Hello,

I need an overview of the options that are available today for making self-hosted apps securely available externally via my own domain.

My plan (maybe incomplete) looks something like this:

- Booking a small VPS linux server in the internet with fixed IPv4 address

- Building a VPN between opnsense or via unraid in my private network with the VPS server. (I have CGNAT so no external port forwarding possible)

- In the DNS matching my domain and all subdomains *.mydomain.tld to the IP of the VPS.

- Using authelia as a Single Sign On Provider framework for authenticate at the reverse proxy and user management for the Apps that runs on unraid

- Maybe using of Crowdsec for attack protection

- Firewall with Geoblocking (only germany should be allowed, maybe other countries too)

- Some apps I want to make available on the internet, Outline, Home Assistant, Nextcloud, etc.

- Should then be accessible via home.mydomain.tld, cloud.mydomain.tld, wiki.mydomain.tld

What exactly do I need for this, and where do I need to install it?

- Which tools are installed on the VPS server? Or is the VPN client and port forwarding to the reverse proxy running as an app on Unraid sufficient?

- Or does the reverse proxy have to be installed on the VPS? Then the installation under e.g. Debian Linux has to be done manually, because there is no Unraid running.

- Or can I get the VPS management into an Unraid GUI?

- Or can I install the Proxy as App on Unraid? So I could using split dns resolving for internal usage, so accessing the services internally, the external VPS server is not used.

- Which VPN should I use here? Wireguard? IPsec?

- Which apps do I need in total and where do they have to be installed?

First, I would start with the “outline” service as a wiki to make it available externally as the first project and connect this app to a central authentication service.

Can anyone give me a manual where this has already been described? It can also be the most modern technology possible.

Thank you for your suggestions and help.

places like go daddy where you purcahse the domain to begin with have theses services. often users will use go daddy and nds and html /JS web code to rediret the domain page to a sub domain ... like afraid dns free sub domaind. soemtimes due to static IP and cgnat issues for dns domain name to IP. then use the sub domain form afraid dns and point it at a VPS or self hosted server.

ther are quite a Few VPS out thers the 2 common know ones are Google Cloud Console and Amazon AWS... you pay x amount for x resources... you then are running a bare linux server somethign like ubunut or debain and run dockers/code direct...

SO Go Daddy domain > subdoamin(sometiems) > AWS VM > Linux Server > app/Docker...

what do you want it to do and how do you want to interact with it... I know of a few VPS taht are free. and depending on what app you trying to host and how much traffic it actualy gets may warrant what $$$ and gorup you go with.

You’re basically trying to solve two problems:

1. Get traffic from the internet to your Unraid services despite CGNAT.

2. Secure it with authentication, geo-blocking, and possibly WAF-like protections.

....

Core Architecture

Because you’re behind CGNAT, you can’t just open ports from home — you’ll need the VPS to act as a reverse proxy “bridge” to your LAN.

Internet → VPS (reverse proxy) → VPN tunnel → Unraid services

I asume unraid and slef hosteing a VPS...
Example with Outline on Unraid:

• wiki.mydomain.tld → VPS (Nginx Proxy Manager, Caddy, or Traefik) → WireGuard/IPsec tunnel → Unraid Docker network → Outline container

Where each component lives

• VPS (public IP, Debian/Ubuntu)

  • Reverse proxy (Nginx Proxy Manager, Caddy, or Traefik)

  • Authelia (can also run on Unraid, but many put it on the VPS so auth happens before traffic enters LAN)

  • CrowdSec (optional, for attack mitigation)

  • Firewall rules (UFW, iptables, or provider firewall) + GeoIP filtering

• Unraid (private network)

  • Your apps (Outline, Nextcloud, Home Assistant, etc.)

  • Optionally Authelia (if you prefer local auth instead of on VPS)

  • VPN server/client (WireGuard or IPsec) connecting to the VPS

  • Internal reverse proxy for LAN access (NPM, Traefik, Caddy)

  • Split DNS so wiki.mydomain.tld resolves locally when you’re at home

Why the VPS reverse proxy is often better

• With CGNAT, your home IP is hidden — the VPS must terminate HTTPS and then forward traffic over a secure VPN to your LAN.

• If you put the reverse proxy on Unraid only, the VPS still needs something to forward ports → this usually means you’re duplicating reverse proxy config.

• With VPS reverse proxy, you:

  • Terminate SSL there

  • Apply Authelia/CrowdSec before hitting your LAN

  • Use a single WireGuard tunnel for all subdomains/services

VPN choice

• WireGuard is faster, easier to configure, and lighter on CPU.

• IPsec is more “enterprise” and works well with site-to-site scenarios but is harder to set up.

• For this setup: WireGuard is perfect.

  • VPS runs WireGuard server

  • Unraid runs WireGuard client

  • VPS reverse proxy sends requests through WireGuard tunnel to Unraid

• ?Tailscale intergration with unraid docker...

DNS setup

• Buy/keep your domain (GoDaddy, Namecheap, Cloudflare, etc.)

• Set A record for *.mydomain.tld → VPS public IP

• If using Cloudflare, you can add:

  • DDoS protection

  • Free SSL

  • Geo-blocking before traffic even hits your VPS

Split DNS for internal use

• At home, your router or OPNsense can override DNS so wiki.mydomain.tld points directly to Unraid’s LAN IP.

• This avoids routing local requests out to the VPS and back in.

