Your cloud is only truly yours when you can reach it from anywhere - and only safe when you choose the right door. There are two good doors, and one that should never be opened.
Inside the house, Nextcloud just works. From outside, you must make a decision with real consequences: who else can knock on this door? The two honest routes are a VPN, which keeps the door invisible to the internet, and a public domain with HTTPS, which makes the door visible but properly locked. The third route - forwarding the port and using plain HTTP with a password - is the one behind most hacked home servers.
With a VPN or mesh-VPN tool on the server and on your phone and laptop, your devices find each other over an encrypted private network and Nextcloud stays completely unlisted on the public internet - no open ports, no login page for strangers to attack. You reach it by its private address or name exactly as if you were home.
This is the right door when the only outside users are you and your own family or staff, all with the VPN app installed. Its weakness is guests: sending a file link to a client or relative does not work, because the link leads to a private address they cannot reach.
The public route done properly has four parts, none optional:
sudo nextcloud.occ config:system:set trusted_domains 2 --value=cloud.example.com - next free index)sudo nextcloud.enable-https lets-encrypt so the login travels encrypted and the browser shows no warningsMillions of Nextclouds run exactly like this. Public is not the risk; public and careless is.
Forwarding a port to a Nextcloud served over plain HTTP - or with only a self-signed certificate standing in for identity - exposes a login page whose passwords cross the internet readable, on an address that scanners find within hours of it opening. Add a weak or reused admin password and the story writes itself. If you cannot do HTTPS with a real certificate yet, use the VPN route until you can. There is no version of in the meantime, just for testing that the internet respects.
Most home connections have an address that changes - after a router reboot, or whenever the provider rotates it. The public route then points at a stranger's house until DNS catches up. The standard fix is a dynamic DNS name: a small updater (in the router, or a tool on the server) keeps one hostname pointed at your current address automatically. The VPN route simply does not care about your public address at all - one more reason small, private setups often choose it.
The server itself takes one step - see it, then choose your door.
Watch Full VideoNo - with HTTPS, strong unique passwords, two-factor authentication and automatic updates running, it is the normal way public Nextcloud servers operate. The danger is plain HTTP, weak passwords and an unpatched server, in any combination.
Yes, with a dynamic DNS service: your hostname stays fixed while a small updater keeps it pointed at your current address. Many routers have the updater built in.
Yes, and many people do - the domain for sharing links, the VPN as the private admin path. Just keep the same discipline on both: HTTPS everywhere, two-factor on, updates on.