I love nextcloud and have been using it for years. However recently I've considered taking my instance offline or at least behind a VPN because even if only 10% is true of what AI folks are claiming about LLMs finding exploits left and right, it seems super risky to be hosting your private data on nextcloud.
How do you folks deal with these massively increased threats to self-hosted open source apps?
Putting everything behind a VPN seems like the solution selfhosters have landed on. That way you have some control over how quickly you have to respond.
Host it in your home an use a vpn to connect to your home network when you are outside, that way it isn't exposed to the internet but you can still access it.
Yup, that's the way it has to be. And thanks to the autocomplete on steroids we call Ai nowadays it actually has become way easyier to do such a thing.
Kinda like how once chemistry gets complicated enough we call it biology, LLMs have become complicated/versatile enough that it's no longer useful to call them autocomplete.
Yeah definitely would put behind a VPN. I run mine on my desktop at home and use Tailscale (Headscale for self-hosting) to make it accessible when I'm out of the house. Blazing fast speeds when at home, and reasonable when not.
I use nextcloud all the time, my private instance works great and does everything I need it to. But I keep it behind a VPN. It’s got a lot of parts, and thus a lot of surface area. It may be secure but I just assume it isn’t. I rely on the VPN to be the security boundary.
When numbers are confusing, it's usually just a recalibration.
Hub 9 aligns with cloud 33. But they are switching Hub to a dated numbering scheme because it's intended to be timestamped. It's not "Hub 26" its "Hub 26 Spring" -- it's not a version number, it's a time.
The underlying Nextcloud keeps an incremental semver release version so it can be based on features rather than timeline. Because the Nextcloud version and Hub version aren't tied to each other.
This would be like saying that iPhones have a confusing naming scheme because iPhone 17 uses iOS 27 and has 2 different numbers. If next year's iPhone was called "iPhone 2027" and used "iOS 29", we'd still understand that.
NextCloud Notes is frustratingly broken for offline use. The UI bricks itself with its own error messages when it can't phone home to the server. Even notes which are marked in the app as "Make available offline" don't work offline!
The iOS applications also are quite poor. For example the home screen widget has never shown me any of my favorited items even though it should, I have many favorited items, it is fully synced when I'm on my home network, yet it says "no favorites".
Considering the size of NextCloud and how long they've been around I wish they would fully complete more of their offerings before launching a dozen new ones.
Nextcloud is great, I self-host an instance at home. I mostly use the calendar, address book, and file sharing with links a la Google Drive. It's probably heavier and slower than it should be for what it does, but it works.
Just like Home Assistant, it is a "must have" tool for self-hosters.
Lot's of people say that's a mess to maintain and too broken to actively use.
I often doubt if that's due to actual problems, or mix with that and bad decisions on the setup. Is dockering, keeping the data handling itself outside of it and a few other easy (or not so much) precautions enough to have a somewhat smoother sailing?
Also, how much time do you need to keep things from failing apart?
They have an “all in one” container that supposedly works out of the box.
I didn’t want to give it access to the docker socket, with the ability to spawn its own containers. So instead I just use the nextcloud container directly. (With several other containers, like DB, reverse proxy, collabora, etc) It’s a mess to configure, hence their recommendation to use their “all in one” setup. All sorts of weird defaults with documentation that says “this is the default but you should absolutely change it to do X instead so that it performs better”. Things like setting up a service to generate thumbnails, setting up redis, etc.
Once configured though, it mostly just works. You can’t let it auto update between major versions, but you probably should be doing that anyway. There are usually breaking changes and you have to manually run a command or two between major updates. That doesn’t happen too frequently though.
I can’t speak to the quality of the all-in-one setup. It’s likely easier than what I did - but also what’s the point of putting it in docker and also giving it control of docker? Seems to defeat the point of containerization.
I never had any issues with it. The Docker image is basically a turnkey solution. The only extra step was to set up nginx as a reverse proxy. I wouldn't deploy a complex piece of software like Nextcloud without Docker to be honest, and this is coming from someone who runs stuff bare metal when it is practical to do so.
