Deploying the Nextcloud Talk AIO Recording Backend as a Standalone Container

This guide deploys the official Nextcloud AIO Talk Recording image as a standalone container. It complements an existing Nextcloud Talk High-Performance Backend and does not require a full Nextcloud AIO installation.

The recording backend joins Talk calls as a participant, captures the selected media, and uploads the result back to Nextcloud. It needs its own resources, storage for temporary recordings, and a secure internal connection to the matching signaling backend.

The deployment uses the pre-built image from the Nextcloud AIO project and follows the upstream Recording Backend installation documentation.

Changelog

1. Prerequisites

You need:

• A working Nextcloud Talk installation.
• A working Talk High-Performance Backend (HPB).
• Docker Engine and Docker Compose v2.
• A Traefik v3 reverse proxy on an external Docker network named proxy.
• A DNS name and TLS certificate for the recording endpoint, or a dedicated path below the existing signaling hostname.
• At least 2 GB of shared memory available to the recording container.

This guide is designed to follow Running the Nextcloud Talk AIO Container as a Standalone High-Performance Backend.

The following internal tutorials provide the surrounding infrastructure:

• Traefik v3 and CrowdSec with Docker Compose: A Modern Security Stack
• Debian Server Initial Setup

For Compose syntax, reverse-proxy behavior, and trusted-proxy settings, see the Docker Compose documentation, Traefik documentation, and Nextcloud reverse-proxy documentation.

2. Create the project directory and secrets

Create an isolated project directory:

sudo mkdir -p /opt/containers/nextcloud-aio-talk-recording
cd /opt/containers/nextcloud-aio-talk-recording
sudo chmod 700 .

Generate a new recording secret:

openssl rand -hex 32

The INTERNAL_SECRET is not a new value: it must be the same value used by the corresponding AIO Talk container. The recording backend uses it to authenticate to that signaling server.

Create .env and replace every placeholder:

sudo tee .env > /dev/null << 'EOF'
# The existing Nextcloud hostname, without https://
NC_DOMAIN=cloud.example.com

# The public hostname of the matching AIO Talk backend
HPB_DOMAIN=talk.example.com

# Leave empty for a dedicated hostname, or use a matching Traefik path prefix
HPB_PATH=

# Generate this specifically for the recording backend.
RECORDING_SECRET=REPLACE_WITH_A_RANDOM_64_HEX_CHARACTER_SECRET

# Copy this value from the matching AIO Talk container only.
INTERNAL_SECRET=REPLACE_WITH_THE_MATCHING_TALK_INTERNAL_SECRET
EOF

sudo chmod 600 .env

3. Create the Docker Compose file

The example below exposes the recorder through a dedicated hostname. It stores temporary recordings in a named Docker volume and gives the browser enough shared memory.

sudo tee docker-compose.yml > /dev/null << 'EOF'
services:
  recording:
    image: ghcr.io/nextcloud-releases/aio-talk-recording:latest
    container_name: nextcloud-aio-talk-recording
    user: "122"
    init: true
    restart: unless-stopped
    read_only: true
    shm_size: 2gb
    tmpfs:
      - /conf
    env_file:
      - .env
    environment:
      ALLOW_ALL: "false"
      SKIP_VERIFY: "false"
      NC_PROTOCOL: https
      HPB_PROTOCOL: https
      AIO_LOG_LEVEL: warn
      TZ: Europe/Vienna
    volumes:
      - recording-tmp:/tmp
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.nextcloud-aio-talk-recording.rule=Host(`recording.example.com`)"
      - "traefik.http.routers.nextcloud-aio-talk-recording.entrypoints=websecure"
      - "traefik.http.routers.nextcloud-aio-talk-recording.tls=true"
      - "traefik.http.routers.nextcloud-aio-talk-recording.middlewares=nextcloud-aio-talk-recording-headers@docker,crowdsec-bouncer@docker"
      - "traefik.http.middlewares.nextcloud-aio-talk-recording-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.services.nextcloud-aio-talk-recording.loadbalancer.server.port=1234"

volumes:
  recording-tmp:

networks:
  proxy:
    external: true
EOF

4. Start and verify the recorder

Pull and start the image:

cd /opt/containers/nextcloud-aio-talk-recording
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps

Wait until Docker reports a healthy container:

sudo docker inspect nextcloud-aio-talk-recording \
  | sed -n '/"Health": {/,/},/p'

Inspect logs when the health check does not become healthy:

sudo docker logs --tail 100 nextcloud-aio-talk-recording

The recorder must be able to resolve and reach both NC_DOMAIN and the signaling URL constructed from HPB_DOMAIN and HPB_PATH.

5. Configure the Recording Backend in Nextcloud Talk

In Nextcloud, open Administration settings → Talk and enter:

Save the settings and confirm that the Talk setup check reports a successful Recording Backend.

6. Make a real recording test

The health check proves that the container starts, but it cannot verify browser capture, TURN fallback, or upload permissions. Create a test room and:

1. Start an audio/video recording as a room moderator.
2. Let the call run briefly and stop the recording.
3. Confirm that the recording appears in the configured Nextcloud location and can be played.
4. Check the recorder logs while the recording is being processed.

sudo docker logs -f nextcloud-aio-talk-recording

7. Multiple independent Nextcloud instances

Use a separate recorder for every isolated AIO Talk container.

Do not point one recorder at two isolated AIO Talk containers. The internal signaling secret must match the one HPB that the recorder joins.

8. Maintenance and troubleshooting

Update the image during a maintenance window:

cd /opt/containers/nextcloud-aio-talk-recording
sudo docker compose pull
sudo docker compose up -d

Before updating, back up .env and docker-compose.yml. The temporary recording volume is cleared by the container at startup; failed or in-progress recordings should therefore be investigated before restarting it.

If recordings fail:

• Confirm that both the recorder and the matching Talk HPB are healthy.
• Confirm that INTERNAL_SECRET matches the matching AIO Talk container exactly.
• Confirm that RECORDING_SECRET matches the Talk administration setting exactly.
• Check available RAM, /dev/shm, disk capacity, and container logs.
• Verify that the recorder can reach Nextcloud and the Talk endpoint using valid TLS certificates.

For upstream configuration details, consult the official Nextcloud Talk Recording installation documentation.

Related tutorials

• Running the Nextcloud Talk AIO Container as a Standalone High-Performance Backend
• Traefik v3 and CrowdSec with Docker Compose: A Modern Security Stack
• Deploying the classic Nextcloud Talk High-Performance Backend with Docker — retained as an archive and migration reference.