> ## Content Index > Fetch the complete content index at: https://voidyapp.ing/llms.txt > Use this file to discover other available public pages before exploring further. # Your own cloud on a mini PC: a Nextcloud setup guide - URL: https://voidyapp.ing/your-own-cloud-on-a-mini-pc-a-nextcloud-setup-guide/ - Published: 2026-10-19T18:43:27.000Z - Updated: 2026-10-19T18:43:27.000Z - Description: Turn a mini PC into your own cloud with Ubuntu Desktop and Nextcloud AIO. Start on your home network, set up encrypted backups, and add public sharing or private remote administration when needed. - Author: Sebastian Wallat - Tags: nextcloud, notes, homelab *Recently a friend of mine asked me about setting up a Nextcloud server with your hardware. In general you can expect that the articles on this blog are written heavily with AI support, even up to “vibe writing”. Yes, I know that some might call it AI slop… Well, I'll do it anyway. At least to have all my memories and projects in order. If it helps somebody else: even better.* *This article is for you, Stefan ;-)* ![Setup overview: personal devices connect to Nextcloud on an Ubuntu mini PC, with backups on a second mini PC and an additional off-site copy.](https://voidyapp.ing/content/images/2026/10/clipboard.png) A friend asked me how to turn a mini PC into a personal cloud. The goal is straightforward: keep files in one place, access them from a phone or laptop, and share a link when someone needs a copy. This guide explains the choices and the installation without assuming you have used Linux or a terminal before. The setup uses Nextcloud on one mini PC and a second machine for backups. You can also begin with one server and an external backup drive. Before installing anything, it is worth deciding whether you want to operate the server yourself or pay someone to run Nextcloud for you. Both options use the same software, but they place very different demands on your time. ## Why use Nextcloud? Files tend to end up spread across phones, laptops, email attachments, and shared folders. Finding the current version becomes harder as that collection grows. Nextcloud provides a central place to store them. Its desktop client can synchronize selected folders with your computer, while its web interface gives you access from another device. The mobile app lets you browse and upload files without first copying them to a laptop. Sharing is another reason to use it. Instead of emailing a large attachment, you can send a link to a file or folder. You can set an expiration date or require a password for a shared link. A shared folder can remain available while its contents change, so recipients do not need a new email every time you update a document. Give people only the access they need and remove old links when the exchange is finished. Nextcloud can also hold calendars and contacts and, with additional components, support document editing in the browser. Start with file storage and synchronization. Adding every available app at once makes it harder to understand what is running and what needs maintenance. The [Nextcloud Files overview](https://nextcloud.com/files/?ref=voidyapp.ing) explains the core file features. ### What you gain by running it at home With a home server, you decide where the main copy of your data lives, which accounts exist, and how long backups are retained. You can add storage when the hardware allows it and choose your own backup destination. For a household with existing hardware and a growing collection of files, this can be more flexible than moving to the next storage subscription tier. Your use of the software is not tied to a single storage provider's account. Nextcloud is open source, and you can move to another server or a managed Nextcloud provider later. Moving an installation still takes planning: files, calendars, account settings, and shared links do not all migrate in the same way. Using your own domain can help keep the public address consistent if you change where the service runs. Local storage can also be useful for large transfers at home. The connection between your computer and the server can be much faster than your internet upload connection. That benefit depends on how you access the server: a public address routed through a tunnel may send traffic outside your home even when you are sitting next to the machine. ### Privacy depends on the whole setup Keeping the main storage at home reduces the number of providers holding a copy of your files. It does not automatically make the installation private or secure. A public share link gives its recipient access; a compromised administrator account can expose data; and a tunnel provider that terminates HTTPS can process the traffic passing through it. HTTPS protects data while it travels. It does not, by itself, encrypt the server's disk or make files unreadable to a server administrator. Encrypted backups protect a different copy of the data. These are separate protections, and choosing home hosting does not remove the need to configure them. ### Is self-hosting cheaper? Nextcloud's community server software does not require a recurring software subscription. Running it still costs money. Count electricity, backup storage, hardware replacement, and any domain or remote backup service. If you already own the mini PCs, your initial cost can be low. Buying two machines solely to avoid a small monthly subscription changes the calculation considerably. For example, assume one server averages 10 watts at the wall. Running it continuously uses 87.6 kWh per year. At an assumed electricity price of €0.35 per kWh, that is about €30.66 a year. Two machines averaging 10 watts each would cost about €61.32 a year in electricity. These are examples, not measurements of your hardware; external drives, workload, and power settings change the result. Time matters too. An update that needs troubleshooting can use up an evening. If you enjoy learning how the system works, that time may be part of the reason to self-host. If you only want dependable file sharing, a managed service may be the better purchase. Section 8 compares the costs and responsibilities before you commit. The setup below uses one mini PC for Nextcloud and a second for backups. You can use the second machine to practice the installation first. Allow a weekend for the initial setup. There are several stages, including commands you will enter in a terminal. ### What you need - One mini PC for Nextcloud and, for the remote-backup route, a second mini PC with enough free storage. Use 8 GB RAM as a starting point for a modest installation; 16 GB gives Ubuntu Desktop and optional apps more room. - A USB stick, 8 GB or larger (it will be wiped) - A monitor, keyboard and mouse, only for the installation - Your laptop, to control the server afterward - A hostname and valid HTTPS certificate for AIO. A purchased domain is optional: a free DNS name can also work. A domain alone does not make the server publicly reachable. - An external USB hard drive for backups, ideally bigger than all the data you plan to store ## Choose your access model first Running the machine in your homelab does not require Tailscale. While your laptop and the server are on the same home network, SSH connects directly to the server’s LAN address. Nextcloud can also stay entirely within