Nextcloud under Virtualmin for Associations: Setting Up Automatic Versioning, Trash Policies, and Audit-Proof Recovery of Deleted Files in a GDPR-Compliant Way

Why Nextcloud under Virtualmin Is Ideal for Associations

Associations often face the challenge of securely managing sensitive member data while complying with GDPR requirements. Nextcloud offers a flexible open-source solution that you can host under Virtualmin – a powerful server management tool. Virtualmin enables easy management of virtual servers, domains, and web hosting packages. Combined with Nextcloud, you get a privacy-compliant cloud platform that you fully control.

Before you start, you should choose a suitable server. If you don't have one yet, you can find DezHost virtual servers that are perfect for Nextcloud. Alternatively, you can use web hosting if you need fewer resources. For domain registration, we recommend DezHost Domains.

Step by Step: Installing Nextcloud under Virtualmin

Installing Nextcloud under Virtualmin is straightforward. Follow these steps:

• Set up Virtualmin: Install Virtualmin on a fresh server (e.g., Ubuntu 22.04). Use the official installation guide.
• Create a virtual server: In Virtualmin, create a new virtual server for your Nextcloud domain. Allocate sufficient storage and PHP resources.
• Database and PHP: Create a MySQL database and a database user. Ensure PHP 8.1 or higher is installed with the required modules (gd, zip, curl, mbstring, xml, intl).
• Download Nextcloud: Download the latest Nextcloud version and extract it to the web directory of your virtual server.
• Installation wizard: Open your domain in a browser and follow the wizard. Enter the database details and create an admin account.

After installation, you should set up regular backups – Virtualmin provides integrated functions for this.

Enable Automatic Versioning in Nextcloud

Versioning is a key feature for tracking file changes and reverting to earlier versions if needed. In Nextcloud, versioning is enabled by default. However, you can adjust the retention period:

• Default retention: Nextcloud stores versions for 180 days (adjustable).
• Configuration: Adjust the parameters in config.php, e.g., 'versions_retention_obligation' => 'auto, 30', to automatically delete versions after 30 days.
• Storage space: Note that versions require additional storage. Monitor storage usage regularly.

For associations, it is advisable to retain versioning for at least 90 days to ensure audit-proof traceability.

Configure Trash Policies

The trash bin in Nextcloud allows recovery of deleted files. By default, deleted files are retained for 30 days. You can adjust this period:

• Global settings: In the admin settings under "Trash bin", you can set the retention period (e.g., 60 days).
• Automatic deletion: Nextcloud permanently deletes files after the period expires. Ensure this is GDPR-compliant – document the deletion periods in your processing register.
• Custom policies: For individual user groups, you can define different periods if necessary.

For associations, we recommend a retention period of 60 to 90 days to cushion accidental deletion while maintaining data minimization.

Audit-Proof Recovery of Deleted Files

Audit-proof recovery means that deleted or modified files can be restored in a traceable manner. Nextcloud offers several mechanisms for this:

• Versions: Every change is saved as a new version. You can revert to an earlier version at any time.
• Trash bin: Deleted files remain in the trash bin and can be restored.
• Audit log: Enable the audit log to record all actions (who changed/deleted what and when?). This is often required for GDPR compliance.

To ensure audit-proof recovery, you should perform regular backups of the Nextcloud database and files. Virtualmin offers backup schedules that you can automate.

GDPR-Compliant Setup: Important Aspects

The GDPR requires the protection of personal data. When using Nextcloud for association data, consider the following points:

• Data processing: If you operate Nextcloud on your own server, you are the controller. For external hosting, you need a data processing agreement (DPA).
• Data minimization: Store only data that is necessary for the association's purpose.
• Deletion concept: Define clear deadlines for deleting data (e.g., after a member leaves).
• Encryption: Use Nextcloud's server-side encryption to protect data at rest.
• Access control: Set up roles and permissions so that only authorized persons have access.
• Logging: Enable the audit log and review it regularly.

Document all measures in a record of processing activities. If you have questions about the GDPR, you can consult a data protection officer.

Conclusion: Nextcloud under Virtualmin as a GDPR-Compliant Association Solution

With Nextcloud under Virtualmin, you create a powerful, privacy-compliant platform for your association. Through automatic versioning, customized trash policies, and the ability to perform audit-proof recovery, you meet GDPR requirements. Remember to perform regular backups and document the configuration. At DezHost, you'll find the right infrastructure – from virtual servers to web hosting and domains.