[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Tutorials](../index.md) > [Deploying Nextcloud integrated with Object Storage](index.md) > Manually deploying Nextcloud on a VM or VM group
# Manually deploying Nextcloud on a Compute Cloud VM or in a VM group, integrated with Yandex Object Storage
In this tutorial, you will connect an Object Storage [bucket](../../../storage/concepts/bucket.md) to a Nextcloud solution deployed on a Compute Cloud [VM instance](../../concepts/vm.md) with a database in a Yandex Managed Service for MySQL® [cluster](../../../managed-mysql/concepts/index.md). To ensure fault tolerance and redundancy of your Nextcloud infrastructure, you will scale Nextcloud across an [instance group](../../concepts/instance-groups/index.md) and implement [L7 load balancing](../../../application-load-balancer/concepts/application-load-balancer.md) with Yandex Application Load Balancer. In the fault-tolerant configuration, Nextcloud will be available via a domain name, for which a [TLS certificate](../../../certificate-manager/concepts/managed-certificate.md) will be issued in Yandex Certificate Manager.
{% note info %}
To implement a fault-tolerant Nextcloud configuration, you will need a domain for the L7 load balancer.
{% endnote %}
Fault-tolerant solution diagram:
Where:
* `example.com`: Your domain for which a [certificate](../../../certificate-manager/concepts/managed-certificate.md) is issued in Yandex Certificate Manager, connected to the [L7 load balancer](../../../application-load-balancer/concepts/application-load-balancer.md).
* `nextcloud-alb`: L7 load balancer to evenly distribute incoming user traffic across instance group hosts.
* `nextcloud-instance-group`: [Instance group](../../concepts/instance-groups/index.md) with hosts the Nextcloud solution is deployed on.
* `nextcloud-db-cluster`: Yandex Managed Service for MySQL® [cluster](../../../managed-mysql/concepts/index.md) with the Nextcloud service database.
* `my-nextcloud-bucket`: Yandex Object Storage [bucket](../../../storage/concepts/bucket.md) connected to the Nextcloud solution.
To deploy Nextcloud in Yandex Cloud and connect an Object Storage bucket:
1. [Get your cloud ready](#before-you-begin).
1. [Deploy Nextcloud in a basic configuration](#the-basic-variant):
1. [Create and set up a cloud network](#setup-network).
1. [Create a service account and static access key](#setup-sa).
1. [Create an Object Storage bucket](#create-bucket).
1. [Create a VM](#create-vm).
1. [Create a Managed Service for MySQL® cluster](#create-mysql-cluster).
1. [Install and configure Nextcloud on the VM](#setup-nextcloud).
1. [Test the solution in the basic configuration](#test-simple).
1. [Deploy Nextcloud in a fault-tolerant configuration](#the-redundant-variant):
1. [Scale the Managed Service for MySQL® cluster](#expand-mysql-cluster).
1. [Complete Nextcloud setup and create a VM disk snapshot](#create-snapshot).
1. [Add a TLS certificate to Yandex Certificate Manager](#issue-certificate).
1. [Deploy an instance group](#create-instance-group).
1. [Create an L7 load balancer](#setup-balancer).
1. [Create an A resource record in your domain’s public DNS zone](#create-a-record).
1. [Test the solution in the fault-tolerant configuration](#test-redundant).
If you no longer need the resources you created, [delete them](#clear-out).
## Getting started {#before-you-begin}
Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.
If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).
[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).
### Required paid resources {#paid-resources}
The cost of the proposed solution includes:
* Fee for [disks](../../concepts/disk.md), [disk snapshots](../../concepts/snapshot.md), and continuously running [VMs](../../concepts/vm.md) (see [Yandex Compute Cloud pricing](../../pricing.md)).
* Fee for using [public IP addresses](../../../vpc/concepts/address.md#public-addresses) and [NAT gateways](../../../vpc/concepts/gateways.md#nat-gateway) (see [Yandex Virtual Private Cloud pricing](../../../vpc/pricing.md)).
* Fee for [data storage](../../../storage/concepts/bucket.md) in Object Storage and data [operations](../../../storage/operations/index.md) (see [Yandex Object Storage pricing](../../../storage/pricing.md)).
* Fee for using a MySQL® managed DB (see [Managed Service for MySQL® pricing](../../../managed-mysql/pricing.md)).