that network; AIO still needs a hostname and a valid HTTPS certificate. - **Home network only:** start with local DNS and HTTPS. Do not create router port-forwarding rules. Section 3 explains the local AIO route. - **Public Nextcloud, private administration:** students open your Nextcloud HTTPS address in a normal browser. Publish only the application as described in section 6\. Keep SSH and the AIO management page private. - **Optional access while away:** your router’s WireGuard VPN or Tailscale can let your own devices reach private services. This can carry SSH, Nextcloud, or both; it is not limited to terminal access. If public Nextcloud already works, its users do not need a VPN. Choose one route before starting AIO. This guide begins with the home-network setup. Public access is an optional extension; Tailscale is not a prerequisite. ## 1\. The operating system Install Linux on the first mini PC to run Nextcloud. The installation described below replaces the existing operating system and erases the disk. Ubuntu Desktop provides a graphical login, file manager, browser, and settings app on the mini PC. You can use its local Terminal app for the commands in this guide. The Nextcloud service runs in the background, independently of whether a desktop window is open. Before creating the installer, copy anything you want to keep from the mini PC to another device and check that you can open it there. The disk selection in the installer is destructive. If several drives are connected, disconnect any backup drive before installation so you cannot select it by mistake. ### Use Ubuntu Desktop 26.04 LTS For this guide, I recommend Ubuntu Desktop 26.04 LTS. The desktop gives a first-time Linux user familiar tools while leaving SSH available for administration from a Windows laptop. Download the LTS release, not an interim release. This guide uses the standard Ubuntu desktop rather than Ubuntu Server. A desktop uses additional memory, disk space, and update bandwidth. That tradeoff is reasonable here if the mini PC has enough resources for Ubuntu and the Nextcloud components you enable. With 8 GB of RAM, begin with a small set of optional Nextcloud apps and monitor memory use; 16 GB leaves more room. You can keep a monitor and keyboard connected for as long as they help. Ubuntu Server is an alternative for someone comfortable managing a machine entirely through remote tools, but it is not the installation path followed below. A local desktop does not automatically provide a remote desktop on Windows. SSH gives you a text session; your browser opens the Nextcloud and AIO web interfaces. A full graphical remote session requires separate setup and is optional. You do not need it to follow this guide. ### Making the installer stick 1. Download the 64-bit Ubuntu Desktop LTS ISO from [ubuntu.com/download/desktop](https://ubuntu.com/download/desktop?ref=voidyapp.ing). For a typical Intel or AMD mini PC, choose the Intel/AMD image. 2. Install [balenaEtcher](https://etcher.balena.io/?ref=voidyapp.ing) or [Rufus](https://rufus.ie/?ref=voidyapp.ing) on the Windows computer used to prepare the USB stick. 3. Select the downloaded ISO and the correct USB stick, then write the image. The stick will be erased. Wait for writing and verification to finish before removing it. An ISO is a disk image containing the installer. Flash it with the imaging tool; copying the ISO onto the stick as an ordinary file does not make it bootable. ### Installing Plug stick, monitor and keyboard into mini PC number one and switch it on. You'll probably have to press a key during boot to pick the USB stick as boot device, typically `F12`, `F7`, `Esc` or `Del` depending on the manufacturer; the boot screen usually tells you. If Windows starts, you missed it. Reboot, try again. Use the graphical installer. The [official Ubuntu Desktop walkthrough](https://ubuntu.com/desktop/docs/en/latest/tutorial/install-ubuntu-desktop/?ref=voidyapp.ing) shows the current screens. Work through these choices: 1. Select your language and keyboard layout, then connect to the network. 2. Choose the interactive installation and the default application selection. 3. For a dedicated server, choose the option to erase the selected disk and install Ubuntu. Check the selected drive carefully before confirming; this removes its existing data. 4. Create your user account, choose a strong password, and set a computer name such as `cloud`. Record the username; the SSH examples use `tom` as a placeholder. 5. Choose your location and time zone, review the summary, and start installation. Follow the restart prompt and remove the USB stick when instructed. Log in to the Ubuntu desktop with the account you created. Open Settings to check the network connection and power settings. Disable automatic suspend while plugged in so the server remains reachable. Locking the screen or turning off the display is fine; suspending the computer stops normal server access. ### Before the first command: using a terminal A terminal is a window where you type instructions instead of choosing them from menus. You do not need programming experience for this guide. You do need to know which computer will run each command and how to tell when it has finished. For the first commands, use the monitor and keyboard attached to the mini PC. Open Ubuntu Terminal with Ctrl-Alt-T, or search for Terminal in the application overview. Commands typed there run on the Ubuntu machine. Later, SSH lets you run commands on that same machine from your Windows computer. On Windows, open the Start menu, type PowerShell, and open it. On macOS, open Spotlight with Command-Space, type Terminal, and press Enter. On Linux, open your distribution's Terminal app. These instructions refer to the laptop unless they explicitly say to run a command on the server. A terminal usually displays a prompt such as `tom@cloud:~$`. The text before the cursor identifies the user and computer. Do not copy the prompt into a command. The command blocks in this guide omit it so you can copy the command itself. For separate single-line commands, paste one command, press Enter and wait for the prompt to return. A block containing line-continuation backslashes or a here-document ending in `EOF` is one multi-line input: copy the entire block, including its final line, together. The Docker package-source example below contains such a block. Some commands produce no output. When Linux asks for a password, it usually shows neither characters nor dots; type the password and press Enter. Commands are case-sensitive. Keep spaces, quotation marks, and punctuation as shown. A command starting with `sudo` requests administrator privileges, so read the explanation before running it. If the output contains an error, stop at that step and keep the message for troubleshooting. Repeating later commands usually makes the original problem harder to identify. If a running command appears stuck, Ctrl-C usually interrupts it. Avoid interrupting a package installation while it is changing software. To close a remote SSH session when you are finished, type `exit` and press Enter. This disconnects the terminal; it does not shut down the server. Throughout the examples, `tom` is a sample username and `192.168.1.50` is a sample server address. Replace them with the username you created and the