Opening the port is at the provider, so not problem with that.
I did some performance tests and mounting with rclone was way faster than with mount_smbfs ... but i configured a cache for rclone.
Also, with rclone I can see in the logs what's going up, which is valuable.
With my first sftp sync tests, I got lots of strange errors, probably need to limit the transfers more.
2025/07/25 00:55:59 ERROR : d/NU/ERMZFKIQB5ESTD7XTFWAIXCBMJJG6X/c6QnGCVd0gfTIMTFnPGPS-1Rn7-Am-zOR4eLoOcW0u93_RFojBHi7DhmZH0OkJ3LDuCd9R5-fe3MhA==.c9r: Failed to copy: Update Close failed: failed to send packet: EOF
2025/07/25 00:56:00 ERROR : d/NU/ERMZFKIQB5ESTD7XTFWAIXCBMJJG6X/r7ehotYYg5Q5QbrqM9G8Ir4tHv1MlwQu9oh6Voq3XT9fTqKtHsZh5rbkUoyRzupsel1Dh4csZFYpsDsKJfwFJuDrWUU0TuRRL0tfxr_MGD2RSpmdrnelC_U=.c9r: Failed to copy: Update Close failed: connection lost
2025/07/25 00:56:01 ERROR : d/NU/ERMZFKIQB5ESTD7XTFWAIXCBMJJG6X/tz-WmYFo4HSRr4OPKEJYUK8U6FFGS_oEl_Nj9t0BtKo_oJR0oihqstKZWNwYCvksnbBARA==.c9r: Failed to copy: Update Close failed: connection lost
2025/07/25 00:56:02 ERROR : d/NU/ERMZFKIQB5ESTD7XTFWAIXCBMJJG6X/o7YPFlKqvkinRsMrifiM3Wbe6Cge2l8454Kewy90l7j4-wb7125ZlFp3CKGfPRIh0oZWeg==.c9r: Failed to copy: Update Close failed: connection lost
2025/07/25 00:56:06 ERROR : d/SA/4XLRIXOXJIRYKIJ3UXEGMG2OMAENYL/hJz_tGkl7TtZD2QSEz3MiKbSES8AxkjkGzYSR1xnXDju4_37pK1r0qYqgxrY2WAqgoIjOnEd.c9r: Failed to copy: Update Close failed: connection lost
But with WebDAV, I saw no problems - seems to be fine.
I also use a NextCloud server, but I did not configure the type "nextcloud", as then I cannot mount several sub-dirs individually anymore (which I also couple with dedicated and separate cache dirs).
I did that as those directories are used for their own Cryptomator Vaults, and that may be better to cache separately.
But I get that it may be better to use the type "nextcloud" and only use one cache dir, as then I could use hashes and mod times ...
note: about the media files accessed by jellyfin server. they are stored on storagebox, they are cypted using a rclone crypt remote.
so if hetzner would fail if it tried to access the files, could not see the filenames, not read the contents
but i really doubt hetzner would snoop around, it is a european company, that complies with GPDR.
plus, i have been doing that for 6+ years.
and everything runs over tailscale. the client, the server, etc...