Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).

For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.

I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

    • waterproof@sh.itjust.worksOPEnglish
      4·
      1 day ago

      Tailscale is very tempting, on one hand it should provide a pretty good layer of security without too much thinking and it is “free”, and on another hand, it’s a business solution, so it is probably not really free…

      Thanks for the answer anyway confirming that Tailscale is pretty easy to setup !

      • psycotica0@lemmy.caEnglish
        8·
        1 day ago

        The tailscale clients are, I believe, open source. It’s just the server that’s not, and you can run the unofficial but well supported “headscale” as a server if you want. But this requires you to run this somewhere publicly accessible, like a VPS, for coordination and NAT-punching purposes.

        But! I’m pretty sure as the business operates right now, that tailscale doesn’t have access to the actual data connections or anything, it’s all encrypted, they’re basically just there for simplicity and coordination. And their business model is to offer simple things for free, like small numbers of devices, with the hope that you like the service and convince your business to pay for the fancy version for money. So I don’t think it’s quite as bad as the typical “free because I’m harvesting your data” models.

        That all having been said, I run headscale 😛

        • JPAKx4@lemmy.blahaj.zoneEnglish
          1·
          18 hours ago

          I use headscale and it’s been working wonderfully for my nightly offsite backups and remote access.