# Nextcloud - nc.wittenberger.us

Self-hosted Nextcloud instance running on a bare metal Ubuntu VM with Apache + PHP 8.3 and a MySQL backend.

---

## Repository Contents

```
nextcloud/
├── configs/
│   ├── config.php                        # Nextcloud application config (secrets redacted)
│   ├── nc.wittenberger.us.conf           # Apache HTTP vhost (port 80, redirects to HTTPS)
│   ├── nc.wittenberger.us-le-ssl.conf    # Apache HTTPS vhost (port 443, SSL + RemoteIP)
│   └── php.ini                           # PHP 8.3 config (apache2 SAPI)
└── README.md
```

---

## Stack

- **Nextcloud** v33.0.3.2
- **Apache2** - HTTP/HTTPS, mod_ssl, mod_remoteip, mod_rewrite
- **PHP 8.3** - mod_php (apache2 SAPI)
- **MySQL** - database backend (`nextcloud` db, `localhost`)
- **Redis** - distributed locking (`memcache.locking`, localhost:6379)
- **APCu** - local memory cache (`memcache.local`)
- **Let's Encrypt** - SSL via Certbot (`/etc/letsencrypt/live/nc.wittenberger.us/`)

---

## Prerequisites

- Ubuntu VM with Apache2, PHP 8.3, MySQL, Redis installed
- PHP extensions: `apcu`, `opcache`, `pdo_mysql`, `mbstring`, `intl`, `gd`, `curl`, `zip`, `xml`
- Certbot for SSL certificate management
- Cloudflare in front of the server (NPM on a separate host handles proxying)

---

## Key PHP Settings

The following values in `configs/php.ini` are tuned specifically for Nextcloud - these differ from PHP defaults:

| Directive | Value | Reason |
|-----------|-------|--------|
| `memory_limit` | `512M` | Nextcloud recommendation |
| `upload_max_filesize` | `200G` | Large file uploads |
| `post_max_size` | `200G` | Large file uploads |
| `max_execution_time` | `360` | Long-running operations |
| `opcache.enable` | `1` | Performance |
| `opcache.memory_consumption` | `512` | Performance |
| `opcache.interned_strings_buffer` | `16` | Performance |
| `opcache.max_accelerated_files` | `10000` | Performance |
| `date.timezone` | `America/Chicago` | Local timezone |

---

## Apache Configuration

Two vhost files in `configs/`:

**`nc.wittenberger.us.conf`** (port 80) - redirects all HTTP traffic to HTTPS via `mod_rewrite`.

**`nc.wittenberger.us-le-ssl.conf`** (port 443) - main vhost. Notable settings:
- `RemoteIPHeader X-Forwarded-For` with all Cloudflare IP ranges trusted via `RemoteIPTrustedProxy`
- NPM reverse proxy IP (`10.10.14.199`) also trusted
- HSTS header set via `mod_headers`: `max-age=15552000; includeSubDomains`
- SSL via Let's Encrypt; includes `/etc/letsencrypt/options-ssl-apache.conf`

> The `RemoteIPTrustedProxy` list should be kept in sync with the Cloudflare IP ranges in `config.php`'s `trusted_proxies` array and the NPM host's `http_top.conf`. All three need updating when Cloudflare adds new ranges.

---

## Nextcloud Configuration (`config.php`)

Key settings (see `configs/config.php` for full file):

| Setting | Value |
|---------|-------|
| `dbtype` | `mysql` |
| `dbhost` | `localhost` |
| `memcache.local` | `APCu` |
| `memcache.locking` | `Redis` |
| `redis.host` | `localhost:6379` |
| `maintenance_window_start` | `6` (6 AM UTC) |
| `default_phone_region` | `US` |
| `mail_smtpport` | `587` |
| `REVERSE_PROXY_LIMIT` | `2` |

Secrets to fill in after cloning:

| Placeholder | Description |
|-------------|-------------|
| `instanceid` | Auto-generated, do not change on restore |
| `passwordsalt` | Auto-generated, do not change on restore |
| `secret` | Auto-generated, do not change on restore |
| `trusted_domains` | Your FQDN and LAN IP |
| `trusted_proxies` | NPM host IP + Cloudflare ranges |
| `dbpassword` | MySQL password for `nextcloud` user |
| `mail_smtphost` / `mail_smtppassword` | SMTP credentials |
| `INTERNAL_TOKEN` / `JWT_SECRET` | Auto-generated, restore from backup |


---

## Background Jobs (Cron)

Nextcloud background tasks run via system cron as root every 5 minutes:

```
*/5 * * * * php -f /var/www/nc.wittenberger.us/cron.php
```

To restore after accidental removal:

Verify cron mode is set to **Cron** (not Ajax or Webcron) under **Administration → Basic Settings** in the Nextcloud UI.

---

## SSL Certificates

Managed by Certbot. Certificates live at `/etc/letsencrypt/live/nc.wittenberger.us/`. Auto-renewal is handled by the system `certbot.timer` - verify with:

```bash
systemctl status certbot.timer
```

---

## Backups

| What | Where |
|------|-------|
| Nextcloud files | `/var/www/nc.wittenberger.us/` |
| User data | `/var/www/nc.wittenberger.us/data/` (or custom `datadirectory`) |
| Database | `mysqldump -u nextcloud -p nextcloud > nextcloud_$(date +%F).sql` |
| Config | `config.php` (this repo, secrets stored separately) |
| SSL certs | `/etc/letsencrypt/` |

---

## Updating Nextcloud

Use the built-in web updater or `occ`:

```bash
cd /var/www/nc.wittenberger.us
sudo -u www-data php occ upgrade
```

After updates, clear opcache and verify background jobs are still running.

---

## Troubleshooting

**Incorrect IP in logs / Nextcloud security warning about reverse proxy**
Verify `trusted_proxies` in `config.php` matches the `RemoteIPTrustedProxy` entries in the SSL vhost and that `REVERSE_PROXY_LIMIT` is set correctly.

**Background jobs not running**
Check cron is active: `crontab -l`. Verify mode in Admin → Basic Settings.

**Redis connection errors**
```bash
systemctl status redis
redis-cli ping
```

**Opcache issues after update**
```bash
systemctl restart apache2
```

**Check Nextcloud logs**
```bash
tail -f /var/www/nc.wittenberger.us/data/nextcloud.log
```