[mystraline]

Yeah, I just use a VPS box I pay $20/year for. Only the most basic config goes on this machine. Basically load is 0.1 , and has no data.

Then I run my stuff locally.

And then I use ssh tunneling to forward the port to localhost of the remote machine. Its a unit file, and will reconstruct the tunnel every 30s if broken. So at most 30s downtime.

Then nginx picks it up.

[rmunn]

Brilliant.

I use Tailscale myself, but if you want everything totally under your control (and don't want to go to the trouble of setting up headscale or something similar) then that's one of the absolutely simplest, lowest-effort ways of doing it. EDIT: Well, except for the VPS box I suppose, but if that provider went down or you had any reason to suspect they were doing anything suspicious, it would be quite simple to jump to a different provider, so that's pretty darn close to controlling everything yourself.

[mystraline]

Yep. Ive had the same provider for 3y going on 4.

Particular things: I use letsencrypt wildcard, so my subdomains aren't leaked. If you register per subdomain, LE leaks all your subdomains as part of some transparency report. Learned that and had to burn that domain.

The VPS is from LowEndBox. Like 2 core, 20GB storage 2GB ram. But runs perfectly fine.

I run jellyfin, audiobookshelf, Navidrome, and Romm. Ssh tunnel per application.

It would also be trivial to switch providers as well. But again, not a seed box, not doing torrents, not doing anything that would attract attention. And best of all, no evidence on the VPS. Its all SSL and SSH.

[BobbyTables2]

I do something similar using an openvpn tunnel (home->vps). Iptables rules on the VPS redirect services to the VPN client IP.

Client automatically deals with reconnecting, never have to touch it.

SSH tunnel would have been simpler, just didn’t want it open.

SSH tunnel probably needs the keep alive on, otherwise connection loss may not be detected.