1y ago

I'm done with NextCloud

Just had NextCloud denying my credentials (not for the first time). I know they weren't wrong because I'm using a password manager. Logs didn't say much. Was about to reinstall (again, not the first time nextcloud went bonkers on me) before I tried a docker compose down && docker compose up. Lo and behold after a restart the credentials worked again.

This stuff is just way too flaky for something so important.

Is OwnCloud good again? My main usecase is saving photos but I don't want them locked away in a database so SeaFile is out.

Edit: I'm going to take the time to reply to you all, bit busy with work and family suddenly. But a little update - I've quickly setup Immich and fired up the CLI to import my library. AFAIK the files are still stored on disk somewhere but metadata is in a database. I didn't realize this before, knowing that I think my mind is made up and Immich is the best solution. Thanks everyone!

111 comments

I'm not done but I'm so tired of just stupid error messages that don't help from developers. I love the open source community but for gods sake devs, handle your errors in a format that makes sense.
Nextcloud or others, it's always the same. I either get a 200 line stacktrace that means absolutely nothing to me because the dev didn't bother to handle the exception (like you submit a form and get a null reference back. It sure would be nice to know what field was null) or of course the infamous "Exception occurred" and nothing else.
My favorite was I tried to submit to Jellyfin a fix for one of their very opaque exceptions, keep the stack trace but rewrite the error message like "x exception occurred, do you have permissions to do that?" Or something and the PR was rejected. I just can't even with that
- My favorite was I tried to submit to Jellyfin a fix for one of their very opaque exceptions, keep the stack trace but rewrite the error message like "x exception occurred, do you have permissions to do that?" Or something and the PR was rejected. I just can't even with that
  Out of interest, which PR was that?
  It's uncommon to rewrite exception messages to be user friendly, they are for developers. The exception shouldn't be thrown in the first place if it's a common issue or the error message should be more generic for unhandled problems.
  
  I strongly disagree with this, any error message shown to the user should be helpful to the user
  
  ehh I try to keep me here and my real github separate. I'm all for exception messages being for developers especially in logs, but things also shouldn't error silently either. This was a case where there was something different with my OS I was running and I wanted to show an error that there was a common reason for that exception being thrown. This was years ago though, so I don't remember details
- I'm also a develop and my philosophy is that stack traces are for the developers but they should be translated to informative error messages for the user. Otherwise you're doing security through obscurity.

I almost don’t dare to say this, but I’ve been running the snap for more than a year and have no complaints.
- Too daring of you to say snap
- 6 years here and went from ubuntu 16 to 22
- Glad someone said it out loud 😁 I've been running the snap for almost three years now 24/7. I works really well!
- I've been on the snap version for three years with zero problems. It was originally created as a VM on virtualbox, then ported over to proxmox. Every OS and instance upgrade has gone off without a hitch so far.
- You installed nextcloud with snap? HOW DARE YOU!

Most likely you got blocked for some time by the brute force prevention. Have a look at your logfiles.
- ^this. You probably had a Nextcloud client somewhere with wrong credentials that was trying to reconnect repeatedly which locked you out. It happened once to me.

My problem with nextcloud is more the performance of the web interface rather than it's reliability (and that's even with mariadb + redis setup and a decently fast minipc). It's fine if you avoid the web interface, but that's part of the draw of the thing.
- The poor performance carries over to the sync clients too because they're just using webdav http requests. Nextcloud will take like 10+ hours to sync my folders, vs about 10 minutes with Syncthing or something else.
- The performance is indeed pretty terrible. Most stuff runs fine on my NUCs except nextcloud. Maybe throwing more hardware at it solves it though.
  
  Nope lol I have a pretty godly server and nextcloud is slow as a mf
  
  As someone with a beef server: Nope, performance stays unsatisfactory. Redis helps a lot but only if the page is cached which tbh just makes the experience worse if the page isn't cached
  Edit: I'm using the AIO installer though, as discussed elsewhere in this post that might be the root cause of the poor performance, will check on the weekend by installing nextcloud manually in a fresh vm
- MariaDB runs like hot garbage with Nextcloud imo. I’ve gotten to the point where I use legit MySQL or PostgreSQL and performance is night and day. I have no idea why Maria acts out with Nextcloud for me, but I’ve gotten tired of troubleshooting it.
  
