He mentions nextcloud, has anyone been self-hosting this for a small org with 100-200 users?

Kinda. I use managed Nextcloud by Hetzner (StorageShare) for ~20 people with their smallest instance (1TB, 4.50 EUR/month) and connected it with a Collabora hosted on the smallest Hetzner VPS (this could use more cores).

If you wanna self-host completly look at https://github.com/nextcloud/all-in-one . I have this running on my NAS for other stuff, but it just works out of the box.

Edit: and it scales. Orgs with a lot more people use it for 10k users or more. And it doesn't need a 100 EUR/month setup, from what I experienced.

Yeah I tested it out with the hetzner app on their smallest dedicated server and it ran fine.

Is storage share the managed service?

Look at AIO.

There are institutions with several thousands of employees that use Nextcloud, including mine.

I run an installation for our family, and it’s been problem free.

Great, do you use their video conferencing (Talk?) at that scale?

Yes it's fine. Do you have any particular questions?

What does your usage look like? My use would be about 30 heavy daily users, another hundred sporadic. Mostly doc editing and video calls.

What kind of hosting infra are you using? Hetzner seems popular.

Any major recent security concerns, it seems to have a large attack surface.

We use it as primarily a file sharing thing. We do not use it for video calls (and I woulnd't recomment it for that purpose).Last time I tried integrating with an office suite server was also a pain in the ass. I do use its calendar and dav addressbook because it works fairly well.

The only security thing we've done is disable a few paths in the web configuration and only allow SSO logins. (Authentik). You can also put it behind Authentik's embedded proxy for more security. I didn't do it because of the use case with generic calendar/addresbook software.

Hetzner is good. Great even, in terms of what you get for the money. They do provide mostly professional service. You will not get one iota of extra service other than what they promise. VERY German in that regard and very unapologetic about it. And don't talk about them in public with your real identity attached. They ban people for arbitrary reasons and have their uber fans (children with a 4 dollar vps) convince other fellow users that if you got banned you must have been a Russian hacker trying to infiltrate the Hague.