Nextcloud on NAS: Setup Guide

Nextcloud is the most capable self-hosted cloud storage and collaboration platform available. It replaces Dropbox, Google Drive, and Google Photos, adding collaborative document editing, calendar, contacts, and team file sharing, all running on hardware you own. This guide covers installing Nextcloud on a NAS using Docker Compose, which works on NAS platforms that support Docker Compose and for which all selected container images provide compatible CPU-architecture builds. The Docker Compose approach is more reliable and maintainable than using pre-packaged NAS app store versions, which are typically outdated.

What Nextcloud Replaces (and What It Doesn't)

Nextcloud is a strong replacement for:

• Dropbox / OneDrive / Google Drive. File sync with desktop and mobile clients, folder sharing, offline access
• Google Photos / iCloud Photos. Photo and video backup with album organisation, facial recognition (via the Recognize app), and location maps
• Google Docs / Office 365. Collaborative document editing via OnlyOffice or Collabora Online integration (additional Docker containers required)
• Bitwarden (basic). Nextcloud has a password manager app, though Vaultwarden is a more complete replacement

Nextcloud is not a replacement for:

• Plex or Jellyfin. Nextcloud has video playback but is not a media server
• A full email server. Nextcloud integrates with existing mail, not replace it

Prerequisites

Before starting:

• A NAS with Docker support: Synology DS423+/DS925+ or higher, QNAP TS-264/TS-464 or higher, or any NAS with at least 4GB RAM and an Intel/AMD CPU (ARM is possible but slower)
• At least 8GB RAM on the NAS. Nextcloud memory use varies with user count, enabled apps, file volume and activity; ML features require substantial additional headroom.
• Docker Compose installed or available through your NAS UI (Synology Container Manager, QNAP Container Station)
• A registered domain name with DNS control. Required for HTTPS. A free subdomain from DuckDNS works if you don't have a custom domain
• NGINX Proxy Manager (or similar reverse proxy). Covers HTTPS certificate management

This guide uses NGINX Proxy Manager for TLS, which is itself a Docker container. If you already have a reverse proxy running (Traefik, Caddy, bare NGINX), adapt the proxy configuration to your setup.

Step 1: Create the Docker Compose Stack

Create a directory for your Nextcloud stack (e.g. /volume1/docker/nextcloud/ on Synology or /share/docker/nextcloud/ on QNAP). Inside, create a docker-compose.yml file:

version: '3.8'
services:
  db:
    image: mariadb:10.11
    restart: always
    command: --transaction-isolation=READ-COMMITTED
    environment:
      - MYSQL_ROOT_PASSWORD=your_root_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=your_db_password
    volumes:
      - ./db:/var/lib/mysql

  app:
    image: nextcloud:-apache
    restart: always
    ports:
      - 8080:80
    depends_on:
      - db
    environment:
      - MYSQL_HOST=db
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_PASSWORD=your_db_password
      - NEXTCLOUD_TRUSTED_DOMAINS=your.domain.com
      - NEXTCLOUD_ADMIN_USER=admin
      - NEXTCLOUD_ADMIN_PASSWORD=your_admin_password
    volumes:
      - ./data:/var/www/html

Replace passwords and domain with your values. Start the stack with docker compose up -d (or via your NAS UI's Compose stack deployment). First-start duration varies with NAS performance, storage latency and whether the images must first be downloaded.

Step 2: Configure HTTPS with NGINX Proxy Manager

HTTPS is mandatory when exposing Nextcloud to the internet and may also be required by client-platform security policies; local testing can use HTTP. NGINX Proxy Manager handles SSL certificate acquisition (via Let's Encrypt) and proxying.

If NGINX Proxy Manager is not already running, add it to a separate Docker Compose stack or to the same file. Once running, access the NPM admin UI (default port 81), add a new Proxy Host:

• Domain name: your.domain.com
• Forward hostname/IP: your NAS IP
Forward port: 8080 (the Nextcloud port mapped above)
• Enable Websockets Support
• Under SSL: request a new Let's Encrypt certificate for your domain

After DNS points to the deployment and ACME validation is reachable, NPM can request and configure the certificate. HTTP-01 requires public port 80 reachability; otherwise configure a supported DNS-01 challenge. Nextcloud will be accessible at https://your.domain.com.

