I want to expose my services publicly on my own domain name, how would you guys do that?
I have seen people using Cloudflare, but I don’t want to use Cloudflare out of principle. I have also seen stuff on caddy and frp that I’ve done some rough researching.
What do you guys do?
You must log in or register to comment.
I rent a cheap VPS with iptables routing ports through a wireguard tunnel to a peer on the local network that acts as a firewall and reverse proxy, this gives you a static IP with a local control plane and no ddns.
Similar here. Just a Digital Ocean droplet running Pangolin. Functions basically the same as the cloudflare tunnel it replaced.
Can expose the service directly if needed, or from behind a login page.
What’s a cheap vps you recommend?
I hop around a lot. I’ve used Akamai (fka linode), Vultr, DigitalOcean, AWS EC2, and GCP Compute Engine. I wouldn’t recommend the last 2 anymore because fuck big tech. A lot of people will mention Oracle’s free tier, but I don’t trust anyone that looks like Larry Ellison to own a machine with a direct connection into my local network.
I resonate with you as well, so what kind of set up do you use now?
I use a cheap racknerd vps via low end box. $12/yr.
That’s crazy cheap price. Does it really have enough bandwidth to stream jellyfin?
Most VPS are on 1Gbps connections, but even if it only has 100Mbps that’s plenty.
Is there a data cap? I’m concerned like they only allow me to pass through like a TB or so of data passing through it within a month. If you have users watching your jellyfin server every day that can surpass your limit.
Yes generally around 1TB on cheap plans. That’s a ton of data though for streaming media, if youre moving more than that getting a higher tier VPS would make sense.
Keep in mind that you wouldn’t route local traffic through it, so everything watched at home would be direct and not count.
I have a $5/mo VPS with OVH and they allow unlimited bandwidth within reason. Unless you have multiple households streaming from your server all the time, likely totally fine. If you do end up with one relative streaming 24x7, then I would look at installing the tailscale app on their TV and configuring things to connect that one user direct to your home server.
A VPS takes some learning, but IMHO, it is the “correct” answer and worthile learning.
How do you set up security on your server with the constant attacks that come with having the server public?
Yes. (Depending on load) I run a server with 10 users, probably 2-3 active at any given time. Works fine.
A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let’s encrypt and certbot to generate and manage TLS certificates.
I host around 15 public facing web services this way using nginx.
Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.
The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I’m not a fan of that, but it does bring benefits.
A lot of folk decry Cloudflare as a terrible corp (and their AI push now involves the login page shunted to the side while 70% of the screen is a relatively blank section with some sentence about using their AI), but what is the non-3rd party alternative? Does one rely on sharing the IP instead? It is impossible to have public (non-family) traffic without a Cloudflare/Google DNS resolver right?
Being on a standard ISP I cannot use a higher-level rDNS.
It costs a little but a VPS running Pangolin and Crowdsec is a decent replacement for cloudflare for hiding your IP and having some extra protection.
im on a basic uk isp, with no fancy router, just the isp provided one. i have a fully exposed web server, im even hosting a lemmy server. Thats my domain, radiantfig.fyi, totally public, has been for nearly 2 years now. From that you can get my servers IP address. My IP is dynamic, changes roughly every 6 weeks. I have a ddns script that updates my server IP address to my domain name provider automatically. I have certbot running updating my TLS certs with lets encrypt, and if a cert dies or fails or is compromised, my server will refuse to serve. Everything is behind an nginx reverse proxy through port 443. I also have an ssh port open on a random port. Have fail2ban setup fairly aggressively to prevent brute force attacks, and have crowdsec which also kind of does the same but in a slightly different way. the internet requires ip addresses. to protect your ip address you have to give somebody elses. that somebody is a 3rd party you have no control or say on the decisions they make. i must have over 20 individual services that are public facing. 3 fully federated, lemmy, forgejo and matrix. Im as secure as any other website. nothing is unhackable, no matter how far down the rabbit hole you go. its all just layers of difficulty.
The important thing is dont listen to random internet people about security. dont listen to me. dont listen to anybody who tells you they know best. do your own research, understand the options, the risks, the compromises. only then do you put anything up. but if you are going to anxious or worried about your server and data, no amount of security guarantees you safety, so be warned.
I bought myself a Synology disk station and a domain.
Yes I use Cloudflare for DNS so I can get a wildcard domain cert using ACME.
