Nextcloud on Ubuntu 26.04 by Verified Images

This is a repackaged open source software product wherein additional charges apply for the hardened, security-maintained image (rebuilt and re-verified as new CVEs are disclosed).

Verified Images publishes a hardened, production-ready deployment of Nextcloud (the open-source file-sync, sharing, and collaboration platform - your own private alternative to hosted file-storage services) on Ubuntu 26.04 LTS. The full stack is wired up and tuned at boot (Nextcloud on PHP-FPM behind Caddy with automatic TLS, a MariaDB database, and a Valkey cache for memory caching and transactional file locking), so you get a running, maintained Nextcloud in minutes instead of assembling and hardening a PHP stack by hand. If you are moving off a retiring Nextcloud image, this is a drop-in, security-maintained replacement.

What's included beyond a stock install:

• No baked-in credentials: on first launch the image generates a unique database password and Nextcloud secrets, and sets the initial administrator password to the EC2 instance ID (fetched via IMDSv2). Nothing secret is stored in the AMI.
• A one-command operator CLI (ncctl): status, logs, backup, restore, safe upgrade, custom-domain TLS, and health, all in a single tool. The standard Nextcloud console (occ) is also preinstalled for administration.
• Automated nightly backups of the database and Nextcloud configuration, rotated (last 7 kept), plus on-demand backup and guided restore; user files live on the EBS volume, so point-in-time recovery is a matter of EBS snapshots.
• Safe one-command upgrades of Nextcloud: an automatic pre-upgrade backup, maintenance mode, then apply, with a printed rollback path.
• One-command custom domain with automatic Let's Encrypt TLS (ncctl set-domain), which also registers the domain as a Nextcloud trusted domain and sets the overwrite URL; a self-signed certificate is used until you point a domain at the instance.
• Background jobs configured the recommended way (system cron driven by a systemd timer), so previews, reminders, and housekeeping run on schedule.
• A hardened application baseline: PHP-FPM runs under least privilege behind Caddy, MariaDB listens only on localhost, the Nextcloud security and hardening recommendations and security headers are applied, and fail2ban guards SSH and Nextcloud logins.
• A hardened OS baseline: SSH password authentication and root login are disabled, a kernel/network sysctl hardening profile is applied, automatic OS security patching (unattended-upgrades) is enabled, and a health watchdog restarts the stack if the site stops answering.
• Ongoing security maintenance: the hardened image is rebuilt and re-verified as new CVEs are disclosed, so new launches stay current.

Nextcloud Server is licensed under the GNU AGPL v3; PHP under the PHP License; MariaDB under the GNU GPL v2; Caddy under the Apache 2.0 License; the Valkey cache under a BSD 3-Clause license. Valkey is the open-source fork used deliberately in place of Redis, whose current license is source-available rather than an approved permissive or copyleft license. Every bundled component is open source under a permissive or copyleft license; none carry source-available or usage-restricted resale terms. Nextcloud connects to MariaDB over a local socket (independent programs in mere aggregation), so the database's copyleft terms do not extend to Nextcloud. Source for the AGPL and GPL components is available on request. Nextcloud is a trademark of Nextcloud GmbH; Verified Images is not affiliated with, endorsed by, or a reseller of Nextcloud GmbH, and this image is not the Nextcloud-hosted or managed service.