Remote Access
Reaching your homelab from outside your own network, safely — Cloudflare Tunnel for publishing an app to the internet without opening a port, and Tailscale for a private mesh between your own devices. Start with the comparison if you are not sure which one you need.
Giving Internal Homelab Apps Real DNS Names and HTTPS
Cloudflare Tunnel gets your public apps out; a local DNS rewrite gives private ones the same clean hostname and valid HTTPS, from the same Caddy instance.
Part 1: Cloudflare vs Tailscale
Cloudflare Tunnel publishes an app without opening a port; Tailscale puts your devices on one private network. The real difference, and the hybrid I run.
Part 2: Cloudflare Tunnel
cloudflared connects outbound-only to Cloudflare's edge; Caddy reverse-proxies apps behind it with automatic TLS: compose files, and a DNS-challenge trap.
Part 3: Tailscale
Tailscale runs once per host, not per container: every app on it becomes reachable through one mesh IP. The setup, a DNS trap, and the sidecar exception.