homelab-configs/nextcloud-to-ocis-migration-plan.md

# Nextcloud → ownCloud Infinite Scale (OCIS) Migration

**Date:** 2026-06-09  
**Status:** 🟡 Migration in progress — data transfer running, cutover pending  
**Author:** Joe Gitta

---

## What Was Done (Summary)

VM 114 (`ocis`, 192.168.88.63) was created on Proxmox and OCIS v8.0.4 was deployed as a native binary (systemd service). Both Nextcloud users (`jgitta` 89 GB / `cgitta` 210 GB) were recreated in OCIS and rclone migrations launched. Prometheus monitoring was added. Nextcloud (VM 103) remains running — no cutover yet.

---

## Deployed Architecture

```
Internet / LAN
     │
     ▼
Caddy (192.168.88.110)
     │
     ├── next.jgitta.com   → VM 103 (Nextcloud, 192.168.88.62)  ← still running
     │
     └── cloud.jgitta.com  → VM 114 (OCIS, 192.168.88.63:9200)
                                  │
                                  └── Local SSD: /mnt/ocis-data (500 GB, Proxmox SSD-2)
```

---

## VM 114 (ocis) Specs

| Item | Value |
|---|---|
| VM ID | 114 |
| VM Name | ocis |
| IP | 192.168.88.63 |
| SSH | `ssh jgitta@192.168.88.63` |
| vCPU | 4 cores |
| RAM | 8 GB |
| OS Disk | 64 GB (local SSD) |
| Data Disk | 500 GB SSD (Proxmox SSD-2) → `/mnt/ocis-data` |
| OS | Debian 13 (cloned from VM 9000 template) |
| OCIS Version | 8.0.4 |
| Binary | `/usr/local/bin/ocis` |
| Service | `systemctl {start|stop|restart|status} ocis` |
| Config | `/mnt/ocis-data/config/ocis.yaml` (auto-generated on first run) |
| Env file | `/mnt/ocis-data/config/ocis.env` |
| Systemd unit | `/etc/systemd/system/ocis.service` |

**Note:** Local disk was chosen over TrueNAS NFS so that PBS full-VM backups capture both OS and data together, providing an extra layer of redundancy.

---

## OCIS Configuration

`/mnt/ocis-data/config/ocis.env`:
```
OCIS_URL=https://cloud.jgitta.com
OCIS_BASE_DATA_PATH=/mnt/ocis-data
OCIS_CONFIG_DIR=/mnt/ocis-data/config
PROXY_TLS=false
OCIS_LOG_LEVEL=info
OCIS_LOG_COLOR=false
PROXY_ENABLE_BASIC_AUTH=true
```

> **Why `PROXY_ENABLE_BASIC_AUTH=true`?** OCIS v8 disables basic auth by default (OIDC only). This flag re-enables it so that rclone WebDAV and desktop/mobile sync clients can authenticate with username + password.

---

## Accounts

See `ocis-credentials.md` for full credential details.

| Username | Display Name | Use |
|---|---|---|
| admin | Admin | Administration only |
| jgitta | Joe Gitta | Primary account |
| cgitta | Cynthia Gitta | Secondary account |

Accounts were created via direct LDAP manipulation (OCIS v8 has no CLI user-create tool). The libregraph LDAP sysuser (`uid=libregraph,ou=sysusers,o=libregraph-idm`) was used for write access; passwords set with `ldappasswd` over LDAPS on `127.0.0.1:9235`.

---

## Data Migration Status

rclone is copying files directly from Nextcloud's filesystem on VM 103 (avoiding WebDAV overhead) and pushing to OCIS via WebDAV. Both processes run as background jobs on VM 103.

```bash
# Monitor from Nextcloud VM (192.168.88.62):
sudo tail -f /tmp/rclone-jgitta.log
sudo tail -f /tmp/rclone-cgitta.log

# Check if still running:
ps aux | grep rclone | grep -v grep
```

| User | Source | Data | Status |
|---|---|---|---|
| jgitta | `/mnt/nextcloud-data/jgitta/files/` | ~35 GB | 🔄 In progress |
| cgitta | `/mnt/nextcloud-data/cgitta/files/` | ~210 GB | 🔄 In progress (ETA many hours) |

**Expected errors:** Some files show `Failed to copy: object not found` — these are files present in Nextcloud's database but missing from disk (DB/filesystem desync in Nextcloud). Non-fatal; rclone skips and continues.

### rclone Config on VM 103

`/root/.config/rclone/rclone.conf` contains two WebDAV remotes:
- `ocis_jgitta` → `https://cloud.jgitta.com/remote.php/dav/files/jgitta/`
- `ocis_cgitta` → `https://cloud.jgitta.com/remote.php/dav/files/cgitta/`

### Re-run Migration (if needed)

```bash
# SSH to Nextcloud VM
ssh jgitta@192.168.88.62

# Re-run jgitta (rclone copy is idempotent — safe to re-run)
sudo nohup rclone copy /mnt/nextcloud-data/jgitta/files/ ocis_jgitta: \
  --transfers 4 --checkers 8 \
  --log-file /tmp/rclone-jgitta.log --log-level INFO --stats 120s &

# Re-run cgitta
sudo nohup rclone copy /mnt/nextcloud-data/cgitta/files/ ocis_cgitta: \
  --transfers 4 --checkers 8 \
  --log-file /tmp/rclone-cgitta.log --log-level INFO --stats 120s &
```

