Any Tips for Upgrading Old Installation of Nextcloud with Server Side Encryption

Hi all,
I have an instance on Nextcloud running on my FreeBSD server. I installed it in 2014 and upgraded from ownCloud 6 incrementally to Nextcloud 16. But since 2018 have had 3 kids (all boys!), so I haven’t had as much time for server maintenance, lol.

My server only has 3 active users, all family members. It is primarily used for photo backup of our Android phones and PC file syncing, with about 1TB of primarily photos. I enabled server-side encryption and all of the data lives on a ZFS dataset. I replicate this dataset to another FreeBSD server about a 2-hr drive away.

This year I plan to get everything current. My steps would be to upgrade my local server to FreeBSD 14, and redo my Nextcloud jail with the latest PHP. Then incrementally update Nextcloud to 16.011, 17.0.10, … , 28.0.3.

Does anyone foresee any reasons this upgrade path won’t work? And is there any benefit to starting with a fresh install of Nextcloud 28, compared to incrementally upgrading from an old version? For example has server-side encryption changed, and the encryption of existing files could benefit from being re-encrypted?

If things go badly, I could always just install Nextcloud 28 fresh, enable server-side encryption, then add the 3 users back and re-sync their files from their computers. The issue with a fresh install is my ZFS dataset of encrypted files would be completely replaced. So I would need to replicate ~1TB of data over my home internet connection with only ~25Mbps upload. To mitigate this, I could just buy some new harddrives, initially replicate the ~1TB locally, then just replace the harddrives in my remote FreeBSD server.

This whole process will probably take me a few months, so I’m just preparing at the moment.
Thanks for the help!

Hi Joshua. Welcome back!

My steps would be to upgrade my local server to FreeBSD 14, and redo my Nextcloud jail with the latest PHP. Then incrementally update Nextcloud to 16.011, 17.0.10, … , 28.0.3.

For this part, don’t overlook the each major version of Nc only works with a particular set of PHP versions. You will need to have a strategy to swap around PHP versions while you do that (based on the requirements for each version noted at https://docs.nextcloud.com).

I enabled server-side encryption and all of the data lives on a ZFS dataset.

  • If you have good data backups (and, importantly, a good restore strategy), you can (at least in theory) just go for it.
  • You should look out for legacy (headerless) encryption that may exist in your environment (especially when you get up to v20): https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_migration.html
  • There is a more efficient storage format for encrypted files (in v25) which reduces space consumption by ~30%. New files get it, existing files continue to work as-is (until they’re opened writing for some reason, in which they’ll get written out in the more efficient format)

If things go badly, I could always just install Nextcloud 28 fresh, enable server-side encryption, then add the 3 users back and re-sync their files from their computers.

This will only work for files, not for other things (like share information or any app data).

If you do try to sync back from clients, beware the server is considered master. You have to take extra steps if you take this path: Restoring backup — Nextcloud latest Administration Manual latest documentation

Thanks for the tips, yeah I thought about the PHP dependencies, and dealing with all that might make me just use the fresh install route instead.

Ok, yeah I would definitely test syncing only a few files at a time. I would rename the old Nextcloud folders to a different folder first, then slowly copy files to the new synced folder to make sure it is working before just moving them all.

What’s funny is I do have good backups in this case. 1 or 2 copies on everyone’s desktop/laptop, a version on my local ZFS server, and a replicate offsite. But, i can really screw things up if I make a mistake because of encryption, lol.