I don’t know any good tutorial, because I knew traefik from work. But here are a few hints:
I use the official traefik 2 docker image. Put traefik and nextcloud in the same docker network. Now use traefik with these commands and these labels:
command:
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.middlewares=redirect-to-https@docker" # use middleware defined in labels. Always redirect http to https
- "--entrypoints.websecure.address=:443"
- "--serverstransport.insecureskipverify=true"
- "--certificatesresolvers.letsencrypt.acme.email=your@mail.com"
- "--certificatesresolvers.letsencrypt.acme.storage=acme.json"
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
# - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" use this for testing. Letsencrypt as a ratio limit on its production endpoint
# - "--log.level=DEBUG"
# - "--accesslog=true" help with finding errors
labels:
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
and now you add these labels to your nextcloud container:
labels:
- "traefik.http.middlewares.nextcloud_headers.headers.stsSeconds=315360000" # for security mentioned in server overview
- "traefik.http.middlewares.calcarddav.redirectregex.permanent=true"
- "traefik.http.middlewares.calcarddav.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
- "traefik.http.middlewares.calcarddav.redirectregex.replacement=https://$$1/remote.php/dav/" # important fĂĽr caldav and carddav
- "traefik.enable=true"
- "traefik.http.routers.nextcloud_http.rule=Host(`example.com`)"
- "traefik.http.routers.nextcloud_http.entrypoints=web"
- "traefik.http.routers.nextcloud_https.rule=Host(`example.com`)"
- "traefik.http.routers.nextcloud_https.entrypoints=websecure"
- "traefik.http.routers.nextcloud_https.middlewares=calcarddav,nextcloud_headers"
- "traefik.http.routers.nextcloud_https.tls=true"
- "traefik.http.routers.nextcloud_https.tls.certresolver=letsencrypt" # defined in traefik command
The traefik documentation is pretty good. Just remeber that everything defined in traefiks command area is its static configuration and all labels are a dynamic configuration. This fact caused me confusion many times 
Good luck!