Self-hosting Nextcloud: No Big Tech, but full control

1. The need for digital sovereignty and the choice for Kubernetes

Tech giants currently have a massive grip on our data and privacy. When using services from large cloud providers, it is often completely unclear where your data is physically stored, under which legal regime it falls, and who exactly has access to it. You hand over control completely.

To take back that control, you can use Nextcloud. This is the open-source alternative that allows you to keep all your documents, files, and communication in your own hands. The major advantage: you can run this entirely on your own hardware, so you know exactly where your data resides.

Why choose Kubernetes in such a scenario instead of a simple Docker script on a single server? Because you quickly realize that a serious set of components (file storage, database, caching, security, monitoring) shouldn't rely on a single point of failure. Kubernetes provides automation at scale: it distributes the load, automatically heals itself if a component fails (self-healing), and makes it possible to manage modular services strictly separated from each other without downtime.

2. Active Nextcloud Modules

In my setup, Nextcloud doesn't run as an isolated application, but is linked to several specialized modules to ensure functionality and security:

3. Architecture and Infrastructure

The underlying infrastructure runs on a Proxmox environment, where the Kubernetes cluster (managed via Rancher) is combined with dedicated virtual machines for specific tasks. Incoming internet traffic first passes through a strict firewall, after which MetalLB and Traefik securely route the traffic to the correct components within the cluster.

graph TD classDef external fill:#0d1117,stroke:#58a6ff,stroke-width:2px,stroke-dasharray: 5 5,color:#c9d1d9; classDef network fill:#0d1117,stroke:#00ff66,stroke-width:2px,color:#c9d1d9; classDef core fill:#0d1117,stroke:#f1c40f,stroke-width:2px,color:#c9d1d9; classDef ops fill:#161b22,stroke:#ff69b4,stroke-width:2px,color:#c9d1d9; classDef api fill:#0d1117,stroke:#8e44ad,stroke-width:2px,color:#c9d1d9; Internet((Internet)) subgraph Proxmox ["Proxmox Virtualization"] subgraph Rancher Cluster ["Rancher Kubernetes Cluster"] K8sAPI{{Kubernetes API}}:::api subgraph Netwerk & Ingress MLB[MetalLB Load Balancer]:::network Traefik[Traefik Ingress]:::network CM[Cert-Manager]:::network end subgraph Core Applicaties KC[Keycloak IdP]:::core NC[Nextcloud Enterprise]:::core NCT[Nextcloud Talk + HPB]:::core AV[ClamAV]:::core end subgraph GitOps & Observability Argo[ArgoCD]:::ops Mon[Grafana, Loki, Kuma]:::ops end end subgraph VMs ["Dedicated VMs"] DB[(MariaDB)]:::external Git[Bitbucket]:::external FW[Firewall]:::external end end Internet -->|HTTPS| FW FW --> MLB MLB --> Traefik CM -.->|Auto SSL| Traefik Traefik --> NC Traefik --> NCT Traefik --> KC NC -->|Authentication| KC NC -->|Read/Write| DB NC -->|Scan uploads| AV Argo -.->|Pull Config| Git Argo ==>|Sync State| K8sAPI Mon -.->|Log/Metrics| K8sAPI

4. Design choices and motivation

Conscious architectural choices were made when setting up this environment:

The database outside the cluster

Although Kubernetes is flexible, I chose to run the MariaDB database on a dedicated virtual machine instead of inside the cluster. This makes managing stateful data much more reliable. At the hypervisor level (Proxmox), this allows me to easily create and restore snapshots and backups, completely shielded behind the firewall.

Automated management via GitOps

Nothing is manually configured on the production systems. The complete configuration is defined as code in a private Bitbucket repository. ArgoCD reads this repository and automatically synchronizes the actual state of the cluster with the desired state. This guarantees reproducibility and prevents human errors.

Security and network control

By using Cert-Manager for automatic SSL certificates, Traefik as an Ingress controller, and a strict separation of network components, the environment is optimally secured against unauthorized outside access, without compromising performance.