How to install Nextcloud on Ubuntu with a perfect security score

This is a collection of 4 tutorials, on how to install Nextcloud on Ubuntu.

The goal of each of these guides, is to have no warnings in the admin center and the instance should get a perfect security score from the nextcloud security scanner.

There are tutorials that use “bare metal” installations (classical LAMP stack) or ones that use Docker Compose. There are also versions behind a NGINX reverse proxy.

They are step by step instructions, aimed at beginners. They start with quiet difficult topics like network requirements and split DNS, since that knowledge is IMHO needed beforehand.
They are not guides on how to run Nextcloud without certs, maybe only locally or over a VPN. IMHO it is so easy to get a valid cert for Nextcloud, there is no reason why should go without a valid cert.

Feel free to offer feedback, or even better, open up a PR :slightly_smiling_face:

2 Likes

Unfortunately, all these guides have the same disadvantage: they use Apache instead of nginx web server

1 Like

Well Yes But Actually No GIFs - Get the best GIF on GIPHY

All of them use either NGINX or Caddy as reverse proxy in front of them.
But yes, all of them use Apache internally.

Years ago, I read some reasoning that NGINX is faster serving static files and Apache2 is better handing PHP-FPM and putting NGINX in front as proxy will get you the best of both worlds.
I am not qualified enough to proof or disproof that statement.

Either way, I you want to use only NGINX, you can simply use the bare metal tutorials and replace the apache part with the official doc about NGINX.

2 Likes

No. For sure not nextcloud.md. But well the question apache or nginx is most likely a question similar to religions. Some believe this others that.

In my case i don’t use apache and i don’t use MariaDB but nginx and PostgreSQL and that runs for my use case perfect.

It’s not really a disadvantage, since the potential performance drawbacks associated with using Apache rather than NGINX are negligible for home users and small businesses.

On the other hand, Apache has one big advantage that is far more relevant in those scenarios: it interprets the .htaccess file shipped with Nextcloud, which is important from a security perspective. If the NGINX configuration from the documentation is not applied correctly, or not kept up to date as things change over time, it could, lead to certain security mechanisms not working properly, and in the worst case, expose sensitive data.

1 Like

My bad, you are right. Still, you can just replace Apache it with the official NGINX doc for the nextcloud.md bare metal install.