Ok, so I fucked around and found out: you can run Bitcoin Core + Specter on your server, create a watch-only wallet by importing your xpub and use that to derive new addresses as needed.

I think there’s a much simpler setup (xpub-tool, for example) but I couldn’t make derive the same addresses as my Nunchuk wallet. Tinkered with derivation paths to no avail.