seems like your DNS works fine but your certs doesn't. Are you able to connect to your services on your browser normally, with SSL?
Edit: please also try curl -4 and curl -6 to your services from within the uptime kuma container to see if theres an ipv4/v6 issue
Another edit: seems like there is a dataprolet URL in your post and a datenprolet URL in your comments. It might just be a typo so also check that too.
Might look into Gotosocial considering it's more lightweight.
Other than that I wonder whether it's better for the uni/department to register on another instance, similar to how fosstodon is home for many FOSS projects. An inter-unis, academic-focused Fediverse server might be a good club project, and could allow more donation sources to sustain too (although this is pretty above-scope from what you're asking).
Tailscale/Headscale + DERP may work as they relay packets through a typical HTTP server. Just make sure your router has some space to download the binary - for MIPS they're like ~60MB or something iirc.
My bad, I meant the recommended deployment is to bring your own auth provider, but normal username/password is fine too. Glad it works!
Assuming you just want file sync and storage, if you can live without External Storage (having another SFTP/WebDAV/whatever backend), then I think oCIS is great for you. It also expect an OIDC auth provider by default - this guide helped me through. Note that you have to configure the S3 storage driver in oCIS and properly backup your buckets and metadata.
For Talk you can setup an internal Matrix and TURN server too. I recommend conduwuit if you want something lightweight, or Synapse (quite heavy) if you need OIDC integration.
An alternative method is to run an actions workflow that syncs from upstream images directly, like what Forgejo actually do.
Update: there seems to be a more "native" storage driver for OCIS that is currently WIP. It seems very exciting
I think oCIS spoiled me with regards to the database issue xD. You bring up a good point - I'll try reinstalling Nextcloud with Postgres, removing unneeded bloat, and use it until oCIS has a "native" backend
Non-OCIS Owncloud still needs a dedicated database and recommend against SQLite in prod
I've looked at rclone mounting with the --vfs-cache-* flags. But I'm not sure how it can smart sync like mountain duck or handle conflicts elegantly like the Nextcloud/Owncloud clients do. Let me know how to set it up that way if possible
Then I guess you only define an A record in the DuckDNS panel. That's fine.
A while back I ran a somewhat similar Wireguard tunnel and can't connect. Turns out some MTU settings were lower than the docker's MTU and that breaks big packets like SSL handshakes. Restarting makes it work fine until things start congesting again.
Suffice to say this would be something I'll look at if the SSL errors reoccurs