To install Nextcloud AIO on a VPS, prepare a clean Linux server with Docker Engine, point a DNS record at it, open the ports required by your chosen network design, and run the official AIO master-container command. Direct mode is simplest when ports 80 and 443 are available. If Nginx, Apache, Caddy, or another service already owns web ports, run AIO behind that reverse proxy and publish its internal Apache service on a separate port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide answers “How do I install Nextcloud AIO on a VPS?”, “What ports does Nextcloud AIO need?”, and “Can I run Nextcloud AIO behind Nginx or Caddy?” with the exact startup commands, firewall plan, HTTPS requirements, proxy settings, and recovery steps.
As an Amazon Associate I earn from qualifying purchases.
What Nextcloud AIO installs
Nextcloud All-in-One (AIO) is Nextcloud’s official Docker-based installation path. A master container creates and coordinates the Nextcloud services you select, rather than requiring you to assemble every container manually. The project publishes the image and installation procedure in its official repository.
The master container is more than a temporary installer. Its Docker volume, nextcloud_aio_mastercontainer, stores AIO’s configuration and is part of the recovery plan. Keep the container name exactly nextcloud-aio-mastercontainer; AIO’s update and management workflow expects that name.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the network topology first
| Topology | Use it when | Public web ports | How AIO receives web traffic |
|---|---|---|---|
| Direct AIO HTTPS | The VPS has no existing web server and ports 80/443 can be dedicated to Nextcloud. | 80/TCP, 443/TCP; 8443/TCP is used by the direct AIO interface. | AIO publishes its own web and Apache services. |
| Reverse proxy | Nginx, Apache, Caddy, or another proxy already serves domains on the VPS. | Your proxy owns 80/TCP and 443/TCP. | The proxy forwards the Nextcloud hostname to AIO’s Apache service, for example port 11000. |
Do not run both designs at once. A process cannot bind a port already occupied by another process, and exposing unused ports increases attack surface.
Prerequisites for a VPS installation
Use a compatible VPS platform
Choose a Linux VPS with Docker Engine and a kernel that supports normal Docker operation. KVM or non-virtualized platforms are the safer choices. Older Virtuozzo-style virtualization and other constrained VPS products can omit kernel features that AIO needs, causing containers to fail even when the Docker command itself succeeds.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
SSD-backed storage is preferred for database, preview-generation, and file operations. HDD storage can work but is slower; SD cards are specifically discouraged by the AIO project. Size the disk for the Nextcloud data you expect to keep, plus room for temporary files and backup archives.
Confirm the CPU architecture
Run this before installing AIO:
uname -mThe project lists x86_64 (also written x64 or amd64) and aarch64 (arm64 or armv8) as supported architectures. If your provider reports a different architecture, verify compatibility before committing data to the server.
Install Docker Engine
Install Docker Engine using Docker’s official Linux instructions for your distribution. Confirm that the Docker daemon is running and that your administrator account can run Docker with sudo. AIO relies on the Docker socket, so disabling or replacing the daemon after deployment will stop AIO from managing its child containers.
Create DNS before requesting a certificate
Create an A record, or an AAAA record when using IPv6, for the hostname that will serve Nextcloud. Point it to the VPS address and wait until public DNS resolvers return that address. A certificate request can fail if the name still resolves elsewhere or if an old AAAA record sends validation traffic to the wrong machine.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Prepare both firewall layers
Allow the required TCP and UDP traffic in the provider’s firewall and in the operating-system firewall. Cloud firewalls and local tools are independent; opening a port in only one of them is not enough. Start with the ports for your selected topology and remove temporary broad rules after validation.
What ports does Nextcloud AIO need?
The exact exposure depends on whether AIO terminates HTTPS directly or sits behind a proxy.
| Port | Protocol | Purpose | Expose publicly? |
|---|---|---|---|
| 80 | TCP | HTTP redirect and ACME HTTP challenge in direct mode. | Yes for direct mode; normally the proxy owns it in reverse-proxy mode. |
| 443 | TCP | Normal HTTPS access to the Apache/Nextcloud service. | Yes, either from AIO or from your reverse proxy. |
| 443 | UDP | Optional HTTP/3 support. | Only when you intentionally enable HTTP/3. |
| 3478 | TCP and UDP | Nextcloud Talk signaling and media connectivity. | Only when Talk is enabled and you need external Talk clients. |
| 8080 | TCP | AIO management interface. It uses a self-signed certificate and is opened by IP. | Allow it only for administration; restrict source addresses where practical. |
| 8443 | TCP | Direct-mode AIO interface that can obtain a valid certificate when its conditions are met. | Direct mode only, when using that interface. |
Never publish an internal proxy port such as 11000 to the internet when a reverse proxy is handling public HTTPS. Bind it for proxy access and protect the management interface separately.
