I am configuring a private cloud at home using nextcloud on a linux machine. It is running an apache webserver over an https connection (let's encrypt self-signed certificate) and a VPN server (wireguard). The goal is to access, on the move, to information stored on nextcloud's webdav server (it can be personal photos, personal bank reports or finances, contracts, etc) and I would like to fully understand the risks of this approach, namely, the risk of that information being exposed on the internet to others (being hacker or my ISP, if I'm feeling that paranoid).

An example use case: I connect my phone to my VPN server located at home, access my nextcloud webdav server and download + upload several documents.

In this scenario: who or what can see what I am doing, or what kind of documents I am working on? Is it possible for a hacker to get hands on the information? Or my ISP to "see" that I am sending or receiving documents of a specific kind, and their filenames and/or content?

1 Answer 1


To take apart your setup, using TLS alone provides complete confidentiality for application-layer content. Wireguard provides confidentially for all of your traffic that is sent through it.

Your question doesn't specify whether NextCloud is only accessible over the VPN. If so, the main advantage of this is that the VPN acts as another level of access control to the NextCloud service, but doesn't really provide additional confidentiality since TLS is already used.

The main threat would be that your phone (or another device you access NextCloud from) is compromised, at which point an adversary could potentially see everything you see on NextCloud. But this is fairly unlikely. Or, there could be a critical vulnerability in Wireguard that is not publicly known, or you haven't patched it. But this is also fairly unlikely.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .