Architecting a Secure LLM Wiki with Nextcloud API, QOwnNotes, and Local Inference

by

Status

The integration pipeline connecting the Nextcloud REST API, local LLM orchestration, and the file system remains under active development. Subsequent technical revisions will document prompt optimizations and refined file persistence logic as the system matures.

Overview

This implementation defines a privacy-first pipeline for ingesting, synthesizing, and storing external information feeds. The system combines a local LLM runtime (Ollama) with an IDE-based orchestrator (Roo Code) to autonomously retrieve unread RSS feeds from the Nextcloud News API.

To maintain operational security, the pipeline abstracts API credentials into local environment variables. The orchestrator parses the JSON payload, synthesizes the content into structured Markdown, and writes it directly to a local QOwnNotes vault directory via native file system execution.

Infrastructure

Local Inference Engine Setup

Deploy Ollama locally to handle model execution. The system requires a high-context, instruction-tuned model capable of reliable JSON parsing and strict Markdown formatting.

Initialize the runtime and pull the target weights (e.g., glm4.7 or gemma4)

Orchestration Layer Configuration

The orchestration layer relies on Visual Studio Code and the Roo Code extension to manage API tool calling, context limits, and file system operations.

  1. Install Visual Studio Code.
  2. Install the Roo Code extension from the VS Code Marketplace.
  3. In the Roo Code settings panel, set the API Provider to Ollama.
  4. Bind the base URL to http://localhost:11434 and configure the Model ID to match the provisioned model.

Vault Integration & Context Management

The target destination for the synthesized data is a QOwnNotes vault. Because Roo Code possesses native file system manipulation capabilities (write_to_file), the QOwnNotes Model Context Protocol (MCP) server is not strictly required for this unidirectional RSS ingestion pipeline.

While an MCP server can be configured for deeper, bidirectional vault queries in a mature wiki architecture, standardizing the Roo Code workspace directory to match the QOwnNotes vault path is sufficient for the current phase of this ingestion workflow.

Secure Credential Management

The Nextcloud News app exposes a REST API for feed extraction. Standard user passwords must not be utilized for programmatic access, and credentials must not be hardcoded into the LLM context window.

  1. Navigate to the Nextcloud instance: Settings -> Personal -> Security.
  2. Locate the Devices & sessions section.
  3. Generate a new App Password (e.g., RooCode-NewsFetcher) and record the token.

Create a .env file in the root of the workspace to store the authentication variables securely. This prevents the orchestrator from leaking credentials into its operational logs.

# .env file configuration 
NC_USER="your_username" 
NC_APP_PASSWORD="your_generated_app_password" 
NC_URL="https://your-nextcloud.com"

Execution via Roo Code Orchestrator

With the credentials isolated and the toolchain configured, pass the orchestration prompt to Roo Code. The prompt instructs the system to read the environment variables, utilize standard shell execution for API retrieval, and execute a file-write operation to persist the output.

Input the following instruction set into the Roo Code interface:

I want you to synthesize my unread Nextcloud News into my QOwnNotes vault.

First, read my Nextcloud credentials ($NC_USER, $NC_APP_PASSWORD, and $NC_URL) from the .env file in the current workspace.

Use your execute_command tool to run a curl request to my Nextcloud News API. Source the .env variables in your command:

curl -u "$NC_USER:$NC_APP_PASSWORD" -H "Accept: application/json" "$NC_URL/index.php/apps/news/api/v1-2/items?type=3&getRead=false&batchSize=20"

Read the returned JSON output to see my unread articles.

Synthesize the articles into a well-structured Markdown summary document. Include [[Tags]] based on the topics.

Use your write_to_file tool to save this as News_Synthesis.md in the current workspace.

The orchestrator extracts the credentials, executes the network request, processes the JSON array of unread articles through the local LLM, and outputs a tagged, synthetic summary into the active QOwnNotes directory.