I used to run a relay on a home server tunneled through cloudflare (didn't want to pay for a public IP). I want to do that again, but with the right tools this time.
Discussion
I would recommend checking out Tailscale Funnel. It sounds like what you need, and they have a higher reputation for privacy, etc. Your IP will not be revealed.
I use Tailscale a LOT.
i have a VPS that i only run a wireguard server and a reverse proxy, which i can use to point at wireguard client addresses
it also lets me use teh public IP of the VPS, which i point all of my domains to, meaning i can turn these domains into paths to my little test server
lets me get around the problem of web clients, it gives me both a public address and TLS certificate
i haven't considered the idea of adding an access limit to particular reverse proxied mappings though, that would be neat for getting the best of all worlds
you would be able to blanket do that for the reverse proxy using iptables, or, extending the mapping syntax to enable specifying an access whitelist
https://github.com/mleku/lerproxy is the reverse proxy, it also gives you nip-05 and #golang vanity import redirections currently
PRs for a origin filtering syntax most welcome
now that i've heard/had the idea i may just add this feature myself
Thanks! will check it out
https://tailscale.com/kb/1223/funnel
Meant to post that above. Enjoy!