Ask HN: Most secure way to run Nextcloud?

23 pointsprivacyisntdead4y ago10 comments

Is it more secure to run Nextcloud with a third party provider or host my own?

For either method, what provider or hardware is recommended?

Much appreciated

10 comments

I run it using docker, paired with a watchtower container that automatically updates it. For accessing it, I use tailscale so that I don't have to open ports or have any kind of exposure to the internet. This obviously won't work if you want to do public linking from your instance. In that case, just run it from a subdomain. Make sure your www folder is mounted read only

DenseComet4y ago

Yes! Tailscale is incredibly useful and a great way to access your devices. For public linking, if you don't want any open ports, you can use Cloudflare Tunnel. Note that in this case, for your own use, you should still be accessing Nextcloud via Tailscale, as its P2P, so it'll be substantially faster than routing via a CF datacenter.

stevenicr4y ago

'can use Cloudflare Tunnel.' - Most secure way to run Nextcloud?

since cloudflare posted they are going to spy on things they connect to and send info to men with guns about what they see, [1] I would not put them in a list of 'most secure' anything.

[1] along with helping govt's create legislature to encourage and allow more of the same... https://blog.cloudflare.com/terminating-service-for-8chan/

its a longish ramble - but you can ctrl-f "us cooperating around monitoring potential hate sites on our network and notifying law enforcement"

joshxyz4y ago

zerotier[0] is also a surprisingly great alternative to tailscale. stable as hell, adding devices is fast and easy, and their web panel is real-time and user-friendly as hell. cloudflare tunnel is a mess to set up unfortunately.

[0] https://www.zerotier.com/

aborsy4y ago

Do you use relays with Tailscale?

Otherwise, UPnP and STUN may not be secure (it’s generally recommended to disable these protocols in router).

DenseComet4y ago

STUN isn't something that runs on your router. You can disable UPnP in your router and still use Tailscale perfectly fine.

https://tailscale.com/blog/how-nat-traversal-works/

1 more reply

SevenSigs4y ago

A Wireguard VPN is the only thing publicly accessible on my network, so I used that to access my self-hosted Nextcloud from anywhere until I switched to Syncthing.

endofreach4y ago

Any backups outside your own network? I always think if someone would break in, everything‘s lost…

d3nigma4y ago

Don't run it xD

j / k navigate · click thread line to collapse

10 comments

implying4y ago

DenseComet4y ago

stevenicr4y ago

'can use Cloudflare Tunnel.' - Most secure way to run Nextcloud?

since cloudflare posted they are going to spy on things they connect to and send info to men with guns about what they see, [1] I would not put them in a list of 'most secure' anything.

[1] along with helping govt's create legislature to encourage and allow more of the same... https://blog.cloudflare.com/terminating-service-for-8chan/

its a longish ramble - but you can ctrl-f "us cooperating around monitoring potential hate sites on our network and notifying law enforcement"

joshxyz4y ago

[0] https://www.zerotier.com/

aborsy4y ago

Do you use relays with Tailscale?

Otherwise, UPnP and STUN may not be secure (it’s generally recommended to disable these protocols in router).

DenseComet4y ago

STUN isn't something that runs on your router. You can disable UPnP in your router and still use Tailscale perfectly fine.

https://tailscale.com/blog/how-nat-traversal-works/

1 more reply

SevenSigs4y ago

A Wireguard VPN is the only thing publicly accessible on my network, so I used that to access my self-hosted Nextcloud from anywhere until I switched to Syncthing.

endofreach4y ago

Any backups outside your own network? I always think if someone would break in, everything‘s lost…

d3nigma4y ago

Don't run it xD

j / k navigate · click thread line to collapse