* If using Yandex Cloud DNS, fee for [DNS zones](../../../dns/concepts/dns-zone.md#public-zones) and public DNS queries (see [Cloud DNS pricing](../../../dns/pricing.md)).
* If using a load balancer, fee for the number of [L7 load balancer](../../../application-load-balancer/concepts/application-load-balancer.md) resource units (see [Yandex Application Load Balancer pricing](../../../application-load-balancer/pricing.md)).
* If using a [log group](../../../logging/concepts/log-group.md) for load balancer logging, fee for data logging and storage (see [Yandex Cloud Logging pricing](../../../logging/pricing.md)).
## Deploy Nextcloud in a basic configuration {#the-basic-variant}
You will deploy the basic Nextcloud configuration on a single VM with the Nextcloud service database created in a single-host Managed Service for MySQL® cluster or directly on the Nexcloud VM.
### Set up a cloud network {#setup-network}
1. Create a [cloud network](../../../vpc/concepts/network.md#network) and [subnets](../../../vpc/concepts/network.md#subnet) for your new cloud infrastructure:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you are going to create your infrastructure.
1. Navigate to **Virtual Private Cloud**.
1. In the top-right corner, click **Create network**.
1. In the **Name** field, enter a name for the network: `nextcloud-network`.
1. Make sure the **Create subnets** option is enabled and click **Create network**.
{% endlist %}
1. Create a [security group](../../../vpc/concepts/security-groups.md) that allows the traffic required for your Nextcloud infrastructure:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Virtual Private Cloud**.
1. In the left-hand panel, select  **Security groups**.
1. Click **Create security group**.
1. In the **Name** field, enter `nextcloud-sg` for name.
1. In the **Network** field, select `nextcloud-network` you created earlier.
1. Under **Rules**, [create](../../../vpc/operations/security-group-add-rule.md) the following traffic management rules:
| Traffic
direction | Description | Port range | Protocol | Source /
Destination name | CIDR blocks /
Security group |
| --- | --- | --- | --- | --- | --- |
| Inbound | `http` | `80` | `TCP` | `CIDR` | `0.0.0.0/0` |
| Inbound | `https` | `443` | `TCP` | `CIDR` | `0.0.0.0/0` |
| Inbound | `ssh` | `22` | `TCP` | `CIDR` | `0.0.0.0/0` |
| Inbound | `self` | `All` | `Any` | `Security group` | `Current` |
| Inbound | `healthchecks` | `All` | `Any` | `Load balancer healthchecks` | `–` |
| Outbound | `any` | `All` | `Any` | `CIDR` | `0.0.0.0/0` |
1. Click **Create**.
{% endlist %}
1. Create a [NAT gateway](../../../vpc/concepts/gateways.md#nat-gateway):
Your VMs need internet access to connect to Object Storage buckets. To avoid assigning public IP addresses to VM instances in the group, use a NAT gateway to enable internet access.
{% note info %}
You can also configure VM access to the bucket using [service connections](../../../vpc/concepts/private-endpoint.md).
This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage.
{% endnote %}
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Virtual Private Cloud**.
1. In the left-hand panel, select  **Gateways** and click **Create gateway**.
1. In the **Name** field, specify `nextcloud-gateway` as the gateway name.
1. In the **Type** field, select `Egress NAT` and click **Save**.
{% endlist %}
1. Create a [route table](../../../vpc/concepts/routing.md):
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Virtual Private Cloud**.
1. In the left-hand panel, select  **Routing tables** and click **Create routing table**.
1. In the **Name** field, specify `nextcloud-rt-table`.
1. In the **Network** field, select `nextcloud-network`.
1. Click **Add**, and in the window that opens:
1. In the **Next hop** field, select `Gateway`.
1. In the **Gateway** field, select the NAT gateway you created. The destination prefix will apply automatically.
1. Click **Add**.
1. Click **Create routing table**.
{% endlist %}
1. Link the route table to all subnets in `nextcloud-network` to route their outgoing traffic via the NAT gateway:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Virtual Private Cloud**.
1. In the left-hand panel, select  **Subnets**.
1. In the subnet row, click  and select **Link routing table** in the context menu.
1. In the window that opens, select the route table you created in the previous step and click **Link**.
{% endlist %}
Make sure the **Routing table** field for each listed subnet displays the name of the route table linked to it.
