If you don't want additional software requirements client side, then it means you need a publicly-routable IP address on your server, or at least publicly-routa

If you don't want additional software requirements client side, then it means you need a publicly-routable IP address on your server, or at least publicly-routable IP/port pairs. This can be achieved in a few ways: - use a VPN from a net-neutral ISP to obtain a real public IP address over VPN (5-10€/mo) - route specific ports to your own machine from an internet-facing server (via SSH/Wireguard/VPN tunnels) ; unfortunately it makes it impossible for different people (backend servers) to share a single routable port - reverse proxy specific protocols to a backend server, using for example TLS SNI (or eSNI) headers ; a single internet-facing server can serve many different vhosts to separate backends, where TLS encryption is terminated on the backend But of course you can run tor/i2p and other crypto-secure routing protocols (yggdrasil, zeronet, cjdns...) to expand the ways to reach your server. I'm unaware of good protocol-agnostic address discovery... for tor we usually do TOFU over DNS (eg. onionMX records) or HTTPS (HTTP2 Alt-SVC headers). The GNU Name System, at least on paper, sounds like the perfect crypto-secure naming scheme that could securely bootstrap addresses from names, but i don't think it has broad adoption yet.