diff --git a/bundles/nextcloud/files/config.php b/bundles/nextcloud/files/config.php
index 6ac32fa..4eb45be 100644
--- a/bundles/nextcloud/files/config.php
+++ b/bundles/nextcloud/files/config.php
@@ -1,5 +1,7 @@
 <?php
 $CONFIG = array (
+  'instanceid' => '${instance_id}',
+% if not setup:
   'passwordsalt' => 'jySy/iELFRob7rRpecEXAI2Rn1gbNI',
   'secret' => 'wj3r+B2/NS8X/ETWCTnwwrNy+dyy2OSWRCVQxDE8+UZBJrRd',
   'trusted_domains' =>
@@ -8,14 +10,14 @@ $CONFIG = array (
   ),
   'datadirectory' => '/var/lib/nextcloud',
   'dbtype' => 'pgsql',
-  'version' => '21.0.2.1',
+  'version' => '${version}',
   'overwrite.cli.url' => 'http://localhost',
   'dbname' => 'nextcloud',
   'dbhost' => 'localhost',
   'dbport' => '',
   'dbtableprefix' => 'oc_',
   'dbuser' => 'nextcloud',
-  'dbpassword' => 'JQImkLIeaa38whvJ1lBj3UeMqNt0SH33',
-  'instanceid' => 'oc3wqc1kg39w',
+  'dbpassword' => '${db_password}',
   'installed' => true,
+% endif
 );
diff --git a/bundles/nextcloud/items.py b/bundles/nextcloud/items.py
index 0ed2e8c..f07717a 100644
--- a/bundles/nextcloud/items.py
+++ b/bundles/nextcloud/items.py
@@ -1,12 +1,16 @@
 assert node.has_bundle('php')
 
 from shlex import quote
+from os.path import join
+from mako.template import Template
 
 def occ(command, *args, **kwargs):
     return f"""sudo -u www-data php /opt/nextcloud/occ {command} {' '.join(args)} {' '.join(f'--{name.replace("_", "-")}' + (f'={value}' if value else '') for name, value in kwargs.items())}"""
 
 version = node.metadata.get('nextcloud/version')
 
+# FILES AND FOLDERS
+
 downloads[f'/tmp/nextcloud-{version}.tar.bz2'] = {
     'url': f'https://download.nextcloud.com/server/releases/nextcloud-{version}.tar.bz2',
     'sha256': node.metadata.get('nextcloud/sha256'),
@@ -49,28 +53,27 @@ actions['chown_/opt/nextcloud/config'] = {
     ],
 }
 
-files['/opt/nextcloud/config/config.php'] = {
-    'owner': 'www-data',
-    'group': 'www-data',
-    'mode': '0770',
-    'needs': [
-        'action:extract_nextcloud',
-    ],
-}
-
 directories[node.metadata.get('nextcloud/data_dir')] = {
     'owner': 'www-data',
     'group': 'www-data',
     'mode': '0770',
 }
 
-actions['set_nextcloud_uninstalled'] = {
-    'command': """sed -i "/installed/d" /opt/nextcloud/config/config.php""",
-    'triggered': True,
-    'needs': [
-        'file:/opt/nextcloud/config/config.php',
-    ],
-}
+# SETUP
+
+with open(join(repo.path, 'bundles', 'nextcloud', 'files', 'config.php')) as file:
+    content = Template(file.read()).render(
+        setup=True,
+        instance_id=node.metadata.get('nextcloud/instance_id'),
+    )
+    actions['nextcloud_config_for_install'] = {
+        'command': f'echo {quote(content)} > /opt/nextcloud/config/config.php && chown www-data:www-data /opt/nextcloud/config/config.php',
+        'needs': [
+            'action:extract_nextcloud',
+        ],
+        'triggered': True,
+    }
+
 actions['install_nextcloud'] = {
     'command': occ(
         'maintenance:install',
@@ -85,28 +88,46 @@ actions['install_nextcloud'] = {
         data_dir=node.metadata.get('nextcloud/data_dir'),
     ),
     'unless': """
-        psql -At -d nextcloud -c "SELECT 'OK' FROM information_schema.tables WHERE table_name='oc_users' AND table_schema='public'" | grep -q "^OK$"
+        psql -At -d nextcloud -c "SELECT 'OK' FROM information_schema.tables WHERE table_name='users' AND table_schema='public'" | grep -q "^OK$"
     """,
     'needs': [
+        'postgres_db:nextcloud',
         f"directory:{node.metadata.get('nextcloud/data_dir')}",
         'directory:/opt/nextcloud',
         'directory:/opt/nextcloud/config',
         'directory:/opt/nextcloud/apps',
-        'file:/opt/nextcloud/config/config.php',
         'action:chown_/opt/nextcloud/config',
         'action:chown_/opt/nextcloud/apps',
         'action:extract_nextcloud',
     ],
     'preceded_by': [
-        f'action:set_nextcloud_uninstalled',
+        'action:nextcloud_config_for_install',
     ],
 }
 
+files['/opt/nextcloud/config/config.php'] = {
+    'content_type': 'mako',
+    'context': {
+        'setup': False,
+        'version': version,
+        'instance_id': node.metadata.get('nextcloud/instance_id'),
+        'db_password': node.metadata.get('postgresql/roles/nextcloud/password'),
+    },
+    'owner': 'www-data',
+    'group': 'www-data',
+    'mode': '0770',
+    'needs': [
+        'action:install_nextcloud',
+    ],
+}
+
+# UPGRADE
+
 actions['upgrade_nextcloud'] = {
     'command': occ('upgrade'),
     'unless': occ('status') + ' | grep -q "installed: true"',
     'needs': [
-        'action:install_nextcloud',
+        'file:/opt/nextcloud/config/config.php',
     ],
 }
 
diff --git a/bundles/nextcloud/metadata.py b/bundles/nextcloud/metadata.py
index b7e2d22..5fcd0c8 100644
--- a/bundles/nextcloud/metadata.py
+++ b/bundles/nextcloud/metadata.py
@@ -28,6 +28,7 @@ defaults = {
         },
     },
     'nextcloud': {
+        'instance_id': 'oc3wqc1kg39w',
         'data_dir': '/var/lib/nextcloud',
         'admin_user': 'admin',
         'admin_pass': repo.vault.password_for(f'{node.name} nextcloud admin pw'),