---

## Caddy Config

Added to `/etc/caddy/sites/media.caddy` on Caddy VM (192.168.88.110):

```caddy
cloud.jgitta.com {
    import web_secure
    reverse_proxy 192.168.88.63:9200 {
        import proxy_timeouts
    }
}
```

---

## Monitoring

- **node-exporter** running on OCIS VM as Docker container, port **9101** (port 9100 is taken by OCIS itself)
- **Prometheus** on siklos scrapes `192.168.88.63:9101`, labeled as instance `ocis`
- PBS backup job `backup-5d4b43bd-7988` uses `all=1` — VM 114 is automatically included, no changes needed

---

## Pending Steps (Manual)

### 1. Add Cloudflare DNS record ⚠️ REQUIRED for external access

Log into Cloudflare dashboard → jgitta.com DNS zone → Add A record:
- **Name:** `cloud`
- **Content:** your WAN IP
- **Proxy:** Grey cloud (DNS only)

Internal access via `cloud.jgitta.com` works already (MikroTik wildcard → Caddy).

### 2. Verify files after migration completes

Once rclone logs show completion:
1. Log into https://cloud.jgitta.com as `jgitta` and `cgitta`
2. Spot-check files in the web UI — confirm folder structure looks right
3. Check error count in logs: `sudo grep ERROR /tmp/rclone-jgitta.log | wc -l`

### 3. Change default passwords

Log into https://cloud.jgitta.com and change passwords for both accounts (see `ocis-credentials.md` for current values).

### 4. Reconnect desktop/mobile sync clients

- Desktop: Add account pointing to `https://cloud.jgitta.com` in ownCloud or Nextcloud desktop client
- Mobile: Add account in ownCloud app (iOS/Android) — same URL

### 5. OnlyOffice integration (optional, can defer)

OCIS uses WOPI for document editing. The existing OnlyOffice at `https://office.jgitta.com` supports WOPI.  
In OCIS Admin Settings → Apps, configure the WOPI server URL.

---

## Cutover Procedure (when ready)

Once files are verified and clients reconnected:

1. **Enable Nextcloud maintenance mode** (prevents new uploads):
   ```bash
   ssh jgitta@192.168.88.62
   sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --on
   ```

2. **Run a final rclone sync** to catch any files changed since the initial copy:
   ```bash
   sudo rclone copy /mnt/nextcloud-data/jgitta/files/ ocis_jgitta: --transfers 4 --stats-log-level NOTICE
   sudo rclone copy /mnt/nextcloud-data/cgitta/files/ ocis_cgitta: --transfers 4 --stats-log-level NOTICE
   ```

3. **Redirect Caddy** — update `next.jgitta.com` in Caddy to redirect to OCIS:
   ```caddy
   next.jgitta.com {
       redir https://cloud.jgitta.com{uri} permanent
   }
   ```

4. **Stop VM 103** in Proxmox — do NOT delete it yet

5. **After 4 weeks with no issues** — delete VM 103

---

## Service Management Quick Reference

```bash
# OCIS status / logs
ssh jgitta@192.168.88.63 "sudo systemctl status ocis"
ssh jgitta@192.168.88.63 "sudo journalctl -u ocis -f"

# Restart OCIS
ssh jgitta@192.168.88.63 "sudo systemctl restart ocis"

# Check migration logs (run on Nextcloud VM)
ssh jgitta@192.168.88.62 "sudo tail -50 /tmp/rclone-jgitta.log"
ssh jgitta@192.168.88.62 "sudo tail -50 /tmp/rclone-cgitta.log"

# Check OCIS disk usage
ssh jgitta@192.168.88.63 "df -h /mnt/ocis-data"
```

---

## Checklist

- [x] VM 114 created on Proxmox (Debian 13, 4 vCPU, 8 GB RAM)
- [x] Static IP 192.168.88.63 configured
- [x] 500 GB data disk partitioned and mounted at `/mnt/ocis-data`
- [x] OCIS v8.0.4 binary installed at `/usr/local/bin/ocis`
- [x] OCIS systemd service configured and running
- [x] `cloud.jgitta.com` added to Caddy config and reloaded
- [x] OCIS users created: `admin`, `jgitta`, `cgitta`
- [x] rclone configured on VM 103 with both user remotes
- [x] Data migration launched (background, running)
- [x] node-exporter deployed on VM 114 (port 9101)
- [x] Prometheus scraping VM 114 confirmed (`up`)
- [x] PBS backup covers VM 114 automatically (`all=1`)
- [ ] **Cloudflare DNS A record for `cloud`** ← add manually
- [ ] Verify files in OCIS web UI after migration completes
- [ ] Change passwords from defaults
- [ ] Reconnect desktop/mobile sync clients
- [ ] OnlyOffice WOPI integration (optional)
- [ ] Final sync + enable Nextcloud maintenance mode
- [ ] Redirect `next.jgitta.com` → `cloud.jgitta.com` in Caddy
- [ ] Stop VM 103
- [ ] Delete VM 103 (after 4-week verification)