What I do: VPS with reverse proxy and ssh reverse tunnels from the homelab.

OG would be to understand IPv6 and use that directly. Depending on the services you plan to expose that could be a good way. Tried it some years ago, was hit and miss and I still don't get my head around how v6 work...but that would be the most independent, standalone way.

I rent a cheap VPS with iptables routing ports through a wireguard tunnel to a peer on the local network that acts as a firewall and reverse proxy, this gives you a static IP with a local control plane and no ddns.

A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let's encrypt and certbot to generate and manage TLS certificates.

I host around 15 public facing web services this way using nginx.

Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.

The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I'm not a fan of that, but it does bring benefits.

I got off CloudFlare by using Pangolin. Ideal for my use-case, I didn't use any of CF's advanced features, so Pangolin is the ideal replacement for me.

Publicly serves everything from static sites to forgejo (+the ssh endpoint for git pushes).

Reverse proxy is what you need. I would post instructions here but honestly they wouldnt be that good. Just search it up and follow along.

Authentication & single sign-on service

Plugged into Reverse proxy, routing to each service by name

With a wild card cert so there are no name leaks.

Make your urls unexpected. If your domain is example.com, don’t put your jellyfin server at jellyfin.example.com. Instead, use watch.example.com or telly.example.com. Anything that’s memorable to you about what the service is without using a specific brand name.

With a wildcard dns record to point all names to your IP, and a wildcard certificate that works for all names loaded on your load balancer, it becomes hard for a hacker to know what name to use to get the load balancer to send them to the service they want to hack.

If you then use a sso tool like traefik’s ForwardAuth middleware, you won’t even get to the service until you’ve first authenticated.

Why do you want to expose them? This might limit the solutions.

The way I do this is in 2 different ways:

1. Tailscale, my server connects to tailscale so all I have to do is connect to it from my phone and I can access things remotely easily. This is the best for most things, but has the downside that others can't access it as easily

2. I have a VPS (two actually at the moment as I'm switching providers from Vultr to IONOS) that also connects to tailscale so it can access my home server through it, then using Caddy I expose the services on a subdomain of the VPS. This is what I do for things that others might want to access, or things I don't want to have to connect to tailscale to access.

If you're going down the second route do consider that you will need to:

• Add something like fail2ban or crowdsec to the VPS as attacks will happen.
• Same reason you should add a dedicated authentication on front of most things. While I don't expect the auth on services to be weak, it might be more vulnerable than a dedicated authentication service. You should look into Authelia, Authentik, or similar to put on front of your services so any attacker would first have to pass that to even get to your services.

I recently switched to Netbird on a VPS (on Vultr). Their reverse proxy is super easy to set up / self host. They also offer a free version that works pretty good too, I just wanted to make it difficult for myself (thats the whole point of self hosting, right? )

i configured dyndns in my router and have it forward all traffic to a gateway vm running nginx and fail2ban. every service is on a subdomain so any attempt to fetch things from the main name gets banned.

Netbird reverse proxy: https://docs.netbird.io/manage/reverse-proxy

It's like Tailscale, but Open Source. You can self-host the components, if you want. I just use the cloud offering. I have a domain name that resolves to my server. There's different ways you can do auth. I just hard coded an allow list of IPs. Otherwise, devices in my Netbird network can use the private IP.

Recently set up caddy myself, very straightforward setup. You essentially just edit one config file and point your domain host to the right place and are good to go. Took me by surprise actually.

Make it publicly available to the world or just for you (and people you know)?

My router (gl-net) has a VPN server built in. I just use WireGuard client and freedns.

I personally use a vps for this stuff but my setup is standalone nginx as a reverse proxy and fail2ban and ufw

I can't answer your question as I haven't taken that step yet, everything is still confined to my LAN.

Here's a similar thread from last month that had a lot of replies. Hopefully will be some useful info there for you. Good luck!

Just a reverse proxy, I was using Caddy, moved to Pangolin because it's neat.

If you have a UniFi gateway, you can enable region based firewall on your port forward ip. This then blocks most of the world (incoming) as a first step. Then like others suggest, a reverse proxy. I use Caddy built with the Maxmind geolocation plugin, and I also run fail2ban on my exposed service.

I figure if you don’t need most of the world accessing your services, it is best to exclude them

I bought myself a Synology disk station and a domain.

Yes I use Cloudflare for DNS so I can get a wildcard domain cert using ACME.

I use the Synology supplied login portal as a web application firewall for every site I want to host with the wildcard SSL cert. Like bar.mydomain.com, mealie.mydomain.com, etc.

The Synology routes the traffic to the services hosted on other services within my network.

Anything else I don’t want open to the public web, I use the Synology supplied OpenVPN server to connect.

For those of us behind double NAT (CGNAT) forwarding ports is not an option as we do not control forwarding on the second gateway. This will limit you to any of the solutions that include a device outside your network with a public port that tunnels traffic into your server.