Why project files and project work belong in one integrated design
Many teams track delivery in OpenProject but keep specifications, contracts and sign-offs in Nextcloud folders that sit outside the project record. The result is familiar: a work package marked accepted, a PDF approval that lives in someone's personal sync folder, and no way to show an auditor which version of a document the team relied on when a decision was made. OpenProject linked to Nextcloud is a practical pairing when you need documents tied to work packages under one identity layer, and the edition and deployment you choose decide how far that link goes. The integration itself is available in the free Community edition according to the OpenProject pricing page, but the features that make it governable at enterprise scale sit in the paid tiers.
A generic project tool setup usually treats attachments as a convenience and leaves access control to whatever the file store does. Here the design question is different: who may see a file, who may change it, and whether that permission follows the person who holds the work package. Before you commit, confirm three things with your vendor and in your own environment: whether OpenID Connect for Nextcloud is available in the edition you are pricing, how user accounts and groups will be provisioned into both systems, and whether removing a user from the directory removes their access to project folders on both sides. Those answers determine whether the pairing is a governed design or two systems that happen to share a browser tab.
The second decision is where the two platforms run. If they share one identity provider and one administrative boundary, access reviews can cover both at once. If they sit in separate trust zones, every link between them becomes a cross-boundary path you must document, monitor and test. Write down, per project, which folder is the system of record, who owns its retention, and which work packages are allowed to reference it. A short written standard for those rules will do more for audit readiness than any configuration option, and it gives your implementation partner a concrete scope to build against.
Which requirements shape the OpenProject and Nextcloud build
This table maps the requirements most likely to shape a project management and Nextcloud build to what each one means for architecture, licensing and evidence. Read each row as a decision point: the edition, upgrade cadence, identity design or retention rule you must settle before installation. The main takeaway is that the integration itself is free in Community, but identity, lifecycle support and records obligations drive the choice of edition and design.
| Requirement | What it means for the build | Evidence to gather or confirm |
|---|---|---|
| Nextcloud integration in the Community edition | The file link integration is in the free Community edition, so basic linking of work packages to Nextcloud folders does not require a paid tier. | Confirm the exact integration features in your OpenProject version and test them in a non-production instance. |
| OIDC and SCIM provisioning | OpenID Connect for Nextcloud Hub, SCIM provisioning and the openDesk integration sit in the Corporate plan, so identity automation may force an Enterprise choice. | Ask the vendor for a written edition matrix mapped to your identity requirements before scoping. |
| Nextcloud major-version upgrades | Nextcloud does not allow skipping major releases, so each upgrade path must step through one major version at a time with a backup before each step. Nextcloud 35 is supported until September 2027. | Keep a documented upgrade runbook, a tested backup and a dated support calendar for both platforms. |
| LDAP or SSO across both platforms | Nextcloud's LDAP app and its OpenID Connect and SAML backends must align with OpenProject's SSO and LDAP options, so one directory should drive access in both systems. | Confirm which identity provider is authoritative, how groups map to project roles and how deprovisioning is handled. |
| HIPAA transmission and audit controls | If project documents contain ePHI, 45 CFR 164.312(e)(1) requires protection of transmitted data and 164.312(b) requires audit controls recording activity in those systems. Encryption in transit and access logs for both platforms become design requirements. | Retain audit logs from OpenProject and Nextcloud, document TLS settings and confirm with counsel whether HIPAA applies to your documents. |
| SEC Rule 17a-4(b)(4) retention | If project files are business communications of a broker-dealer, the rule requires preservation for not less than three years. Retention policies in Nextcloud and deletion behavior in OpenProject must match that period. | Confirm with your compliance team whether project documents are records, and document the retention and legal hold approach. |
| AGPL-3.0 and GPL-3.0 licensing | Nextcloud is AGPL-3.0 and OpenProject is GPL-3.0. Modifications you distribute or expose over a network may carry source obligations, so custom plugins need a licensing review. | Have counsel review your modification and distribution plan, and keep a bill of materials with each component license. |
| Enterprise support and sovereign suite fit | Nextcloud Enterprise is priced per user with a 100-user minimum, and openDesk bundles OpenProject and Nextcloud under Kubernetes. Choosing this path changes operations skills and hosting. | Ask for a written support tier, response targets and the Kubernetes skills your team must hold. |
Which platforms fit a Nextcloud-linked project setup and why
Each option below pairs project tracking with Nextcloud files in a different way, from a single-host install to a full sovereign workplace. The right choice depends on how many users you have, whether you need single sign-on across both products, and how much of the stack your team can operate.
