I was very skeptical because I didn’t want to punch holes into that nice safe lan. Pangolin got me in the end after I left tail scale with its easy docker for a cheap vps (1GB ram) and its approach in general.

For example I am running my services locally in a docker via compose. I add a newt endpoint (pangolin talk) that is a docker container with some with info for my pangolin instance ton said compose and I have only the content of said docker compose connected via wireguard.

Next step is exposing a public resource where you choose a specific service and port to map to a public URL.

It is all so compartmentalized its fantastic and makes me feel good about that public service.

Securing that service itself is possible with an additional auth layer.