Free tools Windows power users keep installed
One-click scans. No signup required.
To install Nextcloud AIO on a VPS, prepare a clean, Docker-capable Linux server, point a DNS record at it, open only the ports your deployment needs, and run the official AIO master container. Choose direct mode when ports 80 and 443 are free; choose reverse-proxy mode when Nginx, Apache, Caddy, or another service already owns those ports. AIO then deploys and updates the Nextcloud components from its management interface.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide answers the practical questions administrators usually have: How do I install Nextcloud AIO on a VPS? Which ports does it need? And can I run Nextcloud AIO behind Nginx or Caddy? The commands and configuration names below follow the official Nextcloud AIO project and its reverse-proxy documentation.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What Nextcloud AIO is and why the installation model matters
Nextcloud All-in-One (AIO) is Nextcloud’s official Docker-based installation path. A master container controls the setup and lifecycle of the Nextcloud container, database, cache, office integration and other optional components. You do not assemble and update every service manually; you start the master container, open its web interface, enter your domain and select the components you need.
The master container itself is named nextcloud-aio-mastercontainer. Keep that name unchanged: AIO’s update and management logic expects it. Its persistent named volume, nextcloud_aio_mastercontainer, stores master-container configuration. Include that volume in your backup and migration planning rather than treating it as disposable Docker metadata.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
AIO can terminate HTTPS directly, or it can expose its internal Apache/Nextcloud service to an existing reverse proxy. Those are different topologies with different published ports and startup variables. Decide which one matches your VPS before launching the container.
Prerequisites for a reliable VPS deployment
Use a supported Linux VPS and virtualization type
Use a clean Linux VPS with Docker Engine installed according to Docker’s official installation instructions. Check the CPU architecture before downloading or starting anything:
uname -mThe AIO project lists x86_64/x64/amd64 and aarch64/arm64/armv8 as supported architectures. A provider’s virtualization layer is just as important as the architecture. KVM or a non-virtualized platform is preferred because Docker and AIO need kernel features that heavily constrained virtualization may not expose. Older Virtuozzo-style VPS products and some provider-specific configurations can fail for this reason; if the master container repeatedly errors on a supposedly correct installation, ask the provider which kernel and container features are available.
Prepare storage before importing data
Use SSD-backed storage when possible. AIO can run on an HDD, but database operations, previews and file scans will be slower. The project discourages SD-card storage because its endurance and latency are poor for a continuously writing database and file service.
Create DNS and firewall access first
Create an A record for an IPv4 address, an AAAA record for IPv6, or both, for the hostname that will serve Nextcloud. Verify that the name resolves to the VPS before entering it in AIO. Open the required ports in both layers of filtering: the VPS provider’s firewall/security group and the operating system firewall. A rule in only one layer still blocks traffic.
Do not leave a temporary “allow everything” rule in place. Open the ports required by your selected topology, validate the installation, then remove broad temporary rules.
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Choose direct HTTPS or an existing reverse proxy
| Deployment choice | Use it when | Published ports from the VPS | Main trade-off |
|---|---|---|---|
| Direct AIO HTTPS | Ports 80 and 443 are available for this Nextcloud instance | 80, 8080 and 8443 in the standard command; public HTTPS is served by AIO | Simplest network path, but those public ports cannot be shared with another web server |
| Reverse proxy in front of AIO | Nginx, Apache, Caddy or another proxy already serves ports 80/443, or you need one proxy for multiple sites | 8080 for the AIO interface; the proxy handles public 80/443 and forwards to AIO’s selected Apache port | More flexible, but proxy headers, trusted-proxy settings and certificate handling must be correct |
In both modes, port 8080 is the AIO management interface and uses a self-signed certificate. Public client traffic normally arrives on TCP 443. Nextcloud Talk additionally uses TCP and UDP 3478 when Talk is enabled.
How to install Nextcloud AIO on a VPS in direct mode
Use direct mode only when another service is not binding ports 80 or 443. Stop or reconfigure any existing web server that owns those ports before starting AIO.
1. Start the official master container
Run the following command as written. The unchanged container name, restart policy, Docker socket mount and named volume are significant:
sudo docker run
--init
--sig-proxy=false
--name nextcloud-aio-mastercontainer
--restart always
--publish 80:80
--publish 8080:8080
--publish 8443:8443
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config
--volume /var/run/docker.sock:/var/run/docker.sock:ro
ghcr.io/nextcloud-releases/all-in-one:latestThe read-only Docker socket mount allows the master container to manage the other AIO containers while preventing writes through that mount. The named volume remains outside the container filesystem, so recreating the master container does not by itself erase its configuration.