This is a niche use, but I use the PhoneTrack app[1] with Nextcloud. It allows me to track my phone without relying on a third party service. It saved my ass already when I lost my phone in the park one night, and it's a nice way to track long hiking trips or road trips too as it saves the gpx and lets you export it:
I now use Nextcloud both for a family server and an academic lab. It has become such a daily part of my life, and I am really grateful for it. I just wish the network effects were stronger so I could benefit more from the federated features, and people didn't think it is so weird to get a Nextcloud link.
Seriously. I ran it on a server with two Xeon CPUs and 128GB of RAM. The web interface took minutes to do anything. Browsing a large photo library was just completely unworkable (and that was before they ripped out all the sorting and filtering features from the photo library).
My instance killed itself somehow, likely a failed auto update. I was, of course, using the default docker setup with the watchtower instance etc etc. I never got it to come back up, and I haven't missed it at all.
Even opening the damn login page took a good 30 seconds to load, there's no excuse for this kind of performance on a real-deal enterprise server.
I run it on a Hetzner vps with 4 vcpus, 16gb of ram that's also running multiple other containers. I haven't checked recently but most of that ram is free.
I'm not going to claim nextcloud is the snappiest app but I can open it right now, from across the world from my server as I'm on vacation, and it loads in <5s. I haven't done much tuning.
NextCloud needs tuning (mostly of php-fpm and caching ) oob to be fast/usable in my experience. Just throwing resources at it won't make it faster as the defaults are generally quite conservative.
As a side note, it's PHP so your single core clocks will generally be more relevant for latency than multi-core performance, feeding many cores requires a lot of divisble work.
Upgraded yesterday, I only use a small amount of features (files, memories, calendar, tasks). It sucks that tasks isn't compatible yet (but I mostly use DAVx⁵/Tasks.org as front-end), and it sucks that the landing page still pulls close to 20MB or so, but besides that, nothing to report one way or another.
> Your apps are now available via focused waffle menu for centralized access to all your apps. It reduces distraction and uses the interface space efficiently as your your library grows.
"your your" typo aside, I remember when Nextcloud moved from a drop-down menu for the apps to listing them all out separately on the header bar, to make them more visible and reduce the clicks to switch apps. I guess they've changed their minds again; I look forward to when they change them back.
I have maintained a Nextcloud server for a small business for the last 6 years.
I agree when I started using it early 2020 that the ui felt less modern, but after some updates down the road up until now it looks completely like it is from this era. Am I missing something?
However, I never complained about the UI neither then nor now.
NextCloud generally appears to use their own design system everywhere, Android apps are also not in Material or on iOS (iirc) in Cupertino. It makes for a subpar experience in general but is consistent.
That is not a compelling reason to overhaul a UI (which is something that should rarely, if ever, be done). If it works and is pleasant to use, what it looks like is of no consequence.
Been using Nextcloud exclusively for probably 4 years now? Before that it was a mix of nextcloud + Google Drive. It works for me really well, I can grab my files through my vpn with any of my computers when I am not at home.
GMKTec G9. Four NVMe slots, plus some internal memory to deploy TrueNAS. It only has 12GB of RAM, but has two ethernet cards, acceptable cooling and performance and has a small footprint.
SSDs shall be single sided and gonna need heatsinks, but I believe it works well and is not tied to any manufacturer for anything.
If you want go all-out get ASUSTOR's Ryzen based systems. You can use the stock firmware or disable it without wiping it and deploy TrueNAS on it. It's a beast.
TrueNAS has containers and applications and VM support so you can run any service you want on it.
I always had terrible trouble keeping it (and before it, Owncloud) updated and in sync with available dependencies on my Debian host. A few years ago, when I built a new NAS, I installed a snap, and that's been the ticket. It's pretty close to flawless now.
I'm not a huge "run everything in a container" guy, but Nextcloud is one of those things I absolutely will always run in a container. It's too much of a beast for me to have any desire to try to manage package versions and fixing it if something breaks.
When I ran OwnCloud (on Debian), I installed from their APT repo, and one "apt upgrade" handled everything. It was nice and easy, and I didn't have any problems with it.
