Homelab-Exposure Deluxe: End-to-End TLS via Nginx Stream & Rathole

This is also available (soon) in German on the Hackspace Blog bytespeicher.org I was faced with a classic problem: My homelab server in my basement offers services that I want to use outside of my home network, but my home internet connection sits behind a NAT and has a dynamic IP. To make matters worse, I often operate from networks whose restrictive firewalls do not allow DynDNS, residential IPs, and certainly no non-standard ports. The common solution would be a reverse proxy on a VPS (with a fixed domain and static IP) that tunnels the traffic into my basement via VPN (e.g., Wireguard). But my threat model is a bit more specific: Since the VPS represents my primary attack surface on the web, I consider it potentially compromisable. I do not want the VPS to be able to decrypt my HTTPS traffic or gain unrestricted access to my internal network should it ever fall. Here is my setup for a completely transparent connection via Nginx Stream modules and Rathole. My Concept: SNI-Preread &…