Collaborate: VPN or Open Access?
Hey folks,
I‘m new in the HomeServer business. So I started with two little applications on my Proxmox: paperless and do most
In the next time I’ll start a little project to collaborate more. Current I connect to my HomeServer with VPN. But if other people start connecting to my instance it would be useful to get an other secure system.
What is the way you prefer to give other people like your fam or friends access to your services (e. g. nextcloud)?
Thanks for helping an newbie!
11 replies
I'll just open them up to the internet via an nginx reverse proxy. Make sure sign up is disabled in the applications, and something blocks people from brute-forcing passwords. Pretty sure Nextcloud comes like that per default. And I'll do updates. And see if I can run stuff in containers or seperate users so in the unlikely case something happens, access to one of my services doesn't compromise the entire server.
Lots of other people use VPNs though. Like Wireguard, Netbird, Tailscale...
I do both. Wireguard VPN for anything that's just me. Expose via nginx proxy for things that are shared with friends and family.
I wouch for the VPN route... VPN servers are built to be exposed, are hardened/engineered to resist the harshness of the net and are somewhat safe even with default settings.
Should you publish on the wild a few web apps, you would have to harden, monitor and manage a bunch of environments and/or frameworks with a load of quirks each.
A VPN is easier to maintain and safer for your data with a lower effort.
Found Barry Kripke
At least of all the answers I prefer your way the most. So you set up a WireGuard access for all of the devices of your users on your router or did you install the vpn-system directly on the homeserver?
my home router is the stock one from my isp and have no vpn capabilities.
I put a port forward on the router and then configured everything on the internal node; in my case it is an opnsense vm running on proxmox.
I don't give access to any of my services to anyone, especially family or friends. LOL However, you could investigate Tailscale, Headscale, Wireguard. Additionally, if you set up Cloudflare Tunnel/Zero Trust, you can give individual users a unique access to your server. For example: You can allow [email protected] to access https://home.mysupercoolserver/shell but deny [email protected]. Only allow bob access only to https://home.mysupercoolserver/media.
I've been preferring mTLS recently. I still use a VPN for management, SMB/NFS, and anything important. But I use mTLS for web services that I'd like to access without having a VPN active all the time. Although, if your web service had a mobile app, usually they don't play nicely with mTLS, so a VPN would be required for me, but Home Assistant and TrilliumDroid do have mTLS support.
Do you happen to know of any guides on setting mTLS up?
I didn't find much other than descriptions of the technology from my search, but I'm probably not using the right terms.
I don't remember which one I specifically used, but theres plenty that show when you DDG "mtls nginx". There's probably others specific to other reverse proxies too.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
4 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.
[Thread #197 for this comm, first seen 29th Mar 2026, 00:20] [FAQ] [Full list] [Contact] [Source code]