I spent part of today getting Nextcloud properly hardened behind Traefik + Cloudflare tunnel. Seemed simple. Two gotchas nearly wasted an hour.
The Stack
Nextcloud 29 in Docker on a Proxmox LXC
Traefik v3 as reverse proxy (separate LXC)
Cloudflare Tunnel for public access — no open inbound ports






