MySQL and MariaDB listen on port 3306. Debian/Ubuntu set bind-address = 127.0.0.1 by default; web apps like Nextcloud on the same host often use the Unix socket anyway.
Do not open it to the internet. Exposed databases are constantly scanned for weak passwords. For remote admin use an SSH tunnel: ssh -L 3306:127.0.0.1:3306 admin@db.example.com. With separate app and DB servers, allow only the app server's IP.
Common errors: Host '…' is not allowed to connect – the user only exists as 'app'@'localhost' – and Can't connect … (111) because the service only listens on 127.0.0.1.
Check
mysql -h db.example.com -P 3306 -u app -p -e "SELECT VERSION();"