diff --git a/nextcloud/hooks/log_rotate-relation-joined b/nextcloud/hooks/log_rotate-relation-joined
new file mode 100755
index 0000000..3505480
--- /dev/null
+++ b/nextcloud/hooks/log_rotate-relation-joined
@@ -0,0 +1,76 @@
+#!/bin/bash
+
+## Should be executable N time in a row with same result.
+
+. lib/common
+
+set -e
+
+nextcloud_uid=$(docker_get_uid "$SERVICE_NAME" www-data) || {
+    echo "ERROR: failed to get uid for www-data"
+    exit 1
+}
+
+LOGS=/var/log/nextcloud
+mkdir -p "$SERVICE_DATASTORE/$LOGS"
+chown -R "$nextcloud_uid" "$SERVICE_DATASTORE/$LOGS"
+
+## check old location for log files
+OLDLOG="$SERVICE_DATASTORE/var/lib/nextcloud/data/nextcloud.log"
+if [ -s "$OLDLOG" ]; then
+    ## check we don't have a log file already
+    if [ -s "$SERVICE_DATASTORE/$LOGS/nextcloud.log" ]; then
+        err "Old log file found at $OLDLOG" \
+            "but new log file already exists at $SERVICE_DATASTORE/$LOGS/nextcloud.log"
+        exit 1
+    fi
+    info "Migrating old log file" \
+         "from $OLDLOG" \
+         "to $SERVICE_DATASTORE/$LOGS/nextcloud.log"
+    mv -v "$OLDLOG" "$SERVICE_DATASTORE/$LOGS/nextcloud.log" || {
+        err "Failed to move old log file"
+        exit 1
+    }
+fi
+
+
+rotated_count=$(relation-get rotated-count 2>/dev/null) || true
+rotated_count=${rotated_count:-52}
+
+
+## No postrotate script as nextcloud is a php script that gets
+## reloaded for each client requests
+
+## XXXvlab: a lot of this intelligence should be moved away into ``logrotate`` charm
+DST="$CONFIGSTORE/$TARGET_SERVICE_NAME/etc/logrotate.d/$SERVICE_NAME"
+file_put "$DST" <<EOF
+/var/log/docker/$SERVICE_NAME/nextcloud.log
+ {
+    weekly
+    missingok
+    dateext
+    dateyesterday
+    dateformat _%Y-%m-%d
+    extension .log
+    rotate $rotated_count
+    compress
+    delaycompress
+    notifempty
+    create 640
+    sharedscripts
+}
+EOF
+
+
+nextcloud:config:simple:add logfile "$LOGS/nextcloud.log"
+
+config-add "\
+services:
+  $MASTER_TARGET_SERVICE_NAME:
+    volumes:
+      - $DST:/etc/logrotate.d/docker-${SERVICE_NAME}:ro
+      - $SERVICE_DATASTORE$LOGS:/var/log/docker/$SERVICE_NAME:rw
+  $MASTER_BASE_SERVICE_NAME:
+    volumes:
+      - $SERVICE_DATASTORE$LOGS:$LOGS:rw
+"
diff --git a/nextcloud/lib/common b/nextcloud/lib/common
index 2f46317..158d7ed 100644
--- a/nextcloud/lib/common
+++ b/nextcloud/lib/common
@@ -107,7 +107,9 @@ create_occ_if_not_exists() {
         if ! out=$(
                 export COMPOSE_IGNORE_ORPHANS=true
                 read-0 LOGIN PASSWORD < "$PASSWORD_FILE" || exit 1
-                compose --debug --no-init --without-relation="$SERVICE_NAME":web-proxy run \
+                compose --debug --no-init --without-relation="$SERVICE_NAME":web-proxy \
+                        --without-relation="$SERVICE_NAME":log-rotate \
+                        run \
                         -v "$CHARM_PATH"/src/fake-apache:/usr/bin/apache \
                         -e NEXTCLOUD_DATA_DIR=/var/lib/nextcloud/data \
                         -e NEXTCLOUD_ADMIN_USER=$LOGIN \
@@ -139,8 +141,10 @@ occ() {
     ## using `occ` would make the call infinitively recursive.
     export COMPOSE_IGNORE_ORPHANS=true
     compose --debug -q --no-init --no-pre-deploy \
-            --without-relation="$SERVICE_NAME":web-proxy run \
-           "${occ_docker_run_opts[@]}" \
+            --without-relation="$SERVICE_NAME":web-proxy \
+            --without-relation="$SERVICE_NAME":log-rotate \
+            run \
+            "${occ_docker_run_opts[@]}" \
             -e NEXTCLOUD_DATA_DIR=/var/lib/nextcloud/data \
             -v "$HOST_CHARM_STORE/${CHARM_REL_PATH#${CHARM_STORE}/}/src/occ.batch:/var/www/html/occ.batch" \
             -T --rm -u www-data "$SERVICE_NAME" /var/www/html/occ.batch "$@" | cat
diff --git a/nextcloud/metadata.yml b/nextcloud/metadata.yml
index 620a292..44a165a 100644
--- a/nextcloud/metadata.yml
+++ b/nextcloud/metadata.yml
@@ -27,6 +27,14 @@ uses:
             Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
           </IfModule>
 
+  log-rotate:
+    #constraint: required | recommended | optional
+    #auto: pair | summon | none ## default: pair
+    constraint: recommended
+    auto: pair
+    solves:
+      unmanaged-logs: "in docker logs"
+    #default-options:
   backup:
     constraint: recommended
     auto: pair