Homelab-Exposure Deluxe: End-to-End TLS via Nginx Stream & Rathole

This is also available (soon) in German on the Hackspace Blog bytespeicher.org I was faced with a classic problem: My homelab server in my basement offers services that I want to use outside of my home network, but my home internet connection sits behind a NAT and has a dynamic IP. To make matters worse, I often operate from networks whose restrictive firewalls do not allow DynDNS, residential IPs, and certainly no non-standard ports. The common solution would be a reverse proxy on a VPS (with a fixed domain and static IP) that tunnels the traffic into my basement via VPN (e.g., Wireguard). But my threat model is a bit more specific: Since the VPS represents my primary attack surface on the web, I consider it potentially compromisable. I do not want the VPS to be able to decrypt my HTTPS traffic or gain unrestricted access to my internal network should it ever fall. Here is my setup for a completely transparent connection via Nginx Stream modules and Rathole. My Concept: SNI-Preread &…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town