Cloud services have revolutionised the way we work, providing easy paths for collaboration over a distance and business-critical features such as automatic off-site backups and version control.
However, potential issues range from not wanting to entrust data to the uncanny tentacles of global megacorporations, to very limited options for intranet-only deployments and the cost of per-user licensing for bundled services that not all users need.
Setting up your own cloud services can – in some cases – provide financial savings, but it will certainly provide greater control over the data you’re responsible for and the way your users can access it.
That can be a distinct advantage when it comes to data protection and financial services regulation. Note, though, that you will be responsible for securing and updating the software that runs your cloud, rather than being able to leave that to a third party.
We’ll guide you through setting up open source cloud storage suite Nextcloud and Collabora Online, which adds online collaborative document editing to Nextcloud, as well as a few more common business cloud features. For brevity and convenience, we’ll be using containerised versions of the software distributed using Snap and Docker.
The latest version, Nextcloud 18 Hub, includes support for an integrated OnlyOffice editing environment on the same server. This is bleeding edge stuff, so for both this reason and because the OnlyOffice Community Edition it uses supports just 20 simultaneous open documents, we’ve opted not to use this approach for our tutorial.
Instead, we’ll guide you through setting up the current stable version 16 snap release of Nextcloud and the more fully-featured Collabora document editing environment on a dedicated server, as this is more appropriately scaleable to the needs of most businesses.
In our example deployment, we’ve given Nextcloud and Collabora’s servers each a dedicated VM. The required spec will vary depending on how many users you have, how much they need to store and how frequently they’ll access storage and edit documents.
A very basic setup – suitable for a small business or department of three to ten people – works smoothly with a single core and 1GB RAM for the Nextcloud server, and two cores and 2GB RAM for Collabora. The extra memory is particularly important here if you expect multiple users to work on their documents at the same time.
Unless you have very high storage capacity requirements, we suggest using an SSD-based system to improve responsiveness. This tutorial was written using virtual servers hosted on Vultr and that service’s default Ubuntu 18.04 image, but applies to any comparable virtual or hardware server configuration.
Nextcloud installation
Set up an Ubuntu 18.04 server. If your install image doesn’t prompt you to do so, create a new user, add them to the sudoers group and update the server. You’ll be logging in as that new user, rather than as root, whenever you need command line access to the Nextcloud server.
| adduser username adduser username sudo su username sudo apt update sudo apt dist-upgrade |
Now, we’re ready to install the Nextcloud snap package, which packs in all required dependencies.
| sudo snap install nextcloud |
To configure your Nextcloud, connect to your server’s IP address in a web browser and follow the prompts to create an admin account. Congratulations, you now have a basic cloud storage server.
To make it easily accessible and appropriately professional-looking, we’ll want a domain name for it – either a new domain or a subdomain of your existing web address will work well.
With an appropriate domain name registered or subdomain selected, create an A record in your registrar’s DNS management portal pointing at your new Nextcloud server’s IP address.
Now we’ll have to tell your Nextcloud instance what its domain name is. Log in to the server at the command line.
| sudo nano /var/snap/nextcloud/current/nextcloud/config/config.php |
Add your new domain name under trusted_domains, save changes and you should now be able to immediately access your Nextcloud from that URL.
With that done, it’s time to run through Nextcloud’s recommended server security tweaks, most importantly HTTPS support.
The Nextcloud snap comes with built-in support for generating a LetsEncrypt certificate, so just run:
| sudo nextcloud.enable-https lets-encrypt |
Then follow through the certificate creation process for your domain name. The Nextcloud Snap includes an integrated auto-renewal routine, but you can also renew your certificates at any point by re-running the creation command above.
Configure Nextcloud
Nextcloud needs to be able to communicate with your users for everything from registration emails to editing invitations, so you’ll need an SMTP server that it can send outbound emails through.
In this example, we’re integrating Nextcloud with a business that uses G-Suite, so we’ll use Gmail as our SMTP server. However, third-party SMTP providers of this kind may require some extra configuration on their end to work. In this instance, we had to reduce security to allow access. If users aren’t allowed to manage their own less secure apps, you’ll have to grand them this permission in the G-Suite admin panel’s Advanced Security Settings.
