Hardening Headless VPS Infrastructure with Caddy
- How to eliminate open public ports across VPS servers using Tailscale Funnel, Caddy reverse proxying, and automated TLS certificates.
Contents
The Zero-Public-Port Architecture
Exposing webhooks, agent APIs, and database ports directly on public IPv4 addresses creates an unnecessary attack surface. By combining Tailscale with Caddy, all inter-service traffic flows over encrypted WireGuard tunnels.
Public endpoints are exposed strictly via managed TLS without exposing raw host ports to network scanners.
Configuring Caddyfile for Local Mesh Routing
Configure Caddy to bind exclusively to localhost and Tailscale interfaces so internal microservices and MinIO storage remain inaccessible from the raw public internet.
FAQ
- Does Tailscale Funnel require open firewall ports on the host?
No. Tailscale initiates outbound connections to the nearest Derp relay, bypassing NAT and strict firewall rules.