### Create a service account and static access key {#setup-sa}
To enable access from Nextcloud to the Object Storage bucket, create a [service account](../../../iam/concepts/users/service-accounts.md) and [static access key](../../../iam/concepts/authorization/access-key.md).
1. Create a service account:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Identity and Access Management**.
1. Click **Create service account**.
1. Enter a name for the service account: `nextcloud-sa`.
1. Click  **Add role** and select [`editor`](../../../iam/roles-reference.md#editor).
1. Click **Create**.
{% endlist %}
1. Create a static access key:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Identity and Access Management**.
1. In the left-hand panel, select  **Service accounts** and select the `nextcloud-sa` service account you created earlier.
1. In the top panel, click  **Create new key** and select **Create static access key**.
1. Click **Create**.
1. Save the ID and the secret key.
{% note alert %}
After you close this dialog, the key value will no longer be available.
{% endnote %}
{% endlist %}
### Create an Object Storage bucket {#create-bucket}
Create the Object Storage bucket you will connect to Nextcloud:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Object Storage**.
1. At the top right, click **Create bucket**.
1. In the ** Name** field, enter a name for the bucket, e.g., `my-nextcloud-bucket`. The bucket name must be [unique](../../../storage/concepts/bucket.md#naming) within Yandex Object Storage.
1. In the **Max size** field, specify the bucket size you need or enable **No limit**.
1. Leave all the other parameters unchanged and click **Create bucket**.
{% endlist %}
### Create a VM {#create-vm}
Create the VM to deploy Nextcloud on:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select  **Virtual machines** and click **Create virtual machine**.
1. Under **Boot disk image**, in the **Product search** field, type `Ubuntu 24.04 LTS` and select a public [Ubuntu 24.04 LTS](https://yandex.cloud/en/marketplace/products/yc/ubuntu-24-04-lts) image.
1. Under **Location**, select the `ru-central1-a` [availability zone](../../../overview/concepts/geo-scope.md).
1. Under **Computing resources**, select the `2 vCPU 4 GB RAM` configuration.
1. Under **Network settings**:
* In the **Subnet** field, select `nextcloud-network` and the subnet in the VM availability zone, `nextcloud-network-ru-central1-a`.
* In the **Public IP address** field, leave the `Auto` value to assign the VM a random public IP address from the Yandex Cloud pool.
* In the **Security groups** field, select `nextcloud-sg`.
1. Under **Access**, select **SSH key** and specify the VM access credentials:
* In the **Login** field, enter a username, e.g., `yc-user`. Do not use `root` or other reserved usernames. For operations requiring root privileges, use the `sudo` command.
* In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile.
If there are no SSH keys in your profile or you want to add a new key:
1. Click **Add key**.
1. Enter a name for the SSH key.
1. Select one of the following:
* `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
* `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
* `Generate key`: Automatically create an SSH key pair.
When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console.
1. Click **Add**.
The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
1. Under **General information**, specify the VM name: `nextcloud-vm`.
1. Click **Create VM**.
{% endlist %}
### Create a Managed Service for MySQL® cluster {#create-mysql-cluster}
Nextcloud uses a MySQL® database to store service information. In this tutorial, you will deploy the Nextcloud database in a Yandex Managed Service for MySQL® [cluster](../../../managed-mysql/concepts/index.md).
{% note info %}
You can create the MySQL® database on the same host as Nextcloud, but this is less reliable and does not provide fault tolerance. If you are not intending to deploy a fault-tolerant configuration, you may skip the cluster creation step and create the database later on the Nextcloud host.
{% endnote %}
To create a Managed Service for MySQL® cluster:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Managed Service for MySQL** and click **Create cluster**.
1. In the **Cluster name** field, enter `nextcloud-db-cluster`.
1. Under **Database**:
* In the **DB name** field, enter `nextcloud`.
* In the **Username** field, enter `user`.
* In the **Password** field, select `Enter manually` and enter a password you will use to access the database.
1. Under **Network settings**, select `nextcloud-network` and the `nextcloud-sg` security group.
1. Under **Hosts**, make sure the cluster is going to have one [host](../../../managed-mysql/concepts/instance-types.md) within the same [availability zone](../../../overview/concepts/geo-scope.md) you created the VM in.
{% note info %}
To test Nextcloud in its basic configuration, a single-host cluster would be enough. Later, when deploying a fault-tolerant configuration, you will scale the cluster you created across the remaining availability zones.
