Nextcloud AIO without any ports open

I have built my own little 10 inch network rack with two machines in my student dorm. One of the machines running Debian 12 is currently host to a Nextcloud bare metal install which is reachable inside of an overlay network by Tailscale.

For multiple reasons I want to start using Nextcloud AIO now. The issue here is that I can’t just open up ports, since all port-forwards are blocked by default on our dorms router.

As far as I’ve understood, AIO needs some ports forwarded, so it can fetch necessary files and valid TLS certs to use HTTPS.

Since I only want to use our Nextcloud instance within the Tailnet, I don’t need TLS certs, since I can get those from Tailscale.
Can I get the install to work without any ports being opened in the routers firewall?

Hi, can you follow Tailscale (and Caddy as a sidecar) Reverse Proxy · nextcloud/all-in-one · Discussion #5439 · GitHub?