maiskanzler

Yes, I do loose the origin IP and I'm a little bugged by it. It also means that ALL traffic incoming on a specific port of that VPS can only go to exactly ONE private wireguard peer. You could avoid both of these issues by having the reverse proxy on the VPS (which is why cloudflare works the way it does), but I prefer my https endpoint to be on my own trusted hardware. That's totally my personal preference though.

I trust my VPS provider to not be interested enough in my data to setup special surveillance tooling for each and every possible software combination their customers might have. Cloudflare on the other hand only has their own software stack to monitor and all customers must adhere to it. It's by design much easier for them to do statistics or snooping.

I am using the smallest tier VPS from IONOS for 1€/month. Good, reliable and trustworthy as it is a subsidiary of 1&1 telecommunications.

Rent a VPS, point DNS to it, have it act as central wireguard peer and connect your server(s). Then bridge incoming traffic to server via socat or firewall rules. Done

Sure it's easy to set up, but the same behaviour is what I get with my handrolled solution. I rent a cheap VPS with a fixed IP solely for forwarding all traffic through wireguard. My DNS entries all point to the VPS and my servers connect to the VPS to be reachable. It is absolutely network agnostic and does not require any port shenanigans on the local network nor does it require a fixed IP for the internet connection of my home server.

Data security wise the HTTPS terminates on my own hardware (homeserver with reverse proxy) and the wireguard connection is additionally encrypted. There are no secrets or certificates on the rented VPS beyond the bare minimum for the wireguard tunnel and my public key for SSH access.

Shuttling the packets on the VPS (inet to wireguard) is done by socat because I haven't had the will or need to get in the weeds with nftables/iptables. I am just happy that it works reliably and am happy to loose some potential bandwidth to the kernelspace/userspace hoops.

Nur eine Spur noch, dann wirds besser! Wirklich! Ich kann aufhören wann immer ich möchte!

Coming from Rust I am toying around with Lua at the moment. Lua is a small, simple and I would say a very neat language. But for big projects like an entire game I would personally much prefer a "traditional" compiled language like C/C++, Java/C# or Rust. Scripting langs are great for small scopes, but they quickly become a burden for bigger things in my opinion.

Momentan boomt auch Lack. Der wird traditionell aber eher auf Sylt genossen.

And basically sentenced for life on top of that.

Wtf.

Yeah that occurred to me as well. Then I immediately think that maybe we need ☆one more language☆ to fix this. And then I remember that one xkcd comic...

Absolutely true, it was more of a joke because Python is being used for pretty much anything today. I really don't want to mess with correct indentation in my terminal.

The line between configuration is very messy anyways. So many projects abuse YAML as a domain specific language. Looking at you, HomeAssistant and ESPHome!