diff --git a/.woodpecker/nextcloud.yaml b/.woodpecker/nextcloud.yaml
new file mode 100644
index 0000000..537d112
--- /dev/null
+++ b/.woodpecker/nextcloud.yaml
@@ -0,0 +1,60 @@
+when:
+  - event: push
+  - event: cron
+    cron: daily
+
+# Manually set a workspace path, so we can use it literally, without using
+# ${CI_WORKSPACE}, when running kaniko, since using ${CI_WORKSPACE} doesn't work.
+# https://github.com/woodpecker-ci/woodpecker/issues/3982
+workspace:
+  path: src
+
+# Use matrix to set NEXTCLOUD_VERSION instead of setting the NEXTCLOUD_VERSION as
+# an environment variable in the build-images step, since string substitution
+# doesn't work for custom environment variables.
+# https://github.com/woodpecker-ci/woodpecker/issues/3983
+# Also because global environment variables aren't a thing.
+matrix:
+  NEXTCLOUD_VERSION:
+    - 28
+    - 29
+  IMAGE_NAME:
+    - git.hamburg.ccc.de/ccchh/oci-images/nextcloud
+
+steps:
+  - name: setup-image-path
+    image: docker.io/library/alpine
+    commands:
+      - mkdir /woodpecker/images
+
+  - name: build-image
+    image: gcr.io/kaniko-project/executor
+    entrypoint:
+      - /kaniko/executor
+      - --context=dir:///woodpecker/src/nextcloud
+      - --dockerfile=./Containerfile
+      - --build-arg=TAG=${NEXTCLOUD_VERSION}
+      - --destination=${IMAGE_NAME}:${NEXTCLOUD_VERSION}
+      - --no-push
+      - --tar-path=/woodpecker/images/nextcloud.tar
+
+  - name: publish-image
+    image: docker.io/library/alpine
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane push /woodpecker/images/keycloak.tar $IMAGE_NAME:$CI_COMMIT_BRANCH
+
+  - name: tag-version-and-latest
+    image: docker.io/library/alpine
+    when:
+      - branch: main
+    secrets:
+      - GIT_API_TOKEN
+    commands:
+      - apk -u add crane
+      - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
+      - crane tag $IMAGE_NAME:$CI_COMMIT_BRANCH $NEXTCLOUD_VERSION
+      - crane tag $IMAGE_NAME:$CI_COMMIT_BRANCH latest
diff --git a/nextcloud/Containerfile b/nextcloud/Containerfile
new file mode 100644
index 0000000..79741b0
--- /dev/null
+++ b/nextcloud/Containerfile
@@ -0,0 +1,13 @@
+ARG TAG=latest
+FROM docker.io/library/nextcloud:${TAG}
+
+RUN apt-get update && apt-get install -y \
+    supervisor \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir /var/log/supervisord /var/run/supervisord
+
+ADD supervisord.conf /supervisord.conf
+
+ENV NEXTCLOUD_UPDATE=1
+
+CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
\ No newline at end of file
diff --git a/nextcloud/supervisord.conf b/nextcloud/supervisord.conf
new file mode 100644
index 0000000..836a08a
--- /dev/null
+++ b/nextcloud/supervisord.conf
@@ -0,0 +1,22 @@
+[supervisord]
+nodaemon=true
+logfile=/var/log/supervisord/supervisord.log
+pidfile=/var/run/supervisord/supervisord.pid
+childlogdir=/var/log/supervisord/
+logfile_maxbytes=50MB                           ; maximum size of logfile before rotation
+logfile_backups=10                              ; number of backed up logfiles
+loglevel=error
+
+[program:apache2]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=apache2-foreground
+
+[program:cron]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+command=/cron.sh