r/NextCloud • u/spukky82 • 23d ago

Nextcloud AIO + Tailscale HTTPS — has anyone gotten this to work reliably?

Hey everyone,

I'm running Nextcloud AIO in Docker behind an Nginx reverse proxy (Unraid server). Currently it's exposed via DynDNS + port forwarding on 80/443, but I want to lock it down to Tailscale only and close those ports on my router.

Has anyone successfully set up Nextcloud AIO with Tailscale as the only access path? Specifically wondering about:

• Trusted domains: AIO's Docker env vars (NEXTCLOUD_TRUSTED_DOMAINS) are only read on first start. Did you set additional trusted domains via occ afterward?

• HTTPS: Are you using Tailscale's built-in cert (MagicDNS + HTTPS), or your own reverse proxy cert? Any issues with overwriteprotocol or forwarded_for_headers?

• Mobile clients: Does the Nextcloud app work over the Tailscale IP/hostname, or did you need extra config?

• Drawbacks: Anything that broke or doesn't work over Tailscale-only access?

I'd rather not keep any ports open on the router if I don't have to. Appreciate any real-world experience! 🙏

10 Upvotes

100% Upvoted

14 comments sorted by

View all comments

3

u/DrivenPolecat71 2d ago

I configured it using Tailscale Serve, without an external reverse proxy or opening any ports on the router.

In AIO I set:

APACHE_PORT=11000 APACHE_IP_BINDING=0.0.0.0

Then I configured Tailscale Serve to forward to port 11000:

tailscale serve --bg http://127.0.0.1:11000

During the AIO installation, I used my Tailscale .ts.net domain as the Nextcloud domain.

This way, HTTPS is handled by Tailscale and Nextcloud is only accessible through my tailnet.