Halloween at Nexthosting: 10% off game servers with the code – until November 1
A practical guide to choosing AIO or manual for Nextcloud on a VPS. AIO cuts maintenance but exposes the Docker socket. Includes hardening and backups.
For most readers, Nextcloud AIO is the recommended method for installing Nextcloud on a VPS. The reason is the combination of Docker, a preconfigured Redis, and automatic backups, which rules out many sources of error from the start. If, on the other hand, you need full control over individual software versions, an existing reverse proxy, or a specific MariaDB configuration, you should choose the manual installation.
In short:
- For low maintenance effort and ease of use, Nextcloud AIO is the better choice because it offers automatic updates and ready-made all-in-one containers.
- If you have specific requirements for PHP, database, or proxy configurations, a manual installation with your own components is the better fit.
- Before installing, check the operating system, resources, domain, SSH access, snapshots, and backups to avoid errors.
- The Docker installation requires setting up the master container with full access to the Docker socket, which can pose security risks.
- For optimal performance, Redis caching, PHP OPcache, tuned database settings, and fast NVMe SSDs are recommended.
Both routes lead to the same goal, but they differ significantly in effort and in the control you have afterward. Nextcloud All-In-One bundles the web server, database, Redis, Collabora Online, and a backup tool into one master container and can be updated through a web interface. The manual route using LAMP or nginx with PHP-FPM, on the other hand, gives you control over every individual component, but in return you have to take care of updates, compatibility, and security vulnerabilities yourself.
Maintenance is where the biggest difference shows: AIO notifies you of new versions in its web interface and updates most containers with a few clicks. With a manual installation, you have to maintain PHP, the web server, and the database separately, which takes more time but also allows finer control.
In terms of security, AIO has one particularity: the master container mounts the Docker socket in order to control other containers. This is functionally necessary, but a real risk if the container is compromised. Manual setups do not have this risk, but other pitfalls lurk there, such as incorrectly set file permissions or open ports that you have to secure yourself.
In practice:
Before you get started, you should work through a short checklist. Missing preparation is the most common reason an installation gets stuck halfway through.
If you clarify these five points in advance, you will get through the actual installation much faster, whether you choose AIO or the manual variant.
The Docker-based installation is now the method recommended by Nextcloud itself and takes just a few clearly defined steps.
First, you need Docker on your VPS. Use docker --version to check whether it is already installed; otherwise, install it from the official Docker repository for Debian or Ubuntu. Then create a working directory where the configuration data will be stored later:
mkdir -p /opt/nextcloud-aio
cd /opt/nextcloud-aio
The actual start is done with a single docker run command that creates the master container:
sudo docker run \
--init \
--sig-proxy=false \
--name nextcloud-aio-mastercontainer \
--restart always \
--publish 8080:8080 \
--env APACHE_PORT=11000 \
--env APACHE_IP_BINDING=0.0.0.0 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
ghcr.io/nextcloud-releases/all-in-one:latest
Three things matter here: the volume nextcloud_aio_mastercontainer stores the configuration persistently, the docker.sock mount allows the master container to control other containers, and port 8080 opens the setup interface. This socket mount is exactly the point where Nextcloud itself openly acknowledges that the master container thereby gains far-reaching privileges on the host. This is not a bug but architecture, yet you should be aware of it before you set up AIO on a server used in production.
After the start, open https://your-server-ip:8080, enter your domain, and follow the guided setup. AIO takes care of the Let’s Encrypt certificate on its own, provided the domain points correctly to your server.
sudo ss -tulpn | grep -E '443|80|8080' helps you find the blocking process.APACHE_PORT to an internal port such as 11000 and let your proxy handle TLS termination.Pro tip: Place the Docker volume for the master container on a separate, regularly backed-up partition from the start. If the container is lost, the entire AIO configuration is gone with it, not just the Nextcloud data itself.
If you prefer full control, you build Nextcloud the classic way on a web server, PHP-FPM, and a database. The following sequence follows the official Nextcloud Administration Manual and works almost identically on Debian and Ubuntu.
apt update && apt upgrade, then install nginx or Apache as well as PHP-FPM with the required extensions, such as php-gd, php-mysql, php-curl, php-mbstring, php-intl, php-imagick, and php-redis.CREATE DATABASE nextcloud; CREATE USER 'nextclouduser'@'localhost' IDENTIFIED BY 'YourPassword';./var/www/nextcloud, and set the ownership to the web server user, usually www-data.certbot --nginx -d your-domain.com. Certbot automates both the issuance and the later renewal of the certificate.config.php so that Nextcloud uses it for file locking and caching instead of the slower database variant.occ with the cron job every five minutes, since Nextcloud otherwise falls back to the slower AJAX mode.This sequence is deliberately chosen so that each component builds on the previous one. If you skip a step, such as Redis, you will notice it at the latest when several users are active at the same time, through noticeably slower load times in the interface.
