Nextcloud AIO without any ports open

I have built my own little 10 inch network rack with two machines in my student dorm. One of the machines running Debian 12 is currently host to a Nextcloud bare metal install which is reachable inside of an overlay network by Tailscale.

For multiple reasons I want to start using Nextcloud AIO now. The issue here is that I can鈥檛 just open up ports, since all port-forwards are blocked by default on our dorms router.

As far as I鈥檝e understood, AIO needs some ports forwarded, so it can fetch necessary files and valid TLS certs to use HTTPS.

Since I only want to use our Nextcloud instance within the Tailnet, I don鈥檛 need TLS certs, since I can get those from Tailscale.
Can I get the install to work without any ports being opened in the routers firewall?

Hi, can you follow Tailscale (and Caddy as a sidecar) Reverse Proxy 路 nextcloud/all-in-one 路 Discussion #5439 路 GitHub?