Comment on I love Home Assistant, but...
hai@lemmy.ml 7 months agoI largely agree with this, but (and this might be me being a little paranoid) I don’t really trust anyone to handle my data like that. I self-host as much as possible to get away from things beyond my control, I understand that this is an extremist view of things, but the only reason why I use Tailscale Funnel is because the family would either not know how to, or not want, to deal with a VPN like that.
Nyfure@kbin.social 7 months ago
As far as i understood tailscale funnel its just a TCP-tunnel.
So you handle TLS on your own system, which makes sure tailscale cannot really interfere.
If you already trust them this far, might aswell do the same with a VPS and gain much more flexibility.
I'd connect the VPS and your home system via VPN (you can probably also use tailscale for this) and then you can use a tcp-tunnel (e.g. haproxy), or straight up forward the whole traffic via firewall-rules (a bit more tricky, but more flexible and can preserve original source IP without PROXY-Protocol, which doesnt always work, but do what works and is easy).
This way you can use all ports, all protocols, incoming and outgoing traffic with the IP-Address of the VPS.
And as you terminate TLS on your home-system, traffic flowing through the VPS is always encrypted.
If you want to go overboard, you can block attackers on the server before it even hits your home-system (i think crowdsec can do it, the detector runs on your home-system and detects attacks and can issue bans which blocks the attacker on the VPS)
And yes, its a bit paranoid.. but its your choice.
My internet connection here isnt good enough to do major stuff like what i am doing (handling media, backups and other data) so i rent some dedicated machines (okay, i guess a bit more secure than a VPS, but in the end its not 100% in your control either)