address shown by your router. Keep a short setup note with those values and your chosen domain. Store passwords separately in your password manager. ## 2\. Configuring the operating system ### Give it a fixed address Reserve an IP address for the server in your router. Look for "DHCP reservation", "static lease" or "Always assign this device the same IPv4 address" on a Fritz!Box. Select the mini PC and enable the reservation. This avoids configuring a static address on the server. Find out the address while you're there (or type `ip a` on the server; it's the `192.168.x.x` or `10.x.x.x` number next to `inet`). Let's say it's `192.168.1.50`. An IP address identifies a device on your network. Your router normally assigns addresses automatically, and an address can change after a restart. A reservation tells the router to keep giving this server the same address. That matters because your laptop and any router forwarding rules need a consistent destination. Use an Ethernet cable for the server if possible. A wired connection avoids depending on Wi-Fi reception for every upload and backup. Record the reserved address before disconnecting the monitor. ### Enable SSH on the Ubuntu mini PC Ubuntu Desktop needs an SSH server before Windows can connect to it. On the mini PC, open Terminal with Ctrl-Alt-T. Run the following commands there, entering your Ubuntu password when asked. The first refreshes package information, the second installs OpenSSH Server, and the third starts it and enables it at boot. ``` sudo apt update sudo apt install -y openssh-server sudo systemctl enable --now ssh ``` If UFW is already enabled, allow SSH before leaving the local console: ``` sudo ufw allow OpenSSH ``` Use `sudo systemctl status ssh` to check the service. Look for an active state; press `q` to leave the status display. Keep the monitor attached until your first remote login works. See the [Ubuntu OpenSSH instructions](https://ubuntu.com/server/docs/how-to/security/openssh-server/?ref=voidyapp.ing) for details. ### Connect from Windows step by step ![Windows PowerShell installs the SSH client and starts the connection. After login, commands run on Ubuntu; exit returns to Windows.](https://voidyapp.ing/content/images/2026/10/clipboard-1.png) On Windows, use PowerShell and install OpenSSH with [Scoop](https://scoop.sh/?ref=voidyapp.ing), a command-line package manager. Scoop lets you install and update the SSH tools with named commands. Windows Terminal is optional; a regular Windows PowerShell window is sufficient. Keep a web browser available for the Nextcloud interfaces. ### Install Scoop and OpenSSH on Windows These commands run locally on Windows, before connecting to Ubuntu. Open Start, search for Windows PowerShell, and open a normal window, not an administrator window. If Scoop is already installed, skip its setup and go straight to the OpenSSH installation. First, set the script execution policy for your Windows user as required by the [official Scoop setup instructions](https://github.com/ScoopInstaller/Scoop/wiki/Quick-Start?ref=voidyapp.ing). Confirm the prompt if PowerShell asks: ``` Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser ``` This changes the policy for your account, not for every user. Then download and run the official Scoop installer: ``` irm https://get.scoop.sh | iex ``` Wait for installation to finish. Install OpenSSH and check its version: ``` scoop install openssh ssh -V ``` A version string confirms that an SSH client can run. If a command is not found, close and reopen PowerShell and try again. If Windows already has its own SSH client, it may still be the one found first. Use `Get-Command ssh` to see the executable PowerShell resolves and `scoop which ssh` to locate the Scoop-managed copy. Either can connect to Ubuntu; you do not need to remove the Windows copy. The [Scoop OpenSSH manifest](https://github.com/ScoopInstaller/Main/blob/master/bucket/openssh.json?ref=voidyapp.ing) identifies the release being installed. The package may track a preview build; check the manifest if you need a stable-only version. Installing the package does not mean you need to enable an SSH server on Windows. This guide only uses its client tools. Later, update the Scoop package information and the installed OpenSSH package with: ``` scoop update scoop update openssh ``` ### Open the connection to Ubuntu Keep Windows and the mini PC on the same home network. In local Windows PowerShell, enter the connection command below. Replace `tom` with your Ubuntu username and `192.168.1.50` with the address reserved for the mini PC: ``` ssh tom@192.168.1.50 ``` On the first connection, SSH displays the server fingerprint. On the Ubuntu mini PC, run `ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub` to display the Ed25519 host-key fingerprint. Compare it with the fingerprint shown by Windows. If they match, type `yes` in PowerShell and press Enter. If another host-key algorithm is shown, compare its corresponding public host-key file instead. Enter the Ubuntu account password, not your Windows password. Nothing appears while you type. Press Enter and look for a prompt such as `tom@cloud:~$`. You are now connected: subsequent Linux commands in that window run on the mini PC. The original Windows prompt, such as `PS C:\Users\YourName>`, returns after you type `exit`. ### If the connection fails - Connection refused: confirm that the address is correct and the SSH service is running on Ubuntu. - Connection timed out: check the Ethernet connection, network address, firewall, and whether Ubuntu has suspended. A guest Wi-Fi network may prevent access to other local devices. - Permission denied: check the Ubuntu username, password, and keyboard layout. - Host identification has changed: investigate before removing the saved key. Reinstalling Ubuntu changes host keys, but an unexpected change can also mean you reached a different machine. After a successful login, you may unplug the monitor and manage the machine through SSH. You can reconnect the monitor whenever you want to use the local desktop. Closing PowerShell disconnects the session; it does not shut down Ubuntu or Nextcloud. ### Update everything ``` sudo apt update && sudo apt upgrade -y ``` `sudo` runs a command with administrator privileges and may ask for your password. `apt` manages software packages. These commands refresh the package list and install available updates. The first part, `apt update`, downloads information about available packages. It does not install the updates itself. The second part, `apt upgrade -y`, installs available upgrades and automatically accepts ordinary confirmation prompts. The `&&` between them runs the second command only if the first succeeds. A reboot may still be needed after some updates; returning to the prompt does not always mean every running component has been restarted. ### Let it update itself Enable automatic security updates: ``` sudo apt install -y unattended-upgrades sudo dpkg-reconfigure -plow unattended-upgrades ``` Choose "Yes" when prompted to enable automatic security updates. Check periodically that updates are being applied and whether a reboot is required. Automatic operating-system security updates reduce routine work, but they do not replace checking the server. They also do not update every Nextcloud container managed by AIO. Treat Linux updates and AIO updates as two separate jobs, and review failures instead of assuming both completed. ### Configure the firewall for local administration **Ubuntu — local Terminal or connected SSH session.