Without a working domain, neither AIO nor a manual installation can get a valid certificate. A standard domain with an A record pointing to the VPS IP is the simplest way. Alternatively, dynamic DNS works if your IP address changes occasionally. If you do not want public accessibility, you can run Nextcloud via Tailscale or a Cloudflare Tunnel instead and thereby avoid opening ports 80 and 443 altogether.
The Certbot workflow runs via an HTTP challenge: Let’s Encrypt checks whether your server is reachable at the specified domain before it issues the certificate. If that fails, it is almost always due to an incorrect DNS record or a port 80 that is already in use.
For operation behind a reverse proxy, you have several options:
If AIO runs behind your own proxy, you must set APACHE_PORT to an internal port and must not let the master container additionally occupy ports 80/443. If you open ports directly on the router or in the firewall, you should generally only allow 80 and 443; all other services are better left hidden behind the firewall.
A freshly installed Nextcloud instance is functional but not yet production-ready. Security headers such as HSTS are often missing by default, as are correctly set file permissions. Practical guides stress that a secure Nextcloud does not come about automatically but needs active hardening, such as HSTS headers, restrictive file permissions, and protection against brute-force login attempts.
Right after the installation, you should work through the following points:
occ security:setupchecks and work through the warnings in the admin area systematically.Backup is where most self-hosters fail. Many only back up the data directory and overlook the database and the config.php, which in an emergency results in an unusable backup. A complete backup strategy covers three things: the data directory with the actual files, a dump of the database, and the configuration file. For automation, a tool such as Borg is suitable, which AIO already includes; with manual installations, you set it up separately via a cron job.
The order matters when restoring: first you restore the database dump, then you copy the data directory, and finally you check the config.php for consistency. If you swap this order, you risk an instance that starts but can no longer bring files and database together.
Performance problems almost always come from the same two causes: missing Redis caching and untuned database settings. AIO comes with Redis preconfigured out of the box; with manual installations, you have to set it up yourself and link it in the config.php.
For a noticeably more responsive instance, the following adjustments are worthwhile:
imagick so that preview images are generated quickly.innodb_buffer_pool_size to about 50 to 70% of the available RAM, provided the database runs alone on the server.When it comes to maintenance, AIO and the manual installation differ significantly: AIO shows new versions in the web interface and updates most components automatically, whereas with a manual installation you have to keep PHP, the web server, and the database up to date separately. In both cases, plan fixed maintenance windows in which you apply updates, and enable automatic security updates at the operating system level so that critical vulnerabilities do not stay open for days.
Pro tip: After every major update, check the status with occ status and occ security:setupchecks. This way you find configuration problems before they turn into real outages.
Running Nextcloud on a rented VPS spares you the network connectivity, power supply, and redundancy that your own hardware at home never offers at the same quality. A server location in Germany reduces latency for users in the region and simplifies data protection questions, especially when customers or employees access the instance. Nexthosting offers VPS plans with NVMe SSD storage and DDoS protection, suitable both for a personal AIO instance and for a manually set up Nextcloud with several active users.
— Erik
Whether you choose Nextcloud AIO or the manual installation, the foundation stays the same: a reliable VPS with enough RAM, fast SSD storage, and a stable connection. This is exactly where the difference lies between a VPS you find somewhere on offer and one designed specifically for responsive operation. Nexthosting offers VPS servers with NVMe SSD and DDoS protection, plus a control panel that lets you manage Docker containers and classic LAMP setups alike.
For a small personal instance with AIO, the VPS Einfach is often enough. If you plan on Collabora Online, Talk, or several active users, you will find more headroom in RAM and compute power with the VPS Standard or the more powerful VPS Pro. If you are still missing a suitable domain for your Let’s Encrypt certificate, it can be set up directly when you order the server. Take a look at the VPS offers from Nexthosting and choose the plan that fits your expected number of users, or contact support directly if you have questions.
AIO is clearly the easier choice for beginners because Docker, Redis, and backup come preconfigured. A manual installation mainly makes sense if you already have experience with web servers and databases.
For a small personal or team instance, a modest amount of RAM is usually enough. For AIO with Collabora Online or several active users, you should plan for more RAM. The exact requirement depends heavily on the number of users and the additional services you enable.
In practice, yes, because AIO obtains a valid certificate for the domain you enter. Alternatives are dynamic DNS or a tunnel service such as Tailscale if you do not want to use a public domain.
A complete backup covers three things: the data directory, a dump of the database, and the config.php file. If you only back up the files, a database failure still costs you all metadata and user accounts.
In principle, yes, as long as the VPS offers enough RAM and storage and runs a current Debian or Ubuntu release. A VPS with NVMe SSD storage and a stable network connection, such as one from Nexthosting, noticeably improves response times when many users are connected at the same time.