None of this concerns me for an application like NextCloud. Deploying TLS properly is table stakes. What does concern me: this app is written in PHP, famous for such a horrific design that it frequently leads developers down dangerous code paths that result in remotely exploitable bugs.

Seriously WTF are the PHP devs smoking? Just look at these tables: https://secure.php.net/manual/en/types.comparisons.php

Given the size of the codebase and the insecure language and frameworks it's built on, I would consider a NextCloud instance that touches the internet to be at enormous risk of compromise.

If you want to investigate my gut there are a million and one things having to do with its architecture and implementation that you want to look into. None of those things involve what TLS cipher suites it uses.