I use the Synology supplied login portal as a web application firewall for every site I want to host with the wildcard SSL cert. Like bar.mydomain.com, mealie.mydomain.com, etc.
The Synology routes the traffic to the services hosted on other services within my network.
Anything else I don’t want open to the public web, I use the Synology supplied OpenVPN server to connect.
I also have a synology but my old gaming laptop does video transcoding better so I have it on debian right now and am figuring out the best set up to access it and self host services to access publicly
For those of us behind double NAT (CGNAT) forwarding ports is not an option as we do not control forwarding on the second gateway. This will limit you to any of the solutions that include a device outside your network with a public port that tunnels traffic into your server.
I’m not behind CGNAT/double NAT but I’m curious, can you use IPv6 to bypass that?
To some degree yes. I ran an experiment to see and found there is just too much of the existing internet infrastructure not implementing IPV6 for this to be reliable. For instance, you can’t use it for email intake because only 2 major players do IPV6.
You still get dynamic assignments from the ISP and have to automate keeping your AAAA records up to date.
The short answer is, it depends. For what OP is doing here, I expect it would work.
If anyone else has messed with this, I’d love to here about it. Might be good as it’s own post.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority CSAM Child Sexual Abuse Material DNS Domain Name Service/System Git Popular version control system, primarily for code ISP Internet Service Provider SSD Solid State Drive mass storage TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
10 acronyms in this thread; the most compressed thread commented on today has 24 acronyms.
[Thread #74 for this comm, first seen 6th Aug 2026, 09:00] [FAQ] [Full list] [Contact] [Source code]
I got off CloudFlare by using Pangolin. Ideal for my use-case, I didn’t use any of CF’s advanced features, so Pangolin is the ideal replacement for me.
Publicly serves everything from static sites to forgejo (+the ssh endpoint for git pushes).
Authentication & single sign-on service
Plugged into Reverse proxy, routing to each service by name
With a wild card cert so there are no name leaks.
Make your urls unexpected. If your domain is example.com, don’t put your jellyfin server at jellyfin.example.com. Instead, use watch.example.com or telly.example.com. Anything that’s memorable to you about what the service is without using a specific brand name.
With a wildcard dns record to point all names to your IP, and a wildcard certificate that works for all names loaded on your load balancer, it becomes hard for a hacker to know what name to use to get the load balancer to send them to the service they want to hack.
If you then use a sso tool like traefik’s ForwardAuth middleware, you won’t even get to the service until you’ve first authenticated.
I recently switched to Netbird on a VPS (on Vultr). Their reverse proxy is super easy to set up / self host. They also offer a free version that works pretty good too, I just wanted to make it difficult for myself (thats the whole point of self hosting, right? )
I have seen netbird pop around every now and again. I might try out their cloud free version first and if I like it I might try self hosting it.
So you host netbird on a vps you rent and that is used for reverse proxy? So with that reverse proxy I can have my home server be publicly accessible and I can have friends log in to my jellyfin server without having to connect to my tailnet.
My last concern is security. How is this set up good for making sure I don’t just get constantly botted and exploited?
Yup! They can either connect to your Netbird meshnet (ie, similar a tailnet) or you can reverse proxy it out to the internet (no tailnet needed)
I saw a couple comments below concerned about security, one of the nice things about Netbird is that they have reverse proxy auth built in if you want. Some stuff (Navidrome or VoidAuth for instance) only has geolocation locked down (US only) but other things that I’m either more concerned about or don’t necessarily trust being open (Paperless or Komodo for instance) have Netbird Auth and VoidAuth as sign in options before it will let me open the page. Its worked flawlessly so far, and has kept my sanity intact because I wanted some stuff publically accessible without it being OPEN.
As far as being hammer fucked, it has CrowdSec and Geolocation lockdowns so you can set it to only accept traffic from ONE location and the Crowdsec also catches everything.
Opening jellyfin up publicly is kind of asking for trouble if you ask me. I haven’t done so myself, but seen enough on this community and elsewhere to know that it’s probably not a good idea.
You’re probably misunderstanding what netbird does (unless I’m the one misunderstanding things?).
Netbird subnet is equivalent to a tailscale tailnet (for all practical purposes; they even both use wireguard and hole-punching underneath). Netbird is not a reverse proxy (which I feel is what you think based on your comment).
Just a reverse proxy, I was using Caddy, moved to Pangolin because it’s neat.