{% endnote %}
1. Under **DBMS settings**, click **Settings**, and in the window that opens:
1. In the **character_set_server** field, select `utf8mb4`.
1. In the **collation_server** field, select `utf8mb4_general_ci`.
1. Leave all the other parameters unchanged and click **Save**.
1. Click **Create cluster**.
{% endlist %}
It may take a few minutes to create a cluster.
### Install and configure Nextcloud on the VM {#setup-nextcloud}
1. Install Nextcloud on `nextcloud-vm`:
1. [Connect](../../operations/vm-connect/ssh.md#vm-connect) to `nextcloud-vm` over SSH.
1. Upgrade the versions of the packages installed on the VM:
```bash
sudo apt update && sudo apt upgrade
```
1. Install the required software packages and dependencies:
```bash
sudo apt install \
apache2 mariadb-server libapache2-mod-php php-gd php-mysql php-curl php-mbstring \
php-intl php-gmp php-bcmath php-xml php-imagick php-zip php-fpm unzip
```
1. Optionally, if you want to create the database on the same host as Nextcloud:
{% cut "**If you did not create a MySQL® cluster and are not intending to deploy a fault-tolerant solution:**" %}
1. Run MySQL:
```bash
sudo mysql
```
1. Run these commands to create the database and user and grant the user the permissions to work with the database:
```bash
CREATE USER 'user'@'localhost' IDENTIFIED BY '';
CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
GRANT ALL PRIVILEGES ON nextcloud.* TO 'user'@'localhost';
FLUSH PRIVILEGES;
quit;
```
Where `` is the password you will use to access the database.
{% endcut %}
1. Download the archive with the latest Nextcloud version:
```bash
wget https://download.nextcloud.com/server/releases/latest.zip
```
1. Unpack the archive to the `/var/www` directory:
```bash
sudo unzip latest.zip -d /var/www
```
1. Edit access permissions for the Nextcloud directory:
```bash
sudo chown -R www-data:www-data /var/www/nextcloud
sudo chmod -R 755 /var/www/nextcloud/
```
1. Configure the default virtual host:
1. Open the configuration file of the default virtual host:
```bash
sudo nano /etc/apache2/sites-available/000-default.conf
```
1. Replace the contents of `000-default.conf` with the following:
```text
DocumentRoot /var/www/nextcloud/
Require all granted
AllowOverride All
Options FollowSymLinks MultiViews
Dav off
```
1. Enable the required [Apache web server](https://en.wikipedia.org/wiki/Apache_HTTP_Server) modules:
```bash
sudo a2enmod rewrite
sudo a2enmod headers
a2enmod env
a2enmod dir
a2enmod mime
```
1. Increase the amount of RAM available to the PHP interpreter for processing requests to Nextcloud to `512 MB`.
1. Open the `.htaccess` file in the Nextcloud installation directory:
```bash
sudo nano /var/www/nextcloud/.htaccess
```
1. Add the following line to the end of the file:
```bash
php_value memory_limit 512M
```
Make sure to save your changes.
1. Restart the web server:
```bash
sudo systemctl restart apache2
```
1. Configure Nextcloud in the GUI:
1. Open your local computer browser and enter the following in the address bar:
```text
http://
```
You can look up the VM's public IP address in the [management console](https://console.yandex.cloud) by checking the **Network** section's **Public IPv4 address** field on the VM information page.
1. In the **Create an admin account** form that opens:
1. In the **New admin account name** and **New admin password** fields, set the Nextcloud administrator credentials you will use to log in to the system.
1. In the **Database account** field, enter `user`, i.e., the database user name you specified when creating the MySQL® cluster or local database.
1. In the **Database password** field, enter the database user password you specified when creating the MySQL® cluster or local database.
1. In the **Database name** field, enter `nextcloud`, i.e., the database name you specified when creating the MySQL® cluster or local database.
1. In the **Database host** field, specify the FQDN of the cluster's [current master host](../../../managed-mysql/operations/connect/fqdn.md#fqdn-master) and port in this format:
```text
c-.rw.mdb.yandexcloud.net:3306
```
You can look up the cluster ID in the [management console](https://console.yandex.cloud) by checking the **ID** field on the cluster information page.
{% note info %}
If it is not your intention to deploy a fault-tolerant solution and you did not create a MySQL® cluster but created a database on `nextcloud-vm` instead, leave `localhost` in the **Database host** field.
