I want to expose my services publicly on my own domain name, how would you guys do that?

I have seen people using Cloudflare, but I don’t want to use Cloudflare out of principle. I have also seen stuff on caddy and frp that I’ve done some rough researching.

What do you guys do?

  • Decronym@lemmy.decronym.xyzBEnglish
    1·
    6 minutes ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    DNS Domain Name Service/System
    Git Popular version control system, primarily for code
    TLS Transport Layer Security, supersedes SSL
    VPN Virtual Private Network
    VPS Virtual Private Server (opposed to shared hosting)
    nginx Popular HTTP server

    6 acronyms in this thread; the most compressed thread commented on today has 13 acronyms.

    [Thread #74 for this comm, first seen 6th Aug 2026, 09:00] [FAQ] [Full list] [Contact] [Source code]

  • myrmidex@belgae.socialEnglish
    2·
    1 hour ago

    I got off CloudFlare by using Pangolin. Ideal for my use-case, I didn’t use any of CF’s advanced features, so Pangolin is the ideal replacement for me.

    Publicly serves everything from static sites to forgejo (+the ssh endpoint for git pushes).

  • fozidAEnglish
    5·
    2 hours ago

    A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let’s encrypt and certbot to generate and manage TLS certificates.

    I host around 15 public facing web services this way using nginx.

    Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.

    The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I’m not a fan of that, but it does bring benefits.

  • MagnificentSteiner@lemmy.zipEnglish
    1·
    2 hours ago

    I can’t answer your question as I haven’t taken that step yet, everything is still confined to my LAN.

    Here’s a similar thread from last month that had a lot of replies. Hopefully will be some useful info there for you. Good luck!

  • Karna@lemmy.mlEnglish
    3·
    3 hours ago

    Make it publicly available to the world or just for you (and people you know)?

  • Nibodhika@lemmy.worldEnglish
    3·
    3 hours ago

    Why do you want to expose them? This might limit the solutions.

    The way I do this is in 2 different ways:

    1. Tailscale, my server connects to tailscale so all I have to do is connect to it from my phone and I can access things remotely easily. This is the best for most things, but has the downside that others can’t access it as easily

    2. I have a VPS (two actually at the moment as I’m switching providers from Vultr to IONOS) that also connects to tailscale so it can access my home server through it, then using Caddy I expose the services on a subdomain of the VPS. This is what I do for things that others might want to access, or things I don’t want to have to connect to tailscale to access.

    If you’re going down the second route do consider that you will need to:

    • Add something like fail2ban or crowdsec to the VPS as attacks will happen.
    • Same reason you should add a dedicated authentication on front of most things. While I don’t expect the auth on services to be weak, it might be more vulnerable than a dedicated authentication service. You should look into Authelia, Authentik, or similar to put on front of your services so any attacker would first have to pass that to even get to your services.
  • lime!@feddit.nuEnglish
    3·
    4 hours ago

    i configured dyndns in my router and have it forward all traffic to a gateway vm running nginx and fail2ban. every service is on a subdomain so any attempt to fetch things from the main name gets banned.

  • spork@pawb.socialEnglish
    5·
    6 hours ago

    I rent a cheap VPS with iptables routing ports through a wireguard tunnel to a peer on the local network that acts as a firewall and reverse proxy, this gives you a static IP with a local control plane and no ddns.

  • AllYourSmurf@lemmy.worldEnglish
    3·
    5 hours ago

    Authentication & single sign-on service

    Plugged into Reverse proxy, routing to each service by name

    With a wild card cert so there are no name leaks.

    Make your urls unexpected. If your domain is example.com, don’t put your jellyfin server at jellyfin.example.com. Instead, use watch.example.com or telly.example.com. Anything that’s memorable to you about what the service is without using a specific brand name.

    With a wildcard dns record to point all names to your IP, and a wildcard certificate that works for all names loaded on your load balancer, it becomes hard for a hacker to know what name to use to get the load balancer to send them to the service they want to hack.

    If you then use a sso tool like traefik’s ForwardAuth middleware, you won’t even get to the service until you’ve first authenticated.

    • Helix 🧬@feddit.orgEnglish
      3·
      4 hours ago

      If you use TLS like you should, your domains will be on the internet in the certificate transparency log. Yes, you should use a wildcard cert if you want this security by obscurity, but it’s still security by obscurity.

  • ISolox@lemmy.worldEnglish
    3·
    6 hours ago

    Reverse proxy is what you need. I would post instructions here but honestly they wouldnt be that good. Just search it up and follow along.

  • RanchBranch@anarchist.nexusEnglish
    0·
    5 hours ago

    I recently switched to Netbird on a VPS (on Vultr). Their reverse proxy is super easy to set up / self host. They also offer a free version that works pretty good too, I just wanted to make it difficult for myself (thats the whole point of self hosting, right? )

    • /home/pineapplelover@lemmy.dbzer0.comOPEnglish
      0·
      5 hours ago

      I have seen netbird pop around every now and again. I might try out their cloud free version first and if I like it I might try self hosting it.

      So you host netbird on a vps you rent and that is used for reverse proxy? So with that reverse proxy I can have my home server be publicly accessible and I can have friends log in to my jellyfin server without having to connect to my tailnet.

      My last concern is security. How is this set up good for making sure I don’t just get constantly botted and exploited?

      • stratself@lemdro.idEnglish
        1·
        3 hours ago

        I do this albeit with Tailscale. Netbird/Tailscale would act as a node of your VPN and you can configure reverse proxy routes (via tailscale serve or Netbird’s equivalent) from the VPS edge to the homelab. You can even do SNI passthrough and have TLS terminated at your home, if you want, though this can be a bit slower

        Alternatively you can even expose stuff via their servers. Tailscale Inc calls this service Funnels, and Netbird should have similar offerings. It’s kinda like Tunnels but you gotta use their domains, so a VPS acts greater as a dedicated entrypoint.

        Lastly yes you’d be exposing the service to the general public internet, so some basic security is needed. Netbird has a Crowdsec module integration, might wanna look at that one and set up rules/detections. Consider putting extra auth in front of Jellyfin, use Authelia or something with an auth screen. And only expose the stuff you need, not your internal dashboard or whatever admin UI.

      • InnocentZero@kbin.earth
        1·
        5 hours ago

        Opening jellyfin up publicly is kind of asking for trouble if you ask me. I haven’t done so myself, but seen enough on this community and elsewhere to know that it’s probably not a good idea.