunnels. ## Prerequisites Before we dive in, here's what you'll need: - **An Ubuntu server** (bare metal or VM) with at least 2 CPU cores and 4 GB of RAM. Nextcloud AIO runs several containers (database, Redis, Apache, the Nextcloud app itself), so give it some headroom. - **Docker installed.** If you haven't done that yet, I have a full [getting started with Docker guide](/content/knowledge-hub/tutorials/getting-started-with-docker/index.html) that covers installation, post-install setup, and the basics. The quick version: ```bash curl -fsSL https://get.docker.com -o get-docker.sh sudo sh get-docker.sh sudo usermod -aG docker $USER newgrp docker ``` - **A self-hosted NetBird instance** with the reverse proxy enabled. If you don't have that set up, follow the [self-hosting NetBird with Authentik guide](/content/knowledge-hub/tutorials/selfhost-netbird-with-authentik/index.html) first. That covers the full install, reverse proxy setup, and identity provider configuration. - **A domain** configured in your NetBird reverse proxy. We'll set this up in a later step, but make sure you have a domain ready to go in your NetBird dashboard. ## Planning Your Storage This is the part where you want to stop and think before you start deploying containers. Nextcloud stores user files, and those files can get large fast. Where you put that data matters. ### Option 1: Docker Volume (Simple) The easiest option. Nextcloud AIO manages its own Docker volumes by default. Your data lives in `/var/lib/docker/volumes/` on the host. This works great if your Ubuntu server has enough local disk space and you just want to get up and running. The downside is that Docker volumes can be harder to browse and back up compared to a regular directory. If you're running this on a machine with a single disk and don't plan on storing terabytes of files, this is totally fine though. ### Option 2: Custom Directory with NFS or SMB Mount If you have a NAS or dedicated storage server, you probably want Nextcloud's data living there instead of on the local disk. The way to do this is to mount your network share on the Ubuntu host and then tell Nextcloud AIO to use a folder on that mount as its data directory. First, install the packages you need for your mount type: **For NFS:** ```bash sudo apt install nfs-common -y ``` **For SMB/CIFS:** ```bash sudo apt install cifs-utils -y ``` Create a mount point on your system: ```bash sudo mkdir -p /mnt/storage ``` Then add the mount to `/etc/fstab` so it persists across reboots. **NFS fstab entry:** ```txt your-nas-ip:/volume1/nextcloud /mnt/storage nfs defaults,_netdev 0 0 ``` **SMB fstab entry:** ```txt //your-nas-ip/nextcloud /mnt/storage cifs credentials=/etc/samba/credentials,uid=1000,gid=1000,_netdev 0 0 ``` For SMB, create that credentials file so your password isn't sitting in fstab: ```bash sudo nano /etc/samba/credentials ``` ```bash username=your_username password=your_password ``` Then lock it down: ```bash sudo chmod 600 /etc/samba/credentials ``` Mount everything: ```bash sudo mount -a ``` Verify it's mounted: ```bash df -h /mnt/storage ``` Now create the `ncdata` folder that Nextcloud will use: ```bash sudo mkdir -p /mnt/storage/ncdata ``` This `/mnt/storage/ncdata` path is what we'll pass to the AIO container later. Do note that the folder needs to exist before you start the container, otherwise AIO will throw an error. ## Setting Up the NetBird Peer We need a NetBird client running on the Ubuntu machine so it's reachable through your NetBird network. The reverse proxy will use this peer to route traffic to Nextcloud. ### Create a Setup Key In your NetBird dashboard, go to **Setup Keys > Add Setup Key**. Give it a name like "Nextcloud Server" and copy the key. ### Install and Connect the NetBird Client Install the NetBird client on your Ubuntu server: ```bash curl -fsSL https://pkgs.netbird.io/install.sh | sh ``` Now connect it to your self-hosted instance using the setup key: ```bash sudo netbird up --management-url https://netbird.example.com --setup-key ``` Replace `` with the key you just created and update the management URL to match your NetBird domain. Check that it's connected: ```bash sudo netbird status ``` You should see the peer connected and an IP assigned. Head over to your NetBird dashboard and confirm the peer shows up under **Peers**. Note the peer's NetBird IP address, you'll need it for the reverse proxy configuration. ## Configuring the Domain Now let's set up the domain in NetBird's reverse proxy so Nextcloud will be accessible at something like `nextcloud.netbird.example.com`. 