How to install Nextcloud AIO directly on a VPS
1. Verify DNS and access before starting
- Resolve the planned hostname from a machine outside the VPS and confirm it returns the VPS address.
- Open the direct-mode firewall ports in the table: 80/TCP, 443/TCP, 8080/TCP, and 8443/TCP. Add 3478/TCP and 3478/UDP only if Talk will be enabled. Add 443/UDP only for HTTP/3.
- Check that no existing web server is listening on ports 80, 443, or 8443. Stop or reconfigure that service if you intend to dedicate the ports to AIO.
2. Start the master container
Run the official Linux command as one block:
sudo docker run
--init
--sig-proxy=false
--name nextcloud-aio-mastercontainer
--restart always
--publish 80:80
--publish 8080:8080
--publish 8443:8443
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config
--volume /var/run/docker.sock:/var/run/docker.sock:ro
ghcr.io/nextcloud-releases/all-in-one:latestThe named volume preserves the master-container configuration independently of the container lifecycle. The read-only Docker-socket mount lets AIO create and supervise its component containers. Keep the image name, container name, and volume mapping unchanged.
3. Open the AIO management interface
Browse to https://VPS-IP:8080/. The certificate on port 8080 is self-signed, so your browser will show a warning. This interface is intended for initial administration; access it by the server IP rather than the future domain.
4. Enter the domain and select components
In the AIO interface, enter the DNS hostname after confirming it resolves correctly. Select only the components you need, then let AIO create them. Direct mode can provide a publicly trusted certificate through the 8443 path when ports 80 and 8443 are reachable from the internet and the domain points to this VPS.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
5. Validate the deployment
After the containers finish starting, test an interactive login, a file upload and download, background jobs, and any optional service you enabled. If you selected Talk, test a call from an external network rather than only from the VPS itself.
Can I run Nextcloud AIO behind Nginx or Caddy?
Yes. AIO supports a reverse-proxy topology for Nginx, Apache, Caddy, and similar software. Your proxy keeps ownership of public ports 80 and 443, while AIO exposes its Apache service on an internal port. The project’s detailed proxy requirements are documented in the AIO reverse-proxy guide.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →1. Start AIO with the proxy environment
Use this startup pattern when another service already owns the public web ports:
sudo docker run
--init
--sig-proxy=false
--name nextcloud-aio-mastercontainer
--restart always
--publish 8080:8080
--env APACHE_PORT=11000
--env APACHE_IP_BINDING=0.0.0.0
--env APACHE_ADDITIONAL_NETWORK=""
--env SKIP_DOMAIN_VALIDATION=false
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config
--volume /var/run/docker.sock:/var/run/docker.sock:ro
ghcr.io/nextcloud-releases/all-in-one:latestAPACHE_PORT=11000 tells AIO which port its Apache service should use. APACHE_IP_BINDING=0.0.0.0 allows the proxy to reach that service. Keep port 11000 private: publish it only where the proxy can connect, or place both services on an appropriate Docker network. The example leaves APACHE_ADDITIONAL_NETWORK empty; add a network only when your proxy architecture requires one.
2. Point the proxy at AIO Apache
Configure the proxy’s virtual host for your Nextcloud hostname and forward requests to the AIO Apache endpoint on port 11000. Preserve the original host and forwarding headers required by your proxy so Nextcloud can generate correct HTTPS URLs. Your proxy should terminate the public certificate on 443 and handle the HTTP-to-HTTPS redirect on 80.
Enter the same hostname in the AIO interface at https://VPS-IP:8080/. AIO must know the external name even though the proxy handles TLS.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
3. Add the proxy to trusted proxies
If the proxy connects from an address other than localhost or 127.0.0.1, add that address to Nextcloud’s trusted_proxies setting. The official guide demonstrates this command:
sudo docker exec --user www-data -it nextcloud-aio-nextcloud
php occ config:system:set trusted_proxies 2
--value=ip.address.of.proxyReplace ip.address.of.proxy with the actual source address seen by the Nextcloud container. Use the correct configuration index if your installation already has trusted-proxy entries.