If you’re testing Nextcloud and using a standard Gmail account for SMTP, you’ll find the same setting in your personal Google Account Security options.
If you run your own mail server, you’ll want to create a user for Nextcloud and point it at that.
At this point, you should add a recovery email address and ideally enable two-factor authentication for your admin account. Once you roll Nextcloud out to your users, you should strongly encourage them to do the same.
If all you need is online storage, you’re ready to invite users, but if you want to provide more advanced cloud services and apps, such as document editing, you’ll want to add a few more features.
Click on your profile icon and select Apps. Here, you’ll see all the default features of Nextcloud, such as its gallery display for images, plain text editor and PDF viewer, as well as any pending updates for them.
In the pane on the left, a category list lets you view a full range of official and third-party Nextcloud apps. There’s a lot here, so you’ll want to take a look through everything to see what your users are likely to need.
Nextcloud’s app library includes Google Drive, Microsoft OneDrive and Dropbox integrations that can help users transfer files from third-party cloud services to Nextcloud, multimedia file playback and conversion, single sign-on and additional two-factor authentication support, web form creation, WebRTC-based video and voice conferencing, end-to-end encryption and real-time tracking of associated mobile devices, as well as more traditional office suite functionality.
For this tutorial, we’re going to add a calendar, task list, and contact management. Go to Office & text and select Download and enable on Calendar, Contacts and Tasks. You may be prompted to enter your password. Once you’ve added these and returned to the main Nextcloud interface, you’ll be able to access these via extra buttons that’ll appear on the interface’s top bar.
Nextcloud includes a simple integrated text editor by default, but if you need proper online document creation and editing, the Nexcloud Collabora Online app is an elegant solution. To use it, however, you’ll need to set up a Collabora Online server.
Based on LibreOffice, Collabora’s features include full version control, commenting, collaborative document editing, and it allows you to create word processor documents, spreadsheets and presentations. Documents are saved in standard Open Document formats, and the synced versions that’ll be saved on users’ devices can be opened in any compatible word processor, although you only get access to collaborative editing via the web interface.
Collabora is available as a Docker image. As it can become rather memory-hungry if you’ve got lots of users editing documents at the same time, we recommend giving it its own server, which also makes life a little easier when it comes to setup and configuration.
Collabora installation
Spin up a fresh Ubuntu 18.04 server and update it. We’ll be expanding on Nextcloud’s official Collabora deployment instructions for this section and working on the assumption that Collabora will only need to serve a single Nextcloud instance.
While some previous iterations of Docker liked to run as root, which is reflected in the Collabora setup instructions linked above, you can and should use a normal user in the sudoers group. So, if your installation image doesn’t do this for you by default:
| adduser username adduser username sudo su username sudo apt update sudo apt dist-upgrade sudo apt install docker.io |
These parameters include British, as well as US, English dictionaries – you can add others as needed. The path specified in the docker run command above must match the URL that your users will be using to connect to Nextcloud.
You’ll also need Apache to act as a forward proxy for the Docker images.
| sudo apt-get install apache2 sudo a2enmod proxy sudo a2enmod proxy_wstunnel sudo a2enmod proxy_http sudo a2enmod ssl |
Before you can configure it properly, though, we’ll need to set up TLS certificates for the subdomain it’ll be using. We’re again using Let’s Encrypt certificates in this tutorial.
In this particular configuration, the easiest option is to stop Apache before using the Lets Encrypt certbot’s certificate-only generation mode.
| sudo service apache2 stop sudo apt install certbot sudo certbot certonly –standalone |
Enter the domain name you want to use for the Collabora server – we suggest using a subdomain on the same domain you’re using for your Nextcloud server. Remember to create an A record in your DNS settings to point the subdomain at your new Collabora server before you try to generate the certificate.
