Self-Hosted Nextcloud on a VPS: Moving Your Team Off Google Drive or Dropbox in a Weekend

Self-hosted Nextcloud means running Nextcloud, open-source file sync and collaboration software, on a server you control, and for a small business it can replace Google Drive, Dropbox and much of Microsoft 365. The team gets synced folders on laptops and phones, share links, shared calendars and contacts, calls in Talk, and Office files edited in the browser. For an office of about ten, a VPS with 8 GB of RAM running Nextcloud All-in-One is a comfortable fit, and the move takes one weekend if you prepare on Friday evening.

What you need to know:

• Install with Nextcloud All-in-One (AIO), the project's official method, unless you already run your own PHP web stack.
• With Office or Talk on, AIO needs at least 2 GB of RAM, 2 vCPUs and 40 GB of disk, and recommends 1 GB of RAM on top.
• No per-seat licences: AIO is free for up to 100 users.
• You need a domain name and port 443. A bare IP address will not do.
• Keep the backup encryption password offline: without it there is no restore. Store the AIO passphrase with it, because it opens the interface that controls the whole server.

Is Nextcloud a good Google Drive replacement for a small office?

Say you run a twelve-person accounting office in Prishtina. The shared Drive keeps warning about storage, and a client in Germany has asked in writing which country their documents are stored in. With a big cloud suite, that second question takes a lawyer.

The suites count per seat, so storage grows with licences rather than with what you store:

Google Drive also caps each user at 750 GB of uploads per 24 hours. And the per-seat cost moves on the vendor's timetable: on 1 July 2026 Microsoft raised the price of Microsoft 365 Business Basic by about 17% and Business Standard by 12%, with existing customers paying the new rate from their next renewal (Microsoft's pricing notice).

With Nextcloud, the thirteenth colleague is just one more account, and it scales well past a small office. Austria's economy ministry moved 1,200 staff onto it in four months in 2025, and on 3 July 2026 the German state of Mecklenburg-Vorpommern reported that its first 5,000 employees had moved from SharePoint to Nextcloud without disruption or data loss, with more than 50,000 public employees as the goal (announcement by DVZ M-V, the state's IT provider).

Now the downsides. A widely shared test from November 2025 measured roughly 15 to 20 MB of uncompressed JavaScript on the web interface's first load, so it feels heavier than Drive on a weak connection. There is no delta sync: trim a 4 GB video and the whole file uploads again. And the servers Google used to hide are now yours to patch. An office of PDFs and spreadsheets will barely notice. A video studio should test first.

Friday evening: the checklist before you touch a server

1. Measure what you are moving, in gigabytes and in files. The count matters more than the size: one admin on the Nextcloud forum wrote that the first sync of folders holding more than 600,000 files took up to two hours, even with 900 Mbps of upload.
2. Pick the address, such as cloud.YOUR_DOMAIN, and check you can edit its DNS.
3. Pick the city: Amsterdam or Dublin for EU client data, Prishtina for data that should stay in Kosovo (reasons below). Only order in a city the plans page shows with capacity.
4. Start the exports tonight; they take hours. Google Takeout turns Docs, Sheets and Slides into Word, Excel and PowerPoint files, and calendars and contacts export as .ics and vCard. From Dropbox or OneDrive, use a laptop that keeps a full offline copy, or rclone, which copies straight into Nextcloud over WebDAV. Pick Nextcloud as rclone's WebDAV vendor so big files go up in small chunks: since AIO 14.1 in September 2026, an upload sent in one piece stops at 1 GB by default (AIO's upload limit notes).
5. Tell the team: from Monday, new files go to Nextcloud, and the old service stays read-only for a month.

How much server does self-hosted Nextcloud need?

For a manual install, the admin manual only says each PHP process needs at least 128 MB of RAM and should have 512 MB. AIO's interface is more specific and prints these minimums (requirements text in the AIO source):

An AIO maintainer adds a rule of thumb: about 1 GB of RAM and one vCPU per simultaneously active user. Read it as a cautious ceiling; twelve staff rarely means twelve people uploading at once.

Storage runs out before memory does. The admin manual lets the trash keep deleted files for 30 days and hold up to half of each user's quota; old versions may take up to half of a user's free space, and metadata such as thumbnails takes about 10% of the disk. None of that counts against quotas. Ten people with 10 GB quotas therefore need about 160 GB before the system, Docker images and database. A Borg backup on the same disk grows toward that size again, so keep backups elsewhere.

