Rootless Nextcloud installer

🌟 Perks of this setup

• 🔐 Hardened SSH configuration using OpenSSH and public keys
• 🧱 Strong firewall rules using ufw
• 🛡️ Rootless Nextcloud setup using Docker Rootless
• ⭐ Official Nextcloud installation method using Nextcloud AIO
• ✨ Flexible configuration using reverse proxy using Caddy
• ⬆️ Automatic upgrades of both Nextcloud and Debian itself using Crontab
• 🆕 Latest stable Debian version (Trixie)
• 💾 Automatic zero-trust encrypted backup system using Restic and Rclone
• 🐍 All configured using IaC (Infrastructure as Code) in pure Python thanks to PyInfra
• ✅ End-to-end tested using both a distant server and a virtual machine using Qemu and Just

🚀 Setting everything up

To run this, simply install Debian on a server, configure SSH on it and add your own SSH key to a sudo user.

Then edit the inventories/production.py file to include your root password, hostname, SSH port, username and SSH identity file (private key filepath).

Finally, run the pyinfra command to deploy everything:

just deploy
# or
pyinfra inventories/production.py deploy.py -y

💾 Setting up an append-only backup repository

On the backup server run the following commands:

sudo apt install -y rclone
sudo useradd -m backuptest
sudo mkdir /home/backuptest/.ssh
sudo chmod 700 /home/backuptest/.ssh
sudo chown -R backuptest:backuptest /home/backuptest/.ssh
echo "0 1 * * * rm -rf /home/backuptest/data" | sudo crontab -u backuptest -
echo 'restrict,command="rclone serve restic --stdio --append-only ./data" FULL_SSH_KEY_HERE' | sudo tee -a /home/backuptest/.ssh/authorized_keys

Simply replace FULL_SSH_KEY_HERE by the SSH key present in /root/.ssh/id_ed25519.pub on the production server.

Also, make sure that each backup server has a different crontab schedule to prevent several backup servers from deleting the backups around the same time.

Then add the following Restic repository to the list in the inventory: -o rclone.program='ssh -o StrictHostKeyChecking=accept-new backuptest@HOSTNAME -p PORT' -r rclone:.

Note you can also use other kinds of Restic repositories but you might not benefit from the safety of the append-only mode (that prevents an attacker from deleting the backups).

⚙️ Configure the test virutal machine

First, setup the test virtual machine using the QEMU container.

just setup-test-vm

Once it's started, you can open your web browser on http://localhost:8006 and proceed with the Debian installation. Simply install Debian as you usually would, just make sure the username is testinfra. Then, make sure to remove the sudo password and setup the SSH key for the default user.

# In the virtual machine
sudo apt install openssh-server
# On the main host
# You can generate another key using ssh-keygen if you wish
ssh-copy-id -i ssh/vmkey -p 2222 testinfra@127.0.0.1
# On the virtual machine
sudo passwd --delete testinfra

Once that's done, you should be able to simply run the stop command to shut it down and save the configuration.

just stop-test-vm

🧪 Running the tests

To run a test, simply boot the virtual machine:

just start-test-vm

Then run the test command:

just test

Once you're done with all your testing, simply run the stop command to shutdown and clean the virtual machine.

just stop-test-vm