How to add a Nextcloud trusted domain

Nextcloud trusted domains are a key security feature that helps protect your cloud data. When setting up trusted domains, it’s important to identify the primary domain and ensure that sub­do­mains and al­tern­at­ive domains are also accounted for. You can add Nextcloud trusted domains by either editing the config.php file or using the Nextcloud occ command.

What is a Nextcloud trusted domain?

Trusted domains in Nextcloud function as a whitelist for au­thor­ised domains, allowing them to access your Nextcloud server. This security feature is par­tic­u­larly effective against so-called host header attacks, where cy­ber­crim­in­als attempt to gain un­au­thor­ised access by ma­nip­u­lat­ing the HTTP header. By defining specific Nextcloud trusted domains, you ensure that your cloud server only accepts requests from these approved domains.

The trusted domains are stored in the Nextcloud config.php, which serves as the central con­fig­ur­a­tion file for the cloud software. By default, only the domain under which the in­stall­a­tion was made is listed as an au­thor­ised address. If the server needs to be ac­cess­ible via multiple domains or sub­do­mains, you will need to manually add the ad­di­tion­al domains as trusted domains in Nextcloud.

What to consider when selecting a Nextcloud trusted domain

Before adding Nextcloud trusted domains, de­term­in­ing the primary domain is ab­so­lutely essential. This is the main domain where your Nextcloud instance can be accessed. Usually, the domain defined during in­stall­a­tion serves as the central access point. You should also consider all sub­do­mains and al­tern­at­ive domains used for specific Nextcloud features, such as sub­do­mains for col­lab­or­at­ive work­spaces or file sharing. It’s also vital that you have full control over the domains you want to add as Nextcloud trusted domains, or at least access to DNS man­age­ment. This ensures that the DNS records for the domains are properly con­figured. For example, A-records link the domain to the correct IP address, while CNAME records allow you to create al­tern­at­ive domain names.

How to add Nextcloud trusted domains via config.php

If you want to add a Nextcloud trusted domain, you can easily adjust the basic Nextcloud con­fig­ur­a­tion to include it. The following step-by-step guide shows you how to add Nextcloud trusted domains in the config.php file.

Step 1: Log in to your Nextcloud server

Start by logging into your server through your Nextcloud client as an ad­min­is­trat­or. If the server’s IP address is, for example, “192.168.0.29” and your login name is “ad­min­is­tra­tion”, use the following command:

ssh administration@192.168.0.29

Step 2: Open config.php file

The con­fig­ur­a­tion file config.php is typically located in the in­stall­a­tion directory /var/www/nextcloud/config/config.php and can be edited with any text editor, such as nano, Vim, or Emacs. For instance, if you are using nano, you can open the file with the following command:

sudo nano /var/www/html/nextcloud/config/config.php

Step 3: Modify con­fig­ur­a­tion file

Within the config.php file, there is a section for trusted domains, which includes all au­thor­ised domains. The initial con­fig­ur­a­tion might look something like this:

'trusted_domains' => 
    array (
        0 => '192.168.0.29',
    ),

In this example, only the IP address “192.168.0.29” is allowed to access the server. To add a trusted domain, you simply need to extend the index by adding an IP address or domain name as a value:

0 => '192.168.0.29',
        1 => 'example.com',
    ),

Step 4: Set up for­ward­ing

If your Nextcloud instance is ac­cess­ible via different URLs or you are operating behind a proxy server, you might need to configure the overwrite.cli.url option. This setting ensures that Nextcloud uses the correct base URL, par­tic­u­larly for internal redirects and links in no­ti­fic­a­tions:

'overwrite.cli.url' => 'https://example.com',

Step 5: Save Changes

Once you’ve entered all the trusted domains, you just need to save the changes. To do this, press [Ctrl] + [X], then [y] for “Yes”, and finally hit Enter.

You might also need to restart the web server for the changes to take effect. If you’re using Apache, run the following command:

sudo systemctl restart apache2

If you’re using NGINX as your web server, the command is:

sudo systemctl restart nginx

How to add Nextcloud trusted domains using the occ tool

You can also use the occ command-line tool to add trusted domains. The ap­plic­a­tion may need to be installed first, but it can be activated quickly and easily through the built-in App Store, just like with other Nextcloud apps. After that, use the following command to add the au­thor­ised domain:

occ config:system:set trusted_domains 2 --value=<insert domain here>

The number you enter will depend on how many entries already exist. The “2” in this example means that “0” and “1” are already used for other trusted domains.

To make sure the changes are applied, restart the Nextcloud server:

sudo systemctl restart apache2

Or, if using NGINX:

sudo systemctl restart nginx