Nextcloud (Personal Cloud)

Nextcloud 🡕 hosts files, calendars and contacts for the network. The service is linked to Kanidm : no Nextcloud password to create, the network account is enough.

On workstations, the desktop client is installed and already linked to the account. No synchronization is set up by default.

Enable the service

etc/config.yaml

hosts:
  - hostname: "server1"
    profile: "server"
    services:
      nextcloud:
        title: "Mon cloud"
        domain: "cloud"

The service secrets are generated along with those of the rest of the fleet, and this must be run before the first deployment :

just configure-admin-host

Secret	Role
nextcloud-admin-password	Local administration account
nextcloud-whiteboard-secret	Token shared with the whiteboard
oidc-secret-nextcloud…	Service OAuth2 client against Kanidm

None of these three secrets makes sense to a human : they are drawn at random. The name of the last one follows the declared subdomain (oidc-secret-nextcloud if the service answers on nextcloud, oidc-secret-nextcloud-cloud if it answers on cloud).

With a network.smtp relay, Nextcloud also reads smtp/password, provided by the mail provider and entered by hand. It takes precedence over the password entered in the administration interface.

Idempotent

The command never overwrites an existing secret. Running it again after adding an instance only fills in what is missing.

Missing secret = failed deployment

sops-nix refuses to activate the configuration if an entry is missing from usr/secrets/. The whiteboard is only deployed if whiteboard is listed in plugins, but its secret is still expected.

Service options

Option	Default	Effect
darkone.service.nextcloud.plugins	calendar, contacts, tasks	Enabled applications
darkone.service.nextcloud.adminUser	admin	Administration account name
darkone.service.nextcloud.enableSsoRedirect	true	Redirects directly to Kanidm

SSO redirection

With enableSsoRedirect, Nextcloud no longer displays its login form and sends the user to Kanidm. One less click on every login, including for the desktop client.

The local form disappears

The administration account then logs in via https://cloud.domain.tld/login?direct=1.

Instant notifications

notify_push is enabled : workstations receive changes over websocket instead of polling the server every thirty seconds. Server load is clearly reduced, synchronisation almost immediate.

Check from the server :

sudo nextcloud-occ notify_push:self-test

The test requires the public URL of the service, so the zone’s reverse proxy must be reachable. The unit retries for fifteen minutes after a deployment, to give the gateway time to finish starting.

On workstations

The client is installed as soon as a nextcloud service exists on the network.

Option	Default	Effect
darkone.home.office.nextcloud.enable	service detected	Installs the desktop client
darkone.home.office.nextcloud.server	null	Forces a different instance
darkone.home.office.nextcloud.enableAutoStart	true	Starts in the background at login
darkone.home.office.nextcloud.enableWebdav	true	Provides the account linking wizard
darkone.home.office.nextcloud.syncDir	null	Folder suggested in the wizard

nextcloud.server accepts any URL, including an instance outside the network.

Only two launchers appear in the applications menu :

Launcher	Origin	Role
Nextcloud sync client	nextcloud-client package	Synchronizes a local folder
Webdav Login	framework, if enableWebdav	Links the account to the desktop (files, calendar, contacts)

Everything else (account, folders, pause) is managed from the system tray icon : the framework no longer adds a settings launcher.

No forced synchronization

nextcloud.syncDir intentionally defaults to null. The wizard stops at the folder selection page and the user decides what they want to sync, or nothing at all. Setting this option skips that page, which is only desirable on a fleet with homogeneous accounts and small size.

The system tray icon

Without tray, no settings

Since version 34, the client no longer places any action in its window : it only displays the activity feed. Account, pause and Settings now only live in the system tray icon menu. Losing this icon means losing all access to synchronization settings.

Two GNOME module settings make it visible. A workstation running a different desktop must provide the equivalent.

Setting	Value	Why
GNOME Extension	status-tray 🡕	appindicator, the old one, no longer shows the client icon
qt.platformTheme	qt5ct	gnome deprives all Qt applications of the system tray

Why not qt6ct

qt6ct would be the natural choice for a Qt 6 client, but the package is not available. qt5ct works in the meantime.

First login

1. At login, the client window opens with the server address already filled in.
2. The user clicks Log in: the browser opens Kanidm, where their session is generally already active.
3. They grant access. No password is entered.
4. The wizard then offers to choose a folder. It can be closed here without syncing anything: the account remains connected.

Accessing files, calendar and contacts

To browse files from the file manager without syncing anything, the user launches Webdav Login from the applications menu, or nextcloud-webdav-login in a terminal.

1. The browser opens on Kanidm, the user grants access.
2. The wizard saves a GNOME online account : the share appears in the file manager, the calendar and contacts in Evolution.
3. Nothing else to enter. The wizard nonetheless displays the application password, usable from any other WebDAV client.

Why a wizard

Nextcloud refuses to create an application password from its web interface for an SSO account: it requires confirmation of a local password that does not exist (user_oidc#468 🡕). The wizard uses the same path as the desktop client, which is not affected.

Re-running the wizard

A new execution replaces the online account instead of adding a second one, and issues a new application password. Previous ones remain listed in Nextcloud’s Settings → Security, where they can be revoked.

Start from a healthy configuration

The pre-filled address is only valid for account creation in the wizard. A machine that already carries one (inherited from a previous instance, for example) keeps it as-is, with its former address: the client then displays as “offline”, frozen, with no possible action.

systemctl --user stop nextcloud-client.service
rm -rf ~/.config/Nextcloud
systemctl --user start nextcloud-client.service

Kill the right process

The binary is called nextcloud but the process carries the Nix wrapper name, .nextcloud-wrap: a pkill -x nextcloud misses it. The surviving instance then overwrites the old configuration you just deleted. Check with pgrep -af nextcloud-client before removing the directory.

The online account itself is reset from Settings → Online accounts, or simply by relaunching the wizard.

Autostart belongs to the framework

The client writes its own ~/.config/autostart/Nextcloud.desktop, which launches it without the pre-filled address and duplicates the systemd unit. The framework replaces it with a Hidden=true entry. On a machine that already had the old one, it is moved to .dnf-backup on first activation. Session-start automation remains driven by nextcloud.enableAutoStart.

Inherited credentials

Accounts created before declarative SSO carry a Nextcloud identifier of the form IDM-<uuid>. user_oidc never renames an existing account: this identifier stays frozen, with no impact on usage. Only a server-side migration could change it, at the cost of losing the link to the data.

Updating

Nextcloud refuses to skip a major version. The version is pinned in the module and must be moved forward one major at a time, after checking that the instance indeed reports the previous one. The full procedure, backup included, is described in Services.

Applications missing from Nextcloud 35

news, memories and recognize are not packaged for version 35 → remove them from plugins before upgrading, otherwise evaluation fails.

Troubleshooting

Symptom	Lead
Administrator unable to log in	Go through /login?direct=1
occ fails under sudo -u nextcloud	Run sudo nextcloud-occ
Slow synchronisation on workstations	notify_push:self-test on the server
The whiteboard does not respond	whiteboard absent from plugins, or just configure-admin-host never re-run since
The client asks for authorisation every session	Session keyring not unlocked
The client shows an unknown account, offline	Earlier configuration: clear ~/.config/Nextcloud
Sharing asks for a password in the file manager	Assistant never started, or keyring locked
No icon in the status bar, hence no access to settings	status-tray extension disabled, or qt.platformTheme reset to gnome