Tool Recommendation

Modern guide you can follow:

Here’s a generic flow that matches your needs:

1. Rent VPS (Debian 12 minimal, 1 vCPU, 1 GB RAM is enough for proxy + Authelia)

2. Install Docker + Docker Compose on VPS

3. Deploy:

   • Caddy or Traefik (with Let’s Encrypt)

   • Authelia in front of protected services

   • CrowdSec for security

4. Set up WireGuard server on VPS and client on Unraid

5. Configure proxy rules → WG tunnel → LAN app

6. Update domain DNS to point to VPS

7. Configure OPNsense or Unraid to handle split DNS

Example projects/tutorials to reference

https://www.authelia.com/docs/

SSO, 2FA, JWT, etc.

https://www.authelia.com/integration/proxies/caddy/

caddy with autheli

a... very clean config

https://www.wireguard.com/#documentation

Wireguard site to site...

https://doc.crowdsec.net/docs/getting_started/install_crowdsec_docker/

CrowdSec on Docker...

Flow explanation:

1. User types wiki.mydomain.tld in browser.

2. DNS sends them to the VPS’s public IP.

3. VPS reverse proxy receives request, checks Authelia (SSO, 2FA, access rules).

4. If allowed, VPS sends the request over WireGuard VPN to your Unraid server.

5. Unraid’s app container serves the page back via the same VPN tunnel → VPS → user.

6. If you’re at home, split DNS means your browser talks directly to Unraid’s LAN IP, skipping the VPS.

I Personally use unifi equipment, unifi teleport and tailscale. With free subdomains with unifi tunnel for external app access. immich/plex.

Often for a price, cgnat ISP have a price for a staic IP.

I'd look into runnign a npm (Nginx revers proxy) and tailscale sidecar funnel for app remote access.

Thank you for the comprehensive description.

I have done some own research for this, and I think it will be a good solution to use Pangolin project on the VPS-Server. Easy management and all-in-one proxy & security solution.

Should I use the wireguard client on Unraid or on the opnsense firewall connected in front of it? Both are able to use wireguard.

You write that Authelia can be installed both on the VPS and on Unraid. How is the database synchronized?

It makes no sense if Outline is connected to the local Authelia, while the proxy on the VPS uses the other Authelia instance.

I want that the home server is working air-gapped, too. If the internet connection fails, I want to be able to continue using all apps locally. So I think a unraid instance of authelia and a second Reverse Proxy on the internal box is the right solution.

Pangolin project on the VPS-Server. Easy management and all-in-one proxy & security solution.
-Cool

Should I use the wireguard client on Unraid or on the ?opnsense? pfsense/ipfire the ?open firewall connected in front of it? Both are able to use wireguard.
-For VPN, due to networking equipment and access to routes... If the open firewall supports it, you may find it easier and better to run the VPN/wiregurad there then on unraid.
However, I don't recommend running it on Unraid due to known networking issues and inherit application problems...

How is the database synchronized?

-I don't use Authelia. I talked this over with some others in my ring network... it was worth a mention....
I personally use Ansible, ssh and other code playbooks software and tools... ssh tunnels I make myself and protect myself.... (hardware keys)
As, its what I use for commands and depends on how you setup your cross database talk and can be used between both on a shared Database. Such as having access to something that is ran on unraid accessed over the VPN....

It makes no sense if Outline is connected to the local Authelia, while the proxy on the VPS uses the other Authelia instance.
-Don't know what you mean?... Outline is connected to the local Authelia its order of operations and how it communicated to xyz target. per the table above its optional and depends on your private and inner VPS VPN network access to unraid... I was Just giving an example of a self-hosted free-ish solution. Alot of what you want is paid support...

[you go to domain name > authelia to 2fa auth first or RP{reverse Proxy} to authelia for 2fa (order of operations vary....)... where RP points to app in your example outline... > connects over wireguard to your unriad > outline system auth and app access via RP...]

as explained in the table and outlined pictures above...

if the internet connection fails, I want to be able to continue using all apps locally
-Depends on how you setup you network... This would be more lan wan and wan failover... This is why its important to run them in hose and use the VPS/Domain name as public facing and cone t back to you so systems don't degrade and communication doesn't fail... as you can be local without the need of the 2fa...

I Personally use unfi equipment and tailscale on top of it.
https://github.com/SierraSoftworks/tailscale-udm

-Tested install on ux, Unifi cloud, udm etc etc... Unriad can self-host too....

as unfi is essential a debain linux box running... (if you update unifi you may need to ssh into the unifi device and rerun the github curl command to install and re tie back to the tailscale admin interface... but otherwise yes, tailscale for VPN app communication and CGnat forwarding.

As I use tailscale subnet route, endpoint and funnel to have cgnat services Internet forward facing... so my immich, and plex server are avilable over cgnat and I have a teleport unifi site to site if needed for my ring network and/or the tailscal vpn(which uses WireGuard underneath...) to connect to...

unraid has quite a bit of support integration with tail scale and dockers for forward facing...
-Better to run sidecar... I've found to just install the tailscale plugin but leav it alone and use user script terminal and/or unraids docker integration to interact and use tailscale. as the plugin just adds the binary need to use with docker within the web ui...

Truthly I've never heard of Authelia until today... Was looking for something that fit your needs and was free-ish..

RP are a good step. Nothing is air gaped. I can only recommend current security standards via the IEEE RFC and security standards one should follow...

https://www.rfc-editor.org/standards

such as immich should be behind a RP and not funneled directly... but this adds complexity and communication issues... similar when running a system like plex that has their own 3rd party site to API check against...

Other vpn instance that may help you that you could look into is twingate... depends on what you need to cross talk over CGnat and what needs endpoints.

you could run a RP on unraid and the VPS as the VPS is just a public accessible system for tunneling to and from... otherwise you will need to run the xyz auth, geoip blocking at home on the lan first and tunnel outward which done't require a VPS...

Edited August 11, 2025Aug 11 by bmartino1
data