OpenProject Community and Enterprise
OpenProject is the project tool most directly tied to Nextcloud in this set, and its Nextcloud integration appears in the free Community edition. Confirm first which edition you need for single sign-on, because OpenID Connect for Nextcloud Hub, SCIM provisioning and the openDesk integration sit in the Corporate plan. The software is GPL-3.0. Check your target Linux distribution against the supported packaged installs and confirm PostgreSQL 16 or later with the required extensions before sizing the database.
Nextcloud Server and Enterprise tiers
Nextcloud Server is the file layer that holds project folders and linked documents. It is licensed under AGPL-3.0 and ships a new major version every four months, with each supported for one year. Because upgrades cannot skip major releases, plan a predictable upgrade cadence. Enterprise is sold in Standard, Premium and Ultimate tiers with a 100-user minimum, so small teams should confirm whether the community version meets their support and lifecycle needs.
openDesk as a bundled suite
openDesk is a Kubernetes-based workplace suite from ZenDiS that bundles Nextcloud for files and OpenProject for projects, with a shared identity layer. It fits organizations that want the integration built and tested together rather than assembled by hand. Confirm first that your platform team can run a CNCF-certified Kubernetes cluster at v1.33 or later, since openDesk is tested on kubespray clusters and not on OpenShift. ZenDiS recommends the Enterprise Edition for production.
Nextcloud All-in-One on one host
Nextcloud All-in-One is the official installation method and bundles caching, PostgreSQL, optional Nextcloud Office, Talk, BorgBackup-based backups, ClamAV and full-text search. It suits a single-host deployment where the file layer is the priority and projects are a smaller add-on. Confirm first whether OpenProject will run on the same host or separately, because the Enterprise connection features and sizing depend on that decision. Plan backups and restore tests before the first upgrade.
Plane as an alternative
Plane is an AGPL-3.0 project tool that some teams consider when they want a modern issue tracker. This page does not confirm a supported Nextcloud file link for Plane, so treat it as an alternative to evaluate, not a default. Confirm first whether Plane can link to Nextcloud documents natively or through an integration you would maintain. Also confirm which edition you need for single sign-on and directory sync, and whether your team needs a Plane edition for air-gapped use.
How the OpenProject to Nextcloud link works in practice
The link keeps the plan and the documents in separate systems. Work packages, status, owners and comments stay in OpenProject, while the files they depend on stay in a project folder in Nextcloud that OpenProject references through its Nextcloud integration. The file contents do not move into OpenProject, so Nextcloud remains the system of record for file versions, sharing and retention settings. Access is decided in two places. Nextcloud decides who can open, edit or share a file, based on folder sharing and group membership. OpenProject decides who can see the work package and any file references shown against it, based on project membership and role. A user who holds only one of those rights may see a link that Nextcloud refuses to open, or no link at all. Test that exact case in your version, because the behavior depends on how each side handles a missing right.
Single sign-on is what makes the two permission models workable for users. With OpenID Connect or SAML, one identity provider authenticates each person into both Nextcloud and OpenProject, so users do not manage a second password and disabling an account is a single action. Nextcloud documents OIDC and SAML user authentication backends, and its LDAP app lets directory users sign in with their directory credentials, as described in the Nextcloud LDAP documentation. On the OpenProject side, SAML and OIDC are listed among the Enterprise features, and the pricing page places OpenID Connect for Nextcloud Hub and SCIM provisioning in the Corporate plan. Signing in once does not grant access, though. Groups from the identity provider must map to Nextcloud groups and OpenProject roles, and a leaver's removal should reach both systems in the same cycle. Confirm that mapping and provisioning path before rollout.
Before you commit, confirm the link behavior in the exact versions you plan to run. Nextcloud 35 was released on 16 September 2026 and is supported until September 2027, and OpenProject 17.9.2 was published on 15 October 2026, so test against those releases or a later patch in your own environment. Ask the implementation partner to demonstrate five cases in staging: attaching an existing folder, creating a new one, a user with access to the work package but not the folder, a user with folder access but no project role, and a renamed or deleted file. Record what each system logs for each action, since audit evidence for file access may have to come from both. Also confirm that your chosen edition supports every connection you need, because the Community edition includes the Nextcloud integration while SSO and provisioning sit in higher tiers.
How sovereign, regulated and single-host deployments change the design
When the project work sits inside a wider sovereign workplace, openDesk is the deployment model most readers will meet. It is a Kubernetes-based suite provided by ZenDiS GmbH, and OpenProject and Nextcloud are two of its bundled components, each keeping its own license. Data residency is set by the cluster and the storage behind it, so the operations team must decide where the cluster, the object storage and the identity layer run before any application is installed. The stack expects more than a single application host, and the operations team carries the platform work that comes with that.
