> Sure, that means you can no longer access your self-hosted stuff when you're out of the house, but the tradeoff is peace of mind about your data leaking or worse.

Lots of things I'd consider self-hosting are functionally useless if I can't access them from my phone while out and about.

I could put my phone on a VPN, but that's just another layer of complexity to add to the self-hosting process.

I do a split approach -- Most services are available internally only, some are reverse proxied out. It used to be caddy2, but after a recent issue and switching to TrueNAS, I just use Traefik with k8s Ingresses and only set it on the few containers I would like accessible.

Tailscale solves the “a vpn is annoying to setup” problem pretty nicely.

It does, but I found it to drain a lot of battery on mobile (iOS). I'd say that for a simple setup you're likely to be accessing your services via their LAN IPs or their TailScale IPs, so if you have these bookmarked etc. on your phone then it means you either:

1) Have separate bookmarks for accessing services via the LAN or the VPN, and need to remember to turn on and off the VPN when you need to access things out of the house; or 2) Always access services via the TailScale IP, which means you need to be connected to the VPN on your phone even to access them from your LAN, which in turn either means toggling the VPN on and off even when at home or leaving it connected all the time and letting it drain 20% of your battery every day.

It's a great service but I didn't find it to make accessing self-hosted services from out of the home on a phone to be as nice as using them at home, or using a managed service.

You could also configure dns via Tailscale so that the same host name resolves to different IPs if you’re connected to the VPN.

Tailscale makes accessing a Raspberry Pi in your basement from outside of the house genuinely easy, including from mobile devices.

I think Tailscale opens up all kinds of new opportunities for self-hosting.

You should probably use headscale instead of you care about self hosting.

If you don't trust Google drive with your passwords, why would you trust a company's server that manages access to all of your devices?

Never heard of headscale before. Doesn't it require the control server to be accessible publicly?

Yes, that's the trade off. Let someone else manage the control server, or manage it yourself - not self hosted vs self hosted

Setting up a VPN is pretty easy these days. If you don't want to run it on your router, you can look at something like Tailscale for remote access.

*headscale If you care about privacy or self hosting, use headscale instead.

You have no idea what tailscale is really doing.

>You have no idea what tailscale is really doing.

please elaborate...

What I mean is just the general statement that can be applied to any company or server. Even if they release all of their code as free and open source (not entirely true, as I understand it - their public servers that handle connecting your devices is not), there is no gaurantee that they are actually using that specific, unmodified code on their servers. They could add or remove whatever they like to the software before deploying it on their servers without you knowing. You have to trust whatever they may write on their blogs. Some people may not care, but the winds these days are shifting away from trusting companies with their private data.

That's not really a solution if you want to self-host mail, or a blog; those services only work if the wider internet can see you.

That helps for external threats breaking into buggy network services, but it doesn't help for compromised apps/images/dependencies exfiltrating your secrets.

A compromised app on a local network has no one to phone home to.

If it's an air-gapped local network, then sure, but how useful is that? Are you disconnecting your phone/laptop from the internet when you access the air-gapped network, or do you use two network interfaces on every device?

I assumed the GP was talking about a typical home "local network", one behind a NAT - so no incoming traffic, but usually, it allows any outgoing traffic.

How about add a remote apple host. Not for the world but just you?