WASTECH

I second Pocket ID. I initially set up Authentik, but after discovering Pocket ID and giving it a try, it is way easier to set up and use. Authentik is great if you want to customize everything, but for my needs it was too much. I was able to migrate everything to Pocket ID in an afternoon, whereas Authentik took me several hours over the course of a few days to get set up.

I was fortunate enough to get a .io domain with my first initial and last name (I have a very common last name), and I have stuck with that ever since. I am a bit concerned with the political stuff around it, as the domain may be going away as some territory changes hands. But I think at this point there are enough large companies using the domain that I’m hoping it would be protected if the country ends up losing the domain.

I have just recently started messing with Authentik. And I can confirm OIDC claims and whatnot are an absolute nightmare. I have some experience setting up SAML stuff from my work, but I only do that if our main guy is out and I always struggle with it there too.

Your setup sounds the most like what I am doing now, minus the DMZ. But all of my containers are rootless. I am running everything on TrueNAS right now.

I think I will lean more on Authentik, as the provisioning of users and giving them access to services through that is very easy. I will probably stick with Cloudflare for the time being, but I will look more into Pangolin.

My ISP is charging $20/mo for static IP’s, so almost any other solution would be cheaper.

I hate Oracle with the passion of a thousand suns, so I don’t want to touch them with a 10ft pole. I would happily pay anyone else to avoid using anything affiliated with Oracle.

Thanks for the warning. My Plex server is currently behind a Cloudflare tunnel, so I probably need to look at moving that.

I mistook pangolin for netbird, so thanks for the clarification!

I would like to avoid paying for a VPS. I probably should have clarified in my post too that I am specifically looking for advise on securing public facing services. While I certainly could make everyone use a tailscale-like service, at this point I think securing an external service would be easier. Especially since most of these people would not be tech savvy and I don’t particularly want to play tech support for their VPN.