Thanks for the information. I will have to look into SNI and see if my router can support it – if I move someday to an ISP behind a more restrictive firewall, this system looks pretty good. (Or if I get unhappy with one reverse proxy handling everything).
Interesting, I already use cloudflare DNS and had “proxy” turned on for nextcloud, but I still had to open 80 and 443 on my router, so I’ll look up how to set up the free tunnel sometime