File Image Sharing (Multi-tenant)

🏷️ General
1

I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.)

on

Which general topic do you have

I want to have a service like imagebank.fi for my clients - so that clients can access their asset files directly themselves instead of each one of them calling us for emailing their revised logos or banners.

Question: Will NextCloud fit the bill for this purpose ? My web hosting company OpalStack provides NextCloud out of the box, so I don’t need any help in self-installation etc. I am just curious to know the category NextCloud falls under.

2

Unfortunately, I didn’t quite understand your question. But you can, for example, share folders for joint editing. This means that documents can be downloaded there, edited locally and uploaded again e.g. with Nextcloud clients. There is also Nextcloud Office (Collabora Online) or ONLY OFFICE as online office software. There is probably no separate solution just for images. For apps you can look in the app store from Nextcloud. You can test this demo from Wolkesicher.

3

Lets say I have 50 clients - I would like to give each client access to their own content at say client1.mydomain.com, client2.mydomain.com, client3.mydomain.com … and so on to client50.mydomain.com

4

Nextcloud doesn’t normally operate with subdomains, but you can share a folder with them and either password protect it, or have them sign up a guest account.

5

Only for (anonymous) but separated uploads:
Since a few releases Nextcloud offers the standard sharing option File Request within Nextcloud Files. All users can use the same link https://cloud.server.tld/s/abcdefghijklmno. The user enters a name or title and the files are then saved in a folder with the exact name.

Use this way for sharing:

file-request
file-request333Ă—357 13.7 KB

Link for the user:

file-request2
file-request2407Ă—211 5.48 KB

6

Hmmmm … the main idea is to give each of my clients a separate space of their own - like say 1GB of space of each and have their own version of NextCloud then I guess. Im looking for a multi-tenant architecture.

7

In short:

  • Multi-tenant = no - you need a separate instance for each one.
  • People have their own space = (yes) per folder(s)), with their own permissions/ folders and quota.
1 Like
8

Then I guess I will create a separate / new instance of NextCloud for each client under a subdomain for each client.

9

Unfortunately, there is no good solution. You will need around 600 MB of installation files and a separate database structure for each individual Nextcloud. You will also have to update each Nextcloud individually again and again.

Users are actually well separated. You could simply create several users on one Nextcloud.

You can create a Nextcloud with multiple names such as cloud1.server.tld, cloud2.server.tld, … But all users can use all names.

10

If I choose to use one installation, then can I set it up in such a way that when client1 logins, he sees only mydomain.com/client1 and when client20 logins, he sees only mydomain.com/client20 ? This way its a single installation but separated by client ids.

11

No, that won’t work. Maybe if you manage to Rewrite all paths /client1 to /client20. I don’t think that’s possible because Nextcloud uses Rewrite on its own.

But I can imagine that you put 20 DNS names and 20 virtual web servers in the same folder as /var/www/nextcloud and then simply extend config/config.php as follows.

  'trusted_domains' => 
  array (
    0 => 'client1.server.tld',
    1 => 'client20.server.tld',
  ),

But does that make sense? Billions of people use the same addresses when accessing Google, for example. Is it so bad if 20 clients use the same name?

You don’t have a real client separation and it’s easy to see that everything belongs together. This also applies to the subdomain solution.

1 Like
12

First of all, I don’t think multiple subdirectories for the same instance would work at all, so you’d have to use subdomains.

Secondly, as @devnull already said, this won’t give your users any actual privacy or security benefits, it would be purely cosmetic, so your users could use a personalized subdomain of their choice.

13

Ok, but there since multi-tenancy option doesn’t yet exist in NextCloud, I won’t be able to set it as subdomains.

14

Let’s put it this way. You can have multiple users on an instance, you can have multiple subdomains for an instance, and you can only communicate certain subdomains to certain customers, but as I said, in theory any customer could use any of those subdomains if they knew them, which isn’t a security issue because they would be purely cosmetic in the first place.

As for the separation of users/customers on a single instance, you would have to be very careful that completely unrelated customers can’t find each other. This can be achieved by disabling the global address book and/or restricting its visibility to users in the same group, and then placing the customers in different groups. However, misconfiguration here can easily lead to breaches of personal data and, in the worst case, legal consequences.

If you want to be 120% sure that this won’t happen, you should set up a dedicated Nextcloud instance for each customer. And yes, this is the only option for true multi-tenancy with Nextcloud, because in my opinion multi-tenancy also means that customers can administrate their instance, i.e. install/uninstall apps, manage their users themselves, etc. None of this is possible on a single instance, or only to a limited extent, and again there is always a risk that user data could be leaked to other customers in the event of a misconfiguration or bug in Nextcloud.

