What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Nextcloud works reliably behind Traefik on a VPS when the containers share the correct Docker networks, Traefik terminates HTTPS, and Nextcloud is explicitly configured to trust the proxy. The deployment below uses Docker Compose, a separate database network, Traefik v3-style labels, and an ACME certificate resolver.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished stack looks like
The public request path is:
Internet → VPS ports 80/443 → Traefik → Nextcloud:80
As an Amazon Associate I earn from qualifying purchases.
Traefik handles the public hostname and TLS certificate. Nextcloud listens on its internal HTTP port because TLS has already been terminated at the proxy. A database container stays on a private Docker network and is not published to the Internet.
Use two Docker networks:
- proxy: shared by Traefik and Nextcloud so the router can reach the application.
- internal: shared by Nextcloud and the database, with no host port exposed for the database.
This separation limits accidental exposure and makes the proxy route explicit. If you use a different network name, change the network label and the Compose declarations together.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Prerequisites on the VPS
DNS and hostname
Create an A record for a hostname such as cloud.example.com pointing to the VPS public IPv4 address. Add an AAAA record only when IPv6 is correctly routed and firewalled on the server. The hostname must resolve before ACME validation can succeed.
Firewall and host access
Allow SSH from your administration addresses and allow inbound TCP ports 80 and 443. Do not expose the database port. Port 80 is useful even when the site is intended to be HTTPS-only because ACME HTTP challenges and HTTP-to-HTTPS redirects commonly use it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDocker storage
Install Docker Engine and the Docker Compose plugin using the instructions for your VPS distribution. Create a project directory, keep the Compose file and Traefik configuration there, and place persistent data on durable VPS storage. Back up the Nextcloud data directory, database, and Traefik ACME storage independently.
Prepare Traefik’s certificate storage
Traefik must be able to write its ACME state. From the project directory:
mkdir -p traefik/letsencrypt
touch traefik/letsencrypt/acme.json
chmod 600 traefik/letsencrypt/acme.jsonThe restrictive mode is important because the file can contain private key material. Keep it on persistent storage so a container recreation does not discard certificate state.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Static Traefik configuration
The following static configuration enables the Docker provider and a resolver named letsencrypt. The name is case-sensitive; the label and configuration must use exactly the same spelling and capitalization.
Recommended Free Tools
entryPoints:
web:
address: :80
websecure:
address: :443
providers:
docker:
endpoint: unix:///var/run/docker.sock
exposedByDefault: false
certificatesResolvers:
letsencrypt:
acme:
email: [email protected]
storage: /letsencrypt/acme.json
dnsChallenge:
provider: cloudflareThe DNS challenge provider shown is an example. Configure the credentials required by the DNS provider you actually use, and do not place secrets directly in a publicly readable Compose file. An HTTP challenge can also be used when it better fits your DNS and firewall arrangement.
Traefik v3 uses its current rule syntax. Do not add the deprecated ruleSyntax label; the provider documentation says that label is being removed in a future major version.
Compose file for Nextcloud, a database, and Traefik
This example uses PostgreSQL, but the important proxy details are the networks, labels, and Nextcloud proxy variables. Replace the example domain and secrets before deployment.
