Then it follows the same principles as cloud flare. Create a site (vpn endpoint), get a docker snippet for a newt (what they call the vpn connector), paste it in the docker compose on your Homeserver and see it come up in the Webinterface.
Then you create a public resource and point it to said site and give it a url.
Temp stuff where I could care less about the free tier domain name or things that I just want to funnel to my existing devices: Tailscale
Widespread, prolonged services that will be more actively maintained for a longer amount of time and can just spin off of its own domain/subdomain: Cloudflare
Expose internal services to the public internet with automatic TLS, authentication, access restrictions, and traffic routing through the NetBird mesh network.
No, you cannot. Putting in your emails just redirects to the identity provider you used when signing up. If you try to create an account you'll see that email's not a option.
Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don't bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).
It's still worth setting up a wildcard cert with ACME so you get nice https and a real domain.
Cloudflare has some opt-in auth. Mail-OTP is a nice balance imo: You can allowlist mail addresses per service/subdomain and set expiry for each. Then for access, you first have to enter the mail address, get the OTP and then access the service.
So, nobody without access to allowed mail addresses even gets to knock on you door.
But yeah, that's why I think about going tail scale: why bother having something exposed when not needed?
I just think, some services might be nice to provide to friends, too - and having them connect to my tailnet for this is a bit too much friction, I guess
Just Wireguard on a router, but I'm thinking Netbird.
WG can be a bit PITA to set up, but once you do, it just works. What I would to have is more fine grained control over who goes where if I were to expose some of the services to friends.
tofu
Als Antwort auf frosch • • •androidul
Als Antwort auf tofu • • •frosch
Als Antwort auf tofu • • •Manodor
Als Antwort auf frosch • • •prenatal_confusion
Als Antwort auf frosch • • •fleem
Als Antwort auf prenatal_confusion • • •prenatal_confusion
Als Antwort auf fleem • • •frosch
Als Antwort auf prenatal_confusion • • •When I looked into it first, Pangolin seemed a bit overwhelming.
Is it hard to set up?
prenatal_confusion
Als Antwort auf frosch • • •No, ridiculously easy with docker.
Then it follows the same principles as cloud flare.
Create a site (vpn endpoint), get a docker snippet for a newt (what they call the vpn connector), paste it in the docker compose on your Homeserver and see it come up in the Webinterface.
Then you create a public resource and point it to said site and give it a url.
Done.
Ask me if you have questions
frosch
Als Antwort auf prenatal_confusion • • •Cool, do you get any auth and/or ingress protection?
With cloudflare, you get some auth options, can block AI crawlers (that get recognized...) etc for free
prenatal_confusion
Als Antwort auf frosch • • •187OnAnUndercoverCop
Als Antwort auf frosch • • •Temp stuff where I could care less about the free tier domain name or things that I just want to funnel to my existing devices: Tailscale
Widespread, prolonged services that will be more actively maintained for a longer amount of time and can just spin off of its own domain/subdomain: Cloudflare
Both are great.
Lucy :3
Als Antwort auf frosch • • •FlexibleToast
Als Antwort auf frosch • • •giacomo
Als Antwort auf FlexibleToast • • •German The Jackal
Als Antwort auf giacomo • • •Decronym
Als Antwort auf frosch • • •Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
3 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.
[Thread #265 for this comm, first seen 30th Apr 2026, 19:30]
[FAQ] [Full list] [Contact] [Source code]
Decronym: A simple Reddit bot
Gistjlow
Als Antwort auf frosch • • •hendrik
Als Antwort auf frosch • • •French75
Als Antwort auf frosch • • •Evil_Incarnate
Als Antwort auf frosch • • •Illecors
Als Antwort auf frosch • • •frosch
Als Antwort auf Illecors • • •uuj8za
Als Antwort auf frosch • • •Reverse Proxy - NetBird Docs
docs.netbird.ioirmadlad
Als Antwort auf frosch • • •frosch
Als Antwort auf irmadlad • • •I'm a bit stumped, what do you gain from this setup?
Or do you mean just running some services through the tunnel for easy access and "hide" others behind tailscale?
hexagonwin
Als Antwort auf frosch • • •FauxLiving
Als Antwort auf hexagonwin • • •You can use e-mail now.
hexagonwin
Als Antwort auf FauxLiving • • •FauxLiving
Als Antwort auf hexagonwin • • •I haven't looked into it yet, I'm in the same position of using Google to login.
I just noticed that the login page changed.
ScytheDraven47
Als Antwort auf FauxLiving • • •potustheplant
Als Antwort auf FauxLiving • • •BCsven
Als Antwort auf hexagonwin • • •peskypry
Als Antwort auf hexagonwin • • •potustheplant
Als Antwort auf peskypry • • •zeitverschreib ⁂
Als Antwort auf hexagonwin • •@hexagonwin
I think Headscale gives you the option of using your own provider.
@frosch
Selfhosted hat dies geteilt.
frongt
Als Antwort auf frosch • • •skyline2
Als Antwort auf frongt • • •peskypry
Als Antwort auf frongt • • •frosch
Als Antwort auf frongt • • •Atherel
Als Antwort auf frosch • • •julianwgs
Als Antwort auf frosch • • •mlg
Als Antwort auf frosch • • •Wireguard.
Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don't bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).
It's still worth setting up a wildcard cert with ACME so you get nice https and a real domain.
frosch
Als Antwort auf mlg • • •Cloudflare has some opt-in auth. Mail-OTP is a nice balance imo: You can allowlist mail addresses per service/subdomain and set expiry for each.
Then for access, you first have to enter the mail address, get the OTP and then access the service.
So, nobody without access to allowed mail addresses even gets to knock on you door.
But yeah, that's why I think about going tail scale: why bother having something exposed when not needed?
I just think, some services might be nice to provide to friends, too - and having them connect to my tailnet for this is a bit too much friction, I guess
utjebe
Als Antwort auf frosch • • •Just Wireguard on a router, but I'm thinking Netbird.
WG can be a bit PITA to set up, but once you do, it just works. What I would to have is more fine grained control over who goes where if I were to expose some of the services to friends.