ACLs are not a bad as they look.

Get your nextcloud instance hooked into tailscale

You just need a sample file

Group for admins, add yourself

Tag owner for internal is admins Tag owner for nextcloud is admins

Action accept, src admin, dst :

Action accept, src nextcloud, dst nextcloud *.

Then tag your nextcloud ts connection as nextcloud in the webadmin

Tag all your other clients admin in the webadmin