Quick answer: Nginx on :80/:443, app only on 127.0.0.1, proxy headers + Let’s Encrypt.
VPS & root servers: Order VPS in Germany · NexoraHost · nexorahost.com (Maincubes FRA01 Frankfurt · Ryzen · NVMe · GDPR)
Frequently asked questions (FAQ)
Nginx vs Caddy vs Traefik?
Caddy: auto HTTPS. Traefik: Docker labels. Nginx: max control. All fine on a NexoraHost VPS.
Which headers?
Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto – required for Nextcloud trusted_proxies.
WebSockets?
Upgrade headers and longer timeouts.