I stopped exposing half my self-hosted services to the internet, and nothing broke

Published Jul 31, 2026, 10:00 AM EDT Shekhar Vaidya is a veteran technology journalist and computer science engineer. He is the founder of TechLatest, where he has spent years providing technical analysis on hardware and Windows ecosystems. Now a Computing Writer at XDA, Shekhar leverages his deep background in NAS, storage solutions, and PC internals to help readers master their tech. My homelab networking journey has been a rollercoaster. From day one, I needed an external tool to expose any of my self-hosted services online. My ISPs didn’t give me any traditional option to make a hole in my router to expose any services, because I was behind CGNAT on both. I started with Tailscale and then complemented it with Cloudflare Tunnel. For a short time, I even tried using Cloudflare Mesh, an alternative to Tailscale. But all those tools I was relying on were under somebody else's control. Then my tinkerer, self-hosting mindset kicked in, and I decided to look for self-hosted alternatives to expose them. In the process, I started questioning whether all of it needed to be public at all. I kept solving the wrong problem Every fix just moved the mess somewhere else. It immediately became clear that my network alone wouldn't be able to meet my homelab needs. Jellyfin was the first service I deployed on my homelab, and it required external access while I was away. Whether it was private or public access didn't matter at that time. My mindset was that I needed something that could help me consume media wherever I was. When I opened Reddit threads, most of the suggestions were to install Nginx Proxy Manager (NPM). I thought a Docker container was an easy solution. When it didn’t work for me, I dug into every troubleshooting guide and found nothing. But later found out NPM was not the issue; it was my network. I had two ISPs at home, and it turned out both were behind a CGNAT. It meant I didn't have a static IP for my connection. And without a static public IP, I didn’t have the option to enable port forwarding or set up a reverse proxy. I went back to researching, and the best solution people suggested was Tailscale. It was easy to set up. One account, one tailnet, and a client on each device. I could finally watch my Jellyfin library from anywhere. In the meantime, I have already hosted more services such as Portainer, Immich, Nextcloud, Pi-hole, and Beszel. And each one was under Tailscale. But logging into Tailscale each time started feeling like an extra step. That was when I came across Cloudflare Tunnel, and it felt like the best solution for my Tailscale login fatigue. I added all the services that needed public access to Cloudflare Tunnel. Everything started feeling like a perfect solution. And in the meantime, I had already tried many Cloudflare services, such as Mesh and DoH. But that's the self-hosting mindset — when one service worked, I wanted to host another, then one more. Tailscale and Cloudflare Tunnel were the most used tools in my stack, and they were under someone else’s control. I wanted to own the ingress path, so I started looking for a self-hosted alternative. NetBird became my private front door Pangolin finally stopped doing everything. While I was looking for a Cloudflare Tunnel alternative, I came across Pangolin. It felt like everything I was looking for. And one reason that made my decision more concrete was that Pangolin needed a VPS — I already had one, which I was paying for a different purpose entirely. I could borrow a space there to self-host the Pangolin setup. I tested on that same VPS for a week; it felt like a good solution. So, I finally rented another cheap $5 VPS on Hetzner and moved Pangolin to it. Pangolin Self-hosted reverse proxy and tunnel gateway for exposing services publicly, without relying on your ISP or a third-party ingress. Gradually, Pangolin became my go-to service for exposing anything I hosted. I'd host a service, add it to Pangolin, and it would give me a URL to access it from anywhere. Public apps were obviously exposed, but admin dashboards often were too. Eventually, it replaced Cloudflare Tunnel, and without meaning to, I started avoiding Tailscale too. But I knew the risks I was creating by exposing my admin dashboards. After trying Tailscale, Cloudflare Tunnel, and Pangolin, one thing became clear. Public and private access had evolved independently, but the private side still relied on something outside my infrastructure (Tailscale’s hosted coordination). I started thinking, if I could self-host almost everything else, why should my private access layer be any different? Netbird became that answer. I self-hosted NetBird’s management server on the same Hetzner VPS, sharing the box with Pangolin — same Docker host, same Docker network, and similar Traefik routing for both. Finally, my dumb VPS became more useful. One VPS hosted both public and private entry points. The old logic of 'need remote access? Expose it' became two separate questions instead. Is it only for me? NetBird. Is it for others too? Pangolin. Now that I had both doors, I no longer had to force every service through the same one. And I could evaluate my services individually. That's when I finally took a look at the services I was exposing and asked a question I'd somehow never asked before. NetBird Self-hosted WireGuard-based mesh VPN for private access to your own infrastructure, with your own coordination server instead of a hosted one. I finally drew the line And the homelab got easier to manage. With both ends sorted — public and private access finally in place — I decided to take a look at my stack and divide the access points. Where previously I used to ask myself, "How do I access this remotely?" I was now asking, "Will anyone besides me ever touch this?" For most of it, the answers came almost instantly, and two distinct categories emerged naturally. The services I knew would never be used by anyone else remained private under NetBird. These were infrastructure, networking, management, monitoring, and notification services, including AdGuard Home, Unbound, Omada Controller, Portainer, Uptime Kuma, Beszel, Scrutiny, and ntfy. And the services meant for others — streaming, photo access, file storage, and password management, like Jellyfin, Immich, Nextcloud, and Vaultwarden — remained public on Pangolin. Not only was I concerned about security, but I also finally had fewer services running through Pangolin. That meant simple routing, fewer authentication pages, and a cleaner reverse proxy configuration. By default, every container I hosted started as private and moved to Pangolin only if it was justified going public. I didn't go through this long journey out of security paranoia, even though I knew it would reduce my attack surface. I did it because I simply realized most of my hosted services were never intended for anyone but me and never needed internet access in the first place. The default flipped, and nothing broke Exposing a service is no longer my default decision; it's now something each new container must justify. The experiment wasn’t about moving to self-hosted services or about NetBird replacing Pangolin. It was about realizing which of my services actually needed exposure to the internet. In the end, NetBird and Pangolin complemented each other because they solved different problems. Now, each new service starts with one question: Does this actually need to be internet-facing? If the answer is no, it stays private. And so far, nothing I moved off Pangolin has been lost.