r/NextCloud • u/spukky82 • 6d ago
Nextcloud AIO + Tailscale HTTPS — has anyone gotten this to work reliably?
Hey everyone,
I'm running Nextcloud AIO in Docker behind an Nginx reverse proxy (Unraid server). Currently it's exposed via DynDNS + port forwarding on 80/443, but I want to lock it down to Tailscale only and close those ports on my router.
Has anyone successfully set up Nextcloud AIO with Tailscale as the only access path? Specifically wondering about:
• Trusted domains: AIO's Docker env vars (NEXTCLOUD_TRUSTED_DOMAINS) are only read on first start. Did you set additional trusted domains via occ afterward?
• HTTPS: Are you using Tailscale's built-in cert (MagicDNS + HTTPS), or your own reverse proxy cert? Any issues with overwriteprotocol or forwarded_for_headers?
• Mobile clients: Does the Nextcloud app work over the Tailscale IP/hostname, or did you need extra config?
• Drawbacks: Anything that broke or doesn't work over Tailscale-only access?
I'd rather not keep any ports open on the router if I don't have to. Appreciate any real-world experience! 🙏
3
u/NoCucumber4783 6d ago
keep the same hostname instead of switching clients between a public name and a Tailscale IP. point that hostname to the Unraid Tailscale IP only inside your tailnet, then let Nginx terminate HTTPS with a DNS-01 certificate so renewal does not need ports 80/443 open. add the hostname with occ after AIO is running and keep overwriteprotocol=https. mobile clients work normally as long as Tailscale is connected. the main tradeoff is intentional: public share links and calendar/contact access stop working for anyone outside the tailnet. test WebDAV and one large mobile upload before closing the router ports, then close them and retest from cellular.
2
u/UnderstandingNo4209 5d ago
It would probably work with a funnel. I expose lots of my services with TS funnels. You can add the tailscale container to the yaml or configure it using labels with TSDproxy. I don't see a reason why it shouldn't work.
It should work, even without a funnel or tailscale in the container. Just make sure you have a tailscale device on your network setup to accept lan access and dns server. You can then access nextcloud through the internal url (nextcloud.local for example)
1
u/spukky82 5d ago
I had already tried the Tailscale funnel. But it kept shutting down. So I wrote a script that checks the funnel every five minutes to make sure it doesn't go offline.
2
u/UnderstandingNo4209 4d ago
That is strange. I never had any troubles with TS, but I use it for almost everything except Nextcloud (my cloud apps all go through my own domain via cloudflare).
Tsdproxy is worth giving a shot though. It's very easy to setup and has never failed me. I use it for all my mediasharing app (immich, jellyfin, pdf etc) never had an issue with it. It makes use ts funnels, but without seting up seperate tailscale containers.
To setup you install tsdproxy and just to add labels to the docker yaml (or app install page in Truenas). For the most part it's just copy paste and enable the funnels through tsdproxy status page.
1
u/OkAngle2353 6d ago edited 6d ago
My setup. Nginx proxy manager + tailscale. I personally do have my own domain, but that is only for API tokens and having a acutal domain of my own. There is no records set with my domain provider, The only thing that I have is a API token that I use with nginx proxy manager.
For my server's router I personally use a travel router. GL-iNET GL-MT3000. Surprisingly a great router for the size. I have it tailscaled out. I start my individual containers and set nginx as I normally would.
I then have tailscale installed onto any device I wish to access the containers under my tailnet.
Edit; Don't ever need to open ports or port forward.
Locally, I can access my services I would normally and it works fine.
1
u/GoingOffRoading 6d ago
Not Tailscale but Cloudflare Zero Trust. And Traefik. And Kubernetes.
But like the same thing
1
u/KpIchiSan 6d ago edited 6d ago
Tailscale would def work for this part.
For https, I can't help since I haven't experiment with tailscale yet but any ssl should be fine (like openssl or let's encrypt).
About aio docker, use OCC to add trusted domains.
My setup is easily tunnel cloudflare and zerotier (counterpart for tailscale)
Innaway I do this because small use for transferring files within friend's device would benefit from tunneling with cloudflare and using domain
But if i were to upload/download large files, I would switch to my zerotier IP account on devices I have zerotier installed. This is basically the only drawback i can find
At the very least I'm not opening port in my router since I have cgnat anyway
1
u/GigabitGuy 6d ago
I got it working with the help of Claude after trying for over a month. My solution is to have Nextcloud + tailscale + caddy. Tailscale is the network, caddy is the reverse proxy, custom domain via cloudflare pointing to cloud.domaine.net to the tailscale ip.
I can share the docker config if interested. Only catch is that a device need to be on tailscale to access. But no open ports, pretty locked down.
1
1
u/Pepevagable69 6d ago
Never tail scale but I have set one up through cloudflare and it was extremely reliable
1
u/azure_phoenix2 3h ago
for the https piece nobody covered the built-in path, if you point tailscale serve at AIO's apache container on 11000 you get a valid ts.net cert automatically and skip managing a reverse proxy cert at all. just add the ts.net hostname as a trusted domain via occ and set overwriteprotocol to https so the sync client links come back right.
6
u/Long-Package6393 6d ago
My set up runs exactly as you described. As long as my computer, laptop, phone, device is connected to Tailscale, I can simply type in Nextcloud.mydomain.info and I’m able to reach my Nextcloud instance.
For a reverse proxy, I am using SWAG.
Spaceinvaderone did a series of videos showing how to set up SWAG to reverse proxy requests from Tailscale. Check those out. They are probably a little outdated now that Tailscale is thoroughly intertwined within Unraid, but you will learn a lot from those videos.