2. Open the management interface
After Docker reports that the container has started, browse to:
https://VPS-IP:8080/The certificate on port 8080 is self-signed, so your browser will display a certificate warning. Access this interface by the VPS IP address. Do not publish it broadly to the internet; restrict 8080 at the firewall to your administration address or VPN where practical.
Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
3. Enter the domain and choose components
In the AIO interface, enter the hostname whose DNS record points to the VPS. Select only the components you intend to run. AIO will create the managed Nextcloud stack and show its progress in the interface.
The 8443 endpoint can provide a valid certificate in the direct configuration when a domain points to the server and ports 80 and 8443 are reachable from the internet. Port 80 is used for HTTP handling and the ACME HTTP challenge; port 8443 is the AIO HTTPS endpoint in this configuration.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors4. Validate the finished installation
- Open the public HTTPS hostname and sign in.
- Upload and download a test file.
- Confirm background jobs run and that the administrator dashboard reports a healthy deployment.
- If Talk is enabled, test a call from a client outside the VPS network.
Can I run Nextcloud AIO behind Nginx or Caddy?
Yes. AIO supports Nginx, Apache, Caddy and other reverse proxies. The proxy owns public ports 80/443 and forwards the Nextcloud hostname to the AIO Apache service on an internal or host-published port. The reverse-proxy startup command is different from direct mode: it does not publish 80 or 8443, and it sets the Apache listener explicitly.
1. Start AIO with the reverse-proxy variables
sudo docker run
--init
--sig-proxy=false
--name nextcloud-aio-mastercontainer
--restart always
--publish 8080:8080
--env APACHE_PORT=11000
--env APACHE_IP_BINDING=0.0.0.0
--env APACHE_ADDITIONAL_NETWORK=""
--env SKIP_DOMAIN_VALIDATION=false
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config
--volume /var/run/docker.sock:/var/run/docker.sock:ro
ghcr.io/nextcloud-releases/all-in-one:latestAPACHE_PORT=11000 is the port used in the official example. Your proxy must forward the Nextcloud hostname to that AIO Apache service. APACHE_IP_BINDING=0.0.0.0 makes the service reachable on the host’s interfaces, while APACHE_ADDITIONAL_NETWORK is left empty in this pattern. Keep SKIP_DOMAIN_VALIDATION=false unless you have a specific, documented reason to change domain validation.
2. Point the proxy at AIO Apache
Configure the proxy’s virtual host for your Nextcloud hostname and send requests to the AIO Apache listener on port 11000. Terminate the public certificate at the proxy, preserve the original HTTPS scheme in forwarded headers, and allow large request bodies and long-lived WebSocket connections according to your proxy’s syntax. The exact directives differ between Nginx, Apache and Caddy, so use the examples in the official reverse-proxy guide for the server you run.
Open https://VPS-IP:8080/ to reach AIO’s management UI, accept its self-signed certificate warning, and enter the same public hostname. The public hostname should resolve to the proxy, not directly to the AIO Apache port.
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
3. Add the proxy to Nextcloud’s trusted proxies
If the proxy connects from an address other than localhost or 127.0.0.1, Nextcloud must trust that proxy address. The official guide gives this command pattern:
sudo docker exec --user www-data -it nextcloud-aio-nextcloud
php occ config:system:set trusted_proxies 2
--value=ip.address.of.proxyReplace ip.address.of.proxy with the actual source address visible to the Nextcloud container. Use the next available numeric index if the trusted_proxies array already contains entries. Incorrect values can cause redirect loops, rejected host headers or client IPs that appear to be the proxy rather than the user.
4. Account for Collabora when it is enabled
If you enable Collabora and it uses a different proxy IP, add that IP to Collabora’s WOPI request allow list as described in the AIO reverse-proxy documentation. Otherwise document editing may fail even though ordinary file access works.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What ports does Nextcloud AIO need?
