forbiddenlake

Tailscale ssh isn’t enabled by default and I for one don’t see the need for it.

Your choice is valid, but you’ve chosen to be responsible for adding new clients everywhere and making sure they can all connect to each other, etc. you have simpler software but more manual work, which is a valid choice if you’re up for it.

Your stance rules out all the big and mature software. No judgement on the stance, but you are asking a difficult question.

Off that alternatives list, the only one I’ve heard of is lighttpd, and it’s news to me that lighty can do reverse proxying. But I would try that.

I expect it to be a lot more difficult to find documentation and support for anything more obscure than lighty. Which may be fine for you, just know what you’re getting in to.

As for certbot, iirc you need to add a renew command to cron, but otherwise certbot will take care of it. I’m sure the cron is in the documentation.

Note that sudo echo does not work as non root because the shell redirection is attempted before the command runs. You want echo foo | sudo tee -a /bar instead