Access Nextcloud remotely with a public URL

This deploys Nextcloud, including file sync, calendar, and contacts, as a Docker Compose stack with a MariaDB backend. Nethera gives it a public HTTPS endpoint automatically, without port forwarding or router configuration. See /docs for how Nethera works.

Why Nextcloud

Nextcloud is useful when you want files, calendars, and contacts on a machine you control, but still reachable from your other devices. Nethera gives that machine a public HTTPS endpoint without port forwarding, static IPs, or dynamic DNS.

This recipe is aimed at light remote access: calendars, contacts, documents, and occasional file sync. For large photo libraries, full-device sync, team file sharing, or frequent large uploads, bandwidth and storage matter. Nethera is giving your machine a public path, not turning it into unlimited cloud storage.

Requirements

• Nethera CLI (neth) installed
• A machine running the Nethera agent

See /docs/quickstart for setup of both.

nethera.yml

appName: nextcloud
services:
  web:
    image: nextcloud:apache
    environment:
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      NEXTCLOUD_TRUSTED_DOMAINS: ${NETHERA_PUBLIC_HOST}
      OVERWRITEPROTOCOL: https
      OVERWRITEHOST: ${NETHERA_PUBLIC_HOST}
    ports:
      - "8080:80"        # optional LAN access at http://<machine-lan-ip>:8080
    volumes:
      - nextcloud-data:/var/www/html
    depends_on:
      - db
    nethera:
      public: 80      # exposes container port 80 and issues a public HTTPS endpoint for it
      auth: login     # protects first admin setup behind Nethera login
      secrets:
        - MYSQL_PASSWORD
 
  db:
    image: mariadb:11
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    environment:
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
    volumes:
      - nextcloud-db:/var/lib/mysql
    nethera:
      secrets:
        - MYSQL_PASSWORD
        - MYSQL_ROOT_PASSWORD
 
volumes:
  nextcloud-data:
  nextcloud-db:

Only web has public: 80, so only Nextcloud is exposed through Nethera. MariaDB stays internal to the Compose network.

Deploy

Initialize the app and set the database passwords as Nethera secrets:

$neth init
$neth secrets set MYSQL_PASSWORD
$neth secrets set MYSQL_ROOT_PASSWORD
$neth deploy

neth init prepares the Nethera metadata for the app, including the generated app identifier and target machine selection.

Nethera injects NETHERA_PUBLIC_HOST into the deployment env file, so Nextcloud trusts the public endpoint during the first deploy.

Open

Open the HTTPS endpoint printed by neth deploy. Nethera will require login before Nextcloud loads. You'll land on the Nextcloud first-run setup wizard, where you create the admin account.

Lock down normal use

After the admin account exists, change the service's Nethera auth to none if you want Nextcloud's own login and sync clients to be the only access layer:

nethera:
  public: 80
  auth: none

Then redeploy:

$neth deploy

Use local access when possible

This recipe publishes Nextcloud on the machine's LAN at port 8080:

http://<machine-lan-ip>:8080

Use that local address for devices that mostly stay on the same LAN as the machine. That keeps sync traffic on your local network and avoids using Nethera bandwidth.

Find the machine's LAN IP from the machine itself:

hostname -I

If Nextcloud shows an "Access through untrusted domain" error when you open the LAN address, add the LAN IP or a local hostname to NEXTCLOUD_TRUSTED_DOMAINS and redeploy:

environment:
  NEXTCLOUD_TRUSTED_DOMAINS: ${NETHERA_PUBLIC_HOST} 192.168.1.50

Replace 192.168.1.50 with the actual LAN IP or hostname you use locally. If port 8080 is already in use on the machine, change the left side of the port mapping, for example "8081:80", then open http://<machine-lan-ip>:8081.

Use the Nethera HTTPS endpoint for devices that need access away from home, or when you need a stable public URL.