NextCloud uses its own updater* (which I don't like), and aside from some recent MariaDB snafu it's been very low maintenance.
Yeah, I eventually gave up on self hosting Nextcloud because of incompatibilities with PHP(-FPM), iirc. They were always lagging behind and it became a hassle to mantain. I ended up replacing all the parts I used with other single purpose software, and it's been a better experience overall.
Arch Linux added php-legacy and php-fpm-legacy, which tracks (I think) the oldest supported PHP release, a couple of years ago. After I switched to that it's been pretty smooth sailing.
- Owncloud: The 'original' platform, written in php, still developed today
- Nextcloud: A fork of Owncloud (php) by some of the people that worked on it, including the project founder over directional differences, now more widely used than the original Owncloud
- Owncloud infinite scale (OCIS): An implementation of the Owncloud server in Go, with the goal of making it faster and more scalable than the PHP version
- Opencloud: A fork of Owncloud infinite scale (Go) after an acquisition of ownCloud, the company.
My biggest problem with Nextcloud is that it intentionally broke (at least twice by memory) on some updates, wanting me to run some oci command on the box. Remember that "for my family" also means "for my family when I'm gone." I never got round to having to find an alternative thanks to the divorce, but I'd consider Nextcloud a complete non-starter for this reason.
The good OwnCloud is abandoned, and instead they released some meme enterprise nonsense.
I'm running NextCloud, but I hesitate to call it good, because of its kitchen sink approach to features. I really want 2015 era OwnCloud with just files, it being PHP/MariaDB/Apache-based. I refuse to use anything that requires Docker, which is most of the slop alternatives currently available.
I run Nextcloud at home with 1.5TB of files and 2 users, on a reasonably sized server. It is painfully slow. Still better than OneDrive, but only just: synscing takes forever, never reaching a fraction of available bandwidth. Upload from my phone is flaky, often hangs and needs manual intervention. It is a battery drain. The whole experience with add-ons and the general UI feels like a 2010 PHP app.
I am grateful Nextcloud exists, but no app deserves a vibe coded Rust rewrite more than Nextcloud. Literally nothing to loose
This seems to be a really common issue with NextCloud. I'd say about 30% of installs seems to just..be slow? I've had this happen to me on a handful of installs, and i've had friends/collegues it's happened to.
I'm not aware of any "Fix" besides whiping your install(s) and trying again. Try not to use a backup if you can, as it can keep the slowness/lag across installs.
I love nextcloud and have been using it for years. However recently I've considered taking my instance offline or at least behind a VPN because even if only 10% is true of what AI folks are claiming about LLMs finding exploits left and right, it seems super risky to be hosting your private data on nextcloud.
How do you folks deal with these massively increased threats to self-hosted open source apps?
Putting everything behind a VPN seems like the solution selfhosters have landed on. That way you have some control over how quickly you have to respond.
Host it in your home an use a vpn to connect to your home network when you are outside, that way it isn't exposed to the internet but you can still access it.
Yup, that's the way it has to be. And thanks to the autocomplete on steroids we call Ai nowadays it actually has become way easyier to do such a thing.
Kinda like how once chemistry gets complicated enough we call it biology, LLMs have become complicated/versatile enough that it's no longer useful to call them autocomplete.
Yeah definitely would put behind a VPN. I run mine on my desktop at home and use Tailscale (Headscale for self-hosting) to make it accessible when I'm out of the house. Blazing fast speeds when at home, and reasonable when not.
I use nextcloud all the time, my private instance works great and does everything I need it to. But I keep it behind a VPN. It’s got a lot of parts, and thus a lot of surface area. It may be secure but I just assume it isn’t. I rely on the VPN to be the security boundary.
I only use my ownCloud instance behind Tailscale...
Nextcloud has the most confusing versioning of any software I have ever used.
Nextcloud Hub 26 is Nextcloud 34 and follows Nextcloud Hub 9 which is Nextcloud 33.
And I could be off on those exact numbers.
When numbers are confusing, it's usually just a recalibration.
Hub 9 aligns with cloud 33. But they are switching Hub to a dated numbering scheme because it's intended to be timestamped. It's not "Hub 26" its "Hub 26 Spring" -- it's not a version number, it's a time.
