Funwayguy

I have similar setup on my home server except my Crowdsec & Anubis live in a dockerised VPS proxy that tunnels over WireGuard to the real server behind OPNSense. Saves me a ton not having bandwidth obliterating AI crawlers hit my internet bill. As an added bonus, I can move or shutdown the public VPS entry if things get too ‘spicy’ without any downtime on connections via the VPN.

I dumped Portainer on my home server when they did the ‘Fortnite’ graphical rebranding. Now using Arcane to manage my servers and edge nodes. Very much enjoying the CVE scan tools and in-place image updating.

God help us all if we have to break out the Emus

As someone else who uses Tailscale behind a CGNAT, this indeed works. I use it for accessing my home server from the office for a year now. You can’t quite self host anything public facing but anything on your tailnet can talk to it just fine.

Theoretically a VPS proxy into the server over the VPN could work for devices not capable of running tailscale but your mileage may vary.