** The example below assumes your home subnet is `192.168.1.0/24`. Replace it with your actual subnet; for example, many Fritz!Box networks use `192.168.178.0/24`. Keep the monitor attached until remote access has been tested. On a fresh installation: ``` sudo apt install -y ufw sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp sudo ufw allow from 192.168.1.0/24 to any port 443 proto tcp sudo ufw enable sudo ufw status verbose ``` These rules allow SSH and HTTPS from the home network. Port 8080 will be bound to localhost in the AIO commands below and reached through an SSH tunnel. Do not forward ports 22 or 8080 on your router. If you previously added broad UFW allow rules, review and remove the obsolete ones; adding narrower rules does not cancel an existing broad rule. Docker-published ports can bypass UFW, as explained in [Docker’s firewall documentation](https://docs.docker.com/engine/install/ubuntu/?ref=voidyapp.ing#firewall-limitations). Inspect `sudo docker ps --format "table {{.Names}} {{.Ports}}"`, router forwards, UPnP permissions and IPv6 firewall rules. A server without IPv4 forwarding can still be exposed through IPv6\. UFW is one layer, not proof that a published container is private. ### Set the time zone and install utilities ``` sudo timedatectl set-timezone Europe/Berlin sudo apt install -y htop curl ``` Set the time zone for your location. `htop` is a terminal task manager. Run `htop` to view it and press `q` to exit. In the BIOS, look for "power on after power loss" or "AC recovery". Enable it if you want the server to restart after a power outage. ## 3\. Installing Nextcloud There are several installation methods: - **The "LAMP" way.** Install a web server, a database, PHP and Nextcloud by hand, directly on the system. This gives you control over each component, but requires configuring and maintaining them yourself. - **Snap package.** `sudo snap install nextcloud` installs the Snap package, primarily used on Ubuntu. Its packaging can limit customization and complicate troubleshooting. - **NextcloudPi / ready-made images.** Pre-built system images for Raspberry Pis and some x86 boxes. Check supported hardware and the project’s current maintenance status before choosing an image. - **Docker, do-it-yourself.** You write a `docker-compose.yml` with a Nextcloud container, a MariaDB container, a Redis container, a reverse proxy container, and wire them up. You learn a lot about how the pieces fit. You also become the person responsible for making those pieces fit after every update. - **Docker, Nextcloud All-in-One (AIO).** Nextcloud's integrated Docker installation. One command, then a web interface that installs and updates everything, including the database, the office suite, backups and the TLS certificate. I recommend AIO for this setup because it manages the Nextcloud components and their updates through a web interface. A custom Docker Compose setup gives you more control, but also more components to maintain. ### How Docker works Docker runs applications in containers with their dependencies. Updates replace the containers; persistent data stays in separate storage called volumes. The AIO master container is the management component. It starts and manages the application containers. The database holds account and application information, while persistent storage holds uploaded files and other data. That is why backing up only the visible file directory is not enough to recreate the full installation. The Docker socket mounted in the AIO command gives the management container control over Docker on the host. A read-only socket mount does not turn that API into a read-only API. Use the official image and treat access to the AIO management interface as administrator access. ### Install Docker Run these commands on Ubuntu, either in its local Terminal or in your connected SSH session. They add Docker's Ubuntu package source and install Docker Engine. Ubuntu Desktop and Docker Desktop are separate products: this server setup uses Docker Engine, which runs as a background service. The package-source steps below follow the [official Docker Engine instructions for Ubuntu](https://docs.docker.com/engine/install/ubuntu/?ref=voidyapp.ing). They assume a fresh installation without another Docker distribution. If you have already installed Docker through another method, follow the cleanup guidance there before switching. ``` sudo apt update sudo apt install -y ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod a+r /etc/apt/keyrings/docker.asc sudo tee /etc/apt/sources.list.d/docker.sources <> ~/.ssh/authorized_keys" ``` On macOS or Linux, generate the key locally with the same `ssh-keygen` command and copy the public key with `ssh-copy-id tom@192.168.1.50` if that utility is installed. The Windows procedure above does not require it. Keep your current session open. Open a second local PowerShell window and run `ssh tom@192.168.1.50` again. Key login may ask for the private key's passphrase, which is different from your Ubuntu account password. Only continue once this separate login works. Then run the following configuration commands inside the connected Ubuntu session, not in local Windows PowerShell, to disable SSH password authentication. ``` printf '%s\n' 'PasswordAuthentication no' 'KbdInteractiveAuthentication no' | sudo tee /etc/ssh/sshd_config.d/00-local-key-only.conf sudo /usr/sbin/sshd -t sudo /usr/sbin/sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication) ' ``` Check that the output says `passwordauthentication no`, `kbdinteractiveauthentication no` and `pubkeyauthentication yes`. If syntax validation fails or the values differ, stop and inspect existing configuration rather than restarting blindly. Conditional `Match` rules can require a connection-specific check. Once the checks pass: ``` sudo systemctl reload ssh ``` Keep the original session open and test another new key-based login. Also try `ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password,keyboard-interactive tom@192.168.1.50` from local Windows PowerShell: it should be rejected. Only close the original session after both tests give the expected results. Keep a second key on another trusted device so losing your laptop does not remove your only means of SSH access. An SSH key pair has a private key that stays on your laptop and a public key you install on the server. Protect the private key with a passphrase and do not send it to anyone helping you. The public key is the part intended to be copied. **Turn on two-factor authentication in Nextcloud.