  Interesting. MariaDB was the path of least resistance for me but I normally prefer PostgreSQL. I'll put it on the list.
- There are more twerks to it than "just' using mariadb and redis. Maybe look into Apache/nginx cacheing,tune your mariadb settings and stuff like that. Had performance-problems with my owncloud-instance, now it runs like a champ
  
  Honestly the official docker images are hot garbage. I used them when I first tried NextCloud and they load incredibly slow. Shelved it for a while, realized there was a bunch of shit they already have that I was looking for, and gave it a go with my own Dockerfile starting from the PHP alpine image. That one runs waaaayyy better.
  
  Fair, although I feel like performance should be better OOTB, particularly when I'm just using it as a single user. It is an old and complex application that does a lot, so it is understandable.
- I've never really needed the web interface once everything was setup. Mobile app syncs my images and then I browse files through synced desktop clients. Never had any issues this way. I guess I'm not using the extra features some may be after in the webui.

What name do you assign the DB for PostgreSQL in Docker and does it by chance happen to match the name of any other containers, possibly in other docker compose files?
I'm only mentioning it because I experienced weird inconsistent issues with a service I was running where it was sometimes having trouble connecting to its DB companion and I eventually realized that it was sometimes connecting to the other container. I was also finding that turning it off and on again was often 'fixing' the issue, at least for a while. Might be worth checking out. I'd also consider viewing the logs for Nextcloud (docker logs -f ) when you're unable to login and see if there are any errors. Frankly I've never had these specific issues with Nextcloud, and given that it's based on PHP (it only 'executes' on an HTTP request), it seems like restarting shouldn't help unless it's something else.
- I run a separate instance of postgres since I also use it for a lot of other stuff.
  it seems like restarting shouldn’t help unless it’s something else.
  I'm honestly also baffled
  
  And none the container names or link aliases conflict? Like you don't have multiple db containers? Perhaps try renaming the Nextcloud db to something like nextcloud_db if you aren't already.

I haven't got this kind of issue with nextcloud, I'm pretty sure you can reset your password using occ via cli
- I'm using the LSIO docker image and I could not locate the occ file to fire off the reset - but even then - I didn't need to reset my password anyway..
  
  That's your problem, just there: you deployed a one size fits all blackbox of a container that, by definition, on top of pulling all the inefficiencies and redundancies of docker, isn't tuned for your specific hardware and operational needs. I get the appeal of containers, but if you want to self-host responsibly, you've got to be in control of what's running and how.
  Sorry if this sounds harsh.

For photos, I'd highly recommend checking out Photoprism.
the "PhotoSync" app available for both android and apple can sync from your phone to photoprism.
But, nextcloud itself, works pretty nice for me. But, I use OIDC-based logon, with Authentik.
- Would highly reccomend https://immich.app/ too. It's the solution I've finally landed on after trying out most of the options out there.
  
  Does it support syncing photos from your phone? That's the only thing I need to get off Google Photos, I love how seamless it is.
  
  I'll give credit- that actually has a really nice interface. Going to have to star that one, and keep an eye on it.
  Documentation is very nice too.
  
  Main issue is that it doesn't support chunked uploads and that means it doesn't work with cloudflare
- Go with immich if you want to ever have multiple users.
  Photoprism locks user accounts behind a paid subscription.
  Pretty much everything is more full-featured on immich except for incomplete RAW format support because photoprism is mainly focused on photography and now businesses IIRC.
  
  I have been digging through the features and documentation- and I plan on giving it a try.
  Photoprism locks user accounts behind a paid subscription.
  We have been asking for a password for "private" photos, for a few years now.... and yea, still don't have that feature. I did notice photoprism jumped on the subscription train a while back, but, have not paid too much mind to it.
  But, seeing the beautiful interface of this, I will be trying it.
- So the only reason I have been using nextcloud was for the photo sync and that it can be configured to backup right away.
  Does Photosync allow for backups right away?
  
  It's configurable.
  I have mine configured to backup when I am charging and on wifi.
  But, you can set it to run instantly.

I am using nextcloud for years now with postgres, redis and configured PHP setttings, but I installed it on the host. Never had any problems, Performance is awesome... Almost everytime I read about problems is with the docker images. The new AIO image shall be bad too, but I can not say anything to this, since I don't use it.
I really like docker, but sometimes it is better to install on the host directly or use an LXC if you need isolation. MinIO is the same... Would not want it in a Container
Maybe seafile could be an option for you 🤔
- That's how I ran my nextcloud for about a decade and never had problems. On my new server I'm running it in docker and so far it seems to work ok.
  
