For years, the standard advice for homelabbers was: “Don’t open ports on your router.” Yet, the need to access our services from the outside—whether it’s a Jellyfin stream or a Grafana dashboard—often forced us into risky configurations like port forwarding or complex VPN setups.

Today, I’m sharing how I rebuilt my infrastructure from the ground up using a Zero-Trust architecture that provides seamless remote access with a zero-attack surface on the public internet.

The Problem: The Ingress Dilemma

Traditional homelabs rely on one of two things:

  1. Port Forwarding: Exposing ports (80, 443, 1194) to the wild west of the internet.
  2. Standard VPNs: Managing certificates and clients for OpenVPN or WireGuard, which often feels like a second job.

I wanted a third way: a setup that feels like I’m on my home Wi-Fi even when I’m on 5G, without ever touching my router settings.

The Solution: Tailscale & The Private Mesh

The backbone of my new lab is Tailscale. By running Tailscale as a Docker container within my stack, I’ve created a private, encrypted mesh network.

Why this works:

  • No Port Forwarding: Tailscale uses NAT traversal to establish direct, peer-to-peer WireGuard® connections.
  • MagicDNS: I can access my services using human-readable hostnames like grafana.ts.debdut.in.
  • Identity-based Access: My lab is protected by my existing SSO provider. If I’m not logged in, the lab doesn’t exist.

The Stack: Infrastructure as Code

I’ve moved away from “snowflake” configurations to a modular, Infrastructure as Code (IaC) approach. My entire lab is managed via a root orchestrator with private submodules for each service.

Functional Layers:

  • Routing: Nginx Proxy Manager handles internal SSL/TLS and hostname routing.
  • Observability: A full LGTM stack (Loki, Grafana, Prometheus) for deep visibility.
  • Automation: A custom “Bridge” service that normalizes alerts and notifications.

Management via Unified CLI

To keep operations sane, I use a standardized Makefile API. Whether I’m updating the whole stack or just checking logs for a specific service, the commands are consistent and predictable.

make up         # Start everything in dependency order
make status     # Health telemetry at a glance
make logs       # Unified observability stream

Building in Public

I believe in sharing architectural patterns while keeping private implementation details secure. To that end, I’ve launched a public technical wiki that documents the conceptual layers and security model of this project.

👉 Explore the Wiki: https://homelab.debdut.in/

Conclusion

A homelab doesn’t have to be a security liability. By combining zero-trust networking with modern DevOps practices, we can build environments that are both incredibly powerful and virtually invisible to the public internet.

If you’re looking to level up your self-hosting game, I highly recommend looking into Tailscale and an IaC-first approach.

Stay tuned for deep-dives into my custom alerting bridge and eBPF-based monitoring setup!