** Enable a supported TOTP provider if necessary, register your authenticator under personal security settings, save the recovery codes separately and test a login. Use a separate everyday account for routine file work. Remove passwords and tokens from commands or configuration files before sharing them. If you write `docker-compose.yml` files or scripts, keep passwords in a separate `.env` file and exclude it from anything you publish or send for troubleshooting. ## 5\. Access at home and optional administration while away At home, connect directly: SSH uses the mini PC’s LAN address, and Nextcloud uses its configured HTTPS hostname resolved through local DNS. No Tailscale account, VPN app or router port forwarding is needed for communication within the same trusted home network. Guest Wi-Fi or isolated VLANs may block access between devices. ### Optional: a VPN for your own devices away from home If you want to administer the server from a hotel or music school, a router VPN such as WireGuard or a mesh VPN such as [Tailscale](https://tailscale.com/?ref=voidyapp.ing) can provide a private path. This is optional. A VPN carries network traffic and can be used for SSH, Nextcloud, or other permitted services; it is not SSH-specific. Public Nextcloud users can continue to use the normal HTTPS address without it. For Tailscale-based SSH access, install it on Ubuntu and on the laptop you carry, authorize both devices and check the current plan’s personal or business terms. On Ubuntu: ``` curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up sudo ufw allow in on tailscale0 to any port 22 proto tcp tailscale ip -4 ``` The installer downloads and runs software from Tailscale’s official source. Sign in using the link it prints. From your laptop, connect with ordinary OpenSSH to the displayed Tailscale IP, for example `ssh tom@100.101.102.103`. This uses the SSH server and keys already configured; the separate Tailscale SSH feature is not required. Check your tailnet access policy, account MFA and device authorization. Do not open all services on the Tailscale interface just to permit SSH. To manage AIO while away, use `ssh -N -L 8080:127.0.0.1:8080 tom@100.101.102.103`, then open the local management URL. For private Nextcloud use through a VPN, arrange routing and DNS for its existing hostname, or deliberately build the separate [Tailscale Serve architecture](https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md?ref=voidyapp.ing). Merely installing Tailscale does not rewrite your Nextcloud hostname or certificate configuration. ### The apps Once access through the domain works, install the clients you need: - **Desktop sync client** for Mac/Windows/Linux from [nextcloud.com/install](https://nextcloud.com/install/?ref=voidyapp.ing). Gives you a folder that stays in sync, Dropbox-style. Choose the folders you want to synchronize. - **Nextcloud Files** on iOS/Android for browsing, uploading recordings straight from the lesson, and automatic photo upload if you want. - Your phone's calendar and contacts can sync too (CalDAV/CardDAV; the Nextcloud mobile apps walk you through it). Begin by synchronizing one small folder on your laptop. Check which folders are available offline before relying on them while traveling. Synchronization also propagates deletions and unwanted changes, so a synchronized laptop is not a substitute for a backup with older versions. ## 6\. Public access and shared links For shared links that recipients can open in a browser without joining your private network, make Nextcloud publicly reachable under a domain. Register one with a provider such as Namecheap, Porkbun or INWX. Budget around 10 € per year, depending on the domain. For example, use `cloud.tomsguitar.de` under `tomsguitar.de`. Choose one of these access methods: ### Option A: DynDNS and port forwarding Give the public Nextcloud hostname an A record for the reachable public IPv4 address, or an appropriate AAAA record for an IPv6 setup. A DynDNS client keeps the address current when it changes. A router’s DynDNS feature updates only the hostname supported by that service; it does not automatically create arbitrary records at your domain provider. Confirm that your chosen provider and hostname work together. For direct public access, use Route A’s AIO command. Forward TCP port 443 from the router to the mini PC and allow the application traffic in the host firewall. Port 80 has a separate purpose for the master container’s HTTP certificate validation; only expose it if using that feature. This guide keeps AIO administration on the localhost-bound port 8080 and does not publish the alternate management port 8443\. Do not forward SSH or AIO administration. ``` sudo ufw allow 443/tcp ``` Test public DNS and access over mobile data. If the same hostname must work locally, keep a local DNS record pointing to the LAN address; otherwise your router may need hairpin NAT. Review IPv6 firewall rules separately. Opening the application publicly is a deliberate change to the access model, not a prerequisite for running it at home. Port forwarding exposes the service to the internet. Keep Nextcloud updated and enable two-factor authentication. With DS-Lite or CGNAT, incoming IPv4 port forwarding may be unavailable. Check the connection status in your router or ask your provider. Option B works without incoming IPv4 connections. For public access from home, your upload speed is important. When someone downloads a file from your server, your home connection uploads it. A slow upload connection can make large downloads frustrating even if your advertised download speed is high. Power outages and router failures also interrupt access from outside. ### Option B: Cloudflare Tunnel (no open ports) [Cloudflare](https://www.cloudflare.com/?ref=voidyapp.ing) is a huge network that sits in front of a good part of the web. Their Tunnel product (free) lets your server make an outgoing connection to Cloudflare, and Cloudflare forwards visitors to your domain through that connection. No port forwarding, works behind DS-Lite, and Cloudflare absorbs a lot of junk traffic before it reaches you. 1. Create a free Cloudflare account and add your domain. It'll give you two nameservers; set those at your registrar. (Cloudflare now manages your domain's DNS.) 2. In the Cloudflare dashboard, open **Zero Trust → Networks → Tunnels → Create a tunnel**. Name it, choose "Cloudflared", pick **Ubuntu** as the system. It shows you an install command; it looks like `curl ... && sudo dpkg -i cloudflared.deb && sudo cloudflared service install eyJ...`. Paste that into your server's terminal. That long `eyJ...` bit is the tunnel token, a secret (section 4). 3. Add a **Public Hostname**: subdomain `cloud`, your domain, service type `HTTP`, URL `localhost:11000`. Save. 4. In the domain's settings, **Speed → Optimization → disable Rocket Loader**, otherwise Nextcloud's login page will misbehave. The tunnel service URL here is explicitly HTTP on the same host; a generic zone SSL-mode setting does not turn that loopback connection into HTTPS. 