Selfhosted

Sorry to hear that!

Should you be using nextcloud aio if you use tunnels?

I use https://hub.docker.com/_/nextcloud/#running-this-image-with-docker-compose

It works like a charme.

Same as now, you only have to write in docker compose that this local file, next to docker compose should be mounted to that location inside container

Yes you can use docker-compose which spines up all your necessary container connects them with an internal network and most of your stuff has been setup.

Then you but all your configurations in a git repository and you have a all your container under version control.

This is a slightly modified version of mine:

• I use traefik as a reverse proxy
• I mount my syncthing folder to have access on the go to my keepass file

Not in this, but maybe relevant

• Use borgmatic as backup and have script that stops all container with a mount under /opt/backup/docker, does the backup and restarts them.

***
networks:
  default:
    driver: bridge
  traefik_proxy:
    external: true
    name: traefik_proxy
services:
  nextcloud-app:
    container_name: nextcloud-app
    depends_on:
      - nextcloud-db
      - nextcloud-redis
    environment:
      - TZ=Europe/Berlin
      - POSTGRES_HOST=nextcloud-db
      - POSTGRES_PASSWORD=nextcloud
      - POSTGRES_DATABASE=nextPosPw
      - POSTGRES_USER=nextcloud
      - REDIS_HOST=nextcloud-redis
      - REDIS_HOST_PASSWORD=nextRedPw
    image: nextcloud:32
    labels:
      - container-hosts.enable=true
      - container-hosts=${NEXTCLOUD_URL}
      - traefik.enable=true
      - traefik.http.routers.nextcloud.entrypoints=web-secure
      - traefik.http.routers.nextcloud.rule=Host(`${NEXTCLOUD_URL}`)
      - traefik.http.routers.nextcloud.tls=true
      - traefik.http.routers.nextcloud.middlewares=nextcloud-chain@docker
      - traefik.http.middlewares.nextcloud-chain.chain.middlewares=nextcloud-redirect@docker,secHeaders@file
      - traefik.http.middlewares.nextcloud-redirect.redirectregex.regex=^https://(.*)/.well-known/(card|cal)dav
      - traefik.http.middlewares.nextcloud-redirect.redirectregex.replacement=https://$$1/remote.php/dav/
      - traefik.http.services.nextcloud.loadbalancer.server.port=80
    networks:
      - traefik_proxy
      - default
    restart: always
    volumes:
      - /opt/backup/docker/nextcloud/html/data:/var/www/html/data
      - ./data/config:/var/www/html/config
      - /opt/backup/docker/syncthing/data:/syncthing
  nextcloud-cron:
    container_name: nextcloud-cron
    depends_on:
      - nextcloud-db
      - nextcloud-redis
    entrypoint: /cron.sh
    environment:
      - TZ=Europe/Berlin
    image: nextcloud:32
    networks:
      - default
    restart: always
    volumes:
      - /opt/backup/docker/nextcloud/html/data:/var/www/html/data
      - ./data/config:/var/www/html/config
      - /opt/backup/docker/syncthing/data:/syncthing
  nextcloud-db:
    container_name: nextcloud-db
    environment:
      - TZ=Europe/Berlin
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=nextPosPw
      - POSTGRES_DB=nextcloud
    image: postgres:17-alpine
    networks:
      - default
    restart: always
    volumes:
      - /opt/backup/docker/nextcloud/postgresql:/var/lib/postgresql/data
  nextcloud-redis:
    command: valkey-server --requirepass nextRedPw --save 30 1 --loglevel warning
    container_name: nextcloud-redis
    environment:
      - TZ=Europe/Berlin
    image: docker.io/valkey/valkey:8-alpine
    networks:
      - default
    restart: always
    volumes:
      - redis_data:/data
volumes:
  redis_data:
...

PS: I don't want to use any fancy clicky app, because over the last years I had so often problems with updates of these clicky apps and this version is straight forward for all my containers.

Some Android file managers support WebDAV. I'm using Amaze which unfortunately doesn't, so instead I have DAVx5 and I can use it to browse files on the server.

Alternatively, you can use rclone in Termux to download the server files to the device. I use this to sync music from my server.

For your PDF use case, unfortunately you will need to first download the file before opening it.