Getting the configs to work with my personal devices was already a little finicky but doing that for not-so-technical family members was starting to be a bit too much work for me.

I’m hoping that Headscale will cut that down to pointing their app at the server and having them enter their username and password.

Was running Wireguard and am now in the process of changing over to Tailscale (Headscale).

It uses Wireguard for the actual connections but manages all the wireguard configs for you.

Nextcloud is just a web service. How he or anyone can access it is not determined by nextcloud but by the routers, firewalls, vpns and potentially reverse proxies that are routing the traffic to nextcloud.

With the proper configuration of all traffic handling services it will not be possible to access anything other than the intended endpoint i.e. nextcloud.

Within nextcloud any user can only access their own files plus anything that is explicitly shared to them.