Your own cloud storage and photo library, on NVMe you control.

Step 1: order, install Docker, point your DNS

Order the plan, pick Ubuntu 24.04, and log in over SSH once the server is up (30 to 60 seconds after payment). Install Docker with the script the Docker project publishes. Create A records for the names you will use, for example cloud.example.com, photos.example.com and vault.example.com, all pointing at the VPS IPv4.

apt update && apt upgrade -y
curl -fsSL https://get.docker.com | sh
ufw allow OpenSSH && ufw allow 80/tcp && ufw allow 443/tcp && ufw enable

Step 2: start Nextcloud AIO

AIO is one master container that installs the rest. The command is the one from the project README; check there for the current flags before you run it, as they change between releases. Then open port 8080 on the IP, set your domain, and let it fetch the certificate.

docker run --init --sig-proxy=false --name nextcloud-aio-mastercontainer 
  --restart always --publish 80:80 --publish 8080:8080 --publish 8443:8443 
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config 
  --volume /var/run/docker.sock:/var/run/docker.sock:ro 
  ghcr.io/nextcloud-releases/all-in-one:latest

AIO takes ports 80 and 443 for itself by default. If Immich and Vaultwarden go on the same VPS, either run AIO in its documented reverse proxy mode behind Caddy, or give Nextcloud its own S-4 and put the other two on a second server. The second option is simpler and is what we would do for a household.

Step 3: start Immich with docker compose

Immich ships a compose file and an example env file per release. Set UPLOAD_LOCATION to a folder on the NVMe disk and a real DB_PASSWORD before starting. The web UI listens on port 2283.

mkdir -p /opt/immich && cd /opt/immich
wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
nano .env
docker compose up -d

Step 4: add Vaultwarden

Vaultwarden is a single container with a data folder. Bind it to localhost only; Caddy will expose it over HTTPS. The DOMAIN variable must match the public URL or the apps refuse to log in.

# /opt/vaultwarden/docker-compose.yml
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8000:80"

Step 5: put Caddy in front for TLS

Install Caddy from the repository the Caddy project documents, then write a Caddyfile. Caddy requests and renews the certificates on its own. Immich needs a large body limit for video uploads; Caddy has no limit by default, nginx would need client_max_body_size.

# /etc/caddy/Caddyfile
photos.example.com {
    reverse_proxy 127.0.0.1:2283
}
vault.example.com {
    reverse_proxy 127.0.0.1:8000
}

systemctl reload caddy

Step 6: set up backups before you upload anything

Nextcloud AIO has a Borg backup built into its interface; point it at a folder and set a schedule. For Immich and Vaultwarden, stop the containers briefly, dump the Postgres database, and copy the data folders and the database dump off the server. Our backup add-on at 20-60% of the plan price adds server-level backups on our side on top of that. Test a restore once. A backup nobody has restored is a guess.

docker exec -t immich_postgres pg_dumpall -U postgres | gzip > /opt/backup/immich-db.sql.gz
tar czf /opt/backup/vaultwarden.tgz -C /opt/vaultwarden data