Nextcloud vs. Starlink

Making Nextcloud Public via Starlink with Cloudflare – The Complete Tutorial 🚀

You have Starlink as your internet provider, already run a Nextcloud instance on a Linux server, and don’t know how to make the whole thing accessible from outside without an extra router? Then grab a coffee – I’ll show you step by step how to get this rolling via e.g., Cloudflare.

Preliminary note: Cloudflare is just one of several solutions for making self-hosted services accessible from the outside without needing a separate router. And Cloudflare isn’t necessarily the best solution. There are reasons against using Cloudflare, which you can read about at Mike Kuketz .

Prerequisites

• A running Linux system with installed Nextcloud
• A domain name (e.g., meinecloud.de)
• A Cloudflare account
• Starlink internet (obviously 😄)
• Optional but recommended: a Cloudflared Tunnel (the best solution with CGNAT)

Why is Starlink special?

Starlink uses CGNAT – meaning you don’t get a public IPv4 address. Port forwarding like with classic DSL or cable? Forget it. BUT: With Cloudflare, you can still make it work!

Step 1: Bring Domain to Cloudflare

1. Register at Cloudflare.com and add your domain.
2. Cloudflare asks for your DNS entries – ignore them for now.
3. Change the Nameservers at your domain registrar to those of Cloudflare.
4. Wait until Cloudflare has taken over the domain (can take 5–15 minutes).

Step 2: Set up Cloudflared Tunnel (because of CGNAT)

Since you can’t do port forwarding, you need the “Cloudflared Tunnel”. Sounds technical – but it’s super easy.

Installation of cloudflared

cloudflared is not directly installable from Debian repos – you must first add the official Cloudflare repository:

1
2
3
4
5
6
7
8
9

# 1. Cloudflare GPG-Key hinzufügen
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloudflare-main.gpg

# 2. Repository hinzufügen
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared stable main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# 3. Paketliste aktualisieren und cloudflared installieren
sudo apt update
sudo apt install cloudflared

Set up Tunnel

1

cloudflared tunnel login

This opens a browser – log in with Cloudflare there and confirm access to your domain.

1

cloudflared tunnel create nextcloud-tunnel

This creates your tunnel.

Configure Tunnel

Create the configuration file:

1
2

sudo mkdir -p /etc/cloudflared
sudo nano /etc/cloudflared/config.yml

Example content:

1
2
3
4
5
6
7

tunnel: nextcloud-tunnel
credentials-file: /etc/cloudflared/<lange-hash-datei>.json

ingress:
  - hostname: cloud.meinecloud.de
    service: http://localhost:80
  - service: http_status:404

Now run this as a system service:

1
2

sudo cloudflared service install
sudo systemctl enable --now cloudflared

Done. Cloudflare now routes traffic directly to your server – without a public IP!

Enable HTTPS (via Cloudflare)

You don’t need Let’s Encrypt – Cloudflare can terminate TLS. Go to your domain in the Cloudflare web interface:

• Tab: SSL/TLS
• Choose “Flexible” or better “Full (strict)”, if you have an internal certificate.
• Under “Page Rules” you can also force HTTPS.

Testing

• Go to https://cloud.meinecloud.de
• You should see your Nextcloud
• Log in, done 🎉

Extra Tips

• Want to secure /var/www/nextcloud? Set fail2ban and a firewall.
• Use ufw:

1
2
3

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw enable

• Don’t forget backups!

Conclusion

With Starlink + Cloudflare Tunnels, it’s really easy to run your own cloud service – without complicated network configuration. You don’t need a static IP, no DynDNS, no port forwarding.