1. In the NetBird dashboard, go to **Reverse Proxy > Services > Add Service** 2. Enter a subdomain like `nextcloud` and select your domain 3. Click **Add Target** and configure: - **Peer**: Select your Nextcloud server peer - **Protocol**: HTTP - **Port**: `11000` 4. Still in the target settings, open **Optional Settings** and add these custom headers: - `client_body_buffer_size` → `512k` - `client_max_body_size` → `0` - `proxy_read_timeout` → `86400s` These matter for Nextcloud specifically. The buffer size handles chunked uploads more efficiently, setting max body size to `0` removes the upload size limit entirely (otherwise large file uploads will fail), and the read timeout gives long-running uploads a full 24 hours before timing out. 5. Click **Add Target** to save 6. Under the **Authentication** tab, leave all methods disabled. Nextcloud handles its own auth, and you can connect OIDC providers directly through Nextcloud's admin settings. Enabling proxy-level authentication will break connections from the Nextcloud mobile and desktop apps, since they can't handle an auth layer sitting in front of the actual Nextcloud instance. 7. Under **Access Control**, you can optionally add geo-restriction rules. For example, you could add a rule to only allow access from your country. This isn't required but it's a nice extra layer if you know you'll only ever access Nextcloud from specific locations. 8. Before saving, make sure **Pass Host Header** and **Rewrite** are both enabled. Nextcloud needs the original host header to validate trusted domains, and the rewrite ensures requests are forwarded correctly. 9. Click **Add Service** The port `11000` is important here. Nextcloud AIO runs its Apache container on this port by default when configured for use behind a reverse proxy. This is the port that serves the actual Nextcloud interface, not the AIO admin panel. NetBird will provision a TLS certificate for the domain automatically. Once the service shows as active, the domain is ready. But we haven't started Nextcloud yet, so let's do that. ## Creating the Nextcloud Stack Create a directory for Nextcloud on your server: ```bash mkdir -p ~/nextcloud && cd ~/nextcloud ``` Create the Docker Compose file: ```bash nano compose.yaml ``` ```yaml services: nextcloud-aio-mastercontainer: image: ghcr.io/nextcloud-releases/all-in-one:latest init: true restart: always container_name: nextcloud-aio-mastercontainer network_mode: bridge volumes: - nextcloud_aio_mastercontainer:/mnt/docker-aio-config - /var/run/docker.sock:/var/run/docker.sock:ro ports: - 8080:8080 environment: APACHE_PORT: 11000 NC_TRUSTED_PROXIES: 100.64.0.0/10 FULLTEXTSEARCH_JAVA_OPTIONS: "-Xms1024M -Xmx1024M" NEXTCLOUD_DATADIR: /mnt/storage/nextcloud NEXTCLOUD_UPLOAD_LIMIT: 1028G NEXTCLOUD_MAX_TIME: 7200 NEXTCLOUD_MEMORY_LIMIT: 1028M NEXTCLOUD_ENABLE_DRI_DEVICE: true SKIP_DOMAIN_VALIDATION: false TALK_PORT: 3478 volumes: nextcloud_aio_mastercontainer: name: nextcloud_aio_mastercontainer ``` > You can find the official reference compose file from Nextcloud at [github.com/nextcloud/all-in-one](https://github.com/nextcloud/all-in-one/blob/main/compose.yaml). The compose above is tailored for a NetBird reverse proxy setup, but check the official one for the latest options and defaults. A few things to note about what's going on here: - **`APACHE_PORT: 11000`** tells AIO to expose the Nextcloud Apache container on port 11000 instead of the default 443. This is what the NetBird reverse proxy is pointed at. - **`NC_TRUSTED_PROXIES: 100.64.0.0/10`** is the NetBird IP range. Since traffic hits Nextcloud through the NetBird reverse proxy, you need to tell AIO to trust that network so it correctly identifies client IPs instead of seeing everything as coming from the proxy. - **`NEXTCLOUD_DATADIR`** sets where Nextcloud stores user files. Point this to the `ncdata` directory on your mount if you're using NFS/SMB, or remove this line entirely to use the default Docker volume. - **`NEXTCLOUD_UPLOAD_LIMIT`** and **`NEXTCLOUD_MAX_TIME`** control the max upload size