5. Use Route B’s complete AIO command from section 3 and enter `cloud.tomsguitar.de` as the single application hostname. Cloudflare terminates the public HTTPS connection and can therefore access the traffic passing through it. Consider this when storing personal or confidential files. Use direct access or Tailscale if you want to avoid that intermediary. Upload request limits and restrictions on media traffic also apply; check the plan terms before relying on the tunnel for large recordings or videos. ### One application hostname; private administration AIO officially supports one Nextcloud hostname per instance. Keep that address consistent for browsers, sync clients and shared links. You can use a public HTTPS application address alongside VPN-only SSH administration without giving Nextcloud another domain. Running a tailnet-only Nextcloud name and a second public name for the same AIO instance is not the simple supported extension implied by a general Nextcloud trusted-domains setting. ## 7\. Backups on the second mini PC ![Three copies: working Nextcloud data, a separate local Borg backup, and an encrypted copy outside the home.](https://voidyapp.ing/content/images/2026/10/clipboard-2.png) An SSD failure, accidental deletion or damage to your home can destroy the server's data. The 3-2-1 backup rule means keeping three copies on two types of storage, with one copy at another location. ### Copy 1: the server itself This is the working copy of your files, not a backup. ### Copy 2: encrypted AIO backups on mini PC number two Keep the working files on the first mini PC and the backup repository on the second. Both remain in your home network, so this backup connection needs neither Tailscale nor router port forwarding. Reserve `192.168.1.51` for the backup machine. Use different example addresses if your network differs. Install Ubuntu and enable OpenSSH on the second mini PC using sections 1 and 2\. Disable suspend there too. Do not install a second production Nextcloud instance on it just to receive backups. Check that its disk has space for your current files plus retained versions; deduplication cannot promise a fixed storage saving. ### Prepare a dedicated backup account **Backup mini PC — local Ubuntu Terminal or SSH to 192.168.1.51.** Install Borg and create a separate account: ``` sudo apt update sudo apt install -y borgbackup borg --version sudo adduser --disabled-password --gecos "AIO backup" borg sudo install -d -m 700 -o borg -g borg /home/borg/.ssh ``` The repository format in this procedure is Borg 1.x, as used by the checked AIO backup implementation. Confirm a compatible Borg 1.x version is installed; do not silently substitute Borg 2\. The dedicated account has no administrator rights and no password login. The repository will be created at `/home/borg/nextcloud-backup`. Leave that new path unused until AIO initializes it; do not reuse an unrelated existing repository. If the backup host firewall is restricted, permit SSH from the main server’s LAN address. On the backup mini PC: ``` sudo ufw allow from 192.168.1.50 to any port 22 proto tcp ``` ### Connect AIO to the backup host Open AIO management on the main server through the SSH tunnel. In the backup settings, leave the local backup path empty and enter this remote repository URL: ``` ssh://borg@192.168.1.51/home/borg/nextcloud-backup ``` Start the first backup. AIO generates its own SSH key pair; this is separate from your laptop’s key. Before that key is authorized, the SSH connection fails. Copy the complete public-key line shown by AIO, beginning with its key type, such as `ssh-ed25519`. Never copy a private-key block. On the backup mini PC, open the authorized-keys file: ``` sudo nano /home/borg/.ssh/authorized_keys ``` Add one line containing the restriction below, a space, and the actual public key copied from AIO. Replace the placeholder; do not leave the words `PASTE-THE-AIO-PUBLIC-KEY-HERE` in the file: ``` restrict,command="/usr/bin/borg serve --restrict-to-path /home/borg/nextcloud-backup" PASTE-THE-AIO-PUBLIC-KEY-HERE ``` The entire entry must remain on one line. The forced command limits this key to Borg access under the backup path; it does not permit an ordinary shell or SSH forwarding. Save with Ctrl-O, Enter; close with Ctrl-X. Then set ownership and permissions: ``` sudo chown borg:borg /home/borg/.ssh/authorized_keys sudo chmod 600 /home/borg/.ssh/authorized_keys ``` Retry the backup in AIO. On a fresh unused target, AIO initializes its encrypted repository during the backup process. Save the backup encryption password displayed by AIO in your password manager and in your recovery kit. Do not invent a different password in a separate manual initialization step. If the connection still fails, inspect the AIO backup log for the actual SSH, permissions, path or Borg-version error. Never disable host-key checking as a generic workaround. Wait for a completed backup and confirm its timestamp in AIO. Run the integrity check before relying on it. Enable the daily schedule only after this manual run succeeds. Check which time zone the interface uses and choose a quiet period. The application is stopped for consistency during the backup; the initial run may take substantially longer than later runs. AIO protects its application data, database and required configuration. Files attached through Nextcloud’s External Storage app require separate consideration; do not assume every mounted share is automatically included. Enable failure notifications and check recent results regularly. A scheduled task is not evidence of a successful backup. ### A simpler starting alternative: a local USB backup disk If the second machine is not ready, use a separate USB drive on the main server. In Ubuntu’s Disks application, identify the drive by model and capacity, select its existing filesystem, open the mount options and configure a persistent mount such as `/mnt/backup`. Do not format a disk containing files you need. Reboot and check `findmnt /mnt/backup`: the source must be the external drive. Merely creating an empty folder is not a mounted backup disk. Enter `/mnt/backup` as the local backup destination in AIO and leave the remote field empty. Create the first backup, save its encryption password and verify a successful run. Choose one initial destination; moving an existing repository later needs the documented migration process, not a casual path change. ### Copy 3: off-site backup with a Hetzner Storage Box For an external backup destination, I recommend considering a [Hetzner Storage Box](https://www.hetzner.com/storage/storage-box/?ref=voidyapp.ing). Keep Nextcloud on the first mini PC and the fast local backup on the second; add an encrypted repository copy at Hetzner so a fire, theft or other loss of the whole home does not destroy every copy. A Storage Box provides backup storage, not a managed Nextcloud installation. Hetzner Storage Share is a different product. The entry-level BX11 offers 1 TB. Size it for the full backup repository, retained versions and snapshot overhead, rather than only today’s visible Nextcloud files. Germany or Finland are available as storage locations. Check the current gross monthly price for your country before ordering and add twelve monthly payments to the annual-cost comparison in section 8\. This remains a recurring cost even when the mini PCs are already paid for. For the two-mini-PC layout in this guide, the Storage Box should receive a consistent copy of the encrypted Borg repository from the backup mini PC. Coordinate copying with Borg locking and retain independently recoverable generations or Storage Box snapshots. A simple live mirror can propagate deletion and corruption. The actual transfer job needs its own setup, failure notifications and recovery test; the rotated-disk procedure below remains a complete alternative you can use immediately. ### Storage Box connection and recovery considerations Enable SSH support and External Reachability in the Hetzner Console for access from your home connection. Hetzner’s extended SSH service uses port 23 for Borg and rsync. Use a dedicated SSH key, verify the server