Self-hosted media platform
A service on hardware I own, reached from anywhere through an outbound-only tunnel rather than an inbound port forward, and monitored so failures get caught before a user notices.
Context
A streaming service running on hardware I own and administer, used by a group of people who are not on my network and are not technical. Treated the way a small production service would be: provisioned per user, monitored, and reachable without anyone having to configure anything.
The problem
Making a service on a home network safely reachable from outside it is the hard part. Forwarding ports at the router exposes the application directly to the internet; handing non-technical users VPN credentials does not survive contact with reality. On top of that, users need to be added and removed without me being at the machine, client devices vary enough that some of them can't play the source format at all, and when something falls over I am rarely at the machine — I need to hear about it from the server, not from a user.
What I built
Remote access runs over an outbound tunnel. The server holds a connection out to the edge network, and users reach a public hostname over authenticated HTTPS — so the user-facing path needs nothing forwarded inward at the router, and the service is never addressed directly from the internet. My own administration goes over a private Tailscale mesh instead, which keeps the admin surface off the public hostname entirely. Users get individually provisioned accounts rather than a shared login, so access is granted and revoked per person, and hardware-accelerated transcoding handles the clients that can't play the source directly, keeping that work off the CPU.
Monitoring is the part that makes it maintainable without me. Health checks run on a schedule and restart the media service automatically if it has died; disk alerts fire at 90% capacity; weekly usage stats and daily service status arrive over a Telegram bot that I can also query on demand for queue depth, free space, and what is due this week.
Result
Remote users get a service that works the same from any network without configuring anything, and access is granted or revoked per person rather than by sharing a password. Capacity and health problems get caught by monitoring instead of by a user reporting an outage, and the most common failure — the media service dying — recovers itself within ten minutes without anyone touching it.
Stack
Unraid · Docker · Cloudflare Tunnel · Tailscale · hardware transcoding · Bash and Python health checks · Telegram Bot API