and timeout. The values here are generous to support large file uploads. - **`NEXTCLOUD_ENABLE_DRI_DEVICE: true`** enables hardware transcoding via Intel QuickSync. If your server doesn't have an Intel GPU, you can remove this line. - **`SKIP_DOMAIN_VALIDATION: false`** can be set to `true` if AIO has trouble validating your domain through the reverse proxy. Try `false` first, and only flip it if domain validation fails during setup. - **`TALK_PORT: 3478`** exposes the Talk container for video calls on this port. - The Docker socket mount (`/var/run/docker.sock`) is required because the master container manages other containers. It spins up the database, Redis, Apache, and the Nextcloud app containers on its own. Now start it up: ```bash docker compose up -d ``` Give it a minute to pull the images. You can watch the logs with: ```bash docker compose logs -f ``` ## Initial Nextcloud AIO Setup Once the master container is running, access the AIO admin interface at `https://your-server-ip:8080`. You'll get a self-signed certificate warning since this is the local admin panel, go ahead and accept it. > **Note:** The AIO interface on port 8080 is only for initial setup and administration. The actual Nextcloud instance that your users access goes through the NetBird reverse proxy on your configured domain. On first load, AIO gives you a passphrase. **Save this somewhere safe.** You'll need it to access the AIO admin panel in the future. Log in with the passphrase and you'll see the AIO dashboard. From here you can: 1. Verify the domain shows your configured domain (e.g., `nextcloud.netbird.example.com`) 2. Confirm the **NetBird IP range** (`100.64.0.0/10`) shows up under trusted proxies. We already set this in the compose file via `NC_TRUSTED_PROXIES`, so it should be populated automatically. If it's not, add it here manually. 3. Select which optional containers you want (Collabora for document editing, Talk for video calls, Imaginary for image previews, and so on) 4. Click **Start containers** to deploy everything AIO will pull and start all the selected containers. This can take a few minutes depending on your internet connection and how many optional containers you enabled. Once everything is green, Nextcloud is running. Now go to `https://nextcloud.netbird.example.com` in your browser. You should see the Nextcloud login page, served over HTTPS through your NetBird network. The initial admin credentials are shown in the AIO admin interface, so grab those and log in. ### Change Your Admin Password The first thing you should do after logging in is change the auto-generated admin password. Go to your profile in the top right, click **Administration Settings**, then navigate to **Security**. Enter the current password and set a new one that's strong and something you'll actually remember. Don't skip this — the default password is long, random, and easy to lose track of. And there we go. Nextcloud is running, storage is sorted, and it's accessible through a secure WireGuard tunnel with automatic TLS. No ports exposed to the public internet, no complex reverse proxy configs. ## Closing the Admin Port Once you've confirmed everything is working, you can optionally firewall port 8080 on the Ubuntu server so the AIO admin panel isn't accessible from the local network. You'll still be able to reach it if you need to by temporarily opening the port or SSHing in with a tunnel: ```bash ssh -L 8080:localhost:8080 user@your-server-ip ``` Then access it at `https://localhost:8080` from your local machine. ## What's Next From here, there's a lot you can do with Nextcloud: - **Install mobile and desktop clients** from [nextcloud.com/install](https://nextcloud.com/install/) and point them at your domain - **Enable two-factor authentication** in Nextcloud's security settings - **Set up Collabora** or **OnlyOffice** through the AIO interface for browser-based document editing - **Configure external storage** within Nextcloud to connect additional SMB/NFS shares, S3 buckets, or FTP servers The combination of Nextcloud AIO handling the application stack and NetBird handling the networking means you get a production-ready setup without the usual headaches of certificate management, port forwarding, and reverse proxy configuration. I do hope this guide was helpful. Have a great one.