services:
traefik:
image: traefik:v3
command:
- --configFile=/etc/traefik/traefik.yml
ports:
- 80:80
- 443:443
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
- ./traefik/letsencrypt:/letsencrypt
networks:
- proxy
restart: unless-stopped
db:
image: postgres:16
environment:
POSTGRES_DB: nextcloud
POSTGRES_USER: nextcloud
POSTGRES_PASSWORD: change-this-long-secret
volumes:
- db_data:/var/lib/postgresql/data
networks:
- internal
restart: unless-stopped
nextcloud:
image: nextcloud:latest
depends_on:
- db
environment:
POSTGRES_HOST: db
POSTGRES_DB: nextcloud
POSTGRES_USER: nextcloud
POSTGRES_PASSWORD: change-this-long-secret
NEXTCLOUD_TRUSTED_DOMAINS: cloud.example.com
TRUSTED_PROXIES: 172.20.0.0/16
OVERWRITEPROTOCOL: https
OVERWRITEHOST: cloud.example.com
volumes:
- nextcloud_data:/var/www/html
networks:
- proxy
- internal
labels:
- traefik.enable=true
- traefik.docker.network=proxy
- traefik.http.routers.nextcloud.rule=Host(`cloud.example.com`)
- traefik.http.routers.nextcloud.entrypoints=websecure
- traefik.http.routers.nextcloud.tls=true
- traefik.http.routers.nextcloud.tls.certresolver=letsencrypt
- traefik.http.services.nextcloud.loadbalancer.server.port=80
restart: unless-stopped
volumes:
db_data:
nextcloud_data:
networks:
proxy:
name: proxy
internal:
name: nextcloud-internalUse a pinned, tested image tag rather than latest for a production change-controlled environment. The example leaves the tag visible so you can select the Nextcloud edition and version appropriate for your maintenance policy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
The loadbalancer.server.port=80 label tells Traefik which port to use inside the Nextcloud container. It is not a host port mapping and should not be changed to 443 merely because the public site uses HTTPS.
Configure the Nextcloud proxy relationship correctly
trusted_proxies
trusted_proxies accepts proxy IP addresses or CIDR ranges, not URLs. In a Compose deployment, container IP addresses can change, so trusting the dedicated Docker network subnet is often more stable than trusting one container address. Inspect the actual subnet before using the example:
docker network inspect proxyReplace 172.20.0.0/16 with the subnet assigned to your proxy network. Keep this range as narrow as practical. Nextcloud treats trusted proxies as security-sensitive because an untrusted client could otherwise spoof forwarded headers.
overwriteprotocol and overwritehost
Traefik receives HTTPS from the browser and forwards HTTP to Nextcloud. OVERWRITEPROTOCOL=https tells Nextcloud to generate HTTPS URLs even though its container-side connection is HTTP. OVERWRITEHOST keeps generated links on the public hostname. These settings prevent mixed-content warnings, incorrect redirects, and links that expose an internal container address.
When several proxies are involved, overwritecondaddr can limit overwrite behavior to requests from a specific proxy IP. Use that only when you know the address seen by Nextcloud; a broad or incorrect condition can make the setting appear ineffective.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Environment variables are not a removal mechanism
The official Docker image writes supported environment values into Nextcloud configuration. Removing TRUSTED_PROXIES or OVERWRITEPROTOCOL from Compose later does not necessarily remove values already written to the configuration file. Review the resulting configuration and change it deliberately with occ or by editing the persistent configuration through a controlled maintenance procedure.
Handle CalDAV and CardDAV discovery
Calendar and contact clients commonly request /.well-known/caldav and /.well-known/carddav. The Nextcloud Administration Manual’s Traefik guidance includes a redirect-regex middleware for these paths. Without equivalent redirects, the web interface can work while mobile or desktop calendar and contact clients fail autodiscovery.
Implement the middleware using the syntax for your installed Traefik release, then attach it to the HTTPS router. The intended result is that both well-known paths redirect to Nextcloud’s DAV endpoint at /remote.php/dav/. Test each path with a command such as:
Free tools Windows power users keep installed
One-click scans. No signup required.
curl -I https://cloud.example.com/.well-known/caldav
curl -I https://cloud.example.com/.well-known/carddavConfirm that the response is an intentional redirect to the DAV endpoint, not a 404 or a redirect back to HTTP. Because exact label escaping differs between Compose formats and Traefik releases, verify the final regular expression against the Traefik v3 middleware reference before applying it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Deploy and verify the stack
- Create the project directory, Compose file, static Traefik configuration, and persistent-data directories.
- Set strong database credentials and the real hostname. Keep DNS-provider credentials in the mechanism supported by your chosen ACME challenge.
