I spent part of today getting Nextcloud properly hardened behind Traefik + Cloudflare tunnel. Seemed simple. Two gotchas nearly wasted an hour.

The Stack

Nextcloud 29 in Docker on a Proxmox LXC

Traefik v3 as reverse proxy (separate LXC)

Cloudflare Tunnel for public access — no open inbound ports