| Port | Protocol | Purpose | When to expose it |
|---|---|---|---|
| 80 | TCP | HTTP access, redirect handling and the ACME HTTP challenge in direct mode | Direct mode; a reverse proxy may also need public 80 for redirects or certificate challenges |
| 443 | TCP | Public HTTPS access to the Apache/Nextcloud service | Always for a public HTTPS deployment, owned by AIO directly or by your proxy |
| 443 | UDP | Optional HTTP/3 (QUIC) | Only if your proxy/AIO HTTP/3 configuration uses it |
| 3478 | TCP and UDP | Nextcloud Talk signaling and media traffic | Only when Talk is enabled and you need external calls |
| 8080 | TCP | AIO management interface with a self-signed certificate | For administration; restrict it to trusted source addresses |
| 8443 | TCP | Direct-mode AIO HTTPS interface that can obtain a valid certificate | Direct mode when the domain points to the VPS and 80/8443 are reachable |
Do not expose every listed port automatically. In reverse-proxy mode, the proxy handles public 80/443 while AIO needs the management port and the internal Apache path. Add 3478 only if Talk is enabled. Match provider-level and host-level firewall rules, and remove temporary broad allowances after testing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.First-run HTTPS and security checklist
- Resolve the DNS A/AAAA record from a network outside the VPS and confirm it returns the intended address.
- Check the provider firewall/security group and the VPS firewall for the exact TCP/UDP ports required by your topology.
- Start the master container and open port 8080 from an administrator network.
- Enter the domain in AIO only after DNS and reachability checks pass.
- Select the required AIO components and wait for deployment to finish.
- Test sign-in, a file upload, a download, background jobs and any enabled Talk or office integration.
- Restrict or remove temporary firewall rules and keep 8080 inaccessible to untrusted networks.
Troubleshooting common VPS installation failures
The container exits or reports missing kernel features
Confirm the architecture with uname -m, verify that Docker itself can run ordinary containers, and ask the VPS provider whether the instance is KVM-based or exposes the required kernel capabilities. Older constrained virtualization platforms can prevent AIO from working even when the command is syntactically correct. Moving to a KVM or non-virtualized VPS is usually the relevant infrastructure fix; repeatedly recreating the container will not add missing kernel features.
Port 80, 443 or 8443 is already in use
Inspect existing listeners before choosing direct mode. A web server, control panel or another container may already own the port. Either stop that service and use direct AIO, or keep the existing proxy and restart AIO with the reverse-proxy command. Do not publish conflicting host ports and expect Docker to choose another one silently.
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
The AIO page on 8080 cannot be reached
Check that the master container is running, that TCP 8080 is published, and that both firewalls allow your administration address. Browse to https://VPS-IP:8080/, not an HTTPS hostname that has not yet been configured. Expect a self-signed certificate warning on this management endpoint.
Recommended Free Tools
Certificate issuance or domain validation fails
Verify that the hostname resolves to the correct public address and that the required public ports are reachable from the internet. In direct mode, port 80 is needed for the ACME HTTP challenge and port 8443 must be reachable for the AIO HTTPS endpoint described by the project. In reverse-proxy mode, ensure the proxy—not an internal AIO port—is serving the public hostname and that its certificate challenge method is allowed through the firewall.
The reverse proxy returns a 502 or redirect loop
Confirm that the proxy forwards to the configured AIO Apache port (11000 in the example), that APACHE_IP_BINDING=0.0.0.0 is present, and that the proxy can route to that address. Then check the forwarded scheme and host headers. Add the proxy’s actual source IP to trusted_proxies when it is not localhost; omitting it commonly produces incorrect client-IP handling or repeated HTTPS redirects.
Talk works locally but not over the internet
Open both TCP 3478 and UDP 3478 at the provider and host firewalls when Talk is enabled. Test from a separate network, such as a mobile connection, because local clients can succeed without proving that the public media path is reachable. Do not open Talk ports if the Talk component is not part of your deployment.
Backups, upgrades and recovery planning
AIO includes a backup section in its management interface and supports restoring an instance from a backup archive through that interface. Treat backups as a procedure, not merely a file: keep the backup archives and the nextcloud_aio_mastercontainer volume available before an upgrade, migration or VPS replacement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Document where the archives are stored, who can access them and how encryption keys or credentials needed for the restore are protected. Perform a restore test on a separate VPS before relying on the backup as your recovery plan. A backup that has never been restored is only an assumption about recoverability.
Choosing the right topology
Use direct AIO HTTPS when this VPS is dedicated to Nextcloud and ports 80/443 are free; it has fewer moving parts. Use the reverse-proxy pattern when another site already occupies those ports or when a central proxy must serve several domains. For either choice, prioritize KVM or non-virtualized infrastructure, SSD storage, correct DNS, and narrowly scoped firewall rules. Once those foundations are correct, the AIO master container provides the repeatable installation and management path described in the official project.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
