diff --git a/services/nextcloud.nix b/services/nextcloud.nix
index 37f57e2..03cb183 100644
--- a/services/nextcloud.nix
+++ b/services/nextcloud.nix
@@ -14,13 +14,24 @@ let
 	post_max_size=5G
 	upload_max_filesize=5G
 	output_buffering=0
-	apc.enable_cli=1
 	redis.session.locking_enabled=1
 	redis.session.lock_retries=-1
 	redis.session.lock_wait_time=10000
+	apc.enable_cli=1
     '';
   };
-
+  occ = pkgs.writeScriptBin "nextcloud-occ" ''
+    #! ${pkgs.runtimeShell}
+    cd /var/www/nextcloud
+    sudo=exec
+    if [[ "$USER" != nextcloud ]]; then
+      sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR --preserve-env=OC_PASS'
+    fi
+    export NEXTCLOUD_CONFIG_DIR="/var/www/nextcloud/config"
+    $sudo \
+      ${myPhp}/bin/php \
+      occ "$@"
+  '';
 in
 {
 
@@ -30,8 +41,18 @@ in
         serverName = "cloud.stubbe.rocks";
         root = "/var/www/nextcloud/";
         extraConfig = ''
+	  index index.php index.html /index.php$request_uri;
+          add_header X-Content-Type-Options nosniff;
+          add_header X-XSS-Protection "1; mode=block";
+          add_header X-Robots-Tag none;
+          add_header X-Download-Options noopen;
+          add_header X-Permitted-Cross-Domain-Policies none;
+          add_header X-Frame-Options sameorigin;
+          add_header Referrer-Policy no-referrer;
+          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
           client_max_body_size 1024M;
           fastcgi_buffers 64 4K; 	
+	  fastcgi_hide_header X-Powered-By;
 	  gzip on;
 	  gzip_vary on;
 	  gzip_comp_level 4;
@@ -40,14 +61,6 @@ in
 	  gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
           error_page 403 /core/templates/403.php;
           error_page 404 /core/templates/404.php;
-	  add_header Strict-Transport-Security "max-age=31536000;includeSubDomains";
-	  add_header X-Content-Type-Options nosniff;
-	  add_header X-XSS-Protection "1; mode=block";
-	  add_header X-Robots-Tag none;
-	  add_header X-Download-Options noopen;
-	  add_header X-Permitted-Cross-Domain-Policies none;
-	  add_header Referrer-Policy no-referrer;
-	  add_header X-Frame-Options sameorigin;
 	  rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
           rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;		
         '';
@@ -74,12 +87,9 @@ in
               location = /.well-known/caldav {
                 return 301 $scheme://$host/remote.php/dav;
               }
-	      location = /.well-known/nodeinfo {
-                return 301 $scheme://$host/index.php/.well-known/nodeinfo;
-              }
-              location = /.well-known/webfinger {
-                return 301 $scheme://$host/index.php/.well-known/webfinger;
-              }
+              location ~ ^/\.well-known/(?!acme-challenge|pki-validation) {
+                return 301 $scheme://$host/index.php$request_uri;
+              }           
 
               try_files $uri $uri/ =404;
             '';
@@ -155,9 +165,7 @@ in
       };
   };
 
-    users.extraUsers.nextcloud.packages = [
-      myPhp
-    ];
+    environment.systemPackages = [ occ ];
 
     # Option I: PHP-FPM pool for Nextcloud
     services.phpfpm.pools.nextcloud = let
@@ -189,4 +197,18 @@ in
 services.cron.enable = true;
 services.redis.enable = true;
 
+systemd.timers.nextcloud-cron = {
+        wantedBy = [ "timers.target" ];
+        timerConfig.OnBootSec = "5m";
+        timerConfig.OnUnitActiveSec = "15m";
+        timerConfig.Unit = "nextcloud-cron.service";
+};
+
+systemd.services.nextcloud-cron = {
+	environment.NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config";
+        serviceConfig.Type = "oneshot";
+        serviceConfig.User = "nextcloud";
+        serviceConfig.ExecStart = "${myPhp}/bin/php --define apc.enable_cli=1 -f /var/www/nextcloud/cron.php";
+};
+
 }
diff --git a/users.nix b/users.nix
index 68d706f..c36f91b 100644
--- a/users.nix
+++ b/users.nix
@@ -18,7 +18,7 @@ in
         defaultUserShell = pkgs.zsh;
 	extraUsers.etherpad = myPublicSshKeys //  { isNormalUser = true;  home = "/home/etherpad";};
         extraUsers.sshuser = myPublicSshKeys //  { isNormalUser = true;  home = "/home/sshuser";};
-        extraUsers.nextcloud = myPublicSshKeys //  { isNormalUser = true;  home = "/home/nextcloud"; group = "nextcloud";};
+        extraUsers.nextcloud = myPublicSshKeys //  { isSystemUser = true;  home = "/home/nextcloud"; createHome= true; group = "nextcloud";};
         extraUsers.ledebuild = myPublicSshKeys //  { isNormalUser = true;  home = "/home/ledebuild"; extraGroups = [ "docker" ];};
 #        extraUsers.gitea = myPublicSshKeys //  { isNormalUser = true;  home = "/home/gitea"; };
         extraGroups.nexdcloud.name = "nextcloud";