- Cluster prerequisites: The openDesk requirements call for a CNCF-certified Kubernetes cluster at v1.33 or later, an ingress controller, cert-manager, an RWO volume provisioner, Helm 3.17.3 or later below v4 and Helmfile 1.0.0 or later.
- Production services: The project expects external PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server.
- Upgrade sequencing: Major releases arrive once a year, minor releases monthly, and in-place upgrades between majors are not guaranteed, so the team should plan staged moves through intermediate versions.
- Support model: ZenDiS recommends openDesk Enterprise Edition for production, which adds SLA-backed support on the closed-source modules.
Confirm with the openDesk maintainers which Kubernetes distribution you will run, since the tested platform is kubespray and OpenShift is not covered.
A standalone pairing runs OpenProject and Nextcloud as separate applications on Linux servers you control, linked by SSO and the Nextcloud integration. Data residency is simpler to explain here because each application writes to hosts and databases in one data center or cloud account. The operations team owns the database layer, the reverse proxy and the upgrade calendar for both products, which is more work than a managed suite but gives direct control over every component.
- Operating system and database: Packaged OpenProject installs support Ubuntu 22.04, Debian 12, CentOS or RHEL 9.x and SUSE Linux Enterprise Server 15, and OpenProject officially supports PostgreSQL 16 or later, with the pg_trgm, btree_gist and unaccent extensions required.
- Sizing: The OpenProject sizing guide suggests 4 cores and 4 GB RAM for up to 200 users, with larger figures for bigger user bases, so confirm the tier that matches your headcount.
- Nextcloud requirements: Nextcloud 35 recommends MariaDB 11.8 or PostgreSQL 18 and PHP 8.5, served by Apache 2.4 or nginx with php-fpm.
- Upgrade order: Nextcloud does not allow skipping major releases, so each step must go one major version at a time with a backup before every upgrade.
- Identity: OpenProject Enterprise lists SAML and OIDC single sign-on, and Nextcloud documents OIDC, SAML and LDAP backends, so both must point at the same directory.
Verify the PostgreSQL extensions and the Nextcloud version matrix in the vendor documentation before you build the database hosts.
Nextcloud All-in-One is the official installation method for a single host, and it bundles PostgreSQL, Redis and APCu caching, optional Nextcloud Office, Talk, BorgBackup-based backups, ClamAV and full-text search. For a small team that wants files and a sync layer on one machine, it reduces the number of moving parts the operations team must maintain. The trade-off is that a single host concentrates risk, so backup location, restore testing and host hardening carry more weight than in a distributed design.
- Bundled services: Most supporting services arrive in one deployment, so the team manages fewer separate databases and caches than in a standalone pairing.
- Backup design: BorgBackup is included, but the backup target must sit in a separate location to protect against loss of the host itself.
- Project integration: The OpenProject Nextcloud integration is available in the free Community edition, so the link between work packages and folders does not require a paid tier.
- Upgrade cadence: Nextcloud publishes a major version every four months, so the team needs a calendar that keeps the host within a supported release.
- Scale limit: A single host suits a bounded user base, so confirm capacity with the vendor before you commit to this layout for a larger organization.
Ask the implementation partner how restore is tested and how the host is hardened, because a backup that has never been restored is not evidence of recovery.
How the rollout moves from pilot folders to production
The sequence moves the OpenProject and Nextcloud link from discovery to a tested configuration, a single pilot project folder and a production cutover, with each phase closing on a written output. Durations are set in the written scope agreed before work starts.
Map document flows and identity sources
DeployOpen works with your project managers, records owners and directory administrators to list which project types depend on which documents, where those files live today, and which identity source (Active Directory, LDAP, or an external identity provider) should govern users in both applications. The output is a written inventory of project folders, file ownership, and user groups, with the gaps you need to decide on. The step is done when your project sponsors have signed off the inventory and the identity source for each application is confirmed.
Decide edition and deployment model
Using the inventory, you choose the OpenProject edition and the Nextcloud deployment model. Confirm with OpenProject which features your single sign-on, directory sync and provisioning requirements need, because several of them sit in Enterprise plans rather than the free Community edition. For Nextcloud, decide whether the Community edition or Nextcloud Enterprise fits your support needs. The output is a signed architecture decision record listing editions, hosting location, and the support model for each component.
