I wanted to move away from Tailscale but found Headscale a bit too convoluted for what I actually needed.
Ended up with a simple WireGuard setup using two VPSes: one as a VPN hub, the other acting as a reverse proxy back into my home lab.
It lets me expose services publicly without any inbound port forwarding on my home connection.
This is an interesting article, but the crux of the setup isn’t described : what is the configuration on your home server?
Creating a wireguard tunnel is pretty simple, but managing how everything is handled behind the VPN is more challenging.