On a test server the size of VDS Medium (8 vCPU, 16 GB of RAM), a fresh AIO with its preselected options (Euro-Office, Talk, Imaginary and Whiteboard) used about 2.2 GB of RAM at idle, 1.3 GB of it for the office server, and its Docker images and volumes took about 9 GB of disk before anyone uploaded a file.

Mapped onto our plans (our estimates, not official numbers):

VPS Nano (1 vCPU, 1 GB) is below the 2 GB AIO asks for as soon as any optional container is on, so skip it for Nextcloud.

What RS Computers gives you for this

The AIO README recommends KVM machines for Docker and SSD storage, and both describe every RS Computers plan: KVM virtual machines on NVMe disks, in Amsterdam (Netherlands), Dublin (Ireland) and Prishtina (Kosovo). The first sync of a whole office is the heaviest traffic the server will see, and here it is unmetered, on a 1 Gb/s port for VPS plans and 10 Gb/s for VDS. Each server has its own IPv4 and IPv6 address for the A and AAAA records in step 1. Under Nextcloud's own backups sits our free weekly backup of the whole server, restorable from the client area, and when the team outgrows its plan, you upgrade from the client area with a short reboot on the same server.

Nextcloud All-in-One or a manual install?

Use AIO unless you already run Apache or nginx with PHP-FPM and like tuning them. The AIO README calls it "the official Nextcloud installation method". It bundles PostgreSQL, Redis and APCu caching, Client Push (which stops desktop clients from constantly polling for changes), HTTP/3, automatic Let's Encrypt certificates and BorgBackup. In return it wants a real domain on port 443 and Docker from Docker's own repository rather than the snap, and it stops at 100 free users.

The manual route, the release tarball on a LAMP stack, is Nextcloud's other supported path. On Debian 13, install the current release, Nextcloud 35: its system requirements list Debian 13, support its PHP 8.4 (8.5 is now the recommended version) and recommend its MariaDB 11.8. You then own the tuning guide's must-dos that AIO does for you: system cron every 5 minutes instead of AJAX, APCu plus Redis for caching and file locking (most "file is locked" errors trace back to missing Redis locking), a 512 MB PHP memory limit, and more PHP-FPM workers than the default, which the guide calls "extremely conservative". Our guides to PostgreSQL, MySQL and Redis on a VPS and to reverse proxies with Caddy, nginx and Traefik help on that route. Snap packages and the Docker Hub "nextcloud" image also run, without support from Nextcloud GmbH.

Euro-Office or Collabora, and how far Talk stretches

AIO runs one office suite at a time. Its list offers Nextcloud Office in two versions, powered by Euro-Office (preselected) or by Collabora Online, plus OnlyOffice, marked deprecated. AIO's own comparison rates Euro-Office best for Microsoft compatibility and Collabora best for OpenDocument and legacy files, so an office that lives in Word and Excel files can keep the default, and one built on .odt files or old formats should switch to Collabora. If your business runs on macro-heavy spreadsheets, test a few before Monday; any that only work in desktop Excel can stay there, on the laptops or on a Windows VPS with Remote Desktop for the one or two people who use them.

Euro-Office is new: a fork of OnlyOffice's code, launched in late March 2026 by Nextcloud, IONOS and other European companies, and on 31 March OnlyOffice suspended its partnership with Nextcloud over it. Euro-Office reached its first stable release on 9 June, AIO made it the default for new installs that month, and since AIO 14.2 in September the OnlyOffice option can no longer be selected. With Hub 26 Summer on 16 September, Euro-Office also gained a desktop app for editing on the laptop while the file stays connected to Nextcloud (Nextcloud's release announcement).

In a plain Talk call, every participant sends a stream to every other one at about 1 Mbit/s each, so a five-person call costs each laptop about 4 Mbit/s up and down. AIO's Talk option adds the high-performance backend, a server that relays video so each laptop sends its stream once instead of once per participant, and a TURN server (port 3478, TCP and UDP) that carries calls for people behind strict office or hotel firewalls. With those, the Talk documentation says calls typically carry 30 to 50 active participants.

Saturday: installing Nextcloud AIO on Debian 13

Order the server with Debian 13 and log in over SSH as root (new to that? See our guide to learning Linux on a practice VPS). On an account other than root, put sudo in front of each command.

1. Point the domain at the server

Create an A record for cloud.YOUR_DOMAIN with the server's IPv4 address, and an AAAA record only if you do step 4. On Cloudflare, set the record to "DNS only": the AIO README warns that the proxy can block the domain check and the certificate request, limits uploads to 100 MB on the free plan and can stop Talk's TURN server from working.

