How do you connect outside the network?

I am running DDNS to access my home services and it has been very error prone and frustrating. I moved some services back to the cloud because the bots were using all my DSL upload that we didn’t have enough bandwidth to work even with cloudflare firewalls.

There's an nginx reverse-proxy container in the stack that routes traffic to the individual service containers via the servername; eg nitter.tail.net goes to the nitter container, teddit.tail.net goes to the teddit container, etc.

The nginx proxy only listens on the Tailnet interface and only accepts connections from the Tailnet CIDR, therefore any device I have on my tailnet can access them. Letsencrypt is also setup so everything is over https.

This allows me to access them from my phone, laptop, whatever when connected using Tailscale.

Tailscale essentially let me completely remove any need for port forwarding on my router and still have global access. It's truly amazing.

Basically all the services on nomad listen on the tailnet, and traefik straddles the tailnet and the public internet. It then loads the service configurations from nomad and exposes them using let’s encrypt certificates.

https://github.com/ecliptik/tailscale-privacy-frontends

I've tested it out on a new Tailnet on a t3.medium EC2 instance and it works relatively well. Adding new services should be relatively easy.

I'm planning to write up a post about the more technical details on the stack still.

Combined with only allowing connections to hosts from the Tailnet and https, forgoing passwords makes them easier to manage and use.

Granted most these personal services are things like Audiobookshelf, Nitter, Plex, and Newsblur. While important to me, they're not exactly high value targets.

My internal Gitea is locked down more and has MFA enabled since I always see git as something to secure.

WARP is primarily used for long running services I have, like GotoSocial or Lemmy that need public ingress over https for federation.