{% endnote %}
1. Click **Install**.
This will start the deployment of the Nextcloud database. Wait for this process to complete.
1. After the installation is over, you will see a window with recommended apps. Click **Skip**. You can get back to installing the applications you need at a later time.
1. Close the window with information on updates in the current Nextcloud version.
1. Open the application management menu. To do this, click the user icon in the top-right corner of the screen and select  **Apps** from the context menu.
1. In the window that opens, select  **Your apps** in the left-hand panel.
1. In the list that opens, find the `External storage support` application and click **Enable** in the row with it.
If needed, enter your Nextcloud administrator password in the pop-up window to confirm the operation.
1. Open the main settings menu. To do this, click the user icon in the top-right corner of the screen and select  **Administration settings** from the context menu.
1. In the window that opens, select  **External storage** in the left-hand panel under **Administration** and specify the Object Storage integration settings under **External storage** in the window that opens:
1. In the **External storage** section, select `Amazon S3`.
1. In the **Authentication** section, select `Access key`.
1. In the **Configuration** section:
* In the **Bucket** field, enter the name of the bucket you created earlier, e.g., `my-nextcloud-bucket`.
* In the **Hostname** field, specify `storage.yandexcloud.net`.
* In the **Port** field, specify `443`.
* In the **Access key** field, paste the static access key ID you got earlier.
* In the **Secret key** field, paste the static access key's secret key you got earlier.
1. Under **Available for**, enable **All people**.
1. On the right side of the section you are editing, click the  icon to save your changes.
Enter your Nextcloud administrator password in the pop-up window to confirm the operation.
### Test the solution in the basic configuration {#test-simple}
To test Yandex Object Storage integration with Nextcloud on a single host:
1. Open your local computer browser and enter the public IPv4 address of the Nextcloud VM in the address bar:
```text
http://
```
1. Get authenticated in Nextcloud using the login and password created when configuring the solution in the previous step.
1. In the left pane of the top menu, select  **Files**.
1. In the left-hand menu, select **External storage** and then **AmazonS3**.
1. Click  **New** and select  **Upload files** to upload a file from your local computer to the storage.
1. Select a file on your local computer and upload it to the storage.
The uploaded file will now appear in the Nextcloud storage named `AmazonS3`.
1. In Yandex Object Storage, [make sure](../../../storage/operations/objects/list.md) the file was uploaded to the bucket.
The deployment of the Nextcloud basic configuration is now complete. If you used a MySQL® cluster in the basic configuration, you can now proceed to deploy a fault-tolerant configuration.
## Deploy Nextcloud in a fault-tolerant configuration {#the-redundant-variant}
You will deploy a fault-tolerant Nextcloud configuration in a group of three VMs, the load on Nextcloud hosts distributed with the help of an L7 Yandex Application Load Balancer. The service database will reside in a three-host MySQL® cluster. Hosts of the instance group, load balancer, and MySQL® cluster will be evenly distributed across three [availability zones](../../../overview/concepts/geo-scope.md). Nextcloud will be available via the domain name, for which a TLS certificate will be issued in Certificate Manager.
### Scale the Managed Service for MySQL® cluster {#expand-mysql-cluster}
To add more hosts to a Managed Service for MySQL® cluster:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Managed Service for MySQL** and select the `nextcloud-db-cluster` cluster.
1. In the left-hand menu, select  **Hosts**.
1. Use the **Create host** button to add more [hosts](../../../managed-mysql/concepts/instance-types.md) to have three hosts in the cluster, one per [availability zone](../../../overview/concepts/geo-scope.md).
Do not enable **Public access** when creating hosts.
{% note warning %}
Before adding the third host, wait until the second one goes `ALIVE`. You cannot add a new host to the cluster until the operation of adding the previous one is over.
{% endnote %}
{% endlist %}
### Complete Nextcloud setup and create a VM disk snapshot {#create-snapshot}
Before you create a VM snapshot to proceed with the instance group deployment, add your domain to the list of trusted addresses and Nextcloud domains:
1. [Connect](../../operations/vm-connect/ssh.md#vm-connect) to `nextcloud-vm` over SSH.