Build and configure identity links in a test environment
DeployOpen installs OpenProject and Nextcloud in a non-production environment inside your own infrastructure, then configures single sign-on, directory group synchronization, and the OpenProject Nextcloud integration so that work packages can reference and link project folders. Test accounts cover each role, including users who should see a folder but not edit it. The step closes when test logins, group mappings, and file link permissions have been checked against the decision record and any gaps are logged as defects.
Run a pilot with one project folder
Select one active project with a real document dependency and a team willing to use it. DeployOpen configures a single project folder in Nextcloud, links it to the matching work packages, and supports the pilot team through the first sprint or planning cycle. Your team records what breaks, which permissions confuse users, and where the folder structure does not match how the work is done. The output is a pilot report with fixes applied and a go or no-go recommendation for production.
Cut over to production
After the pilot sign-off, DeployOpen moves the validated configuration into production, applies the agreed backup policy before the change, and migrates the pilot folder and links with their permissions. Remaining project folders are added in waves agreed in the written scope, so that each wave can be checked before the next starts. The step is done when production logins, folder links, and permission checks pass and your administrators have confirmed the cutover record.
Hand over with upgrade runbooks
DeployOpen documents the installation, configuration, backup and restore steps, and the upgrade procedure for both applications. Nextcloud requires one major version at a time, a backup before each upgrade, and third-party apps disabled until confirmed compatible, so the runbook captures these checks along with OpenProject's release process. Your operations team runs a rehearsal from the runbook. The handover is complete when your team has performed the rehearsal and the support scope, retainer options, and escalation contacts are agreed in writing.
Evidence auditors ask for from a linked project and file setup
This table maps the records an assessor typically asks for, such as document access logs, permission exports, backup and restore records, upgrade records and SSO configuration, to the component that produces each one. Use it to confirm where each record lives before a review starts. DeployOpen prepares this evidence, but independent auditors assess it and decide whether it is sufficient.
| Evidence | Produced by | What to confirm before an assessment |
|---|---|---|
| Document access logs | Nextcloud audit and server logs | Which events are logged, where logs are stored, and how long they are retained outside the server |
| Permission exports for project folders | Nextcloud share and group settings, plus OpenProject project roles | Whether folder access is granted through groups that match OpenProject project membership, and how an export is generated |
| Work package to file link history | OpenProject work package activity and file link records | Whether link changes are recorded with user and timestamp, and whether linked files are checked when a project closes |
| Identity provider and SSO configuration records | OpenProject OIDC or SAML settings, Nextcloud OpenID Connect or SAML backend | That both applications trust the same identity provider, with configuration kept under change control |
| Directory sync and user lifecycle records | Nextcloud LDAP app and OpenProject group synchronization (Enterprise features) | How leavers lose access in both applications, and whether removals are logged |
| Backup and restore records | Nextcloud backup tooling (such as BorgBackup in All-in-One) and the OpenProject database backup | Whether files and the database are backed up together, and whether a restore test has been documented with a date and result |
| Upgrade and patch records | Nextcloud maintenance releases, OpenProject release notes, and openDesk release notes where bundled | Current major version against each product's support window, and a record of pre-upgrade backups and third-party app checks |
| Malware scanning records | ClamAV integration, listed among OpenProject Corporate features and used in openDesk | Whether scan results are logged for uploaded files and where the scanner is deployed |
What do buyers ask before hiring a partner for this integration?
Is the OpenProject and Nextcloud integration free?
The Nextcloud integration is included in OpenProject's free Community edition, according to OpenProject's pricing page. The software license does not add a fee, but the work around it still costs money: installing and hosting both platforms, configuring the link between them, setting up project folders and permissions, and testing. Those items are either paid to your own staff, a hosting provider or an implementation partner, and they recur as the environment is patched and upgraded. Ask any partner to separate license cost from implementation, hosting and support in a written quote.
What does the OpenProject Enterprise edition add, and what does it cost per user?
OpenProject's pricing page lists single sign-on through SAML, OIDC, CAS, Kerberos and Okta, LDAP group synchronization and custom branding as Enterprise features. The Corporate plan also adds OpenID Connect for Nextcloud Hub, the openDesk and XWiki integrations, SCIM provisioning and ClamAV antivirus scanning. On premises, Enterprise is priced per named user per month: Basic at 5.95 euros, Professional at 10.95 euros with a 25-user minimum, Premium at 15.95 euros with a 100-user minimum, and Corporate on request for 250 or more users. Confirm the current figures on the pricing page before budgeting, because the edition you need depends on whether single sign-on and directory sync are mandatory.
How long does a Nextcloud and OpenProject rollout take?