2. Update Debian and turn on the firewall

This block updates the system and enables a firewall that keeps SSH reachable:

# as root
apt update && apt full-upgrade -y
apt install -y ca-certificates curl ufw
ufw allow 22/tcp
ufw allow 443
ufw --force enable

ufw status should show Status: active with 22/tcp and 443 allowed; if SSH runs on another port, allow that one instead. Visitors need no other ufw rules, because Docker opens the ports it publishes (80, 443, 8080, 8443, 3478) through its own rules; our guide to Docker on a VPS explains why. That also means ufw cannot close them. The 443 rule is for the server itself. Nextcloud reaches its office server and Talk's signalling through cloud.YOUR_DOMAIN, and without the rule ufw drops those calls, so the office suite and Talk's high-performance backend cannot connect.

3. Install Docker from Docker's repository

Docker says its convenience script "isn't recommended for production environments", so this block adds Docker's apt repository and installs Docker Engine from it:

# as root
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

systemctl status docker should say active (running), and docker run hello-world prints "Hello from Docker!". On Ubuntu 24.04, write ubuntu for debian in both URLs and use ${UBUNTU_CODENAME:-$VERSION_CODENAME} in the Suites line. If AIO later warns about "docker installed via snap", run snap remove docker and install as above.

4. Optional: IPv6 inside Docker

Only if you published an AAAA record: this switches on IPv6 for Docker networks and creates AIO's network before its first start.

# as root
tee /etc/docker/daemon.json <<'EOF'
{"default-network-opts": {"bridge": {"com.docker.network.enable_ipv6": "true"}}}
EOF
systemctl restart docker
docker network create nextcloud-aio

docker network inspect nextcloud-aio | grep EnableIPv6 should print "EnableIPv6": true,.

5. Start the AIO mastercontainer

This is the README's command, unchanged: it starts the mastercontainer, which creates and updates every other container, and stays in the foreground showing its log.

# as root
docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

When the log says "Initial startup of Nextcloud All-in-One complete!", press Ctrl+C three times: current Docker versions wait for the third press, then print "got 3 SIGTERM/SIGINTs, forcefully exiting" and return your prompt. Thanks to --sig-proxy=false the container keeps running, and docker ps lists nextcloud-aio-mastercontainer as Up. Never rename the container or the volume.

6. Finish in the browser

Open https://YOUR_SERVER_IP:8080, by IP and never by domain: once Nextcloud sends its HSTS header (which tells browsers to accept only HTTPS with a valid certificate for that name), browsers refuse the interface's self-signed certificate under your domain. Accept the warning, then:

1. Write down the passphrase shown and log in with it.
2. Enter cloud.YOUR_DOMAIN. AIO checks that it reaches this server on port 443.
3. Check the optional containers. Nextcloud Office, Talk, Imaginary (faster previews) and Whiteboard come preselected, which suits most teams; if you change anything, click "Save changes" below the list. Leave ClamAV and full-text search off below VDS Small; each wants about 1 GB more RAM.
4. Tick "Install Nextcloud Hub 26 Summer", which is version 35, scheduled for support until September 2027. Left unticked, AIO installs version 34 (Hub 26 Spring), supported until June 2027.
5. Click "Download and start containers", wait several minutes, then copy the initial admin password shown and click "Open your Nextcloud".

If you see "Domain does not point to this server or the reverse proxy is not configured correctly", look for a wrong A or AAAA record, port 443 blocked upstream, Cloudflare's proxy switched on, or another web server on 443, then submit again.

7. Set up backups before anyone uploads

This creates a folder for the local backup repository:

# as root
mkdir -p /mnt/backup

ls -ld /mnt/backup shows the empty folder, owned by root. In AIO, enter /mnt/backup as the local backup location, click "Submit backup location", store the encryption password it then shows next to the passphrase, and click "Create backup". That backup stops every container and leaves them stopped, so once the page says "Last backup successful", click "Start containers". Then click "Click here to reveal all backup options", enter a quiet hour such as 04:00 (UTC) under "Daily backup and automatic updates", leave the automatic-update box ticked and submit; scheduled backups restart the containers by themselves. On a single-disk VPS this copy guards against mistakes, not disk loss.

8. Check it from the command line

Nextcloud's occ tool runs as the web server user inside its container; this block checks the status and sets the phone region the admin overview asks for (XK is Kosovo, or use your own country code):

# as root
docker exec --user www-data nextcloud-aio-nextcloud php occ status
docker exec --user www-data nextcloud-aio-nextcloud php occ config:system:set default_phone_region --value="XK"

You should see installed: true and a versionstring starting with 35 (34 if you left the box unticked), then System config value default_phone_region set to string XK. The phone-region notice disappears from Administration settings > Overview; a few others may remain on a fresh install, and the email one goes once you finish Sunday's first step.

