[HOW-TO] Install Bare-metal opencloud version (without compilation)

[StafLoker]

Install Opencloud

Please change:

• Version to actual: v2.2.0
• Domain to yours: domain.com

Download

sudo wget -P /usr/local/bin https://github.com/opencloud-eu/opencloud/releases/download/v2.2.0/opencloud-2.2.0-linux-amd64

sudo chmod a+x /usr/local/bin/opencloud-2.2.0-linux-amd64

sudo ln -s -f /usr/local/bin/opencloud-2.2.0-linux-amd64 /usr/local/bin/opencloud

opencloud version --skip-services

Create system user & folders

sudo useradd --system --no-create-home --shell=/sbin/nologin opencloud

sudo mkdir -p /var/lib/opencloud

sudo chown opencloud:opencloud -R /var/lib/opencloud

sudo mkdir -p /etc/opencloud

Configs

sudo -u opencloud touch /etc/opencloud/opencloud.env

sudo chown -R opencloud:opencloud -R /etc/opencloud

sudo -u opencloud vim /etc/opencloud/opencloud.env

# General
OC_URL=https://drive.domain.com
PROXY_HTTP_ADDR=0.0.0.0:7750
PROXY_TLS=false
OC_INSECURE=false

DEMO_USERS=false

OC_LOG_LEVEL=warn

OC_CONFIG_DIR=/etc/opencloud
OC_BASE_DATA_PATH=/var/lib/opencloud

Systemmd

Create

sudo -u opencloud opencloud init --config-path /etc/opencloud --insecure=false

sudo systemctl edit --force --full opencloud.service

[Unit]
Description=OpenCloud server

[Service]
Type=simple
User=opencloud
Group=opencloud
EnvironmentFile=/etc/opencloud/opencloud.env
ExecStart=/usr/local/bin/opencloud server
Restart=always

[Install]
WantedBy=multi-user.target

Enable & start

sudo systemctl daemon-reload

sudo systemctl enable --now opencloud

sudo systemctl restart opencloud

sudo journalctl -f -u opencloud

Reverse proxy (Nginx)

sudo vim /etc/nginx/sites-available/drive.domain.com

server {
    listen 80;
    listen [::]:80;
    server_name drive.domain.com;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name drive.domain.com;
    
    ssl_certificate /etc/letsencrypt/live/drive.domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/drive.domain.com/privkey.pem; # managed by Certbot

    set $upstream http://127.0.0.1:7750;

    location / {
        proxy_buffers 4 256k;
        proxy_buffer_size 128k;
        proxy_busy_buffers_size 256k;

        # Disable checking of client request body size
        client_max_body_size 0;

        include /etc/nginx/snippets/proxy.conf;
        proxy_pass $upstream;
    }
}

sudo ln -s /etc/nginx/sites-available/drive.domain.com  /etc/nginx/sites-enabled

sudo nginx -t
sudo systemctl restart nginx.service 

Snippet config:

proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-URI $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;

SSO setup

[HOW-TO] Setup SSO (OIDC) with Authentik (web, desktop app, iOS app)

Notifications (Email)

Add to .env file

# EMAIL
# Define SMTP settings if you would like to send OpenCloud email notifications.
# SMTP host to connect to.
NOTIFICATIONS_SMTP_HOST=smtp.maileroo.com
# Port of the SMTP host to connect to.
NOTIFICATIONS_SMTP_PORT=587
# An eMail address that is used for sending OpenCloud notification eMails
# like "opencloud notifications <noreply@yourdomain.com>".
NOTIFICATIONS_SMTP_SENDER=drive@domain.com
# Username for the SMTP host to connect to.
NOTIFICATIONS_SMTP_USERNAME=drive@domain.com
# Password for the SMTP host to connect to.
NOTIFICATIONS_SMTP_PASSWORD=<password>
# Authentication method for the SMTP communication.
NOTIFICATIONS_SMTP_AUTHENTICATION=login
# Encryption method for the SMTP communication. Possible values are 'starttls', 'ssltls' and 'none'
NOTIFICATIONS_SMTP_ENCRYPTION=starttls
# Allow insecure connections to the SMTP server. Defaults to false.
NOTIFICATIONS_SMTP_INSECURE=false

# Addititional services to be started on opencloud startup
# The following list of services is not startet automatically and must be
# manually defined for startup:
# IMPORTANT: The notification service is MANDATORY, do not delete!
# IMPORTANT: Add any services to the startup list comma separated like "notifications,antivirus" etc.
OC_ADD_RUN_SERVICES="notifications"

Update

sudo systemctl stop opencloud

sudo wget -P /usr/local/bin https://github.com/opencloud-eu/opencloud/releases/download/v2.3.0/opencloud-2.3.0-linux-amd64

sudo chmod a+x /usr/local/bin/opencloud-2.3.0-linux-amd64

sudo rm /usr/local/bin/opencloud
sudo rm /usr/local/bin/opencloud-2.2.0-linux-amd64 

sudo ln -s -f /usr/local/bin/opencloud-2.3.0-linux-amd64 /usr/local/bin/opencloud

opencloud version --skip-services

sudo systemctl start opencloud

sudo systemctl status opencloud

[Narrat]

Sandboxing options could be used with the systemd unit:

ProtectProc=invisible
ReadWritePaths=/var/lib/opencloud
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
NoNewPrivileges=yes
SystemCallArchitectures=native

ProtectSystem=strict will cause problems. But didn't check with a less restrictive option.

[sanvila]

Hello. Thanks a lot for this HOWTO. I tried that and it almost worked. This is what I get:

opencloud[391525]: {"level":"error","service":"web","error":"listen tcp 127.0.0.1:9100: bind: address already in use","transport":"http","time":"2025-07-31T17:26:54Z","message":"Failed to start server"}
opencloud[391525]: {"level":"error","service":"web","error":"listen tcp 127.0.0.1:9100: bind: address already in use","transport":"http","server":"web","time":"2025-07-31T17:26:54Z","message":"Shutting down server"}

In my machine, port 9100 is already being used by prometheus-node-exporter, and I would much prefer not to change that. Is there a way to tell OpenCloud not to use port 9100? I would love to see OpenCloud packaged for Debian some day, and most probably the setup would be very similar to this (i.e. not docker or containers), so we would definitely need compatibility with prometheus-node-exporter out of the box.

Other than that, I would just use example.com instead of domain.com in the documentation, as recommended by RFC 2606.

Thanks.

Edit: There was also a warning from nginx: the "listen ... http2" directive is deprecated, use the "http2" directive instead. The warning disappears by writing this instead:

listen 443 ssl;
listen [::]:443 ssl;
http2 on;