1. Add your domain to the array of trusted addresses and Nextcloud domains:
1. In the VM terminal, open the Nextcloud configuration file:
```bash
sudo nano /var/www/nextcloud/config/config.php
```
1. In the `trusted_domains` array, replace the host IP address with your domain name.
Here is an example:
```php
'trusted_domains' =>
array (
0 => 'example.com',
),
```
The `trusted_domains` array allows you to restrict the range of IP addresses and/or domains you can use to access Nextcloud and ensures additional protection from unauthorized access. You can specify multiple addresses and/or domains, and you can also reduce or remove this restriction using wildcard characters:
{% list tabs %}
- Example 1
```php
'trusted_domains' =>
array (
0 => '*.example.com',
1 => '198.168.*.*',
),
```
In this example, access is allowed from any subdomains of the `example.com` domain and the IP addresses of the `192.168.0.0` - `192.168.255.255` range.
- Example 2
```php
'trusted_domains' =>
array (
0 => '*',
),
```
In this example, access is allowed from any domains and IP addresses.
{% endlist %}
1. Delete the `'overwrite.cli.url' => 'http://',` line.
1. Save the changes and close the `nano` editor.
1. [Stop](../../operations/vm-control/vm-stop-and-start.md#stop) the `nextcloud-vm` virtual machine.
1. After the VM stops, create a snapshot of its disk:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select  **Disks**.
1. In the line with the disk, click  and select **Create snapshot**.
1. In the **Name** field, specify `nextcloud-vm-snapshot` as the snapshot name.
1. Click **Create**.
1. Wait until the snapshot creation process is over.
To track the snapshot status, select  **Snapshots** in the left-hand panel.
{% endlist %}
### Add a TLS certificate to Yandex Certificate Manager {#issue-certificate}
To enable access to Nextcloud over HTTPS, issue a TLS certificate for your domain:
1. Add a Let's Encrypt® [certificate](../../../certificate-manager/concepts/managed-certificate.md) for your domain to Certificate Manager:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Certificate Manager**.
1. Click **Add certificate** and select **Let's Encrypt certificate**.
1. In the window that opens, specify `mymanagedcert` in the **Name** field.
1. In the **Domains** field, enter a name for your domain, e.g., `example.com`.
1. In the **Check type** field, select `DNS` and click **Create**.
{% endlist %}
A new certificate with the `Validating` status will appear in the certificate list. This status means that a Let's Encrypt® certificate was requested and you need to pass a [domain ownership verification](../../../certificate-manager/operations/managed/cert-validate.md) for the request to be successfully processed.
1. For the certificate to be issued successfully, pass domain ownership verification:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Certificate Manager**.
1. From the list of certificates, select `mymanagedcert`.
1. In the window that opens, under **Check rights for domains**, select `CNAME record`.
1. Add a [CNAME record](../../../dns/concepts/resource-record.md#cname) required for the domain ownership check to your domain’s public DNS zone. This step's further actions will depend on whether your domain is managed by Yandex Cloud DNS or a third-party DNS provider:
{% list tabs group=instructions %}
- Yandex Cloud DNS {#dns}
Under **Check rights for domains**, in the `CNAME` record section, click **Create record**. In the window that opens:
1. If the current folder contains an appropriate DNS zone, it will be automatically inserted into the **Zone** field. If there is no such DNS zone, click **Create zone** and set its parameters to [create](../../../dns/operations/zone-create-public.md) a new zone.
1. Click **Create**.
- Third-party DNS provider {#third-party-dns-server}
1. Under **Check rights for domains**, in the `CNAME` record section, check the record value for the domain in the **Value** field.
1. Add a `CNAME` record to your DNS provider or to your own DNS server to delegate management privileges to the DNS zone used for the check:
```
_acme-challenge.example.com CNAME
```
The `` string is formatted as follows: `.cm.yandexcloud.net.`
{% endlist %}
{% note info %}
For a successful DNS domain rights check based on a `CNAME` record, make sure the `_acme-challenge` subdomain of the domain name you are checking has no other [resource records](../../../dns/concepts/resource-record.md) except `CNAME`. For example, for the `_acme-challenge.example.com.` domain name, there should only be a CNAME record and no TXT record.
{% endnote %}
Domain ownership verification may take from a few minutes to a few days. Wait until it successfully completes. As a result, the certificate will be issued and get the `Issued` status.
{% endlist %}
### Deploy an instance group {#create-instance-group}
For a fault-tolerant Nextcloud solution, scale it across an [instance group](../../concepts/instance-groups/index.md):
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select  **Instance groups**.
