Nextcloud Office
COMPLETE
Deployed office.rmf44.xyz as a Nextcloud All-in-One stack
with Collabora + Whiteboard on homework03, with public
ingress through hawker's Caddy over a NetBird mesh.
Replaces the retired OnlyOffice container.
Cutover completed 2026-08-10.
Page index
- Architecture — topology, container tree, data flow
- Procedure — phase-by-phase build + cutover commands
- Troubleshooting — every pitfall we hit + the fix
- Operations — backup, rollback, monitoring, day-2
The goal
Replace the standalone OnlyOffice container on hawker
with a full Nextcloud All-in-One deployment providing file sync,
Collabora-based office editing (Word/Excel/PowerPoint), and the
built-in Whiteboard. Public URL https://office.rmf44.xyz
serves a single domain (no subdomain split). User data lives on
desslok via NFS so existing backup snapshots still apply.
At a glance
| Item | Value |
|---|---|
| Hostname | office.rmf44.xyz (single domain) |
| Stack | Nextcloud All-in-One, 8 containers (mastercontainer, apache, nextcloud-fcgi, database, redis, collabora, whiteboard, notify-push) |
| AIO host | homework03 (10.0.0.73), Debian 13, Docker 29.6.2, 15 GB RAM |
| Apache port | 11000 (host-side; mastercontainer owns host :80 for acme) |
| Public ingress | hawker Caddy office.rmf44.xyz → 100.79.142.164:11000 over NetBird |
| Office suite | Collabora (via richdocuments + office apps) |
| Extras enabled | Whiteboard |
| Extras disabled | Talk, Imaginary (previews), ClamAV, Fulltextsearch, Adminer |
| Storage | NFSv4.1 from desslok:/slab/container_storage/office mounted at /srv/nc-files/ on homework03 |
| Database | PostgreSQL inside nextcloud-aio-database container, daily pg_dumpall to NFS |
| RAM footprint | ~6-9 GB on 15 GB host (97% baseline before AIO) |
| Cutover time | Caddy block upstream fix (:80 → :11000) ≈ 1 minute |
Architecture at a glance
Why this approach
-
Single domain, no subdomain gymnastics. AIO's
mastercontainer terminates TLS for the domain validation
endpoint, but it does NOT proxy Nextcloud traffic — Apache does,
on a non-standard port (11000). One Caddy block on hawker
forwards to that port. No
officevsnextcloudsplit needed. -
Data on desslok via NFS. Existing backup snapshots
cover
/slab/container_storage/office; AIO runs stateless otherwise. The bind-mount pattern keeps everything portable — destroy the AIO stack and the data is still there. - Mastercontainer owns host :80. This is mandatory for AIO's domain-validation flow, but it conflicts with Apache. Moving Apache to :11000 lets both coexist on the same host.
-
Own backup pipeline. AIO's built-in backup feature
is disabled (
AIO_DISABLE_BACKUP=true) because the data is already on NFS — the natural backup target. A daily systemd timer onhectorSSHes to homework03 and runspg_dumpall+ a config tar + a user-files tar, all writing back to desslok via NFS. - No adminer sidecar. The AIO admin UI on :8080 has full container management; an adminer would just be another admin surface to secure. Dropped.
What's still on the day-2 list
- E2E browser smoke test — login flow + Collabora document open + whiteboard create verified via API; full UI click-through needs your eyes (the admin password is in the chat).
- Additional users — currently only
admin,race(Lord Race),bettyannein DB. Family members can be added through the user management UI. - Talk container — disabled to save RAM. If video conferencing is needed later, re-enable via AIO admin UI.
- Imaginary (image previews) — disabled to save RAM. Re-enable if Nextcloud previews become a complaint.
Files & code paths
| Path | Host | What |
|---|---|---|
/usr/local/containers/nextcloudaio/docker-compose.yaml | homework03 | Mastercontainer with network_mode: host |
/usr/local/containers/nextcloudaio/nextcloud-aio-{mastercontainer,database,redis,apache,nextcloud,collabora,whiteboard,notify-push,database-dump}/ | homework03 | Named docker volume bind targets |
/srv/nc-files/ | homework03 | NFS mount of desslok:/slab/container_storage/office |
/mnt/nc-data/nextcloud-data/ | homework03 | Bind into nextcloud container at /nextcloud-aio/data |
/usr/local/bin/office-backup.sh | homework03 | Daily backup script (pgdump + config tar + user files tar) |
/etc/systemd/system/office-backup.{service,timer} | hector | Daily 03:30 UTC trigger, SSH to homework03 |
/etc/caddy/Caddyfile | hawker | Reverse proxy block: office.rmf44.xyz → 100.79.142.164:11000 |
/slab/container_storage/office/ | desslok | Live data + backups/ subdir |