15

Thank you for the detailed explanation - I’ll check what works best for my use-case. Since the hosting company I’m with, OpalStack, has expertise in NextCloud setup (single click install in their control panel), I guess I’ll run this by them too.

This was initially required to get my clients to access the digital asset files themselves instead of my or my biz partner constantly accepting calls from them and emailing them their own digital assets back and forth from our laptop’s directories which are sorted client wise. It is to address this issue that I was eyeing for NextCloud.

16

Ah. I was under the impression that you wanted to offer Nextcloud hosting to third parties.

If that’s not the case and you only want your company’s customers to be able to access ceratin files, then a password-protected fileshare or a guest account per customer might be already enough: Guests - Apps - App Store - Nextcloud.

2 Likes
17

Yes, the Guests app is really good. Have a look at it.

One more idea. I use Nextcloud test instances on webspaces. I use Nextcloud Webinstaller from GitHub as a web installer. Can you use subdomains? Use company1.domain.tld, start https://company1.domain.tld/setup-nextcloud.php, install it under . (not nextcloud because of subdomain) and you can use SQLite as a database (not recommended, but very easy ) Every installation needs approx 600 MB of storage in the directory (subdomain). That’s not really great. Explain it to your users.

This may allow you to create several independent Nextcloud instances if your requirements are low.

1 Like
18

I’m starting to think that the reason @anjanesh wants multi-tenancy has something to do with content delivery features, like, I don’t know, being able to integrate the assets directly somewhere? Websites, emails, messengers, etc.

@anjanesh Which brings me to the broader question of whether Nextcloud is even the right tool for the job. I mean, it’s definitely not a good fit if your customers want to integrate the assets directly into things, although you could probably make it work somehow with custom named shares and/or different domain names. However, this would be a pain to manage at scale, especially compared to a solution explicitly designed for this use case, and there will almost certainly be more features missing from Nextcloud that are specific to a DAM like Imagebank.

Nextcloud is primarily a Google Workspace, M365 or Dropbox replacement. It is more of a generic file sharing and groupware solution rather than a digital asset manager or content delivery platform. So if you just want to manage and store files in a similar way to Dropbox or Google Drive, and then allow your customers to download them either via a guest account or a password-protected link and then they go from there, Nextcloud might be for you. But if that were the case you probably wouldn’t ask for multi-tenancy or different domain names for each customer, would you? :wink:

19

Hmm… I dont expect any client of mine to have these digital assets elsewhere like on websites or in email embeds etc. Just one master folder belonging to each client which they will have access to.

Like for example a client may want their logo for print or for some use elsewhere other than on a website.

This is mainly for file organization for clients where clients must have access to their own files as well, not just the agency. Hence I thought NextCloud would be fit. Its just that clientA shouldn’t have access to clientB’s files even accidentally.

20

As long as no kind of automated access to the files is necessary, this would work perfectly with standard password-protected public shares, which can also be renamed. e.g cloud.yourdomain.tld/s/customer1.

Or you could use the Guests app I mentioned. Guest users by default can only access files shared to them and cannot create any files outside of shares, cannot find other users, can only use whitelisted apps. etc. See here for more details: guests/README.md at master · nextcloud/guests · GitHub

EDIT: Just saw the following: guests/README.md at master · nextcloud/guests · GitHub

By default, guests will not be able to list other users in the system, but if a guest gets added to a group they will be able to list users within that group (and, for example, share files with those users).

As a result, guests will be able to see each other as they are part of the same guest group. To prevent that behavior, you can add the guest group to the “Exclude groups from sharing” settings. You can find more information in our documentation about sharing.

Not sure how I should feel about this, and I’m not a developer, so I can’t give a technical explanation, but apperantly the Guests App, only separates its users from normal users by putting them in a special “Guests” group, and thus ultimately has the same potential pitfalls like with normal users and groups, which imho makes it a bit too easy to configure it in a way that other users could be found, either through misconfiguration or through bugs that could be introduced in Nextcloud.

I’m not sure, but to me this all doesn’t seem really secure by design, and so I can only repeat myself that Nextcloud is definitely not suitable for multi-tenancy. Is it suitable for this particular use case? Maybe. Would it be suitable for a bank to share things that way with completly unrelated customers? Probably not :wink:

Either way, I would recommend at least to test it extensively before putting it in production.