fingerprint and limit the backup credentials to the required destination. Store the Hetzner account recovery information separately from the Nextcloud server. See [Hetzner’s SSH, rsync and Borg instructions](https://docs.hetzner.com/storage/storage-box/access/access-ssh-rsync-borg/?ref=voidyapp.ing). Borg must encrypt the backup before it leaves your home. SSH protects the transfer; the Borg password protects the stored repository. Keep that password and a recovery copy of the Borg key outside the machines being backed up. Configure Storage Box snapshots as an additional recovery layer, and keep account access separate from the machine’s upload credentials. AIO can alternatively back up directly to a remote Borg repository on a Storage Box. That replaces the configured primary backup destination; it does not automatically add a second independent destination alongside the local Borg target. Direct backup also depends on home upload speed and Internet availability. For this article’s local-plus-off-site design, keep the local target and add a separately managed off-site copy. Before depending on either route, restore a sample from the Storage Box on a separate test system. ### Alternative: rotate an external disk If you prefer an offline destination or have not configured the Storage Box transfer yet, use a rotated external disk as a concrete starting method. Keep at least one completed copy at another location. A weekly rotation limits the loss of recent work better than a monthly rotation; choose a frequency you can actually maintain. Encrypting the repository does not protect the live server disk. **Backup mini PC — Ubuntu.** Connect an external disk with enough space for a complete repository copy. In Disks, select the correct filesystem and configure it to mount at `/mnt/offsite`. Verify the model and capacity; do not format an existing disk unless its contents are disposable. Confirm the actual mount and free space: ``` findmnt /mnt/offsite df -h /mnt/offsite ``` Pause the automatic AIO backup schedule temporarily and wait for any running backup, restore, integrity check or pruning operation to finish. Copy the repository under Borg’s own lock so another Borg operation cannot modify it during copying. Run the following block on the backup mini PC. It creates a new dated destination, never mirrors deletions into an old copy, and excludes transient Borg lock files: ``` sudo bash <<'EOF' set -euo pipefail mountpoint -q /mnt/offsite || { echo "Off-site disk is not mounted"; exit 1; } repo=/home/borg/nextcloud-backup copy_dir="/mnt/offsite/nextcloud-$(date +%F-%H%M%S)" test -f "$repo/config" || { echo "Borg repository not found"; exit 1; } mkdir -m 700 "$copy_dir" borg with-lock "$repo" rsync -a --exclude='lock.*' "$repo/" "$copy_dir/borg/" echo "Repository copied to $copy_dir/borg" EOF ``` Wait for the final success message. A failed copy is incomplete; do not treat its directory as a recovery point. This copies the entire encrypted repository, including retained archives, and can consume considerable space. Keep an older verified copy until the new copy has passed a check and a restore test. Do not run independent backup jobs against the copied repository. Check the copy before unplugging it. Replace the timestamp below with the actual directory printed by the copy command. Borg asks for the backup encryption password when required; do not put that password in the command: ``` sudo borg check /mnt/offsite/nextcloud-YYYY-MM-DD-HHMMSS/borg sudo borg list /mnt/offsite/nextcloud-YYYY-MM-DD-HHMMSS/borg ``` After a successful check, unmount the disk through Disks and take it to the other location. Re-enable the AIO schedule and confirm the next daily backup completes. Store the recovery password separately from the disk. A disk permanently connected beside both mini PCs is not an off-site copy. Cloud storage is an alternative, but a bare `rclone sync` command is not a complete backup workflow. It needs a configured remote, consistent locking, independent retention, failure reporting and a tested restore. Follow a complete provider-specific procedure if you choose that route; the rotated disk above is the immediately usable offline alternative to the recommended Storage Box destination. ### Minimal monitoring: let the server ask for attention You do not need to turn this cloud into a second job. After the initial setup, automate the routine work and arrange a small number of useful alerts. The goal is to hear about a problem, not to inspect dashboards every morning. For this setup, start with two questions: is Nextcloud reachable, and are backups still succeeding? ### One small availability monitor [Uptime Kuma](https://github.com/louislam/uptime-kuma?ref=voidyapp.ing) is an optional, browser-based monitor. Put it on the second mini PC so a failure of the Nextcloud machine does not also stop its monitor. If Docker Engine is not installed there yet, follow the Docker installation steps in section 3 on that machine first. **Backup mini PC — Ubuntu Terminal/SSH.** This command keeps the monitoring interface private: ``` sudo docker run -d \ --name uptime-kuma \ --restart unless-stopped \ --publish 127.0.0.1:3001:3001 \ --volume uptime-kuma:/app/data \ louislam/uptime-kuma:2 ``` From local Windows PowerShell, open a tunnel to the second mini PC: ``` ssh -N -L 3001:127.0.0.1:3001 tom@192.168.1.51 ``` Open `http://127.0.0.1:3001`, create the administrator account, and add an HTTPS monitor for your Nextcloud hostname. Use a five-minute interval and two retries to avoid alerts for brief interruptions. Add one notification destination, such as Pushover or email, and send a test message. Plan a maintenance window for the scheduled AIO backup if it regularly causes alerts. The second mini PC must resolve the hostname correctly too. A local monitor checks the local path; it does not prove public access works. If public student links matter, an external uptime service can check that public address as well. A home-hosted monitor cannot notify you during a total home power or Internet outage. Keep the monitoring dashboard private; you do not need a public status page. ### Use the backup notifications already available AIO provides backup and update notifications to Nextcloud administrators. Review these with the admin account and test the notification delivery you intend to rely on. An item in the web interface is not automatically an email or phone alert. Set up Nextcloud’s outgoing mail and send its test message if you use email, but verify the actual backup notification channel separately. See the [Nextcloud email setup](https://docs.nextcloud.com/server/stable/admin%5Fmanual/configuration%5Fserver/email%5Fconfiguration.html?ref=voidyapp.ing). Treat the Storage Box transfer as its own job: its success or failure must be reported separately from AIO’s local backup. If you later add a heartbeat monitor, send its success signal only after the backup or transfer has completed successfully. A timer that sends “OK” every day regardless of the result would hide failures. An HTTPS check alone cannot detect stale backups or a nearly full disk. ### A short monthly check, not a daily checklist Keep Ubuntu’s automatic security updates enabled. Once the first backup and restore test work, you can enable AIO’s option to update after its scheduled backup. Read