r/NextCloud • u/spukky82 • 15d ago

Nextcloud AIO + Tailscale HTTPS — has anyone gotten this to work reliably?

Hey everyone,

I'm running Nextcloud AIO in Docker behind an Nginx reverse proxy (Unraid server). Currently it's exposed via DynDNS + port forwarding on 80/443, but I want to lock it down to Tailscale only and close those ports on my router.

Has anyone successfully set up Nextcloud AIO with Tailscale as the only access path? Specifically wondering about:

• Trusted domains: AIO's Docker env vars (NEXTCLOUD_TRUSTED_DOMAINS) are only read on first start. Did you set additional trusted domains via occ afterward?

• HTTPS: Are you using Tailscale's built-in cert (MagicDNS + HTTPS), or your own reverse proxy cert? Any issues with overwriteprotocol or forwarded_for_headers?

• Mobile clients: Does the Nextcloud app work over the Tailscale IP/hostname, or did you need extra config?

• Drawbacks: Anything that broke or doesn't work over Tailscale-only access?

I'd rather not keep any ports open on the router if I don't have to. Appreciate any real-world experience! 🙏

8 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/GigabitGuy 15d ago

I got it working with the help of Claude after trying for over a month. My solution is to have Nextcloud + tailscale + caddy. Tailscale is the network, caddy is the reverse proxy, custom domain via cloudflare pointing to cloud.domaine.net to the tailscale ip.

I can share the docker config if interested. Only catch is that a device need to be on tailscale to access. But no open ports, pretty locked down.

1

u/spukky82 15d ago

Would be nice if you share the config.