Quick answer: Tailscale on the VPS = SSH, Portainer, NPM admin and Home Assistant via a 100.x VPN IP without publishing those ports.
tailscale upon Ubuntu- SSH to 100.x
- Close public 22 / bind admin UIs to the tailnet
VPS & root servers: Order VPS in Germany · NexoraHost · nexorahost.com (Maincubes FRA01 Frankfurt · Ryzen · NVMe · GDPR)
Frequently asked questions (FAQ)
What is Tailscale?
WireGuard mesh VPN. Devices get 100.x addresses. Reach the VPS without publishing 22/81/8123.
Tailscale or self-hosted WireGuard?
Tailscale: fast NAT traversal, ACL UI, control plane at Tailscale (or Headscale). WireGuard: you own everything, more work.
Or Cloudflare Tunnel?
Tunnel for public HTTP without open ports. Tailscale for SSH and internal UIs. Many use both.
Harden SSH with Tailscale?
tailscale up, ssh [email protected], then close public 22 in UFW.
Subnet / home LAN?
Advertise an exit node or subnet routes so the phone can reach HA/Pi-hole – or the VPS.