I just built a similar setup. I have an offsite server at my brothers house. I set up Nextcloud on the server at my house, using ACME (lets Encrypt), and HAProxy on my pfsense firewall to secure it. I then use rclone with the Nextcloud webdav settings to sync my files to the server at their house, and their files to my mine. nextclouds website has a security scanner you can use to make sure it is a secure connection. I also signed up with a site called https://probely.com/ and they run a monthly scan with report to check for vulnerabilities. It is working great, and it was a fun project.