>and just deal with the fact it's not externally available

Perhaps wireguard(or tailscale just for this bit). Not saying you have to, having local only as default is perfectly good and safer maybe!

yeah i have a vpn to my home. i don't have a static ip to my home but i run a script on my mikrotik router to update the A record for the subdomain at cloudns.net that i use for vpn.

Yeah, Tailscale is probably a good bet. If you wanted to get a bit more involved, I have a blog post about my setup with OpenVPN (though it does require a hosted box, which may kinda defeat the purpose of having it locally for OP depending on their needs)

https://blog.ollien.com/posts/vpn-gateway/

If you're worried about costs, I run Nextcloud locally in my house, and just deal with the fact it's not externally available.

I do the same but then have a VPN so I can reach it externally. One more thing to maintain but worth it.

Tailscale works great for this application.

I second this. I was using a Cloudflare Tunnel, which worked but meant I had to jump through some hoops setting up an email auth flow that then sent me a verification code

Now I use Tailscale (which is free for a single-user account) and it works excellently, without the Cloudflare dependency. No login necessary through the browser like with Cloudflare Tunnel, because you're already authed with Tailscale on the device.

I use this with Resilio Sync and custom dns names from Tailscale Magic DNS - life saver!

I run Nextcloud "locally" too. It's "local" in the sense that it sits on an laptop-turned-server by my desk [0]. Add a domain name, a simple dynamic DNS [1] and a forwarding rule on your router ; your local machine is now reachable from everywhere.

No (useless for that usecase) additional intermediary like Tailscale in the middle. It has the added benefit of allowing you to share everything that is on Nextcloud with people without requiring them to use any VPN/etc.

[0] the fact that it runs an a laptop (with its battery) rather than on a workstation provides a UPS on the cheap

[1] dynamic DNS can be achieved even using cheap providers such as OVH as long as you get your domain name there https://docs.ovh.com/ie/en/domains/hosting_dynhost/

Re: dynamic dns, I've just started self-hosting some services and piping them through cloudflare, and I use the docker container oznu/cloudflare-ddns to handle IP changes.

Bonus is that I can restrict incoming traffic on the router to cloudflare ip ranges, and use cloudflare tools to restrict traffic.

I suppose you could accomplish the same with a VPS but this is all free.

This would definitely be the ideal solution, and it is certainly how the Internet was intended to be used, but a lot of residential ISPs either frown on hosting services on a residential link, or outright forbid it. Plus, CGNAT is more or less inevitable at this point, might as well embrace it.

Like you mention, services like tailscale and cloudflare tunnels are a way around it, but that introduces complexity and additional trust in another company.

The main reason I host my stuff on a VPS is because if an attacker finds their way in, I don't want them to have unrestricted access to my home network as well. (And I'm to lazy to set up a DMZ...)

I wouldnt call Tailscale "useless" in that case. If you use Tailscale there, you dont have to port forward, so you have no exposure to the general internet. No one bashing on your port, looking for vulnerabilities. You don't need a DDNS, since Tailscale gives you a fixed address for your machine that persists. So you can set a single CNAME record with your Domain hosting service and you're done. And Tailscale has clients for all platforms, including mobile, so it "just works" with all your devices. It's free for up to 20 devices.

Lack of hairpin NAT makes that very challenging on my network, I mean I can access things from inside and outside the network but I have to use different domain names.

I just use Cloudflares tunnels instead of dyndns.

In my case, I want it everywhere. I operate from a permanent deficit of attention, and I store all of my musical reference material in Google at the moment, because one thing I do always manage to have with me (so far) is my phone, so if someone calls for a song that I don't have memorized I can very quickly pull up the chart no matter what.

I've tried making binders, I've tried every suggestion anyone could possibly make, and the ubiquitous available of Google Docs while I have a phone with internet is the only thing that has verifiably made me more productive. It's only gonna be a few tenners per month to have it fully under my control.

So what you're saying about AWS seems to be that if I just use EC2 and their cheap storage and stick to things I understand (I understand a rented VM, for instance, and I understand the idea that whatever that VM sends out counts against a quota), that they would have a hard time catching me out, and that also seems true to me. Behind a firewall I'm extremely brave, the fact this is internet-public has me a bit more trepadacious I suppose.

I also considered using a local instance to start, but the documentation seems to be very against that and I don't like starting my journey with a new system in defiance of their stated best practices, that seems like the road to a broken heart to me.

edit: lots of suggestions to use dyndns type services, problem there is I'm on Starlink and have no public IP available. There might be a cheap bouncing service out there but that's more googling and in the final analysis I can afford to do it the straightforward way.

Use wireguard or cloud flare tunnels - personally, I have connected all the places I regularly spend time with persistent site-2-site IPSEC. Having your own infrastructure is a real blessing and relief from FAANG.

this is the (modern) way.

You can run dyndns yourself if your dns provider has an API (e.g. cloudflare). Mine is a ~10 line bash script.

Basic idea is `curr_ip=$(curl ifconfig.me | grep smth)`, then `curl -X POST https://your_dns_provider?dn=vpn.jtode.com&new_ip=$curr_ip`.

Run it as a cron, on a schedule that's kind to your IP identification service and kind to your personal SLAs around uptime (mine's set to every 5 minutes).

Verizon changes my home IP every couple weeks, by my latest log check. No need to pay for dynamic dns.

Self-hosting is a long journey of solving such trivial problems. But it's pretty rewarding when it all fits together. :) Good luck!

I have a setup like the one you desire. Some of my services are port-forwarded to the public internet (i.e. the ones with a login screen) behind a local nginx instance. Others are only available on a "local" network, i.e. at home or via a VPN tunnel advertised at secret-vpn.{}.tld.

I've used openvpn to set up a tunnel into my network before, which worked great. I'd check out wireguard if I were to do that again from scratch, I like netmaker personally

> and just deal with the fact it's not externally available

I'm confused about this part. The default Docker implementation and Docker AIO implementation expect you to have a website that you point to to make it work. They auto-get SSL certs against that website.

Has this not been everyone else's experience?

The docker image I'm using runs over HTTP just fine. The client can be prompted to use it manually. Since it's only internal, I'm dealing with it (and it doesn't share any passwords).

Is it a bad idea? Yeah, sure, but given that it's not publicly routable if you're attacking my HTTP port as far as I'm concerned I've already lost. So there's no security situation that internal HTTPS will change, as far as I'm concerned. If HTTPS was the thing that stopped something, I've still got a problem.

My greater surprise / confusion is that the way the comment was written, it sounded like that was the default implementation and that you were unable to change it (despite wanting to). This was confusing and didn't correspond with my experience.