Nextcloud — Proxmox LXC¶

Nextcloud installed via the community Proxmox helper script, with data stored on a ZFS dataset and served over HTTPS using a Tailscale certificate. Using a Tailscale cert directly (rather than tailscale serve) is generally more reliable for internal-only services like Nextcloud because it allows the web server (Apache) to handle the TLS handshake directly.

1. Create the LXC with Helper Script¶

Run this in the Proxmox host shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nextcloudpi.sh)"

Install on the local NVMe drive. The data directory will be pointed to the 1TB SSD later via ZFS mountpoint.

2. Set Up ZFS Dataset for Data Directory¶

On the Proxmox host, create the ZFS dataset, verify its mountpoint, fix ownership for the LXC's mapped UID, then attach it to the container (replace 107 with your VMID):

zfs create sync_pool/nextcloud_data
zfs get mountpoint sync_pool/nextcloud_data

Expected output:

NAME                      PROPERTY    VALUE                      SOURCE
sync_pool/nextcloud_data  mountpoint  /sync_pool/nextcloud_data  default

chown -R 100033:100033 /sync_pool/nextcloud_data
pct set 107 -mp0 /sync_pool/nextcloud_data,mp=/var/www/nextcloud-data-zfs

3. Prepare Tailscale Account¶

Before working in the LXC, configure your Tailscale account for HTTPS:

Go to the Tailscale DNS Admin Console and ensure MagicDNS is enabled.
In the same DNS tab, scroll to HTTPS Certificates and click Enable HTTPS.

4. Configure LXC for Tailscale (TUN Device)¶

Shut down the Nextcloud LXC. On the Proxmox host shell, add the following to the LXC config file (/etc/pve/lxc/107.conf, replacing 107 with your VMID):

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Restart the LXC, then install Tailscale inside the container:

curl -fsSL https://tailscale.com/install.sh | sh

Start Tailscale and authenticate:

tailscale up

5. Generate the Tailscale Certificate¶

Inside the Nextcloud LXC, identify your machine's full Tailscale DNS name:

tailscale status

The hostname for this container is:

nextcloud-lxc.tail01024c.ts.net

Generate the certificate:

tailscale cert nextcloud-lxc.tail01024c.ts.net

This generates two files in your current directory: a .crt and a .key file.

6. Configure Apache for TLS¶

Move the certificates to standard system locations:

mv nextcloud-lxc.tail01024c.ts.net.crt /etc/ssl/certs/tailscale.crt
mv nextcloud-lxc.tail01024c.ts.net.key /etc/ssl/private/tailscale.key

Edit the Apache site config (often found at /etc/apache2/sites-enabled/001-nextcloud.conf or similar):

nano /etc/apache2/sites-enabled/nextcloud.conf

Add or update the SSL directives:

SSLEngine on
SSLCertificateFile /etc/ssl/certs/tailscale.crt
SSLCertificateKeyFile /etc/ssl/private/tailscale.key

Reload Apache:

systemctl reload apache2

7. Update Nextcloud Trusted Domains¶

Open /var/www/nextcloud/config/config.php and add your Tailscale domain to the trusted_domains array:

'trusted_domains' => array (
  0 => 'localhost',
  1 => '192.168.1.x',
  2 => 'nextcloud.your-tailnet.ts.net',
),

'overwrite.cli.url' => 'https://nextcloud-lxc.tail01024c.ts.net',
'overwriteprotocol' => 'https',
'overwritehost' => 'nextcloud-lxc.tail01024c.ts.net',

8. Automate Certificate Renewal¶

Tailscale certs expire every 90 days

Run the renewal script weekly to keep the cert fresh without manual intervention.

Create the renewal script¶

nano /usr/local/bin/renew-tailscale-cert.sh

#!/bin/bash
# Request a fresh certificate from Tailscale
# This will save the files to the standard locations used in your Apache config
tailscale cert \
  --cert-file /etc/ssl/certs/tailscale.crt \
  --key-file /etc/ssl/private/tailscale.key \
  nextcloud-lxc.tail01024c.ts.net

# Check if the command was successful
if [ $? -eq 0 ]; then
    echo "Tailscale certificate renewed successfully. Reloading Apache..."
    systemctl reload apache2
else
    echo "Tailscale certificate renewal failed!"
    exit 1
fi

Make it executable:

chmod +x /usr/local/bin/renew-tailscale-cert.sh

Schedule the weekly cron job¶

crontab -e

Add at the bottom:

@weekly /usr/local/bin/renew-tailscale-cert.sh >> /var/log/tailscale-cert-renew.log 2>&1

@weekly is a shortcut for 0 0 * * 0 (Sunday at 12:00 AM).

Verify the setup¶

Test the script manually:

/usr/local/bin/renew-tailscale-cert.sh

Check the log:

cat /var/log/tailscale-cert-renew.log

Systemd alternative

If you prefer modern Linux standards over cron, a systemd timer can achieve the same result with more robust logging and error handling.