Data and config notes

• nextcloud-data holds the Nextcloud install, config, apps, and user files.
• nextcloud-db holds the MariaDB data directory.
• Back up both volumes if you care about the data. The files and database belong together for a useful restore.
• Database passwords are stored as Nethera secrets and injected into the containers at deploy time.
• Use strong database passwords before deploying anything you care about.

Troubleshooting

"Access through untrusted domain" error on first load. Check that NEXTCLOUD_TRUSTED_DOMAINS and OVERWRITEHOST still use ${NETHERA_PUBLIC_HOST}.

"Access through untrusted domain" on the LAN address. Add the machine's LAN IP or local hostname to NEXTCLOUD_TRUSTED_DOMAINS, then redeploy.

Nextcloud generates http:// links instead of https:// links. Check that OVERWRITEPROTOCOL is set to https and OVERWRITEHOST matches the Nethera hostname.

The Nextcloud setup wizard asks for database details. Use the same values from the Compose file: database user nextcloud, database name nextcloud, database host db, and the MYSQL_PASSWORD value you set with neth secrets set MYSQL_PASSWORD.

Large uploads or syncs are slow. Nextcloud is moving data through the machine running the Nethera agent and that machine's internet connection. Check upload speed, disk space, and whether other sync clients are running.

Nethera bandwidth is being used faster than expected. Check for initial syncs, photo backup, large folder sync, or multiple clients all syncing through the public endpoint. For devices on the same network as the machine, use local access where practical.

FAQ

Can I use the Nextcloud mobile app to sync from outside my home network? Yes, that's what the public HTTPS endpoint is for. Point the app at the URL Nethera prints after neth deploy, but remember that remote sync uses Nethera bandwidth.

Why not just use a VPN, like Tailscale or WireGuard?

A VPN works well if it's just you, or a small group who already have a client installed. Nethera's endpoint is a normal HTTPS link instead, useful once you want to share access without asking someone to install anything. auth: login still gates who's let through if you want that.

Should I use the Nethera URL when I'm at home? Not necessarily. For devices that mostly stay on the same LAN as the machine, use http://<machine-lan-ip>:8080 or a local hostname that points to the machine. Local access avoids public bandwidth use. For devices that need access from anywhere, the Nethera URL is more convenient.

Is this actually private if auth: none is set? During first setup, Nethera login protects the setup wizard. After you switch to auth: none, Nextcloud's own authentication still sits in front of your files and account. The login page itself is reachable by anyone with the URL, so it's not hidden, just password-protected the same way any public Nextcloud instance is.

Why self-host Nextcloud instead of just using Google Drive or Dropbox? Mainly data ownership and cost structure. Your files, photos, contacts, and calendar live on a machine you control instead of a third party's infrastructure, and storage is bounded by the disks you attach rather than a hosted storage tier. You are still responsible for the machine, backups, reliability, bandwidth, and any Nethera subscription.

Will this handle a whole family or team? It can, but size the machine, disk, backups, internet connection, and bandwidth allowance for the workload. Nextcloud sync traffic can grow quickly with multiple users, photo uploads, and large files.

Can I redeploy or update this without SSHing into the machine?

Yes, neth deploy from your project directory redeploys in place. If you're managing more than one machine, the same command and nethera.yml work whether you're targeting one or several, see fleet management for pairing multiple machines under one workspace.

Notes

• The MariaDB command flags align the database with Nextcloud's recommended settings: READ-COMMITTED transaction isolation and row-based binary logging.
• No cron container is included here, so Nextcloud's background jobs will run via AJAX page loads instead of a real cron schedule. Fine for light use, not ideal for larger instances.
• No reverse proxy config is needed beyond the overwrite/trusted-domain settings in this file. Nethera handles TLS termination.
• Start with auth: login for first admin creation. Switch to auth: none only after the Nextcloud admin account exists.
• Remote file sync can consume significant Nethera bandwidth. This recipe is intended for light remote access, not unlimited cloud-drive replacement.