3 ms·
Another approach I’ve seen is to route public access from Traefik/nginx through a single Cloudflare tunnel instead, and Tailscale/Headscale can be left for priv
by j45 1y ago
Another approach I’ve seen is to route public access from Traefik/nginx through a single Cloudflare tunnel instead, and Tailscale/Headscale can be left for private network and server access.
The traefik box can have the single Cloudflare tunnel , and tailscsle can hang out behind the scenes.
This way tailscale funnel doesn’t need to be public.
There is the self hosted Cloudflare alternative that’s escaping my mind right now too.
- Jnr 1y agoCloudflare also issues certs and logs them in transparency logs. If you do not create a wildcard cert in Cloudflare, your subdomains will leak. And Cloudflare offers free wildcard certs only on the domain root.
- j45 1y agoAppreciate this super valid consideration. If services are being exposed for friends and family, using cloudflare tunnels might be a trade off between security or convenience. If the goal is to ensure security of a home lab online, the less of it that’s discoverable by automated bots, etc, the better.