Deploy Nextcloud with the nextcloud-files template

Stand up Nextcloud, an open-source file-sync and collaboration platform, on a single Quake AI instance using the validated OpenTofu template nextcloud-files. You apply the template, serve it over HTTPS through Caddy, set the trusted domain and admin bootstrap credentials, log in, upload a file and create a share link, and invite a teammate.

Nextcloud keeps your team's files on infrastructure you own. You run it yourself; this is a self-hosted tool you operate, not a managed multi-tenant service.

Prerequisites#

You need:

• OpenTofu 1.6.0 or later (or Terraform 1.6.0 or later) installed locally.
• Your OpenStack credentials sourced into the shell (source openrc.sh). See the OpenStack CLI guide.
• An SSH keypair that already exists in your project. Record its name for the key_name variable.
• A copy of the nextcloud-files template directory from the template reference page.
• A domain you can point at the instance.

Step 1: Apply the template#

Copy the template's example variables file and set key_name:

cp terraform.tfvars.example terraform.tfvars

key_name = "YOUR_KEY_NAME"

Initialize, preview, and apply:

tofu init
tofu plan
tofu apply

OpenTofu provisions a private network, a router, a security group, a block volume mounted at /var/lib/docker, an instance, and a floating IP. On first boot, cloud-init installs Docker Engine, generates the MariaDB root/app passwords and the Redis password into /opt/nextcloud/.env, and starts only db and redis. Nextcloud rejects requests for hosts not on its trusted-domain list, so the app container waits until you finish configuration.

Read the outputs and record floating_ip:

tofu output

Step 2: Point a domain at the host and serve HTTPS with Caddy#

1. Create a DNS A record for your domain (for example files.example.com) pointing at YOUR_FLOATING_IP. Follow How to point a domain at a Quake AI resource. Wait until it resolves:

dig +short files.example.com

1. SSH to the instance and create /opt/nextcloud/Caddyfile:

files.example.com {
  reverse_proxy 127.0.0.1:8080
}

1. Add Caddy to /opt/nextcloud/docker-compose.yml:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/nextcloud/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
volumes:
  caddy_data:

For background on certificates, see How to issue and auto-renew a TLS certificate with Let's Encrypt.

Step 3: Set the trusted domain and start Nextcloud#

Edit /opt/nextcloud/.env and uncomment and set:

NEXTCLOUD_ADMIN_USER=admin
NEXTCLOUD_ADMIN_PASSWORD=CHOOSE_A_STRONG_PASSWORD
NEXTCLOUD_TRUSTED_DOMAINS=files.example.com
OVERWRITEPROTOCOL=https
OVERWRITECLIURL=https://files.example.com

Start the full stack:

cd /opt/nextcloud
sudo docker compose up -d

Step 4: Log in with the admin account#

Open https://files.example.com and log in with the NEXTCLOUD_ADMIN_USER/NEXTCLOUD_ADMIN_PASSWORD you set in step 3.

Step 5: Upload a file and create a share link#

1. Select Upload, choose a file from your machine, and confirm.
2. Hover the uploaded file, select Share, then Create link.
3. Copy the generated link.

Step 6: Invite a teammate#

1. Select the account menu in the top right and choose Users.
2. Select New user, enter a username and password for your teammate, and confirm.
3. Share the login URL and the credentials with your teammate directly.

What you built#

• Applied the nextcloud-files template to provision a network, security group, data volume, instance, and floating IP, with MariaDB and Redis started automatically by cloud-init
• Served Nextcloud over HTTPS by pointing a domain at the floating IP and routing it through a Caddy reverse proxy
• Set the trusted domain and admin bootstrap credentials and started the Nextcloud app container
• Logged in with the admin account
• Uploaded a file, created a share link, and invited a teammate

Scope of this deployment#

This template runs a single-VM Nextcloud host, not a managed multi-tenant file-storage service. The instance is CPU-only and runs in one region, and it bundles MariaDB and Redis as containers on the same host, sized for a small team. You operate the instance, Docker, Nextcloud, the database, and the data volume yourself: back them up, patch them, and grow the attached volume as your team's file storage usage grows.

Next steps#

• Nextcloud files and collaboration template: the template reference, parameters, and resource map
• Mattermost team-chat template: another ops-tools template with the same domain-first setup pattern
• Security hardening checklist: tighten SSH access and exposure before you connect production traffic

Clean up#

When you no longer need the deployment, destroy everything the template created:

tofu destroy

Then remove the DNS A record you created in step 2. Because Nextcloud and its database both live on the instance and its attached volume, tofu destroy removes them along with the infrastructure.