Nextcloud .onion server

Serverside Setup

So for this tutorial we're going to go with a Debian server to install nextcloud via snap:


su -
apt update -y

apt install snapd sudo curl mlocate nginx -y
/sbin/usermod -aG sudo [NAME OF THE NON-PRIVILEGED USER]
/sbin/ufw enable
snap install core

Using snap, installing nextcloud is fairly simple:


snap install nextcloud

ip a | grep inet
curl ifconfig.me

you can verify that the nextcloud server works by going at the ip adress of the server http://server_ip/ where you'll create the administrator account.

Once that's done you should have access to your nextcloud instance, but instead of accessing it through the ip address, we'll set it up in such a way that we can access it through an .onion domain name.

So we follow this tutorial to have our own custom .domain name:


[ Wonderland ] [ /dev/pts/3 ] [~]
→ cat /etc/tor/torrc

HiddenServiceDir /var/lib/tor/onions/nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/
HiddenServicePort 80 127.0.0.1:4443
SocksPort 127.0.0.1:9050

[ Wonderland ] [ /dev/pts/3 ] [~]
→ systemctl restart tor@default

Then we setup a reverse nginx proxy to make sure that the onion requests get redirected to the correct IP:


[ Wonderland ] [ /dev/pts/3 ] [~]
→ rm /etc/nginx/sites-*/default

[ Wonderland ] [ /dev/pts/3 ] [~]
→ cat /etc/nginx/sites-available/cloud.conf
upstream cloudbackend {
        server 192.168.100.130:80;
}

server {
        ######## TOR WEBSITE ########
        listen 4443;
        listen [::]:4443;
        server_name cloud.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion;

        location / {
                proxy_pass http://cloudbackend;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                client_max_body_size 20G;
        }
}

[ Wonderland ] [ /dev/pts/3 ] [~]
→ ln -s /etc/nginx/sites-available/cloud.conf /etc/nginx/sites-enabled/

[ Wonderland ] [ /dev/pts/3 ] [~]
→ nginx -s reload

Configuring Nextcloud

Now that we have the domain name pointing to the public ip address of the nextcloud server, we can setup the https certificate using let'sencrypt, just ssh into your server once more and run the following commands:


[ Wonderland ] [ /dev/pts/3 ] [~]
→ /var/snap/nextcloud/common/nextcloud/data# PATH=$PATH:/snap/bin/

[ Wonderland ] [ /dev/pts/3 ] [~]
→ /var/snap/nextcloud/common/nextcloud/data# which nextcloud.occ

[ Wonderland ] [ /dev/pts/3 ] [~]
→ /snap/bin/nextcloud.occ


[ Wonderland ] [ /dev/pts/3 ] [~]
→ /snap/bin/nextcloud.disable-https

[ Wonderland ] [ /dev/pts/3 ] [~]
→ /snap/bin/nextcloud.occ config:system:set trusted_domains 1 --value=cloud.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion

[ Wonderland ] [ /dev/pts/3 ] [~]
→ /snap/bin/nextcloud.occ config:system:set overwritehost --value="cloud.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion"

[ Wonderland ] [ /dev/pts/3 ] [~]
→ /snap/bin/nextcloud.occ config:system:set overwriteprotocol --value="http"

And once that's done, you can access your nextcloud instance from your onion domain:

In order to upgrade your nextcloud, you can run the following, and also add it to cron to run automatically every day at midnight:


root@cloud:~# sudo snap refresh nextcloud
snap "nextcloud" has no updates available

root@cloud:~# crontab -e

[...]

0 0 * * * /usr/bin/snap refresh nextcloud

:wq


--2022-12-17 20:34:07--  https://github.com/cronitorio/cronitor-cli/releases/download/28.8/linux_amd64.tar.gz
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/274548350/682877d8-1d52-4029-9777-425f3da0f77c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20221217%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221217T193407Z&X-Amz-Expires=300&X-Amz-Signature=1bf21514b0120917047558bc2d6de9d2f900d34dba04cfd3d30838b59ae4701e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274548350&response-content-disposition=attachment%3B%20filename%3Dlinux_amd64.tar.gz&response-content-type=application%2Foctet-stream [following]
--2022-12-17 20:34:07--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/274548350/682877d8-1d52-4029-9777-425f3da0f77c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20221217%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221217T193407Z&X-Amz-Expires=300&X-Amz-Signature=1bf21514b0120917047558bc2d6de9d2f900d34dba04cfd3d30838b59ae4701e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274548350&response-content-disposition=attachment%3B%20filename%3Dlinux_amd64.tar.gz&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.110.133, 185.199.108.133, 185.199.109.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6326130 (6.0M) [application/octet-stream]
Saving to: ‘linux_amd64.tar.gz’

linux_amd64.tar.gz                                           100%[===========================================================================================================================================>]   6.03M  6.47MB/s    in 0.9s

2022-12-17 20:34:09 (6.47 MB/s) - ‘linux_amd64.tar.gz’ saved [6326130/6326130]

root@cloud:~# sudo tar xvf linux_amd64.tar.gz -C /usr/bin/
cronitor
root@cloud:~# sudo cronitor configure --api-key 1234567890

Configuration File:
/etc/cronitor/cronitor.json

Version:
28.8

API Key:
1234567890

Ping API Key:
Not Set

Environment:
Not Set

Hostname:
cloud

Timezone Location:
{Europe/Paris}

Debug Log:
Off
root@cloud:~# cronitor select

✔ /usr/bin/snap refresh nextcloud
----► Running command: /usr/bin/snap refresh nextcloud

snap "nextcloud" has no updates available

----► ✔ Command successful    Elapsed time 0.451s

Clientside Setup

Now you can install the official nextcloud client here


[ cloud ] [ /dev/pts/1 ] [/snap/bin]
→ apt install tor nextcloud-desktop -y

Here as you try to login you'll first see that it can't resolve the .onion domain, which is normal as you need to tell nextcloud to use the local tor socks5 proxy, available on 127.0.01:9050

Afterward, you need to copy the authorization link into the tor browser to validate the request:

Once you have granted access, you can start to sync your nextcloud instance files locally:

Once logged in you can check the progress in the system tray:

Then let it sync, it can take a while due to the low bandwidth of Tor.

And that's it ! You now have a local folder that is synchronized with your nextcloud instance.

Nextcloud .onion server

Serverside Setup

Configuring Nextcloud

Clientside Setup

Nihilism

My Links

About nihilist