As I start to host more and more services on my home server, my family and friends are interested in using some of the services I host as well. Up to now, all of my services have been internal-only, and my wife and I just use Tailscale to access everything. Getting others set up with tailscale isn’t an issue, but I can only have up to 4 other users before I have to pay to add more, and I have more than 4 people I would like to have access to some of the things I host.

Right now I’m using cloudflare tunnels to make some services available externally. I’m behind CGNAT, so I’m forced to use something like tunnels or similar. I’ve always read that if you are going to open things up externally to use a reverse proxy (which I use internally), but does this still apply with cloudflare tunnels? What else should I be looking at to make sure I have everything secured properly?

  • Augmented1207@feddit.orgEnglish
    1·
    8 hours ago

    So my setup rigjt now:

    • vps with headscale
    • all devices connect to it
    • in my home lab a vm running a tailscale client and a reverse proxy with a Wildcard cert
    • all other services run as their own VMS and the proxy routes to them
    • i have a dmz (not yet public) running a proxy with tailscale again for a different domain
    • dmz runs a authentik vm which i use for access controll and user management
    • backup Server connects to tailscale as well and proxmox pushes zfs snapshots every day

    My long term goal is to move to pangolin as a reverse proxy on the vps and tailscale alternative and remove tailscale, as i find its very battery inefficient on Android (no subnet Router etc).

    So i just give people access to the VPN and send them an authentik invite and thats it. With pangolin i dont even have to give them a VPN access anymore, it can be done via authentik i think.

    A vps is 3-6€ and the tailscale standard is 10€ so its even cheaper, but a bit more setup to maintain. But it allows a ton of users :) so i guess this would be the smallest change with the highest impact

    Authentik is nice to have but a pain to set up as the oicd stuff can be tricky. Immich was super ez, nextcloud was OK, docspell was a pain and ocis does not work with authentik becsuse they use different architectures for sso. (Ocis and authentik are a bit dumb here)