Nextcloud

​

Overview

​

Setup

1. Point the connector at your server: replace BASE_ADDRESS (https://nextcloud.example.com in the template) with your Nextcloud address, including the web root if Nextcloud does not run at the domain root (for example https://cloud.example.com or https://example.com/nextcloud), without a trailing slash. Keep this value as NEXTCLOUD_BASE_URL in your deployment notes. For plain HTTP on a plant LAN use http://... and set USE_SSL "false". The host name must be in the server’s trusted_domains.
2. Create a dedicated account for the broker, for example plant-bot, and give it a storage quota. Share the plant folders with it, or let it own them.
3. Log in as that account and create an app password under Personal settings > Security > Devices & sessions > Create new app password. Use the app password, never the login password: accounts with two-factor authentication refuse login passwords, and you can revoke an app password on its own.
4. Admin-only events (UsersList, GroupsList, GroupUsersList, AdminNotificationSend and the webhook events) need an app password of an administrator. Group sub-admins can list the users and groups they manage. Webhook listeners can also be delegated to a group through the Webhooks admin privilege.
5. Talk events need the Talk app, webhook events the Webhook listeners app (Nextcloud 30 and later, shipped but check that it is enabled), and activity events the Activity app.
6. Keep NEXTCLOUD_USER, NEXTCLOUD_APP_PASSWORD and the derived NEXTCLOUD_BASIC_AUTH (see below) in broker secrets and inject them with GET SECRET.

​

Authentication

{"basic_auth": "BASE64_OF_USER_COLON_APP_PASSWORD"}

​

Payloads

​

Uploading files

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "user": "plant-bot", "path": "Plant/Line2/2026-10-05-shift-A.json", "content": "{\"line\":\"2\",\"shift\":\"A\",\"oee\":0.87,\"scrap\":14,\"operator\":\"Jo\u00e3o\"}"}

DEFINE ACTION NextcloudShiftReportUpload
ON TOPIC "plant/line2/shift/report" DO
    SET "auth" WITH GET SECRET "NEXTCLOUD_BASIC_AUTH"
    SET "user" WITH GET SECRET "NEXTCLOUD_USER"
    SET "path" WITH GET JSON "path" IN PAYLOAD AS STRING
    SET "content" WITH GET JSON "content" IN PAYLOAD AS STRING
    PUBLISH TOPIC "storage/nextcloud/files/upload" WITH { "basic_auth": {auth}, "user": {user}, "path": {path}, "content": {content} }

​

Examples

{}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "user": "plant-bot", "path": "Plant/Line2/recipes/PX-200.json"}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "query": "path=/Plant&depth=2"}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "provider_id": "files", "query": "term=shift-A&limit=20"}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "body": {"path": "/Plant/Line2/2026-10-05-shift-A.json", "shareType": 3, "permissions": 1, "expireDate": "2026-10-31", "label": "Shift A report"}}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "file_id": "91", "body": {"actorType": "users", "verb": "comment", "message": "Batch 1005-A released by QA", "objectType": "files"}}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "user_id": "operator1", "body": {"subject": "Line 2: spindle temperature high", "message": "TT-201 92 C (limit 85 C) at 14:05"}}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "room_token": "abcd1234", "body": {"message": "Line 2: TT-201 92 C (limit 85 C)", "silent": false}}

DEFINE ACTION NextcloudAlarmToTalk
ON TOPIC "plant/line2/alarms" DO
    SET "auth" WITH GET SECRET "NEXTCLOUD_BASIC_AUTH"
    SET "text" WITH GET JSON "text" IN PAYLOAD AS STRING
    PUBLISH TOPIC "storage/nextcloud/talk/messages/send" WITH { "basic_auth": {auth}, "room_token": "abcd1234", "body": { "message": {text} } }

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "body": {"statusType": "dnd"}}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "body": {"message": "Line 2 in maintenance until 16:00", "clearAt": null}}

{"basic_auth": "<NEXTCLOUD_BASIC_AUTH>", "body": {"httpMethod": "POST", "uri": "https://broker.example.com/nextcloud/webhooks", "event": "OCP\\Files\\Events\\Node\\NodeCreatedEvent", "eventFilter": {"event.node.path": "/^\\/plant-bot\\/files\\/Plant\\//"}, "authMethod": "header", "authData": {"X-Webhook-Token": "<secret>"}}}

​

Events

​

Limits

• WebDAV PUT has no size limit of its own, but the web server and PHP limits apply (upload_max_filesize, post_max_size, proxy body size). Keep MQTT payloads small. Larger files need chunked uploads, which are not packaged.
• X-NC-WebDAV-Auto-Mkcol needs Nextcloud 32 or later. Admin notifications use the v3 API: subject up to 255 characters, message up to 4000. Talk messages are limited to 32000 characters.
• Nextcloud’s brute-force protection delays and then blocks (429) an IP address after repeated failed logins. In the local test it blocked the client after 11 wrong passwords.
• Shares can have an enforced maximum expiry and password policy (see CapabilitiesGet, files_sharing). A share that breaks the policy answers 400 or 403.
• FolderTreeGet lists folders only, and Search only matches names. File listings with sizes and dates need WebDAV PROPFIND, which is not a REST_API method.

​

Not packaged

• Delete events on purpose: files, folders, shares, notifications, Talk conversations and participants, status messages and webhook listeners.
• WebDAV methods that REST_API does not offer (it supports GET, POST, PUT, DELETE and PATCH): PROPFIND (folder listing and file properties), MKCOL (create folder; FileUpload creates parents instead), MOVE and COPY (rename, archive, copy), PROPPATCH (favorites, tags), REPORT and SEARCH (filtered listings, comment lists), and the MOVE-based trash and version restore.
• Chunked uploads (v2) and bulk upload, public share (/public.php) uploads, folder downloads as ZIP or TAR, previews and thumbnails.
• User and group administration (create, edit, disable, wipe), app passwords and login flow, app config, Talk calls, polls, bots and breakout rooms, calendar and contacts writes (CalDAV and CardDAV), Deck, Forms and Tables.
• The webhook receiver. A receiver would be a separate ENABLE_SERVER REST_API connector that checks the authData header.

​

Suggested branches