Yikes! I’d avoid leaving any services externally exposed unless they’re absolutely necessary…
Tailscale+Headscale are pretty easy to implement these days. Since it’s effectively zero trust, the tunnels become the encrypted channel so there’s an argument that HTTPS isn’t really required unless some endpoints won’t be accessing services over the Tailnet. SmallStep and Caddy can be used to automatically manage certs if it’s needed though.
You can even configure a PiHole (or derivative) to be your DNS server on the VPN, giving you ad blocking on the go.
Anecdotal, but Ive had a container running Nextcloud in an LXC on Proxmox along with PiHole, Step CA, Bacula, and quite a few other services and I’ve had zero downtime since June 2023. Even have Tailscale rigged to use PiHole as the tailnet DNS to have adblocking on the go.
Guess that restart: always
value in the Compose config is pulling it’s weight lol
Definitely complicated to root cause. Please share if ya figure out the hard parts 😄
An idea: Netflix could be fingerprinting TUN interfaces on the TV.
One thing I’d consider trying is Tailscale in userspace networking mode on a distinct network host at location 2, which’ll start a SOCKS/HTTP proxy that the TV can use for outbound connections.
Bonus: any devices incompatible with Tailscale can use the proxies.
If you’d like to take a stab at this, Headscale is a self-hosted version of Tailscale’s service. Personally, I use Caddy to automatically manage letsencrypt certs while proxying requests to Headscale.
Or we fix some shit at home first.