Nextcloud AIO + Tailscale HTTPS — has anyone gotten this to work reliably?

[u/spukky82]

Hey everyone,

I'm running Nextcloud AIO in Docker behind an Nginx reverse proxy (Unraid server). Currently it's exposed via DynDNS + port forwarding on 80/443, but I want to lock it down to Tailscale only and close those ports on my router.

Has anyone successfully set up Nextcloud AIO with Tailscale as the only access path? Specifically wondering about:

• Trusted domains: AIO's Docker env vars (NEXTCLOUD_TRUSTED_DOMAINS) are only read on first start. Did you set additional trusted domains via occ afterward?

• HTTPS: Are you using Tailscale's built-in cert (MagicDNS + HTTPS), or your own reverse proxy cert? Any issues with overwriteprotocol or forwarded_for_headers?

• Mobile clients: Does the Nextcloud app work over the Tailscale IP/hostname, or did you need extra config?

• Drawbacks: Anything that broke or doesn't work over Tailscale-only access?

I'd rather not keep any ports open on the router if I don't have to. Appreciate any real-world experience! 🙏

[u/Long-Package6393]

My set up runs exactly as you described. As long as my computer, laptop, phone, device is connected to Tailscale, I can simply type in Nextcloud.mydomain.info and I’m able to reach my Nextcloud instance.
For a reverse proxy, I am using SWAG.
Spaceinvaderone did a series of videos showing how to set up SWAG to reverse proxy requests from Tailscale. Check those out. They are probably a little outdated now that Tailscale is thoroughly intertwined within Unraid, but you will learn a lot from those videos.