The underlying Nextcloud keeps an incremental semver release version so it can be based on features rather than timeline. Because the Nextcloud version and Hub version aren't tied to each other.
This would be like saying that iPhones have a confusing naming scheme because iPhone 17 uses iOS 27 and has 2 different numbers. If next year's iPhone was called "iPhone 2027" and used "iOS 29", we'd still understand that.
NextCloud Notes is frustratingly broken for offline use. The UI bricks itself with its own error messages when it can't phone home to the server. Even notes which are marked in the app as "Make available offline" don't work offline!
The iOS applications also are quite poor. For example the home screen widget has never shown me any of my favorited items even though it should, I have many favorited items, it is fully synced when I'm on my home network, yet it says "no favorites".
Considering the size of NextCloud and how long they've been around I wish they would fully complete more of their offerings before launching a dozen new ones.
Nextcloud is great, I self-host an instance at home. I mostly use the calendar, address book, and file sharing with links a la Google Drive. It's probably heavier and slower than it should be for what it does, but it works.
Just like Home Assistant, it is a "must have" tool for self-hosters.
What's your experience like?
Lot's of people say that's a mess to maintain and too broken to actively use.
I often doubt if that's due to actual problems, or mix with that and bad decisions on the setup. Is dockering, keeping the data handling itself outside of it and a few other easy (or not so much) precautions enough to have a somewhat smoother sailing?
Also, how much time do you need to keep things from failing apart?
They have an “all in one” container that supposedly works out of the box.
I didn’t want to give it access to the docker socket, with the ability to spawn its own containers. So instead I just use the nextcloud container directly. (With several other containers, like DB, reverse proxy, collabora, etc) It’s a mess to configure, hence their recommendation to use their “all in one” setup. All sorts of weird defaults with documentation that says “this is the default but you should absolutely change it to do X instead so that it performs better”. Things like setting up a service to generate thumbnails, setting up redis, etc.
Once configured though, it mostly just works. You can’t let it auto update between major versions, but you probably should be doing that anyway. There are usually breaking changes and you have to manually run a command or two between major updates. That doesn’t happen too frequently though.
I can’t speak to the quality of the all-in-one setup. It’s likely easier than what I did - but also what’s the point of putting it in docker and also giving it control of docker? Seems to defeat the point of containerization.
I never had any issues with it. The Docker image is basically a turnkey solution. The only extra step was to set up nginx as a reverse proxy. I wouldn't deploy a complex piece of software like Nextcloud without Docker to be honest, and this is coming from someone who runs stuff bare metal when it is practical to do so.
This is a niche use, but I use the PhoneTrack app[1] with Nextcloud. It allows me to track my phone without relying on a third party service. It saved my ass already when I lost my phone in the park one night, and it's a nice way to track long hiking trips or road trips too as it saves the gpx and lets you export it:
https://github.com/julien-nc/phonetrack
I now use Nextcloud both for a family server and an academic lab. It has become such a daily part of my life, and I am really grateful for it. I just wish the network effects were stronger so I could benefit more from the federated features, and people didn't think it is so weird to get a Nextcloud link.
Lab use: https://git.medlab.host/MEDLab/Handbook/src/branch/main/docs...
Personal use: https://nathanschneider.info/2026/06/toward-a-durable-writin...
I left nextcloud because how slow it felt even on my beefy server. I switched to opencloud.eu, it might have less features but it's just what I needed
Seriously. I ran it on a server with two Xeon CPUs and 128GB of RAM. The web interface took minutes to do anything. Browsing a large photo library was just completely unworkable (and that was before they ripped out all the sorting and filtering features from the photo library).
My instance killed itself somehow, likely a failed auto update. I was, of course, using the default docker setup with the watchtower instance etc etc. I never got it to come back up, and I haven't missed it at all.
Even opening the damn login page took a good 30 seconds to load, there's no excuse for this kind of performance on a real-deal enterprise server.
I run it on a Hetzner vps with 4 vcpus, 16gb of ram that's also running multiple other containers. I haven't checked recently but most of that ram is free.
