Define securely.

I’ve run my nextcloud online for a few years with no incidents, it’s behind Apache, I keep it up to date, I have a bit of extra hardening (but none of it really hardens nextcloud itself it would just make running exploits on my server more visible).

It doesn’t really add security in the traditional sense but for a personal server logging outbound traffic and having it email me when something non standard initiates a connection also gives me an added sense of security.

Idk about giving a comprehensive answer, but getting full marks on the nextcloud security scanner is a good start: https://scan.nextcloud.com/

I check mine periodically and make sure I’m on the latest version, use 2fa (passkey) and hope that does the trick.

Also there’s a plugin for brute force protection.