I am not a Nextcloud wizard, but I have been successful using acme.sh in different contexts, specifically using “DNS mode” to prove I have control of a domain name without inbound IP access.

Does any inbound IP traffic work? I’d start by making sure that the port forwarding is working correctly with plaintext traffic like HTTP/port 80 and then look at encryption.

You also might need to use alternate ports if your ISP doesn’t want you running servers, which is probably the case if you’re behind CGNAT.

I used a $0 tier Slack workspace for this in a small business, it worked OK. The Slack clients are enormous in memory.