My biased opinion is that most people run Nextcloud on an underpowered platform, and/or they install and enable every possible addon. Many also skip some important configurations.

If you run NC on a bit more powerful machine, like a used USFF PC, with a good link to it, the experience is better than e.g. OneDrive.

Another thing is, people say “Nextcloud does too much”, but a default installation really doesn’t do much more than files. If you add every imaginable app, sure it slows down and gets buggy. Disable everything you don’t need, and the experience gets much better. You can disable even the built-in Photos app if you don’t need it.

Not saying NC is a speed daemon, but it really is OK. The desktop and mobile clients don’t get enough love, that’s true.

I’m talking about the “bare metal” installation or the community Apache/FPM container images. AIO seems to be a hot mess, and does just about everything a container shouldn’t be doing, but that’s just my opinion.

Borgbackup in addition to git. Since there’s probably not much data, any cheap VPS could act as storage.

If the browser is installed as a flatpak, I think it only gets permission to either the directory the HTML file is in, or just the single HTML file.

Snaps probably have a similar permission restriction.

Portability is the key for me, because I tend to switch things around a lot. Containers generally isolate the persistent data from the runtime really well.

Docker is not the only, or even the best way IMO to run containers. If I was providing services for customers, I would definetly build most container images daily in some automated way. Well, I do it already for quite a few.

The mess is only a mess if you don’t really understand what you’re doing, same goes for traditional services.

Most likely, a Hetzner storage box is going to be so slow you will regret it. I would just bite the bullet and upgrade the storage on Contabo.

Storage in the cloud is expensive, there’s just no way around it.

There was a good blog post about the real cost of storage, but I can’t find it now.

The gist was that to store 1TB of data somewhat reliably, you probably need at least:

• mirrored main storage 2TB
• frequent/local backup space, also at least mirrored disks 2TB + more if using a versioned backup system
• remote / cold storage backup space about the same as the frequent backups

Which amounts to something like 6TB of disk for 1TB of actual data. In real life you’d probably use some other level of RAID, at least for larger amounts so it’s perhaps not as harsh, and compression can reduce the required backup space too.

I have around 130G of data in Nextcloud, and the off-site borg repo for it is about 180G. Then there’s local backups on a mirrored HDD, with the ZFS snapshots that are not yet pruned that’s maybe 200G of raw disk space. So 130G becomes 510G in my setup.

Wireguard runs over UDP, the port is undistinguishable from closed ports for most common port scanning bots. Changing the port will obfuscate the traffic a bit. Even if someone manages to guess the port, they’ll still need to use the right key, otherwise the response is like from a wrong port - no response. Your ISP can still see that it’s Wireguard traffic if they happen to be looking, but can’t decipher the contents.

I would drop containers from the equation and just run Wireguard on the host. When issues arise, you’ll have a hard time identifying the problem when container networking is in the mix.

I used to run everything with Pis, but then got a x86 USFF to improve Nextcloud performance.

With the energy price madness last year in Europe, I moved most things to cloud VPSs.

One Pi is still running Home Assistant, hooked to my heating/ventilation unit via RS485/modbus.

I had a ZFS backup server with 2 HDDs hooked up over USB to a Pi 8GB. That is just way too unreliable for anything serious, I think I now have a lot of corrupted files in the backups. Looking into getting some Synology unit for that.

For anything serious that requires file storage, I’d steer clear from USB or SD cards. After getting used to SATA performance, it’s hard to go back anyways. I’d really like to use the Pis, but family photo backups turning gray due to bitflips is unacceptable.

They are a great entrypoint to self-hosting and the Linux world though!

Perhaps I misunderstand the words “overlapping” and “hot-swappable” in this case, I’m not a native english speaker. To my knowledge they’re not the same thing.

In my opinion wanting to run an extra service as root to be able to e.g. serve a webapp on an unprivileged port is just strange. But I’ve been using Podman for quite some time. Using Docker after Podman is a real pain, I’ll give you that.

on surface they may look like they are overlapping solutions to the untrained eye.

You’ll need to elaborate on this, since AFAIK Podman is literally meant as a replacement for Docker. My untrained eye can’t see what your trained eye can see under the surface.

In my limited experience, when Podman seems more complicated than Docker, it’s because the Docker daemon runs as root and can by default do stuff Podman can’t without explicitly giving it permission to do so.

99% of the stuff self-hosters run on regular rootful Docker can run with no issues using rootless Podman.

Rootless Docker is an option, but my understanding is most people don’t bother with it. Whereas with Podman it’s the default.

Docker is good, Podman is good. It’s like comparing distros, different tools for roughly the same job.

Pods are a really powerful feature though.

Even though you said “isn’t Nextcloud”, I’d still say it’s perhaps the simplest solution.

You can disable most the other apps and set calendar as the landing page. If you don’t use the other features, the resource usage is very low, just a cron job that does basically nothing. I don’t think disabling the default apps has much effect on the footprint, by the way.

Calendar, contacts and notes are why I still self host nextcloud. Just remember to pay/donate to Davx5, they’re one of the projects that need to keep running!

Did a bit of research and found out the feature is available on Fennec F-Droid too via about:config.

Here’s how to enable: https://community.mozilla.org/en/campaigns/firefox-cookie-banner-handling/

I’d go the SSH + sudo way.

Sudo can be quite finely tuned to only allow specific commands. If you want to lock the SSH session further, look into rbash.