Nextcloud - Hardened Self-Hosted File Sync and Collaboration

What is Nextcloud

Nextcloud is the leading open-source platform for self-hosted file sync, sharing, and online collaboration. With over 100 first-party and community apps for files, calendar, contacts, mail, video calls, and document editing, it lets a team replace several SaaS subscriptions with a single platform that runs entirely on your own infrastructure. The Nextcloud client is available for Windows, macOS, Linux, Android, and iOS, and the WebDAV API works with any standards-compliant client.

Why self-host Nextcloud

Self-hosting puts every file, share link, and user account inside your own subscription - no per-seat SaaS fees and no third-party data residency questions. Ideal for organisations with strict data residency requirements (GDPR, HIPAA, SOC 2), regulated industries that need an auditable on-premises share service, and MSPs who keep customer files inside their own tenant. Nextcloud also integrates with Collabora Online for full document editing inside the browser.

What this VM image adds

Security hardening:

• Admin password generated per instance - 20-character random password, stored in /root/nextcloud-credentials.txt at first boot, never the same on two deployments
• Database password and Redis password generated per instance - rotated at first boot, internal only, never written to user-facing files
• MariaDB listens on localhost only - no exposed database port; nextcloud database user limited to localhost
• Redis on a unix socket with password - no TCP listener; APCu used as local cache, Redis as distributed cache and file locking
• PHP-FPM tuned at first boot - max_children, start_servers, and OPcache memory sized from instance RAM
• trusted_domains and overwrite.cli.url - populated automatically with the real public IP of the VM at first boot, no manual config
• Certbot pre-installed - one command issues a Let's Encrypt certificate, ready for production use
• Trivy CVE scan - every image is scanned before release; CRITICAL/HIGH with available fix block the build
• UFW firewall - only ports 80, 443, and 22 open
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control on system services

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark applied via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, MaxAuthTries 4
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with SHA-256 hashes
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html, 0 FAIL rules on the tailored profile
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md with documented exceptions
• Server credentials file - /root/nextcloud-credentials.txt with the public IP, the web UI URL, and the per-instance admin password (DB and Redis secrets stay internal)
• WebDAV ready - /remote.php/dav/files/<user>/ accessible immediately after first boot for any standards-compliant client

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. Open NSG: TCP 80 and 443 from your client networks - SSH 22 from your management IPs only
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. The MOTD shows the public web UI URL and the WebDAV endpoint at every login
5. Read connection details: sudo cat /root/nextcloud-credentials.txt - contains the admin password
6. Open http://<PUBLIC_IP>/ and sign in as admin
7. Issue an HTTPS certificate (recommended for production): sudo certbot --nginx -d your.domain.com, then add the domain to trusted_domains via sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 3 --value=your.domain.com

First boot takes 60-90 seconds while the database is initialised and the admin user is created. The startup page auto-refreshes until the platform is ready.