in my home lab a vm running a tailscale client and a reverse proxy with a Wildcard cert
all other services run as their own VMS and the proxy routes to them
i have a dmz (not yet public) running a proxy with tailscale again for a different domain
dmz runs a authentik vm which i use for access controll and user management
backup Server connects to tailscale as well and proxmox pushes zfs snapshots every day
My long term goal is to move to pangolin as a reverse proxy on the vps and tailscale alternative and remove tailscale, as i find its very battery inefficient on Android (no subnet Router etc).
So i just give people access to the VPN and send them an authentik invite and thats it. With pangolin i dont even have to give them a VPN access anymore, it can be done via authentik i think.
A vps is 3-6€ and the tailscale standard is 10€ so its even cheaper, but a bit more setup to maintain. But it allows a ton of users :) so i guess this would be the smallest change with the highest impact
Authentik is nice to have but a pain to set up as the oicd stuff can be tricky. Immich was super ez, nextcloud was OK, docspell was a pain and ocis does not work with authentik becsuse they use different architectures for sso. (Ocis and authentik are a bit dumb here)
So my setup rigjt now:
My long term goal is to move to pangolin as a reverse proxy on the vps and tailscale alternative and remove tailscale, as i find its very battery inefficient on Android (no subnet Router etc).
So i just give people access to the VPN and send them an authentik invite and thats it. With pangolin i dont even have to give them a VPN access anymore, it can be done via authentik i think.
A vps is 3-6€ and the tailscale standard is 10€ so its even cheaper, but a bit more setup to maintain. But it allows a ton of users :) so i guess this would be the smallest change with the highest impact
Authentik is nice to have but a pain to set up as the oicd stuff can be tricky. Immich was super ez, nextcloud was OK, docspell was a pain and ocis does not work with authentik becsuse they use different architectures for sso. (Ocis and authentik are a bit dumb here)