- Confirm that the VPS firewall permits TCP 80 and 443 and that the DNS record resolves to the VPS.
- Start the stack with
docker compose up -d. - Watch startup output with
docker compose logs -f traefik nextcloud. - Open
https://cloud.example.com. Complete the Nextcloud administrator setup if it was not initialized through environment variables. - Check the certificate presented by the browser and verify that the router selected the intended resolver.
- Run the DAV checks and log in from a separate browser or client to confirm that generated URLs remain HTTPS.
For a first certificate request, a staging ACME certificate is safer while you are correcting DNS, challenge, and resolver settings. Once validation succeeds, switch to the production CA and remove any staging-only setting. This avoids consuming production rate limits during repeated tests.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Troubleshooting by symptom
| Symptom | Likely cause | Fix |
|---|---|---|
| Traefik reports a non-existent certificate resolver | The resolver label does not exactly match the static configuration. | Use the same case-sensitive name, such as letsencrypt, in both places and restart Traefik. |
| 502 Bad Gateway | Traefik is on the wrong network or is targeting the wrong container port. | Keep traefik.docker.network=proxy, attach Nextcloud to that network, and target the internal port exposed by the container. |
| Redirect loop or mixed-content warnings | Nextcloud sees the proxy’s HTTP connection instead of the original HTTPS request. | Set OVERWRITEPROTOCOL=https, verify forwarded headers, and ensure the router terminates TLS only once. |
| Untrusted-domain error | The public hostname is absent from Nextcloud’s trusted domains. | Add the exact hostname through NEXTCLOUD_TRUSTED_DOMAINS during initialization or with the appropriate occ config:system:set trusted_domains command. |
| DAV clients cannot discover calendars or contacts | The well-known paths are not redirected. | Add and test the Traefik redirect-regex middleware for both CalDAV and CardDAV paths. |
| Proxy settings appear unchanged after editing Compose | Existing values remain in persistent Nextcloud configuration. | Inspect the configuration inside the container and remove or replace the values explicitly; deleting the environment entries alone is insufficient. |
| ACME validation fails | DNS is stale, port 80 is blocked for an HTTP challenge, or DNS-provider credentials are invalid for a DNS challenge. | Check public DNS, firewall rules, challenge logs, and provider permissions. Use the ACME staging CA while testing. |
Security and maintenance decisions
Protect the Docker socket
Traefik needs access to Docker metadata to discover labels. A read-only socket mount reduces accidental writes, but access to the Docker socket remains highly privileged. Restrict VPS administration, keep the host patched, and do not expose the Docker API over TCP.
Keep the database private
Do not add a host port mapping for PostgreSQL. Nextcloud reaches it by the Compose service name on the internal network. Back up the database and test restoration instead of relying only on the filesystem volume.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePlan upgrades
Pin image versions, read the upgrade notes for the selected Nextcloud major release, and take a database plus data backup before changing images. Upgrade one major version at a time when the Nextcloud support policy requires it. Review Traefik labels after major Traefik upgrades because deprecated syntax can be removed.
Use narrow proxy trust
Trust only the network or addresses that can actually send requests to Nextcloud. A broad CIDR may make deployment easier but expands the set of sources allowed to influence proxy headers. Recheck the subnet after recreating networks or migrating the stack to another VPS.
Optional Nextcloud Talk scaling
Basic Talk calls can run without a separate high-performance backend, but larger deployments may add the Nextcloud Talk High Performance Backend and TURN/STUN services. Those components introduce additional routing, signaling, and UDP requirements that are separate from the basic HTTP router described here. Treat them as a second design: document the extra hostnames, ports, certificates, and firewall rules before exposing them.
When this architecture is the right choice
Traefik with Compose is a good fit when you want label-driven routing, automatic certificates, and several applications on one VPS. It is less suitable when you need a managed database, multi-node failover, or a platform that hides Docker and certificate operations. For a single VPS, the design remains straightforward as long as persistent storage, proxy trust, and backups are handled as production concerns rather than setup details.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
