this post was submitted on 21 Jul 2025
107 points (96.5% liked)

Selfhosted

49711 readers
238 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).

For the past few days I've been looking for a relatively secure way of accessing my applications from outside.

I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

you are viewing a single comment's thread
view the rest of the comments
[–] nfreak@lemmy.ml 6 points 2 days ago (2 children)

The variant version of number 2, which is more work to set up of course, is Pangolin on a VPS. Basically serves the same purpose but skips Cloudflare entirely.

I'm in the process of setting up Pangolin and Headscale on a VPS to expose a small handful of services and to replace my wg-easy setup. Currently chaining wg-easy through a gluetun container, so with a single VPN connection I get LAN access and protect my outbound traffic, but I can't for the life of me get the same setup working on wg-easy v15, so I'm going to give tailscale/headscale a try with a gluetun exit node.

[–] damnthefilibuster@lemmy.world 2 points 1 day ago (1 children)

haven't looked at Pangolin, but thanks for the info! I might explore it in the future if my current setup gives me any issues.

[–] nfreak@lemmy.ml 2 points 1 day ago

Getting it up and running was pretty easy but admittedly I'm starting to hit some snags with split DNS and Authentik. Totally doable but taking a lot of work for sure.

In the process I'm also moving my entire domain to a different name and got timed out by letsencrypt lmao so I guess I'll try some more tomorrow.

[–] studentofarkad@lemmy.zip 2 points 2 days ago (1 children)

For the vps, will you go with a provider like digital ocean?

[–] nfreak@lemmy.ml 2 points 1 day ago (1 children)

I went with a Racknerd debian 12 box, DigitalOcean is a bit overpriced for what you get. There's a whole list of recommendations in Pangolin's wiki iirc

[–] studentofarkad@lemmy.zip 1 points 1 day ago

Thank you, might give it a shot.