Hello SelfHosters! After getting myself a wonderfully large NAS and spending a couple days thinking about how to link up the different services, I turn to you for advice. This is my situation:
I've been operating a cheap VPS for a while now, which runs a bunch of services that require neither lots of storage nor compute (webserver, vaultwarden, gitea and so on). But I refuse to pay the price for a large capacity / powerful remote machine for stuff like Jellyfin or Immich, especially because I want these things to be available to me in the local network no matter the network state (internet drops frequently here). Therefor, I've setup a ~50TB NAS, on which I want to both store and backup larger data packets, as well as operate some storage/traffic heavy applications (Jellyfin, Immich, Nextcloud, ...).
What I'm struggling with is the networking of things. My VPS sits behind a Cloudflare Proxy, and I like it that way. All services are managed via domains and accessible from anywhere via that. I neither want nor need isolation of these services by a VPN. I want to continue this way with the new homelab, but am unable to directly expose ports on my home connection, or to get a static IP. For additional complication, traffic from these data-heavy applications cannot run through Cloudflare due to their limitations on the free plan. Finally, in a perfect world, I would be able to manage the domain names for services on the Homelab in the Nginx Container on the VPS, so that everything is centralized and I don't have separate management interfaces.
My first idea was to connect the VPS and the Homelab with a Wireguard tunnel, but since this would route traffic through Cloudflare, it wouldn't work.
I then read about Tailscale, and that I could link up the Homelab and VPS in a tailnet, setting up the node on the VPS as subnet router for the docker network on the homelab, which would bring me to something along these lines:
In a perfect world, the Nginx container on the VPS would be able to seemlessly direct traffic to both services running on the VPS and the Homelab, and data coming from the homelab would be routed directly to the client, while VPS data would continue running through Cloudflare. This would work without the client having to connect to any VPNs or mesh networks, the domain name would have to be enough.
Maybe I'm overcomplicating things. Please don't feel obligated to copy-paste guides, I'll happily read external ressources that you can recommend. I'll also provide clarifications in the comments as needed. Any pointers how you people solve this would be much appreciated.
What benefit do you get from running a Cloudflare proxy if you're directing it to a VPS? I used to run with a Cloudflare proxy when my reverse proxy was hosted at home. Since then, I've moved it to a VPS and I no longer use the Cloudflare proxy, because I only expose the IP address of the VPS which is fine. Arguably Cloudflare provides you with DDoS protection, but that's so far never been a problem for me.
Caching, DDOS and other protections, centralized DNS management of all my domains scattered around different registrars, zero trust for sensible dashboards, and most important of all: it makes me feel good that the server IP is just a tad more secret.
For caching, are you sure you're generating enough traffic to benefit from it? Plus, CDN caching's strength only really comes into play when the users are geographically distributed which isn't really the case for most self hosters.
For DDoS check if your VPS host does DDoS protection. Some do and include it for free. I've been monitoring my server traffic lately. Since I've ditched Cloudflare, I haven't needed DDoS protection.
You can still use Cloudflare DNS without redirecting traffic via their CDN. I do that.
The point about not revealing the IP address is a personal one it seems. I think it indeed does matter if that IP address is if your home, but not so much of it's of a VPS in some data center. But anyway, this point seems personal.
However, everything is a trade off and everybody has a personal take on which trade off they want to take. When I was in a similar situation, I ditched CDN proxying via Cloudflare though I still kept them for DNS.