Nextcloud AIO and storage

Extracted from the master document on 2026-09-04. §N numbering kept so as not to break the cross-references.

28. Architecture

SSD  →  VM / Docker / AIO / application / DB / Redis / configuration
HDD  →  /mnt/storage/nextcloud/data  →  bulky files

Image: ghcr.io/nextcloud-releases/all-in-one:latest, managed by docker compose in /opt/stacks/nextcloud/compose.yaml (not by a loose docker run — this way the mastercontainer state is reproducible).

Key design variables for running behind Caddy:

APACHE_PORT: 11000
APACHE_ADDITIONAL_NETWORK: proxy
NEXTCLOUD_DATADIR: /mnt/storage/nextcloud/data
SKIP_DOMAIN_VALIDATION: "true"
NEXTCLOUD_BACKUPDIR: /mnt/storage/nextcloud-aio-backup

Datadir permissions — UID 33, GID 0, mode 750. Never chmod 777:

sudo chown -R 33:0 /mnt/storage/nextcloud/data
sudo chmod -R 750 /mnt/storage/nextcloud/data
ls -ldn /mnt/storage/nextcloud/data

Important fact for backups: NEXTCLOUD_DATADIR is a bind mount to the HDD, not a named Docker volume. That is why AIO’s named volumes add up to only ~1.5 GB (that is where the app lives) while the real data —~129 GB— is in /mnt/storage/nextcloud/data. Copying the Docker volumes does not copy the user data.

29. The 502 / domaincheck incident — and why cloud. is the exception

SYMPTOM        https://cloud.balserosworld.net → 502
WHAT IT PROVED DNS ✅  Caddy ✅  → the 502 confirms Caddy was responding
                                    but could not reach the backend
CAUSE          during bootstrap `nextcloud-aio-domaincheck` existed,
               connected to the `nextcloud-aio` network, NOT to `proxy`

Diagnosis used:

docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
docker logs nextcloud-aio-domaincheck --tail 50
curl -I http://127.0.0.1:11000                     # → HTTP 200 on the host
docker inspect -f '{{json .NetworkSettings.Networks}}' nextcloud-aio-domaincheck

curl returned 200 on the host but Caddy could not get through: exactly the scenario in §26.4 (the guard knows who he wants to call, but gets no answer). Solution: let Caddy go out to the host.

extra_hosts:
  - "host.docker.internal:host-gateway"

Caddy ──► host.docker.internal:11000 ──► AIO's Apache
          (the host's door, not the `proxy` network)

Notes on normal AIO behaviour:

• nextcloud-aio-domaincheck ends with code 143 = SIGTERM, a controlled stop after fulfilling its purpose. Do not delete it by hand: AIO manages its own containers.
• notify-push may show Name does not resolve while Nextcloud is starting, and then log notify-push was started. Lesson: distinguish transient startup errors from persistent failures.

30. HEVC videos and future Jellyfin

One video tested was HEVC/H.265 Main, 3840×2160, ~59.65 fps, ~61 Mb/s, AAC audio. Audio with no picture in the browser is a codec incompatibility, not corruption of the upload.

Nextcloud → storage / organisation / sharing
Jellyfin  → media playback, read-only access to media   (future idea)

Prefer Direct Play. If transcoding 4K60 HEVC were needed, look into hardware acceleration; do not rely on the CPU without measuring.

---