Sunday: moving the files and the people

1. Enter your mail provider's SMTP details under Administration settings > Basic settings, so password resets and share notices arrive.
2. Create groups such as Accounting and Management, then the accounts, and give each a quota; otherwise one synced video folder can fill the disk.
3. On each laptop, install the desktop client, sign in through the browser and point it at that person's export. Start the big ones on Sunday evening and let them run overnight.
4. Import the .ics files in Calendar and the .vcf files in Contacts. iPhones connect through the built-in accounts with the server cloud.YOUR_DOMAIN/remote.php/dav/principals/users/USERNAME/; for Android, Nextcloud's docs recommend DAVx⁵.
5. Recreate the links clients use, because old Drive links die with the account. For documents clients send you, a "File drop" link with a password and an expiry date lets them upload without seeing anything else.

The desktop client runs on Windows 10 and later, macOS 12 and later, and 64-bit Linux; the Files app needs iOS 17 or Android 9. Virtual files, downloaded only when opened, help on small laptop disks, though some Mac users report trouble with that mode. Test one Mac first.

Locking it down: 2FA, brute-force limits and the admin port

Since version 33, Nextcloud ships its authenticator-app (TOTP) provider switched on, but nobody has to use it. This block makes sure the provider is on and makes two-factor authentication mandatory for everyone:

# as root
docker exec --user www-data nextcloud-aio-nextcloud php occ app:enable twofactor_totp
docker exec --user www-data nextcloud-aio-nextcloud php occ twofactorauth:enforce --on

On a fresh AIO install the first command answers twofactor_totp already enabled and the second Two-factor authentication is enforced for all users. At the next login Nextcloud shows "Set up two-factor authentication"; choose "TOTP (Authenticator app)" and scan the QR code with an app such as Aegis. The desktop and mobile apps sign in through the browser and cope with 2FA. Anything that asks only for a username and password, like the iPhone's calendar account or Thunderbird, needs an app password from Personal settings > Security; that is the usual cause of "my calendar stopped syncing after 2FA".

2FA is only as strong as the patch level behind it. In May 2026 Nextcloud fixed a flaw, CVE-2026-45690, that let someone who already knew a user's password skip the second factor by replaying a temporary session token. Versions 32.0.9 and 33.0.3 closed it, and an AIO server with automatic updates on picked up the fix without anyone logging in.

Brute-force protection is on by default. Per the Nextcloud 35 admin manual, failed logins slow responses by up to 25 seconds, and 10 attempts within 30 minutes earn an HTTP 429 Too Many Requests; entries expire after 48 hours. If a colleague locks themselves out, run docker exec --user www-data nextcloud-aio-nextcloud php occ security:bruteforce:reset THEIR_IP as root.

The AIO interface controls the whole server, and ufw cannot close port 8080. Keep the passphrase offline and open the interface only by IP. The README marks 8443 as optional (drop its --publish line if unused) and recommends limiting the interface's exposure; a real block needs a rule in Docker's DOCKER-USER chain or a firewall in front of the server. And do not add people to the docker group to skip sudo: Docker's documentation says that group grants root-level privileges.

Running it week to week

Backups in three layers

Sync spreads damage as well as files. If ransomware encrypts a laptop's synced folder, the desktop client uploads the encrypted copies, and colleagues who share those folders download them. Versions can rescue a few files; for a whole folder you need a backup, and each layer below covers a different failure:

• AIO's daily Borg backup, deduplicated, compressed and encrypted, keeping the last 7 days plus 4 weekly and 6 monthly archives by default. It stops the containers briefly and skips External Storage mounts.
• Our free weekly backup of the whole VPS, restorable from the client area, for the day the server itself will not boot.
• A copy elsewhere. AIO writes to remote Borg repositories directly, and append-only keys stop an attacker on the server from deleting old archives; see our guide to off-site backups with restic and Borg.

Rehearse a restore once: on a spare VPS, start AIO, choose "Restore former AIO instance from backup", give it the repository and password, and pick an archive. If your files appear, you have a backup. If not, better to learn it now.

Updates and monitoring

With daily backups on, AIO updates its containers after each successful backup and Nextcloud's apps on Saturdays. Leave that on. Nextcloud ships a major version about every four months with a year of support, and majors cannot be skipped; AIO walks that path for you. Version 32, for example, reached end of life in September 2026, the month version 35 came out. Patch the host weekly with apt update && apt upgrade, which updates Docker too, and keep the mastercontainer current, because the two depend on each other: when Docker 29.0.0 arrived on 10 November 2025, mastercontainers older than AIO 12.0.0 failed with "client version 1.41 is too old" until they were updated.