1. Click **Create group of virtual machines**.
1. In the **Name** field, specify `nextcloud-instance-group` as the group name.
1. In the **Service account** field, select `nextcloud-sa`.
1. Under **Allocation**, select all [availability zones](../../../overview/concepts/geo-scope.md) for maximum fault tolerance.
1. Under **Instance template**, click **Define** and in the form that opens:
1. Under **Boot disk image**, navigate to the **Custom** tab and click **Select**.
In the window that opens, select the `nextcloud-vm-snapshot` snapshot you created earlier and click **Add disk**.
1. Under **Computing resources**, select the `2 vCPU 4 GB RAM` configuration.
1. Under **Network settings**:
1. In the **Network** field, select `nextcloud-network`.
1. In the **Public address** field, select `No address`.
1. In the **Security groups** field, select `nextcloud-sg`.
1. Under **Access**, select **SSH key** and specify the VM access credentials:
* In the **Login** field, enter a username, e.g., `yc-user`. Do not use `root` or other reserved usernames. For operations requiring root privileges, use the `sudo` command.
* In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile.
If there are no SSH keys in your profile or you want to add a new key:
1. Click **Add key**.
1. Enter a name for the SSH key.
1. Select one of the following:
* `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
* `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
* `Generate key`: Automatically create an SSH key pair.
When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console.
1. Click **Add**.
The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
1. Click **Save**.
1. Under **Scaling**, specify `3` in the **Size** field.
1. Under **Integration with Application Load Balancer**, enable **Create target group** and specify `nextcloud-target-group` in the **Name of the target group** field that appears.
1. Under **Health checks**:
1. Enable **Activate**.
1. In the **Type** field, select `TCP`.
1. Click **Create** and wait for the instance group to be created and started.
{% endlist %}
### Create an L7 load balancer {#setup-balancer}
Create an [application-level load balancer](../../../application-load-balancer/concepts/application-load-balancer.md) for traffic distribution between the hosts of the future Nextcloud instance group:
1. Create a [backend group](../../../application-load-balancer/concepts/backend-group.md):
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Application Load Balancer**.
1. In the left-hand panel, select  **Backend groups** and click **Create backend group**.
1. In the **Name** field, enter a name for the group: `nextcloud-bg`.
1. Enable **Session affinity** and select `By IP address` in the **Affinity mode** field that appears.
1. Under **Backends**, click **Add** and do the following in the **New backend** form that opens:
1. In the **Name** field, specify `nextcloud-backend`.
1. In the **Target groups** field, select the `nextcloud-target-group` target group you created earlier.
1. Expand the **Load balancing settings** section and select `MAGLEV_HASH` in the **Balancing mode** field.
1. In the **HTTP health check**, click  and select  **Delete**.
1. Click **Create**.
{% endlist %}
1. Create an [HTTP router](../../../application-load-balancer/concepts/http-router.md):
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Application Load Balancer**.
1. In the left-hand panel, select  **HTTP routers** and click **Create HTTP router**.
1. In the **Name** field, enter a name for the HTTP router: `nextcloud-router`.
1. Under **Virtual hosts**, click **Add virtual host** and do the following in the **New virtual host** form that opens:
1. In the **Name** field, enter `nextcloud-vh` for the virtual host's name and click **Add route**.
1. In the **New route** form that opens, enter `nextcloud-route` as the route's name in the **Name** field.
1. In the **Backend group** field, select the `nextcloud-bg` backend group created in the previous step.
1. Leave all the other parameters unchanged and click **Create** at the bottom of the page.
{% endlist %}
1. Create an L7 load balancer:
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Application Load Balancer**.
1. Click **Create L7 load balancer** and select **Manual**.
1. In the **Name** field, enter a name for the load balancer: `nextcloud-alb`.
1. In the **Network** field, select `nextcloud-network`.
1. In the **Security groups** field, select `From list` and then the `nextcloud-sg` security group from the list that opens.
1. Under **Allocation**, make sure all availability zones are selected.
1. If you do not want load balancer logs saved to a [log group](../../../logging/concepts/log-group.md), disable **Write logs**.
1. In the **Listeners** section, click **Add listener** and do the following in the form that opens:
1. In the **Name** field, enter a name for the listener: `nextcloud-listener`.
1. In the **Protocol** field, select `HTTPS`.
1. In the **Certificates** field, select the `mymanagedcert` certificate you created earlier.
1. In the **HTTP router** field, select the `nextcloud-router` HTTP router you created earlier.
1. Leave all the other parameters unchanged and click **Create** at the bottom of the page.
{% endlist %}
Wait for the load balancer status to change to `Active` and copy its IP address from the **IP addresses** field.
