A Russian IT enthusiast has published a comprehensive guide on deploying Nextcloud Talk on TrueNAS to give family members a reliable, self-hosted messaging and calling platform that bypasses problems with commercial messengers.
The author explains that VK calls fail on iPhones because the app token is revoked from the App Store, while Telegram requires VPN activation before connections succeed. The goal was to run everything through a personal Nextcloud instance already installed on TrueNAS at 192.168.0.17:30027.
Domain and reverse-proxy setup
The first step creates the subdomain nextcloud.example.com pointing to a HestiaCP VPS. An SSL certificate is obtained from Let's Encrypt directly in the control panel. Port forwarding on the home router maps an external port (56070) to the TrueNAS Nextcloud port, with additional rules opened for coturn on 3478/TCP+UDP and the relay range 49160-49200/UDP.
Reverse proxy configuration is provided in two variants: a simple .htaccess rewrite for Apache and a full nginx template for HestiaCP that correctly forwards WebSocket upgrades and large file uploads. After the proxy is active, the domain is added to Nextcloud’s trusted_domains list and overwrite settings are adjusted for HTTPS.
TURN server and final configuration
Because WebRTC calls require a TURN server for NAT traversal, the author creates a dedicated dataset on TrueNAS and runs a custom coturn container with a minimal turnserver.conf. The container listens on the external IP and uses a long-term credential for authentication.
In Nextcloud Administration settings the external coturn address is registered under TURN servers, while the default STUN server remains stun.nextcloud.com. Testing from outside the home network confirmed that both messaging and video calls function correctly, including Screen Sharing on iOS and push notifications via CallKit after re-authentication.
The finished system offers link-based guest meetings, reactions, message editing, online status, and cross-platform Talk clients without depending on third-party push services that can be blocked.
