Mastodon

Nextcloud on Storm Buckets

Nextcloud can use a Storm Bucket in two ways. External storage mounts the bucket as a folder, and the files in it stay a normal folder tree you can read with any S3 tool. Primary storage puts every file in the bucket, but only on a fresh install, and the bucket on its own is not readable without Nextcloud's database.

Start with external storage unless you are building a new instance and accept that trade.

What you need first

  • A running Nextcloud, or a new one for primary storage. Installing Nextcloud is Nextcloud's own guide.

  • A bucket for Nextcloud and nothing else, created in the dashboard first. Garage cannot create buckets on request, so Nextcloud's autocreate stays off. See Getting Started.

  • A Read / Write key for that bucket. See Managing Access Keys.

Nextcloud serves the files to your users itself, so the bucket needs no static hosting.

Build your settings

Pick a format, type your bucket name and copy the result.

sudo -u www-data php occ files_external:create \
-c bucket=your-bucket \
-c hostname=montreal-1.buckets.stormdevelopments.ca -c port=443 -c use_ssl=true \
-c region=montreal-1 -c use_path_style=true -c legacy_auth=false \
-c key=<your key id> -c secret=<your secret> \
/Storm amazons3 amazons3::accesskey
Three values a generic S3 guide gets wrong

  • Path style on. use_path_style must be true. Storm Buckets serves no
    bucket.host names.

  • Region montreal-1. Your endpoint's name, never an AWS region. The S3
    signature includes it, so a wrong value fails every request.

  • autocreate off. The Docker image defaults OBJECTSTORE_S3_AUTOCREATE
    to true. Set it false and create the bucket in the dashboard.

External storage

Enable the app, then create the mount with the occ command from the builder:

sudo -u www-data php occ app:enable files_external

Or use the web UI: Administration settings, then External storage, add Amazon S3, and fill in the bucket, hostname montreal-1.buckets.stormdevelopments.ca, port 443, region montreal-1, with Enable SSL and Enable Path Style on.

The mount appears as a /Storm folder. Files you put there land in the bucket under their own names, so rclone ls storm:your-bucket lists them and any S3 tool can copy them out.

Primary storage

Primary storage applies to a new instance only. Nextcloud's manual warns that turning it on later makes every existing file inaccessible.

  • Bare metal: add the config.php block from the builder before running the installer.

  • Docker image: set the OBJECTSTORE_S3_* variables from the builder before the first start.

  • Nextcloud All-in-One does not support primary object storage, because its backup and restore cannot cover it. Use external storage there.

What leaving costs

In primary storage, each file is an object named urn:oid:<id>. The names and the folder tree live only in Nextcloud's database, so the bucket alone is not readable. There is no official migration off primary object storage: leaving means exporting through Nextcloud itself, with the desktop client or WebDAV. External storage has no such exit cost.

Backups

Back up the database and the bucket together. Each is meaningless without the other. A restic snapshot of a second bucket, or another provider, covers the files.

What this does not cover

  • Server-side encryption with primary object storage, which Nextcloud does not support.

  • Storage on Storm is single-zone. Keep a second copy of anything you cannot afford to lose, as the Terms of Service say.

Next steps

  • rclone to read an external-storage bucket from the command line.

  • restic for snapshots of what Nextcloud stores.

  • Managing Access Keys to rotate the key Nextcloud uses.