So my setup rigjt now:
- vps with headscale
- all devices connect to it
- in my home lab a vm running a tailscale client and a reverse proxy with a Wildcard cert
- all other services run as their own VMS and the proxy routes to them
- i have a dmz (not yet public) running a proxy with tailscale again for a different domain
- dmz runs a authentik vm which i use for access controll and user management
- backup Server connects to tailscale as well and proxmox pushes zfs snapshots every day
My long term goal is to move to pangolin as a reverse proxy on the vps and tailscale alternative and remove tailscale, as i find its very battery inefficient on Android (no subnet Router etc).
So i just give people access to the VPN and send them an authentik invite and thats it. With pangolin i dont even have to give them a VPN access anymore, it can be done via authentik i think.
A vps is 3-6€ and the tailscale standard is 10€ so its even cheaper, but a bit more setup to maintain. But it allows a ton of users :) so i guess this would be the smallest change with the highest impact
Authentik is nice to have but a pain to set up as the oicd stuff can be tricky. Immich was super ez, nextcloud was OK, docspell was a pain and ocis does not work with authentik becsuse they use different architectures for sso. (Ocis and authentik are a bit dumb here)
WASTECH@lemmy.world
Dalraz@lemmy.ca 1 day ago
This is close to make my setup is as well, mine is all in docker though and with a treafik reverse proxy as the only entrypoint. To help minimize my security risk I have a few middlewares, crowdsec and geofilter. Everyone that requires access are all in one country so I drop all other connections.
I do have private and internal applications as well and use Netbird self-hosted over tailscale.
Also because docker networking can be a little permissive I updated the nftables to drop attempted requests to my local network.
I never heard of pangelin thanks for bringing my attention to it.