This guide configures Nextcloud Full Text Search (FTS) to use Elasticsearch over the Cloudron-internal app network.
The Elasticsearch REST API is not public. The public app URL exposes only a minimal health endpoint; Nextcloud connects directly to Elasticsearch on internal port 9200.
1. Install Elasticsearch from the community catalog
In Cloudron, open:
App Store → Settings → Community Apps
Add this catalog URL:
https://git.due.ren/andreas/elasticsearch-cloudron/-/raw/main/CloudronVersions.json
Or install through the Cloudron CLI:
cloudron install \
--versions-url https://git.due.ren/andreas/elasticsearch-cloudron/-/raw/main/CloudronVersions.json \
--location elasticsearch.example.com
Installing from this catalog makes the app community-tracked, allowing Cloudron to discover later package releases through its normal update mechanism.
Allocate at least 4 GB RAM where possible. The package sizes Elasticsearch's JVM heap from the app memory limit.
2. Obtain the internal Elasticsearch address and credential
Open the Elasticsearch app's Web Terminal and run:
hostname
cat /app/data/credentials.txt
hostname prints the Cloudron app ID. This is the internal hostname that other Cloudron apps can resolve for the lifetime of this installed app.
Use the app-ID hostname, not the container IP. Container IP addresses are not a supported configuration value and can change.
The internal Elasticsearch endpoint is:
http://<APP_ID_HOSTNAME>:9200
For example:
http://210f8b84-f417-4697-80b7-efefd18e7329:9200
The generated password is also available at:
/app/data/secrets/elastic_password
Treat it as a secret. A Cloudron app that has both this password and the internal hostname can query Elasticsearch.
Important: If the Elasticsearch app is removed and installed again, it receives a new app ID. Update the Nextcloud elastic_host configuration after such a migration.
3. Enable the Nextcloud FTS apps
Open the Nextcloud app's Web Terminal and run:
sudo -u www-data php /app/code/occ app:enable fulltextsearch
sudo -u www-data php /app/code/occ app:enable fulltextsearch_elasticsearch
sudo -u www-data php /app/code/occ app:enable files_fulltextsearch
4. Configure Nextcloud
Set the FTS platform and the index name:
sudo -u www-data php /app/code/occ config:app:set \
fulltextsearch app_navigation --value "1"
sudo -u www-data php /app/code/occ config:app:set \
fulltextsearch search_platform \
--value "OCA\\FullTextSearch_Elasticsearch\\Platform\\ElasticSearchPlatform"
sudo -u www-data php /app/code/occ config:app:set \
fulltextsearch_elasticsearch elastic_index --value "nextcloud"
Set the Elasticsearch connection. The password must be URL-encoded if it contains URL-reserved characters such as @, :, /, ?, #, or %.
sudo -u www-data php /app/code/occ config:app:set \
fulltextsearch_elasticsearch elastic_host \
--value "http://elastic:URL_ENCODED_PASSWORD@APP_ID_HOSTNAME:9200"
Replace:
URL_ENCODED_PASSWORD with the generated Elasticsearch password, URL-encoded where necessary.APP_ID_HOSTNAME with the value returned by hostname in the Elasticsearch app.
Example shape:
http://elastic:REDACTED@210f8b84-f417-4697-80b7-efefd18e7329:9200
5. Test and build the index
sudo -u www-data php /app/code/occ fulltextsearch:test
sudo -u www-data php /app/code/occ fulltextsearch:index
The first indexing run can take time, depending on the number and size of files.
Elasticsearch's built-in german analyzer is available. No separate ICU plugin is required for the standard German analyzer.
6. Verify Elasticsearch and the public boundary
Inside the Elasticsearch app:
curl -u elastic:$(cat /app/data/secrets/elastic_password) \
http://localhost:9200/_cat/indices?v
You should see the nextcloud index after indexing.
From outside the Cloudron, verify that Elasticsearch API routes are not public:
curl -i https://elasticsearch.example.com/_cat/indices
Expected result:
HTTP 404
{"status":"not_found"}
The harmless public health endpoint should remain available:
curl -i https://elasticsearch.example.com/health
Expected result:
HTTP 200
{"status":"green","service":"elasticsearch-cloudron"}
Security and operational notes
- Elasticsearch REST runs on internal port
9200; it is not routed through the public Cloudron reverse proxy.
- The public Cloudron
httpPort serves only /health.
- The Elasticsearch transport port
9300 has no external Cloudron port mapping.
- HTTP CORS is disabled by default.
- Elasticsearch data persists in
/app/data; routine package updates do not normally require a re-index.
- Do not use container IP addresses in Nextcloud configuration.
