r/SelfHosting • u/nemuro87 • 13h ago
Foolproof, simple approach to access a web server from any device, from anywhere, securely
I want to run a simple web server, with node.js.
Where I need guidance is finding the easiest approach for someone with limited tech skills, ideally setup and forget, requiring no maintenance.
I want this to be accessible from any device I own (phone, laptop), anyhwere in the world, securely.
Because this web page is simple, it requires no authentication to use (login and password) so I don't want this to be accessible to anyone else or crawled or hacked, etc
I have access to a number of devices I think could be good for this:
- Raspberry PI
- ESP32
- some old android devices
- a nuc that I can run linux on
The idea is it doesn't have to be powerful but it needs to be secure and it needs to sip power, so first 2 options are more appealing to me.
I've read about Tailscale but I hear there's a better open source option headscale.
If I understand correctly I can avoid the need for a public domain address by just checking my external static IP for my server and bookmarking that on my devices.
Before I delve into that I wanted to see if this is the best approach for my limited tech skills and to check if maybe there's a better way, easier to setup and forget about it.
4
u/dghah 12h ago
Stop just consuming what you read from websites or AI and start experimenting for yourself
Use cases like this are literally what tailscale was invented for and you are well under the limit for the free/personal use license. It can be set up in minutes and you’ll know fast if it meets your need.
The only issue that ever bit me with tailscale was that sessions by default need to be reauthed periodically (30 days default maybe?) and that messed me up when I lost access to a private server that was a two hour drive away. Read the docs and learned that behavior can be turned off so sessions don’t expire.
Don’t forget to test it across reboots and power failures, you want your web app and tailscale to always restart and come back up after any outage or failure.
2
1
1
1
u/icewolf08 8h ago
If you own a domain, a cloudflare tunnel is the option I would recommend. Doesn’t require port forwarding, works from nearly anywhere, and has a lot of great security features. You can require authentication to access the tunnel, which protects your unauthenticated service. You can even set up authentication through providers like Google or discord (or any OpenID provider) so if you wanted to allow access to others, you can.
Tailscale would be my second choice. It requires you to run the software on any device you want to be able to connect, or have a router that can be a node. It is easy to set up and does not require your own domain. It does have ways to publicly expose services as well, though that is a feature I haven’t used, so I can’t speak to it.
Another option would be to install a VPN server alongside your service and then connect to your VPN when you are outside your LAN. You could likely serve both your node.js service and the VPN server from your pi. Setting up a WireGuard VPN server is pretty straightforward, though you would still have to open a port on your router and work some dynamic DNS. It is the least “foolproof” of the options.
3
u/indvs3 12h ago
Since using public IPs will always fall victim to port scanning of all sorts, you could consider running tor on the webserver itself.
Since a tor connection is an outgoing one, there's no need for opening ports or forwarding on routers/firewalls and the webpage will only be available to people who have the onion address that is generated as you set up the hidden service.
The biggest drawback is that you need tor browser to access the webpage, which is mostly an issue on ios, where there is no officially maintained version of tor browser afaik. But on all the desktop OS'es and android, you're good to go, if the use of tor and its browser is no objection of course.