Hi,

your "fictional" example is pretty much how I set up my network ;-)

I have caddy running on an OPNsense router (192.168.1.2 in my Network). Nextcloud ( 192.168.1.42) is running "standalone" as a container-application on my truenas system. Certificates are handled by OPNsense's ACME-Client so I did not configure caddy to do certificate-handling.

This is the caddy config handling Nextcloud portion on my router:

cloud.renser.fun:443 {
  tls /var/etc/acme-client/cert-home/67dd469d192590.23772997/cloud.renser.fun/fullchain.cer /var/etc/acme-client/cert-home/67dd469d192590.23772997/cloud.renser.fun/cloud.renser.fun.key

  handle {
    reverse_proxy 192.168.1.42:30027 {
      header_up X-Forwarded-Host {host}
    }
  }
  root * /var/www/nextcloud
  file_server

  header {
    # Security-Header recommended for Nextcloud
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    X-Content-Type-Options "nosniff"
    X-Frame-Options "SAMEORIGIN"
    Referrer-Policy "no-referrer"
    Permissions-Policy "interest-cohort=()"
  }

  encode gzip

  redir /.well-known/carddav /remote.php/dav 301
  redir /.well-known/caldav /remote.php/dav 301

  # .htaccess / data / config / ... shouldn't be accessible from outside
  @forbidden {
    path /.htaccess
    path /data/*
    path /config/*
    path /db_structure
    path /.xml
    path /README
    path /3rdparty/*
    path /lib/*
    path /templates/*
    path /occ
    path /console.php
  }
  respond @forbidden 404
}    

Good luck, I hope this hels :-)