failure alerts when they arrive. Automation reduces routine work; it does not make a failed job successful. Things you might want to regularly check: open AIO, confirm a recent successful backup and the latest off-site copy, look at free storage on both machines and the Storage Box, and check for pending updates or a required reboot. Review Uptime Kuma updates in that same session. If you use the offline-disk alternative, keep its rotation reminder. Occasionally restore a sample file. After major changes, or a couple of times a year, use the full recovery test below. Most days, simply use your cloud; intervene when an alert or the monthly check reveals something that needs attention. ### Prove that recovery works Use a spare machine or isolated virtual machine with fresh Docker/AIO storage. Keep the backup host and production installation intact. In the new AIO management page, choose restoration of a former instance, supply the repository location and encryption password, select an archive and restore before creating an unrelated new cloud. For the rotated-disk copy, the local backup location is the dated parent folder containing `borg`, not the `borg` folder itself. A replacement instance accessing the remote repository needs its own AIO-generated SSH public key authorized on the backup host; keep the existing production key. Stop production backup jobs during the test and use a repository copy whenever possible. Keep the test instance isolated so it cannot receive production sync traffic, send real notifications or claim the live domain. Use controlled test DNS for its restored hostname; do not run two active installations behind the same production address. Sign in, open several documents and recordings, check accounts and sharing settings, and record the archive date and recovery steps. Repository checks detect many storage problems but do not demonstrate a working application restore. Preserve the original files and old backups until the test has succeeded. ## 8\. Self-hosting or managed Nextcloud? ![Comparison of home-hosted and managed Nextcloud: responsibilities and illustrative electricity versus subscription costs.](https://voidyapp.ing/content/images/2026/10/clipboard-3.png) Illustrative costs only: electricity and subscription figures do not represent complete annual costs. You can use Nextcloud without operating a Linux server. A managed provider runs the installation in its data center and gives you a web address and an account. You still use Nextcloud's web interface and clients. Renting a basic VPS is different: unless management is explicitly included, you remain responsible for the operating system, application updates, and backups. ### Compare the full annual cost Use this formula for home hosting: hardware cost divided by its expected useful life, plus electricity, replacement storage, domain fees, and off-site backups. Add any paid services you choose. The time you spend maintaining it belongs in the decision even if you do not assign it an hourly price. - Existing hardware: if you already own suitable equipment, there may be no new server purchase. You still need sufficient backup storage and should budget for failed drives or a replacement machine. - Electricity: at an assumed combined average of 20 watts and €0.35/kWh, two continuously running machines cost about €61.32 per year. Measure actual consumption at the wall to make this estimate useful. - Domain: using an illustrative allowance of €10 per year brings that example to €71.32 before off-site backup costs and hardware replacement. - Off-site storage: add the actual annual price of the remote backup plan you choose, or the purchase and replacement cost of rotated external drives. A backup machine in the same home does not cover loss of the whole location. For comparison, a hypothetical managed plan costing €6 per month would be €72 per year; a €10 monthly plan would be €120\. These are calculation examples, not current offers. Compare actual quotes for the same usable storage, tax treatment, user requirements, and backup coverage. A cheap plan with inadequate restore options is not equivalent to a complete backup setup. If you buy €400 of hardware and spread that purchase over five years, add €80 per year. The illustrative €71.32 electricity-and-domain total then becomes €151.32 per year before remote backups, replacement drives, or your time. Existing hardware can make self-hosting economical; purchasing a new setup can remove that advantage. ### Compare control and day-to-day work At home, you control the operating system, storage layout, installed components, and update timing. You also diagnose disk failures, failed upgrades, network problems, and backup errors. AIO reduces the number of manual tasks, but somebody still needs to notice when a scheduled task fails and decide what to do. With managed hosting, the provider handles the administration included in the plan. You accept its limits on storage, apps, configuration, and update timing. Ask what support covers, how long backups are retained, whether you can restore individual files, and how you would export your data. You remain responsible for account security, sharing decisions, and keeping an independent copy of important data. For a concrete example, [Hetzner Storage Share](https://www.hetzner.com/storage/storage-share/?ref=voidyapp.ing) is a managed Nextcloud service. Its NX11 tier lists 1 TB of storage, and the provider describes automatic updates and backups. Check the live pricing for your country and taxes. The [Nextcloud provider directory](https://nextcloud.com/providers/?ref=voidyapp.ing) lists alternatives. These are useful reference points when comparing a home setup with a service you could use immediately. ### Compare access and privacy A home server depends on your electricity, router, and internet connection. A managed service moves those dependencies to a data center, which can be helpful when files need to remain available while you are away. Its availability and support still depend on the provider and plan. Neither option guarantees uninterrupted service. Home hosting keeps the main copy under your physical control. Managed hosting entrusts the infrastructure to a provider, so consider its location, access practices, and contractual terms. Standard Nextcloud hosting does not automatically prevent an administrator from accessing stored files. If that matters for your data, assess client-side encryption and its effect on sharing and browser features separately. ### Which would I choose? I would self-host if I already had suitable hardware, wanted control over storage and configuration, and was willing to learn the maintenance work. I would choose managed Nextcloud if the main goal were reliable file sharing with little server administration. You can also start with managed hosting, learn the Nextcloud interface, and build a home installation separately using test files. For a first server project, begin on your home network with a few test files and a working backup. Tailscale is optional for private access while away; public student links are a separate decision. Add optional apps after you can maintain and recover the basic installation. The useful outcome is a service you can operate confidently, whether the machine sits at home or in a provider’s data center.