Tailscale is the preferred access path for trusted personal devices. Cloudflare Tunnel fills a narrower role: browser-only access from devices where installing private overlay software is not practical.
That distinction keeps the access model understandable. A trusted device can use the private network directly. A constrained device gets an identity-protected path to a deliberately small set of browser interfaces. Neither path requires broad inbound firewall exposure for the lab.
Role In The Lab
The tunnel is an exception path, not the front door to everything. It exists for situations where a useful web interface needs to be reachable but installing Tailscale is not an option.
Keeping that role narrow matters because browser convenience can easily turn into accidental exposure. The useful question is not “Can this service be published?” but “Does this workflow justify another public-facing access boundary?”
Current Pattern
- Selected browser-accessible services are published through an identity-protected tunnel.
- Google identity and multi-factor authentication sit in front of access.
- Guacamole provides browser-based remote desktop access when direct client software is unavailable.
- Some AI research and project-management interfaces are reachable this way for controlled workflows.
- Tailscale remains the default for trusted devices and broader administrative access.
The public documentation intentionally stops at role labels. It does not include real domains, tunnel names, internal destinations, or policy details.
Reliability Notes
The setup is stable once configured, but the hard part is deciding what deserves browser access at all. Routing subdomains to the right internal endpoints can be fiddly, and returning to the configuration months later requires good notes.
The tunnel is useful, but it is intentionally not the only recovery path. If browser access is unavailable, trusted-device access through the private overlay remains the preferred administrative route. Downtime notifications provide a basic signal without pretending the tunnel is a complete monitoring system.
Lessons
The important lesson is access design: private overlay access by default, browser access where it solves a real constraint, identity and MFA in front of anything reachable through the browser, and no broad firewall-port exposure for the lab.
The second lesson is documentation. Access configuration changes infrequently enough that the reasoning can be easy to forget. A short record of what a route is for, who should use it, and why it exists is more valuable than a dense map of implementation details.
Next Pass
The next improvement is a simple access matrix that records each public-safe service role, its intended audience, its access method, and its fallback. That would make periodic review easier without publishing the real topology.