  Good to hear that it is running ☺️
  Did you follow a specific guide or did you migrate yourself? Which image are you using? Maybe this could help others
- Bare metal club! :D
- Just wanted to +1 your comment. Installing on bare metal host is higher risk, but higher reward as well in terms of stability and performance. In my case I’m using mariaDB, redis, php, and apache and it’s been solid for years now.
  
  I used it with mariadb before, converting to postgres gave a performanceboost. Don't ask me why but it ran faster
  If you are intrested, than here is a guide 😊
- Been running multiple Nextcloud instances for years on bog standard debian + apache + php-fpm install, as documented in the official docs which do not even mention docker. Upgrades were never a problem. Some apps may suffer some bugs from time to time, but Nextcloud itself works flawlessly. Wrote an ansible role to install, manage and update it. The only thing that deviates from the "recommended" setup is Postgres instead of MariaDB. People need to start following the actual documented/well-supported installation options and stop trying to stick containers everywhere...
  
  The docs are very good and you have a lot of tutorials for nextcloud, bit mostly they scratch only on the surface. They show you how to install and if you are lucky you see how to setup HTTPS....
  But then? Start nextcloud and go to system overview and everything is red and you get warnings about region, php opcache... 😁 Most tutorials end there. It is a pity
- I just don't see how docker can fuck something like this up honestly, the only thing that can be screwy is permissions when dealing with filesystem mounts - but once you've got that working it should be pretty static.
  
  Maybe it is permissions or the image won't start correctly. Maybe it tries to read from the database which is jot up at the moment or something similar 🤔
- I use Seafile... can give a partial recommendation
- I tried to run it on Debian and on each update it was always complaining the php version too old. Maybe on a distro that doesn't come with ancient packages can be ok...
  
  I guess this is only a problem on an older debian server. Then you could use the PHP PPA. Some people still run PHP 7.4 or even 5.6, but they are end of life 😳

In my experience, Immich is way better for Photos.
- Giving this a shot, importing everything through the CLI now
- I love Immich. Such an amazing system it still shocks me that it's foss

Maybe try https://github.com/kd2org/karadav if you want to continue using the NC apps for photo backups.
- Is it measurably better? From a quick look, it's PHP again (and if your NC runs slow, there's a fair chance it's not properly set-up/tuned), and SQLite (so, rather small scale).
- That's really cool. I'm giving Immich a try now but I saved your comment.

Would be interesting to hear a little more about your setup. I had some issues when I had Nextcloud installed directly on Debian (though nothing this major), have since switched to running it on Docker and it's been very solid.
- It's the LSIO image hooked up to seperate (but also docker) postgres db that's also used for other apps. The data and config directories are bind mounts to the local filesystem. It connects to a samba share via the external storage plugin. It is exposed to the internet through a caddy reverse proxy though (the database isn't)

Maybe Immich might be a fit fit
https://github.com/immich-app/immich
- I'm giving this a try now - it's true it still saves the files on disk somewhere right? AFAIK at least so, this fits my requirements.
  
  Yes it does, you can back up the files externally and everything if needed. You can also import external directories of existing photos.
  
  The installation instructions talk about the yaml amd env file to dowmload and edit, in one of those you specify explicit path of where your files go

Nextcloud is an overkill. Its just too much. I'd say better split down the needed services. Baikal/radicale etc for contacts/calendar. Photoprism/librephotos etc for photos. A webdav server for storage. And so on.

I’ve been running two NC instances for over five years (linuxserver docker images)—one has been issue-free, and the other had sporadic issues like OP is describing... but not for the last year or so, so I assumed the issue had been fixed in an update. Or maybe the problem was the network configuration instead of NC.

So, now's as good a time as any to ask. Why is everyone using Nextcloud? I've been quietly using Owncloud for a very long time and never had any issues with it. How is Owncloud bad?
- Owncloud is not fully open source. Nextcloud is. They have developed in different directions since then, but that remains the fundamental difference that split them apart in the first place. If that matters to you, Nextcloud is the right choice. If that doesn't matter to you, then use whichever you prefer and has the features you need.
  
