zlacker

>It's the way the internet was meant to work but it doesn't make it any easier. Even when everything is in containers/VMs/users, if you don't put a decent amount of additional effort into automatic updates and keeping that context hardened as you tinker with it it's quite annoying when it gets pwned.

As someone who spent decades implementing and securing networks and internet-facing services for corporations large and small as well as self-hosting my own services for much of that time, the primary lesson I've learned and tried to pass on to clients, colleagues and family is:

   If you expose it to the Internet, assume it will be pwned at some point.

No, that's not universally true. But it's a smart assumption to make for several reasons:

1. No software is completely bug free and those bugs can expose your service(s) to compromise;

2. Humans (and their creations) are imperfect and will make mistakes -- possibly exposing your service(s) to compromise;

3. Bad actors, ranging from marginally competent script kiddies to master crackers with big salaries and big budgets from governments and criminal organizations are out there 24x7 trying to break into whatever systems they can reach.

The above applies just as much to tailscale or wireguard as it does to ssh/http(s)/imap/smtp/etc.

I'll say it again as it's possibly the most important concept related to exposing anything:

   If you expose it to the Internet, assume that, at some point, it will be 
   compromised and plan accordingly.

If you're lucky (and good), it may not happen while you're responsible for it, but assuming it will and having a plan to mitigate/control an "inevitable" compromise will save your bacon much better than just relying on someone else's code to never break or have bugs which put you at risk.

Want to expose ports? Use Wireguard? Tailscale? HAProxy? Go for it.

And do so in ways that meet your requirements/use cases. But don't forget to at least think (better yet script/document) about what you will do if your services are compromised.

Because odds are that one day they will.