Duration depends on scope, not on the tools alone. The main drivers are the number of users and projects, whether single sign-on and directory sync must be in place at launch, how many folder structures and permission rules need mapping, whether any historical data is migrated from Jira or another tool, and how many environments (test, staging, production) you require. Sizing also matters: OpenProject's sizing guide suggests 4 cores and 4 GB RAM for up to 200 users, and 16 cores and 16 GB for about 1,500 users. A partner should give a timeline only after a written scope, and it should list which of these drivers it has assumed.
What does our team need to provide for the integration project?
Expect to supply several named roles. An identity owner must confirm how users are sourced and whether your directory will be used for login. A Nextcloud administrator must approve the folder layout, sharing rules and retention expectations. A project lead must define which work packages depend on which documents, because that mapping is the reason the integration exists. Finally, someone must own the infrastructure, including the Linux hosts or Kubernetes cluster, databases, backups and DNS. Agree these responsibilities in the statement of work so that gaps do not surface during testing.
Can our own IT team build this integration in-house?
Often yes, when the team already runs Linux services, a reverse proxy, a relational database and an identity provider, and has time to read both administration manuals closely. The Nextcloud integration itself is a configuration task in OpenProject, but the surrounding work is not trivial: aligning single sign-on across both platforms, setting directory group rules, and testing permissions. Most teams underestimate the upgrade and testing discipline needed later. A hybrid model is common, where internal staff own operations and an implementation partner handles design, configuration and the first upgrade cycle. Whichever path you choose, document the decision and who will be on call.
How do we keep OpenProject and Nextcloud upgrades in step?
Treat each platform as its own release train and plan upgrades together. Nextcloud publishes a new major version every four months and supports each for one year, and Nextcloud does not allow skipping major releases, so administrators must upgrade one major version at a time, take a backup before each upgrade and disable third-party apps until they are confirmed compatible. OpenProject releases follow its own cadence, with 17.9.0 on September 30, 2026 and 17.9.2 on October 15, 2026 as recent examples. Ask a partner how it tests the integration against both versions in a staging environment before production, and who signs off each change.
Does the pairing fit an openDesk deployment?
It can. openDesk bundles Nextcloud for files and OpenProject for projects, and ZenDiS, the federally owned German company that took over development in January 2024, provides the Kubernetes-based suite. The Enterprise edition of openDesk is recommended for production and adds SLA-backed support, but it carries its own licensing and hosting decisions. openDesk requires a CNCF-certified Kubernetes cluster at v1.33 or later and does not list OpenShift as tested. Confirm with the vendor which components and versions your target release includes before you assume a single sign-on path between them.
What to ask an implementation partner before you sign
Start with edition. Ask the partner to list every OpenProject feature in your requirements that depends on the Corporate or Enterprise tier, and to confirm in writing which edition carries OpenID Connect for Nextcloud Hub, SCIM provisioning and the openDesk integration. Single sign-on is listed among OpenProject's Enterprise features, and the Community edition includes the Nextcloud integration but not the identity features that let one login cover both systems. Ask how group membership will flow from your directory into both products, and who maintains that mapping after go-live. Also ask how link permissions are tested: the partner should show test cases where a user with view-only access to a Nextcloud folder opens a linked work package, a user removed from a project loses access to the linked file, and a file restricted in Nextcloud cannot be reached through a work package link. Ask for the results as evidence, not a verbal assurance.
Next, pin down upgrade sequencing. Nextcloud does not allow skipping major releases, so the partner must state the path from your current version to the target, one major version at a time, with a backup taken before each step and third-party apps disabled until confirmed compatible. Ask which Nextcloud release line they will target and how that choice maps to the published support windows, since Nextcloud 35 is listed with end of life in September 2027. For openDesk, ask how the partner handles version pinning, because openDesk does not guarantee in-place upgrades between major releases and may require intermediate steps. Require a written statement of which component versions are pinned, who tests each upgrade in staging, and what rollback looks like if an OpenProject or Nextcloud upgrade breaks the link integration.
Finish with scope and evidence. Ask whether backups cover the OpenProject database, the Nextcloud data directory and configuration, and the link metadata that ties them together, and how a restore of both systems is tested to the same point in time. Ask what evidence is delivered at handover: configuration records, test results, the upgrade runbook and a restore test report. Be clear about what the partner does not provide. DeployOpen prepares evidence for compliance assessments but does not issue audit reports. Finally, ask what support is included after go-live, what response expectations are written into the contract, and whether a retainer covers upgrades and continuous testing, since these recur and are priced separately from the one-time build.