Step 3: Fix Trusted Domains and Security Headers

After HTTPS is configured, Nextcloud may show a warning about untrusted domains or missing security headers. Fix these by editing ./data/config/config.php on the NAS filesystem:

Trusted domains. Ensure your domain is listed:

'trusted_domains' =>
  array (
    0 => 'localhost',
    1 => 'your.domain.com',
    2 => '192.168.1.x',  // optional: local NAS IP
  ),

Proxy headers. Add to config.php if using a reverse proxy:

'trusted_proxies' => [''],
'overwritehost' => 'your.domain.com',
'overwriteprotocol' => 'https',
'overwrite.cli.url' => 'https://your.domain.com',

After editing config.php, restart the Nextcloud container: docker compose restart app. The admin panel security checklist (Settings → Overview) should clear most warnings after these changes.

Step 4: Desktop and Mobile Clients

Download the Nextcloud desktop client from nextcloud.com/install. Install on each computer you want to sync. On first run, enter your Nextcloud server URL and credentials. Choose which local folders to sync and which NAS folders to map them to.

The Nextcloud mobile app (iOS and Android) provides:

• On-demand access to files and folders available to the user's Nextcloud account
• Automatic photo and video upload (Camera Roll backup to a designated NAS folder)
• Offline file access for marked files

For photo backup specifically, enable Auto Upload in the mobile app settings. New-photo upload timing depends on connectivity, file size, mobile operating-system background scheduling and power settings, even when Wi-Fi-only upload is enabled. This is the self-hosted equivalent of iCloud Photos or Google Photos backup.

Performance and Resource Usage

Nextcloud performance on NAS hardware depends on CPU and storage configuration:

• Intel-based NAS (TS-464, DS423+): Nextcloud runs well. PHP processing and MariaDB queries are fast on Celeron N-series hardware. File-sync throughput depends on the NAS network interfaces, storage, file sizes, client count and Nextcloud configuration; the DS423+ itself is limited to 1GbE ports.
• ARM-based NAS (TS-233, DS223): Nextcloud works but feels sluggish under load. The web interface is slower, and the Recognize face recognition feature (if enabled) is very slow on ARM. Photo thumbnail generation takes longer
• NVMe SSD cache: Placing Nextcloud on an SSD storage pool, or attaching an SSD cache to its HDD-backed volume, may improve random-I/O responsiveness; the benefit depends on the NAS, cache mode and workload.

Nextcloud's background jobs (thumbnail generation, face recognition, file scanning) can cause periodic CPU spikes on NAS hardware. Configure a host cron task or cron container to invoke Nextcloud's cron.php every five minutes, then select Cron mode. The Settings toggle alone does not schedule execution; use maintenance_window_start for eligible off-peak jobs.

🇦🇺 Australian Buyers: Remote Access and Performance Notes

NBN upload speed matters: Nextcloud over the internet is limited by your NBN upload bandwidth. NBN upload speed depends on the access technology and retail plan. Eligible FTTP/HFC Home Fast services moved to 500/50 Mbps in September 2025, while copper and fixed-wireless services can have lower, variable upload rates. Large initial library syncs should be done on the local network first. NBN 250 and above offers proportionally better remote sync performance.

CGNAT: If your ISP places you behind CGNAT (common on residential NBN), direct inbound connections are blocked. The direct public HTTPS reverse-proxy method described here needs a hostname and reachable ingress. VPN and outbound-tunnel methods can provide remote access without inbound port forwarding. Workarounds: (1) a VPS configured as a WireGuard relay or exit node, or (2) a Cloudflare Tunnel (free tier) which routes traffic through Cloudflare without requiring open ports. See the NAS remote access guide for ISP-specific CGNAT status.

Recommended NAS for Nextcloud in AU: the QNAP TS-464 remains current; the Synology DS423+ is discontinued, and its current DS425+ successor should be evaluated separately before purchase. Both are Intel-based, but the DS423+ ships with 2GB and officially supports up to 6GB; the current TS-464-8G ships with 8GB. Avoid ARM models for Nextcloud if you plan to enable the Recognize face recognition or OnlyOffice/Collabora integration.