Certbot automatically sets up a cron job to handle the required three-monthly renewals of Let’s Encrypt certificates, but we’ll have to make a couple of modifications to make sure it stops and restarts Apache properly. First, test renewal, as it’ll have to stop your server.
| sudo certbot renew –dry-run –pre-hook “service apache2 stop” –post-hook “service apache2 start” |
If that runs without any errors, we need to create scripts for those pre and post hooks into the appropriate directories.
| sudo nano /etc/letsencrypt/renewal-hooks/pre/stop_apache #!/bin/bash service apache2 stop sudo nano /etc/letsencrypt/renewal-hooks/post/start_apache sudo chmod u+x /etc/letsencrypt/renewal-hooks/post/start_apache See if these are working by running |
You can also confirm that there’s a systemd timer in place for certbot thus:
| systemctl list-timers |
We’re using Apache as a proxy here, so you’ll need to enter the URL of the Collabora Online server – the one you just got a certificate for – and the path to the certificates we created earlier.
| <VirtualHost *:443> ServerName your.collabora.subdomain:443 # SSL configuration, you may want to take the easy route instead and use Lets Encrypt! # Encoded slashes need to be allowed # Container uses a unique non-signed certificate # keep the host # static html, js, images, etc. served from loolwsd # WOPI discovery URL # Main websocket # Admin Console websocket # Download as, Fullscreen presentation and Image upload operations # Endpoint with information about availability of various features sudo service apache2 restart |
Your Collabora server should now be good to go. Log into your Nextcloud web interface as an admin, open the Settings screen and scroll down the left-hand pane until you get to Collabora Online Development Edition.
Click on that and enter the URL and port of your Collabora subdomain – your.collabora.subdomain:443 – and click apply.
User experience
With all your apps up and running, it’s finally time to invite your users. In the Nextcloud web interface, click on your profile icon on the top right of the interface and select users.
Create new users by clocking the +New user button in the left-hand pane then filling in the account settings you want to give them in the entry that appears at the to of the user list on the right.
You can set a password for them, which they should change after first logging in, and inform them of it. Alternately you can leave this password field blank and have them use the password reset feature to create their own password.
When they first log in, users should set their language and locale preferences in the Personal info section of the settings screen, again accessible by clicking on the user icon at top right. Locale determines the first day of the week for the calendar, which is set to the US Sunday-first system by default, and the language in which days are named.
As well as the website, client applications are available for Windows, Linux, macOS, Android and iOS. Users will be prompted to download these when they first connect, and they’re always available via the Mobile & desktop entry in the settings screen, accessible by selecting settings from the menu that appears when you click on your user icon at top right.
Users can also search for Nextcloud clients in mobile app stores and link them by manually entering your cloud server’s URL. This section also includes links to information for syncing calendar and contact data.
If you want your Android users to be able to edit documents from the Nextcloud mobile app, you should use your device management system to roll out the apk file that can be downloaded directly from Nextcloud or have them install the app from the F-Droid store, as the Google Play version is, at time of writing, lagging behind when it comes to support for Collabora Office.
The mobile apps’ Auto upload options allow you to select specific directories on your phone to be automatically backed up to Nextcloud, whether that’s your photo gallery or critical document folder.
Assuming you’ve enabled the contacts app for Nextcloud, the mobile clients will be able to automatically back up your contacts to the service every day, and you can use Bitfire’s DAVx5 app for real-time calendar and contact syncing – once added, Nextcloud calendars and contacts can be accessed via your preferred app.
Tasklist management for the Tasks feature is supported in DAVx5 via OpenTasks for Android, which users are prompted to install. Sync schedules can be customised as needed, with features including the option of only syncing over Wi-Fi, and everything works seamlessly in the background.
The desktop clients let you configure file syncing and create a default Nextcloud folder, whose contents will be automatically kept in sync with your Nextcloud server. You’ll want to set it to launch on system startup. You can also apply bandwidth limits and throttling, which may be helpful to those working from home or on the road.
Nextcloud and its broad range of apps and connectivity tools have great potential for any business that wishes to either switch away from or supplement third-party cloud services.
For a more customised installation or to support large numbers of users, you may wish to build from source once you’ve familiarised yourself with Nextcloud’s systems, but the containerised versions of Nextcloud and Collabora are regularly updated and meet the core requirements for a small self-managed business cloud.
