Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).

For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.

I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

  • sugar_in_your_tea@sh.itjust.worksEnglish
    4·
    5 hours ago

    If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.

    Benefits:

    • you control everything, so switching to a new provider is as simple as copying configs instead of reconfiguring everything
    • most VPN companies only route traffic going out, not in; you can probably find one that does, but it probably costs more than the DIY option
    • easy to share with others, just give a URL

    Downsides:

    • more complicated to configure
    • bandwidth limitations

    If you only need access on devices you control, something like Tailscale could work.

    Benefits:

    • very simple setup - Tailscale supports a ton of things
    • potentially free, depending on your needs

    Downsides:

    • no public access, so you’d need to configure every device that wants to access it
    • you don’t control it, so if Tailscale goes evil, you’d need to change everything

    I did the first and it works well.

    • deathbird@mander.xyzEnglish
      1·
      2 hours ago

      I would not recommend relying on Tailscale. They have been soliciting a lot of venture capital lately and are probably going to go for an IPO sooner or later. I would not put a lot of trust in that company. The investors are going to want their money.