I'm not going to claim nextcloud is the snappiest app but I can open it right now, from across the world from my server as I'm on vacation, and it loads in <5s. I haven't done much tuning.
NextCloud needs tuning (mostly of php-fpm and caching ) oob to be fast/usable in my experience. Just throwing resources at it won't make it faster as the defaults are generally quite conservative.
They even have a specific guide for this topic, https://docs.nextcloud.com/server/stable/admin_manual/instal...
As a side note, it's PHP so your single core clocks will generally be more relevant for latency than multi-core performance, feeding many cores requires a lot of divisble work.
Upgraded yesterday, I only use a small amount of features (files, memories, calendar, tasks). It sucks that tasks isn't compatible yet (but I mostly use DAVx⁵/Tasks.org as front-end), and it sucks that the landing page still pulls close to 20MB or so, but besides that, nothing to report one way or another.
> Your apps are now available via focused waffle menu for centralized access to all your apps. It reduces distraction and uses the interface space efficiently as your your library grows.
"your your" typo aside, I remember when Nextcloud moved from a drop-down menu for the apps to listing them all out separately on the header bar, to make them more visible and reduce the clicks to switch apps. I guess they've changed their minds again; I look forward to when they change them back.
I love Nextcloud but I feel like they should really completely redo their UI. It just doesn't look like something from this decade.
Wait, you don't feel so?
I have maintained a Nextcloud server for a small business for the last 6 years. I agree when I started using it early 2020 that the ui felt less modern, but after some updates down the road up until now it looks completely like it is from this era. Am I missing something? However, I never complained about the UI neither then nor now.
NextCloud's macOS app is implemented in a way that completely disregards any UI guidelines or just common sense for the platform.
Developers either don't use macOS at all, or don't care.
But functionally it works for our small team.
NextCloud generally appears to use their own design system everywhere, Android apps are also not in Material or on iOS (iirc) in Cupertino. It makes for a subpar experience in general but is consistent.
That is not a compelling reason to overhaul a UI (which is something that should rarely, if ever, be done). If it works and is pleasant to use, what it looks like is of no consequence.
Been using Nextcloud exclusively for probably 4 years now? Before that it was a mix of nextcloud + Google Drive. It works for me really well, I can grab my files through my vpn with any of my computers when I am not at home.
If I want to buy a small NAS that just runs Nextcloud and has a copy of my Google Photos library - what do I go with?
I don't have a ton of space so something that fits in the media center.
If you’re going to run your own NAS then consider swapping Google Photos out with Immich.
I know it’s not the question you asked but I feel not enough people know about it as an option and it’s really as good as Google Photos.
GMKTec G9. Four NVMe slots, plus some internal memory to deploy TrueNAS. It only has 12GB of RAM, but has two ethernet cards, acceptable cooling and performance and has a small footprint.
SSDs shall be single sided and gonna need heatsinks, but I believe it works well and is not tied to any manufacturer for anything.
If you want go all-out get ASUSTOR's Ryzen based systems. You can use the stock firmware or disable it without wiping it and deploy TrueNAS on it. It's a beast.
TrueNAS has containers and applications and VM support so you can run any service you want on it.
I have a g9 and cooling is fine, but not great. I ended up opening it up and placing heatsinks on hot chips
Google photos will become one way sync only in august. You can upload to cloud, but no sync to pc.
How is OpenCloud a serious competitor?
Maybe I'm alone but nextcloud has gone from being kinda flaky and annoying to really great the past few years.
I don't think I really push it, but I find it just right for self-hosting my calendar, contacts, photos, and files.
I'd agree that it has gotten better over time. I'm glad we have Nextcloud around.
I always had terrible trouble keeping it (and before it, Owncloud) updated and in sync with available dependencies on my Debian host. A few years ago, when I built a new NAS, I installed a snap, and that's been the ticket. It's pretty close to flawless now.
I'm not a huge "run everything in a container" guy, but Nextcloud is one of those things I absolutely will always run in a container. It's too much of a beast for me to have any desire to try to manage package versions and fixing it if something breaks.