### Create an A resource record in your domain’s public DNS zone {#create-a-record}
To route your domain's incoming requests to an L7 load balancer, in your DNS zone, create an [A resource record](../../../dns/concepts/resource-record.md#a) pointing to the load balancer's IP address you got in the previous step. Further steps to follow will depend on whether your domain is managed by Yandex Cloud DNS or a third-party DNS provider.
{% cut "**If your domain is managed by Yandex Cloud DNS**" %}
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the folder where you are deploying your infrastructure.
1. Navigate to **Cloud DNS**.
1. Select the DNS zone you need, click **Create record**, and do the following in the window that opens:
1. In the **Name** field, select `Matches zone name (@)`.
1. In the **Type** field, select `A`.
1. In the **Data** field, specify the load balancer IP address you saved in the previous step.
1. Leave other parameters as they are and click **Create**.
{% endlist %}
{% endcut %}
{% cut "**If your domain is managed by an external DNS provider**" %}
Add an A resource record with the following properties to your DNS provider or your own DNS server:
* Host: `@`
* Type: `A`
* Value: ``
{% endcut %}
### Test the solution in the fault-tolerant configuration {#test-redundant}
To test Yandex Object Storage integration with Nextcloud in a fault-tolerant configuration:
1. Open your local computer browser and enter your domain name in the address bar, e.g.:
```text
https://example.com
```
1. Get authenticated in Nextcloud using the login and password created when configuring the solution.
1. In the left pane of the top menu, select  **Files**.
1. In the left-hand menu, select **External storage** and then **AmazonS3**.
1. Make sure you see the file uploaded in the previous step.
1. Download the file you uploaded earlier. Do this by clicking  and selecting  **Download** in the line with the filename.
1. Delete the file. Do this by clicking  and selecting  **Delete file** in the line with the filename.
1. In Yandex Object Storage, [make sure](../../../storage/operations/objects/list.md) the file was deleted from the bucket.
## How to delete the resources you created {#clear-out}
1. If you had created an L7 load balancer, [delete](../../../application-load-balancer/operations/application-load-balancer-delete.md) it and then delete the [HTTP router](../../../application-load-balancer/operations/http-router-delete.md), [backend group](../../../application-load-balancer/operations/backend-group-delete.md), and the load balancer's [target group](../../../application-load-balancer/operations/target-group-delete.md) one by one.
1. If you had created an instance group, [delete](../../operations/instance-groups/delete.md) it.
1. If you had created resource records, delete them in [Yandex Cloud DNS](../../../dns/operations/resource-record-delete.md) or in your domain registrar’s account.
1. If you created a DNS zone, delete it in [Yandex Cloud DNS](../../../dns/operations/zone-delete.md) or in your domain registrar's account.
1. If the L7 load balancer logging feature was left on, [delete](../../../logging/operations/delete-group.md) the log group.
1. [Delete](../../operations/vm-control/vm-delete.md) the VM.
1. [Delete](../../../managed-mysql/operations/cluster-delete.md) the MySQL® cluster database.
1. [Delete](../../../storage/operations/objects/delete.md) the objects you created in the bucket, then [delete](../../../storage/operations/buckets/delete.md) the bucket itself.
1. [Delete](../../operations/snapshot-control/delete.md) the disk snapshot.
1. [Delete](../../../iam/operations/sa/delete.md) the service account.
1. Delete the [subnets](../../../vpc/operations/subnet-delete.md), [security group](../../../vpc/operations/security-group-delete.md), [route table](../../../vpc/operations/delete-route-table.md), [NAT gateway](../../../vpc/operations/delete-nat-gateway.md), and [cloud network](../../../vpc/operations/network-delete.md) one by one.
1. Optionally, [delete](../../../certificate-manager/operations/managed/cert-delete.md) the TLS certificate if you created one.
#### See also {#see-also}
* [Deploying Nextcloud on a Compute Cloud VM from a Container Optimized Image image, integrated with Yandex Object Storage](coi-based.md)
* [Deploying Nextcloud integrated with Yandex Object Storage on a Compute Cloud VM or VM group with the help of Terraform](terraform.md)