No remote access path to LAN-only services #109
Labels
No labels
audit-work
bug
docs
general-admin
major-upgrade
needs-vps-sync
new-service
on-hold
outside-work
post-podman
renovate
upstream
vps
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
mysticalsoap/docker#109
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
No WireGuard, Tailscale, or Netbird. AdGuard's UI, Prowlarr, Alertmanager, LLDAP, and qBittorrent have no remote path at all. The frp+Authelia model deliberately avoids exposing them, which is defensible -- but it also means "fix Prowlarr from a hotel" isn't possible.
Self-hosted wg-easy fits the FOSS/no-account preference considerably better than Tailscale's coordination server.
Architecture note before picking a tool: home-side wg-easy means opening/forwarding a UDP port on the home router — the one thing the frp/VPS design exists to avoid. The shape that stays consistent with "home dials out, nothing dials in" is a WireGuard hub on the VPS (wg-easy there under Quadlet, or headscale if mesh/roaming matters), with the home host as an ordinary outbound-dialing peer. Phone → VPS → home, same trust direction as frp.
Trade to weigh: LAN-only admin traffic (Prowlarr, LLDAP, qBittorrent) would then transit the VPS. WireGuard is end-to-end encrypted so the VPS only relays ciphertext, but it becomes a availability dependency for remote admin — acceptable given it already is one for everything public. Sequencing: after #100/#101 (Quadlet on the VPS).