those days are over

Yep, definitely something wrong with the webserver 😅 Can you try this configuration?

https://nextcloud.domain.com {
        reverse_proxy 192.168.1.182:443 {
                header_up Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
                header_up X-Forwarded-Proto {scheme}
                header_up X-Forwarded-For {remote}
                header_up X-Real-IP {remote}
        }
}

You said that “originally, the Nextcloud server handled HTTPS with Let’s Encrypt at domain.com” and now you are redirecting to 192.168.1.182 on port 443. Is this Nextcloud server still serving HTTPS with Let’s Encrypt for domain.com?

I’m asking because if you are using Caddy in front of that HTTPS webserver as a reverse-proxy, you will need to override the Host header with the configured upstream address. Here’s the documentation. I think it would be something like this (?):

https://nextcloud.domain.com {
        reverse_proxy domain.com:443 {
                header_up Host {upstream_hostport}
                header_up Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
                header_up X-Forwarded-Proto {scheme}
                header_up X-Forwarded-For {remote}
                header_up X-Real-IP {remote}
        }
}

More than 50 redirects? Hmm, that looks weird. What is the output when you run wget --spider https://nextcloud.domain.com? Could you try enabling cookies for cURL and pasting the contents of the cookiefile here?

curl --cookie cookiefile --cookie-jar cookiefile --location https://nextcloud.domain.com

301 Moved Permanently is usually not something that requires user intervention. Most browsers should automatically detect the 301 Moved Permanently response code and redirect automatically. What happens when you run cURL with the --location flag?

curl --location https://nextcloud.domain.com

Yeah, I wish Nextcloud focused more on the file manager side of their applications. I was using it on my TrueNAS instance and it seems like an unfinished product. E2EE is not enabled by default and looks like their implementation is not perfect either.

Thanks anon, this is really useful!