Nextcloud (Personal Cloud)

Nextcloud 🡕 hosts files, calendars and contacts for the network. The service is linked to Kanidm : no Nextcloud password to create, the network account is enough.

On workstations, the desktop client is installed and already linked to the account. No synchronization is set up by default.

Activating the service

etc/config.yaml

hosts:
  - hostname: "server1"
    profile: "server"
    services:
      nextcloud:
        title: "Mon cloud"
        domain: "cloud"

The secrets for the service are generated alongside those for the rest of the fleet, to be run before the first deployment :

just configure-admin-host

Secret	Role
nextcloud-admin-password	Local administration account
nextcloud-whiteboard-secret	Token shared with the whiteboard
oidc-secret-nextcloud…	OAuth2 client for the service in Kanidm

None of these three secrets is meaningful to a human: they are randomly generated. The last one’s name follows the declared subdomain (oidc-secret-nextcloud if the service responds on nextcloud, oidc-secret-nextcloud-cloud if it responds on cloud).

Idempotent

The command never overwrites an existing secret. Running it again after adding an instance only fills in what is missing.

Missing secret = failed deployment

sops-nix refuses to activate the configuration if an entry is missing in usr/secrets/. The whiteboard is only deployed if whiteboard is listed in plugins, but its secret is still expected.

Service options

Option	Default	Effect
darkone.service.nextcloud.plugins	calendar, contacts	Enabled applications
darkone.service.nextcloud.adminUser	admin	Administration account name
darkone.service.nextcloud.enableSsoRedirect	true	Redirects directly to Kanidm

SSO redirection

With enableSsoRedirect, Nextcloud no longer displays its login form and sends the user to Kanidm. One less click on every login, including for the desktop client.

The local form disappears

The administration account then logs in via https://cloud.domain.tld/login?direct=1.

Instant notifications

notify_push is enabled: workstations receive changes via websocket instead of polling the server every thirty seconds. Significantly reduced server load, near-instant synchronization.

Verification from the server :

sudo -u nextcloud nextcloud-occ notify_push:self-test

The test requires the public URL of the service, so the zone’s reverse proxy must be reachable. The unit retries for fifteen minutes after a deployment, waiting for the gateway to finish starting.

On workstations

The client is installed as soon as a nextcloud service exists on the network.

Option	Default	Effect
darkone.home.office.nextcloud.enable	service detected	Installs the desktop client
darkone.home.office.nextcloud.server	null	Forces a different instance
darkone.home.office.nextcloud.enableAutoStart	true	Starts in the background at login
darkone.home.office.nextcloud.enableWebdav	true	Provides the account linking wizard
darkone.home.office.nextcloud.syncDir	null	Folder suggested in the wizard

nextcloud.server accepts any URL, including an instance outside the network.

Only two launchers appear in the applications menu :

Launcher	Origin	Role
Nextcloud sync client	nextcloud-client package	Synchronizes a local folder
Webdav Login	framework, if enableWebdav	Links the account to the desktop (files, calendar, contacts)

Everything else (account, folders, pause) is managed from the system tray icon : the framework no longer adds a settings launcher.

No forced synchronization

nextcloud.syncDir intentionally defaults to null. The wizard stops at the folder selection page and the user decides what they want to sync, or nothing at all. Setting this option skips that page, which is only desirable on a fleet with homogeneous accounts and small size.

The system tray icon

Without tray, no settings

Since version 34, the client no longer places any action in its window : it only displays the activity feed. Account, pause and Settings now only live in the system tray icon menu. Losing this icon means losing all access to synchronization settings.

Two GNOME module settings make it visible. A workstation running a different desktop must provide the equivalent.

Setting	Value	Why
GNOME Extension	status-tray 🡕	appindicator, the old one, no longer shows the client icon
qt.platformTheme	qt5ct	gnome deprives all Qt applications of the system tray

Why not qt6ct

qt6ct would be the natural choice for a Qt 6 client, but the package is not available. qt5ct works in the meantime.

First login

1. At login, the client window opens with the server address already filled in.
2. The user clicks Log in: the browser opens Kanidm, where their session is generally already active.
3. They grant access. No password is entered.
4. The wizard then offers to choose a folder. It can be closed here without syncing anything: the account remains connected.

Accessing files, calendar and contacts

To browse files from the file manager without syncing anything, the user launches Webdav Login from the applications menu, or nextcloud-webdav-login in a terminal.

1. The browser opens on Kanidm, the user grants access.
2. The wizard saves a GNOME online account : the share appears in the file manager, the calendar and contacts in Evolution.
3. Nothing else to enter. The wizard nonetheless displays the application password, usable from any other WebDAV client.

Why a wizard

Nextcloud refuses to create an application password from its web interface for an SSO account: it requires confirmation of a local password that does not exist (user_oidc#468 🡕). The wizard uses the same path as the desktop client, which is not affected.

Re-running the wizard

A new execution replaces the online account instead of adding a second one, and issues a new application password. Previous ones remain listed in Nextcloud’s Settings → Security, where they can be revoked.

Start from a healthy configuration

The pre-filled address is only valid for account creation in the wizard. A machine that already carries one (inherited from a previous instance, for example) keeps it as-is, with its former address: the client then displays as “offline”, frozen, with no possible action.

systemctl --user stop nextcloud-client.service
rm -rf ~/.config/Nextcloud
systemctl --user start nextcloud-client.service

Kill the right process

The binary is called nextcloud but the process carries the Nix wrapper name, .nextcloud-wrap: a pkill -x nextcloud misses it. The surviving instance then overwrites the old configuration you just deleted. Check with pgrep -af nextcloud-client before removing the directory.

The online account itself is reset from Settings → Online accounts, or simply by relaunching the wizard.

Autostart belongs to the framework

The client writes its own ~/.config/autostart/Nextcloud.desktop, which launches it without the pre-filled address and duplicates the systemd unit. The framework replaces it with a Hidden=true entry. On a machine that already had the old one, it is moved to .dnf-backup on first activation. Session-start automation remains driven by nextcloud.enableAutoStart.

Inherited credentials

Accounts created before declarative SSO carry a Nextcloud identifier of the form IDM-<uuid>. user_oidc never renames an existing account: this identifier stays frozen, with no impact on usage. Only a server-side migration could change it, at the cost of losing the link to the data.

Updating

Nextcloud refuses to skip a major version. The version is pinned in the module and must be advanced one major version at a time, after verifying that the instance reports the previous one. The full procedure, including backup, is described in Services.

Troubleshooting

Symptom	Tip
Administrator cannot log in	Use /login?direct=1
Slow synchronization on workstations	Run notify_push:self-test on the server
Whiteboard not responding	whiteboard missing from plugins, or just configure-admin-host never re-run since
Client re-requests authorization each session	Session keyring not unlocked
Client shows unknown account, offline	Previous configuration: clear ~/.config/Nextcloud
Share asks for password in file manager	Wizard never run, or keyring locked
No icon in system tray, therefore no access to settings	status-tray extension disabled, or qt.platformTheme reset to gnome