NextCry shows what patching is worth. That ransomware struck in November 2019 through a PHP-FPM bug (CVE-2019-11043) exposed by certain nginx setups, which Nextcloud had warned admins about three weeks earlier, and it hit 2 of roughly 300,000 Nextcloud servers.

Point an uptime monitor at https://cloud.YOUR_DOMAIN/status.php (see our guide to Uptime Kuma and Grafana) and watch df -h, because a full disk stops uploads and backups alike.

Where your data lives: GDPR and Kosovo's data protection law

Self-hosting does not make you compliant, but it makes the questions answerable. Under the GDPR your host is a processor, so you need a written contract with them (Art. 28), security that includes restoring data in good time (Art. 32), and breach reports to the authority within 72 hours (Art. 33).

The Netherlands and Ireland are in the EU, so a server in Amsterdam or Dublin keeps EU personal data inside it. That client in Germany is the test case. Kosovo is not on the European Commission's list of adequacy decisions, so their personal data on a Prishtina server has left the EU, and the transfer needs safeguards such as standard contractual clauses. With US suites, location does not settle it: the CLOUD Act (18 U.S.C. 2713) obliges US providers to disclose data in their "possession, custody, or control" wherever it is stored.

In Kosovo, Law No. 06/L-082 on Protection of Personal Data, published in Official Gazette No. 6 on 25 February 2019, states in Article 1 that it is aligned with the GDPR. It asks for security including encryption and timely restore (Art. 31), a written processor contract (Art. 32), notice to the Information and Privacy Agency within 72 hours of a breach (Art. 33), and transfers abroad only to countries on the Agency's adequacy list or with its authorisation (Arts. 44 to 49). Kosovo data on a Prishtina server avoids the transfer question; for Amsterdam or Dublin, check the Agency's current list first. The other arguments for a server in the country are in why buy a VPS in Kosovo.

A self-hosted Nextcloud still contacts Nextcloud GmbH by default. The update check sends the server version, an instance ID and its size, and mobile push passes device tokens through Nextcloud's push service. No file content leaves, but note it in your privacy documentation. This is general information, not legal advice.

Frequently asked questions

Is Nextcloud free for businesses?

Yes. The server is open source under the AGPL. AIO allows up to 100 users for free; beyond that it points you to Nextcloud Enterprise, the paid subscription with vendor support. Your real costs are the server and someone's time.

How much RAM does Nextcloud need for a small team?

With Office or Talk, AIO asks for 2 GB plus a recommended 1 GB, and a maintainer suggests about 1 GB more per simultaneously active user. In practice, 4 GB (VPS Mini) suits up to about five people and 8 GB (VDS Small) a team of 10 to 15.

Can I run Nextcloud on an IP address without a domain?

Not with AIO. It rejects IP addresses, ports other than 443 and subdirectories, because it gets a Let's Encrypt certificate for a real domain. A subdomain such as cloud.YOUR_DOMAIN with a single A record is enough, and with no domain at all, AIO's interface has offered since June 2026 to register a free dedyn.io name from deSEC, which is fine for a trial but looks odd on links you send clients.

Can Nextcloud replace Google Workspace or Microsoft 365 completely?

For files, sharing, calendars, contacts, calls and everyday document editing, yes. Nextcloud does not host email, though; its Mail app reads an existing mailbox, so most teams keep their mail provider or run a self-hosted mail server such as Mailcow next to it.

Is self-hosted Nextcloud GDPR compliant?

Software cannot be compliant on its own; the organisation running it is responsible. Self-hosting helps because you choose the country and control admin access. You still need a written contract with the host and a plan for reporting breaches within 72 hours.

Why is my Nextcloud slow?

On a manual install, check cron, Redis locking and the PHP-FPM worker count first. AIO handles those, so look at the client side: the heavy first page load, the Calendar app fetching every calendar on each refresh (remove unused ones, the birthday calendar included), and slow first syncs of huge trees of small files.

Can RS Computers set this up for me?

Yes. Message us on Telegram or email info@rscomputers-ks.com with the number of people, roughly how much data you have and where your clients are, and we will suggest a plan and location and quote the setup.

Monday morning

The first real test is simple: someone saves a file on a laptop and a colleague opens it on a phone a minute later. Only two decisions are hard to undo, the domain and the city. For most offices of ten to fifteen people that means VDS Small, in Amsterdam or Dublin for EU client data or in Prishtina for Kosovo data. Keep both passwords off the server, and pick your plan on the VPS and VDS page.

← All articles