--- title: I stopped exposing half my self-hosted services to the... description: A self-hoster shares how they restructured their homelab network by splitting services into two categories: private (accessed via self-hosted NetBird VPN) and... canonical: https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I stopped exposing half my self-hosted services to the internet, and nothing broke | daily.dev og:description: A self-hoster shares how they restructured their homelab network by splitting services into two categories: private (accessed via self-hosted NetBird VPN) and... og:url: https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9 og:image: https://api.daily.dev/og/posts/RKh9WdjN9.png og:image:alt: I stopped exposing half my self-hosted services to the internet, and nothing broke og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I stopped exposing half my self-hosted services to the internet, and nothing broke **[XDA Developers](https://daily.dev/sources/xda-developers)** · 4 min read · 0 upvotes · 0 comments ## Summary A self-hoster shares how they restructured their homelab network by splitting services into two categories: private (accessed via self-hosted NetBird VPN) and public (exposed via self-hosted Pangolin tunnel). After years of relying on Tailscale and Cloudflare Tunnel, they moved to fully self-hosted ingress tools on a Hetzner VPS. The key insight was asking 'Will anyone besides me ever use this?' rather than defaulting to public exposure — resulting in fewer publicly exposed services, a smaller attack surface, simpler routing, and a cleaner reverse proxy configuration. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Pangolin used for in a self-hosted homelab setup? Pangolin is a self-hosted reverse proxy and tunnel gateway that exposes homelab services publicly without relying on an ISP port forward or a third-party tunnel like Cloudflare Tunnel. It runs on a VPS, and adding a service to it generates a URL to access that service from anywhere, replacing the need for Cloudflare Tunnel entirely. _Homelab builders weighing self-hosted ingress options can find more setups like this one on daily.dev._ ### How can NetBird and Pangolin be combined on the same VPS for a homelab? NetBird's management server and Pangolin can be self-hosted together on a single VPS, sharing the same Docker host, Docker network, and Traefik routing configuration. NetBird handles private, personal-only access while Pangolin handles services meant to be reachable by others, letting one VPS serve as both the private and public entry point for a homelab. _Anyone architecting private versus public access for their own servers can track similar homelab patterns on daily.dev._ ## Similar posts on daily.dev - [I don't expose my home server anymore: I let Tailscale do the scary part](https://daily.dev/posts/i-don-t-expose-my-home-server-anymore-i-let-tailscale-do-the-scary-part-xccmpdrgo) · XDA Developers · 0 upvotes · 0 comments - [I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight](https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6) · XDA Developers · 0 upvotes · 0 comments - [Why I ditched Cloudflare Tunnels for Tailscale and Caddy on my homelab](https://daily.dev/posts/why-i-ditched-cloudflare-tunnels-for-tailscale-and-caddy-on-my-homelab-d7skvload) · XDA Developers · 1 upvotes · 0 comments --- Tags: [#self-hosting](https://daily.dev/tags/self-hosting), [#homelab](https://daily.dev/tags/homelab) [View this post on daily.dev](https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I stopped exposing half my self-hosted services to the internet, and nothing broke","url":"https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9"},"datePublished":"2026-07-31T14:02:20.228Z","dateModified":"2026-09-13T20:56:01.241Z","description":"A self-hoster shares how they restructured their homelab network by splitting services into two categories: private (accessed via self-hosted NetBird VPN) and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/563eae2b0145c03d5217825be91c5555?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/563eae2b0145c03d5217825be91c5555?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"self-hosting,homelab","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I stopped exposing half my self-hosted services to the internet, and nothing broke"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9#faq","mainEntity":[{"@type":"Question","name":"What is Pangolin used for in a self-hosted homelab setup?","acceptedAnswer":{"@type":"Answer","text":"Pangolin is a self-hosted reverse proxy and tunnel gateway that exposes homelab services publicly without relying on an ISP port forward or a third-party tunnel like Cloudflare Tunnel. It runs on a VPS, and adding a service to it generates a URL to access that service from anywhere, replacing the need for Cloudflare Tunnel entirely. Homelab builders weighing self-hosted ingress options can find more setups like this one on daily.dev."}},{"@type":"Question","name":"How can NetBird and Pangolin be combined on the same VPS for a homelab?","acceptedAnswer":{"@type":"Answer","text":"NetBird's management server and Pangolin can be self-hosted together on a single VPS, sharing the same Docker host, Docker network, and Traefik routing configuration. NetBird handles private, personal-only access while Pangolin handles services meant to be reachable by others, letting one VPS serve as both the private and public entry point for a homelab. Anyone architecting private versus public access for their own servers can track similar homelab patterns on daily.dev."}}]} ```