4. Account for Collabora when enabled
When Collabora is enabled and it sees a different proxy address, add that address to Collabora’s WOPI request allow list as well. Otherwise document editing can fail even though ordinary Nextcloud pages load.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFirst-run HTTPS and security checklist
- Confirm the DNS A/AAAA record still points to this VPS immediately before entering the domain.
- Check both firewall layers for the exact public ports required by your topology.
- Use the 8080 interface to finish AIO configuration; expect a self-signed certificate there.
- For direct mode, verify that the certificate path can reach the server on ports 80 and 8443 before expecting a trusted certificate on 8443.
- After testing, remove temporary all-source or all-port firewall rules and limit management access to trusted addresses.
- Check that the browser shows the intended hostname and HTTPS certificate before inviting users.
Backups, upgrades, and recovery
Protect the master-container configuration
Include the persistent nextcloud_aio_mastercontainer volume in your backup design. Losing that volume removes AIO’s stored configuration even if your user-data directory survives. Keep backup archives available separately from the VPS so a provider failure does not destroy both the live instance and its recovery copy.
Use AIO’s backup and restore functions
AIO includes a backup section and can restore an instance from a backup archive through its management interface. Before an upgrade or migration, verify that a recent archive exists and that the configuration volume is protected. A backup that has never been restored is only an assumption, so perform a trial restore on a separate VPS and document the steps, credentials, DNS changes, and firewall rules needed to bring it online.
Do not rename the managed container
Keep nextcloud-aio-mastercontainer unchanged during maintenance. The AIO update process relies on that identifier; replacing it with a custom name can break expected management behavior.
Troubleshooting a Nextcloud AIO VPS installation
Port 8080 does not open
Check that the master container is running with sudo docker ps, confirm the 8080/TCP mapping, and inspect both the provider firewall and the VPS firewall. Connect to https://VPS-IP:8080/, not the domain, and accept that the certificate is self-signed. If another container already occupies 8080, recreate the AIO container with a different host-side management port and use that port consistently.
Domain validation or certificate issuance fails
Recheck A and AAAA records, remove stale records, and verify that inbound 80/TCP and the direct-mode 8443/TCP path reach this server. In reverse-proxy mode, let the proxy perform public TLS termination and ensure it forwards the hostname and HTTPS headers to the AIO Apache port. A firewall rule on the operating system cannot compensate for a blocked provider-level rule.
The reverse proxy returns 502 or connection refused
Confirm that the AIO Apache service is listening on the APACHE_PORT selected at startup, that APACHE_IP_BINDING=0.0.0.0 is present, and that the proxy can reach the container or host address used in its upstream definition. Check the AIO container logs and the proxy’s upstream error log for the actual destination address; a proxy pointed at localhost inside its own container will not reach AIO unless both services share the required network.
Nextcloud reports an untrusted proxy or wrong scheme
Add the proxy’s real source IP to trusted_proxies and preserve the forwarded host and HTTPS headers. If the proxy uses a Docker bridge address, trust the address that Nextcloud actually sees, not the public client address.
Talk works locally but not from the internet
When Talk is enabled, allow both 3478/TCP and 3478/UDP through the provider and host firewalls. Test from a different network, such as a mobile connection. Blocking UDP commonly causes failed media negotiation even when the web interface itself is healthy.
Recommended Free Tools
The VPS cannot start AIO containers
Review the provider’s virtualization model and kernel restrictions. Move to a KVM or non-virtualized VPS if Docker reports missing kernel capabilities, overlay-storage errors, or permission failures that cannot be corrected inside the guest. Also verify that the architecture is one of the supported x86_64 or aarch64 families.
The installation is usable but slow
Check storage latency and available disk space. HDD-backed instances can operate but will respond more slowly than SSD-backed systems, while SD-card storage is not recommended for this workload. Avoid filling the disk with unpruned backup archives or temporary migration data.
Operational checklist
- Record the VPS address, DNS name, architecture, Docker version, and virtualization type.
- Document which topology you selected and which ports are intentionally exposed.
- Keep the AIO master volume and backup archives in separate recovery locations.
- Retest login, uploads, background jobs, HTTPS renewal, and Talk after firewall or proxy changes.
- Perform a restore rehearsal on another VPS before relying on the deployment for important files.
For installation details that change with AIO releases, consult the official AIO repository, and use the Nextcloud Administration Manual for broader Linux installation and administration context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
