ACLs are not a bad as they look.

Get your nextcloud instance hooked into tailscale

You just need a sample file

Group for admins, add yourself

Tag owner for internal is admins Tag owner for nextcloud is admins

Action accept, src admin, dst *:*

Action accept, src nextcloud, dst nextcloud *.

Then tag your nextcloud ts connection as nextcloud in the webadmin

Tag all your other clients admin in the webadmin

Note: you can’t just paste what I put here you need to find a viable template and then follow along. I’m on a mobile device where I would give you something more finalized

Edit: tag your fam client as nextcloud

Something like this:
I stripped down one of my configs, I took out SSH, I don’t think it requires it

{
	"groups": {
		"group:admins": [
			"bob@bob.com",
		],
	},

	"tagOwners": {
		"tag:admin":    ["group:admins"],
		"tag:nextcloud": ["group:admins"],
	},

	"acls": [

		{
			"action": "accept",
			"src":    ["tag:admin"],
			"dst":    ["*:*"],
		},

		{
			"action": "accept",
			"src":    ["tag:nextcloud"],
			"dst":    ["tag:nextcloud:*", "autogroup:internet:*"],
		},

	],

}