Hey folks,
I‘m new in the HomeServer business. So I started with two little applications on my Proxmox: paperless and do most
In the next time I’ll start a little project to collaborate more. Current I connect to my HomeServer with VPN. But if other people start connecting to my instance it would be useful to get an other secure system.
What is the way you prefer to give other people like your fam or friends access to your services (e. g. nextcloud)?
Thanks for helping an newbie!
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters HTTP Hypertext Transfer Protocol, the Web NFS Network File System, a Unix-based file-sharing protocol known for performance and efficiency SMB Server Message Block protocol for file and printer sharing; Windows-native VPN Virtual Private Network nginx Popular HTTP server
4 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.
[Thread #197 for this comm, first seen 29th Mar 2026, 00:20] [FAQ] [Full list] [Contact] [Source code]
I’ve been preferring mTLS recently. I still use a VPN for management, SMB/NFS, and anything important. But I use mTLS for web services that I’d like to access without having a VPN active all the time. Although, if your web service had a mobile app, usually they don’t play nicely with mTLS, so a VPN would be required for me, but Home Assistant and TrilliumDroid do have mTLS support.
Do you happen to know of any guides on setting mTLS up?
I didn’t find much other than descriptions of the technology from my search, but I’m probably not using the right terms.
I don’t give access to any of my services to anyone, especially family or friends. LOL However, you could investigate Tailscale, Headscale, Wireguard. Additionally, if you set up Cloudflare Tunnel/Zero Trust, you can give individual users a unique access to your server. For example: You can allow alice@mysupercoolserver.com to access https://home.mysupercoolserver/shell but deny bob@mysupercoolserver.com. Only allow bob access only to https://home.mysupercoolserver/media.
I do both. Wireguard VPN for anything that’s just me. Expose via nginx proxy for things that are shared with friends and family.
I’ll just open them up to the internet via an nginx reverse proxy. Make sure sign up is disabled in the applications, and something blocks people from brute-forcing passwords. Pretty sure Nextcloud comes like that per default. And I’ll do updates. And see if I can run stuff in containers or seperate users so in the unlikely case something happens, access to one of my services doesn’t compromise the entire server.
Lots of other people use VPNs though. Like Wireguard, Netbird, Tailscale…
I wouch for the VPN route… VPN servers are built to be exposed, are hardened/engineered to resist the harshness of the net and are somewhat safe even with default settings.
Should you publish on the wild a few web apps, you would have to harden, monitor and manage a bunch of environments and/or frameworks with a load of quirks each.
A VPN is easier to maintain and safer for your data with a lower effort.