  Thanks!
- This is a good summary, but the Tl;DR is that Owncloud has a non-open source Enterprise version with extra features you need to pay for, while Nextcloud is a fully open source fork.
  
  the Tl;DR is that Owncloud has a non-open source Enterprise version with extra features you need to pay for
  This isn't any different than a lot of other softwares, though... Nextcloud has the same Enterprise pricing/features shit, too. https://nextcloud.com/enterprises/
  Actually, so does Photoprism. https://www.photoprism.app/features

use immich for photos.
owncloud ocis works but is very young. is literally just file hosting with something to open office files online.
- https://github.com/simone-viozzi/my-server
  those are my configs. you have both immich and owncloud.

For this exact reason I'm using NextCloud as a service. You can even install plugins.
It's a trade-off ofc but it works rocks solid so far.
I'm not affiliated with that particular provider though.

Mine has randomly done that for the last few versions now. I also noticed it now maintains several cookies that I have to clear before I can log in successfully again.
I do have Redis configured with it, have never used their AIO image, and previously, the session ID was the only cookie. Haven't kept quite up to date with NC's development, but maybe it's no longer using PHP's session store in favor of its own mechanism?
Unfortunately, I'm too invested in NC to start switching everything to discrete apps, so I guess I just have to put up with it. :shrug:

I also stopped using Nextcloud after it broke a couple of times. As a consequence I also never use :latest tag on any docker container anymore - manual updates only
When I switched to Android phone, I also switched to syncthing. If you have enough storage on your phone, it is amazing! Never looked back
- When I first started selfhosting I put latest on everything AND used watchtower. Quickly learned my lesson.

Well, I'm amazed you didn't get downvoted to hell by saying NC is bad. Some of my experiences with NC are described in detail at https://lemmy.world/comment/1571886 and https://lemmy.world/comment/346174

Thats frustrating
I second the notion that your ip was banned by nc's brute force detection
The silent reconnects of a DAVx client on a phone could easily trigger this
You can whitelist your home routers ip in the config IIRC Maybe not on the LISO container though, IIRC it is less configurable, but doesn't "just work", I'd ditch that not nextcloud
Quick fix could be to "DELETE FROM" (or "TRUNCATE" if you are certain nobody is blocked correctly) the table bruteforce_attempts (or smth similar). Although that "dc up && dc down" worked could indicate another issue, as you do seem to have persistence with your db in a docker volume (cred are still there) which would mean the time penalty ran out during restart or oits somethimg else

Do you have 2 redis containers by any chance? I'm asking because you mentioned Immich, and that one has redis as part of its stack

I just implemented authentik SSO for Nextcloud and other apps and it’s made my life easier.

Maybe give Seafile a try?
Open source, you can selfhost, has clients for Linux/Win/Mac and Android/iOS and best of all - encryption that actually works.
- My main usecase is saving photos but I don’t want them locked away in a database so SeaFile is out.
  
  Shit. Missed that, sorry.
  
  This is my least favorite part of Seafile. If there were a competitive alternative that used a flat file storage backend then I'd switch to that in a heartbeat. But alas, I still have not found one, so I will continue into my 6th year of using Seafile...
  Worth noting in 6 years I haven't had any actual trouble with Seafile's storage, and the few times I've needed to I've been able to export data to a normal file system using seaf-fsck even if Seafile isn't running. I'm just not 100% comfortable with it anyway so I understand the apprehension. I'd rather use a standard filesystem and be able to use standard tooling on it.
- And the clients are actually really great, competitive with the features of the best cloud storage clients.

I would like to recommend Seafile if immich doesn't work out. I've used it for a long time and it's always been the best self hosted cloud imo. it's not as shiny or pretty looking as some but it's been reliable

If your main use case is photos
https://github.com/LibrePhotos/librephotos

@midas Were you self-hossting or using their hosted service?
- Selfhosted

Are you exposing it to the Internet? Weirdness like that might be from someone exploiting your instance.
- Yeah - don't see any evidence of that in the logs + why would it work again after a restart?
  
  How do you have your auth working? Is it basic user/password managed on Nextcloud (external database connected?), is it external auth against something like Okta, or is it user/pass that you define from docker-compose?
  If via docker-compose then a restart would clear anything an attacker would have done and it would reload from the docker-compose process I think? I’m not too familiar with the specifics on that as I’m not a security researcher, but generally some attacks are resident in memory only and a restart can clear them only for it to crop up again later either due to a running process that was set to rerun an exploit or someone monitoring your system externally and retrying the exploit remotely again.
  Or it could just be some bug in Nextcloud or unique to your environment. Personally I’m only hosting things that are internally accessible via VPN anymore. Tailscale makes that super easy these days.

111 comments