When I ran OwnCloud (on Debian), I installed from their APT repo, and one "apt upgrade" handled everything. It was nice and easy, and I didn't have any problems with it.
NextCloud uses its own updater* (which I don't like), and aside from some recent MariaDB snafu it's been very low maintenance.
Yeah, I eventually gave up on self hosting Nextcloud because of incompatibilities with PHP(-FPM), iirc. They were always lagging behind and it became a hassle to mantain. I ended up replacing all the parts I used with other single purpose software, and it's been a better experience overall.
Arch Linux added php-legacy and php-fpm-legacy, which tracks (I think) the oldest supported PHP release, a couple of years ago. After I switched to that it's been pretty smooth sailing.
Is nextcloud the good one and owncloud the inferior one?
The breakdown as I understand is as follows:
- Owncloud: The 'original' platform, written in php, still developed today
- Nextcloud: A fork of Owncloud (php) by some of the people that worked on it, including the project founder over directional differences, now more widely used than the original Owncloud
- Owncloud infinite scale (OCIS): An implementation of the Owncloud server in Go, with the goal of making it faster and more scalable than the PHP version
- Opencloud: A fork of Owncloud infinite scale (Go) after an acquisition of ownCloud, the company.
My biggest problem with Nextcloud is that it intentionally broke (at least twice by memory) on some updates, wanting me to run some oci command on the box. Remember that "for my family" also means "for my family when I'm gone." I never got round to having to find an alternative thanks to the divorce, but I'd consider Nextcloud a complete non-starter for this reason.
Find an alternative.
I don’t know about owncloud, but I have been hosting a family Nextcloud instance for a little under two years and it works fine.
It’s boring. It works.
same here, great choice for a private family cloud.
Nextcloud is written in PHP, which doesn't sound scalable to me.
OwnCloud is written in Go but employs an open-core model. Some features are locked behind a proprietary paywall.
“OwnCloud infinite scale” is written in Go. But ownCloud 10 is php.
I tried for weeks to get OCIS working but gave up and went back to ownCloud 10.
They’re committed to security updates for 10 but it’s a small company. I doubt it will get much attention sadly.
Shared nothing is no scaleable?
> Nextcloud is written in PHP, which doesn't sound scalable to me.
Lol what? Facebook (pre Hack), Tumblr, Wordpress, Etsy...
Nextcloud and Wordpress both suffer massively from technical debt.
The good OwnCloud is abandoned, and instead they released some meme enterprise nonsense.
I'm running NextCloud, but I hesitate to call it good, because of its kitchen sink approach to features. I really want 2015 era OwnCloud with just files, it being PHP/MariaDB/Apache-based. I refuse to use anything that requires Docker, which is most of the slop alternatives currently available.
I run nextcloud on a NixOS server within a systemd container, so no Docker.
You can remove almost app in Nextcloud. It is pretty modular. You can have a files only Nextcloud, last time I tried.
Am I the only one who doesn’t trust Nextcloud because they use Vimeo instead of a privacy-respecting CDN to showcase videos of their project?
Yes, you are the only one.
I run Nextcloud at home with 1.5TB of files and 2 users, on a reasonably sized server. It is painfully slow. Still better than OneDrive, but only just: synscing takes forever, never reaching a fraction of available bandwidth. Upload from my phone is flaky, often hangs and needs manual intervention. It is a battery drain. The whole experience with add-ons and the general UI feels like a 2010 PHP app.
I am grateful Nextcloud exists, but no app deserves a vibe coded Rust rewrite more than Nextcloud. Literally nothing to loose
This seems to be a really common issue with NextCloud. I'd say about 30% of installs seems to just..be slow? I've had this happen to me on a handful of installs, and i've had friends/collegues it's happened to.
I'm not aware of any "Fix" besides whiping your install(s) and trying again. Try not to use a backup if you can, as it can keep the slowness/lag across installs.
It's really annoying.
At that point it would be so painful it'd prompt users to switch to competing software.
The whole NextCloud suite seems to have this problem of too many offerings that don't get polished to completion.
Opencloud is the golang rewrite and is much faster.
Look into "next cloud HPB" (High performance backend) https://github.com/nextcloud/notify_push