The Elaborate Art of Hiding a Music Server From the Internet

Spent a chunk of Sunday arvo reading a thread on r/selfhosted instead of doing the things I was supposed to be doing, which is more or less how I spend most Sundays. Someone had a Navidrome instance (a self-hosted music streamer, think your own private Spotify) running on a mini PC at home, and they wanted to listen to it from outside the house without, in their words, “exposing my home IP.” Their proposed solution involved a cheap VPS in Germany, Tailscale, Caddy as a reverse proxy, and a Cloudflare DNS record, specifically avoiding Cloudflare Tunnel because it throttles audio streaming.

That is four separate pieces of infrastructure to listen to your own music collection on the bus.

I say this with real affection, because I have built dumber things than this to solve smaller problems, and I will probably do it again next weekend. But the thread was a good one, because it turned into exactly the argument I was hoping for: is any of this actually making you safer, or are you just adding steps?

The most useful comment in the whole thread, and I’m paraphrasing because I’m not naming anyone, was essentially: you’ve opened a port that leads into your home network, just with extra steps. A VPS reverse-proxying back to your home server hides your residential IP address from anyone glancing at DNS records, sure, but the traffic still ends up at your box either way. If there’s a vulnerability in Navidrome, routing the request through Frankfurt first doesn’t patch it. It’s the digital equivalent of parking your car around the corner from your house because you don’t want people to know which driveway it’s in, while leaving the car unlocked either way.

That’s not a knock on the bloke asking the question. It’s a genuinely common instinct, and I get it, because “don’t expose your home IP” has become one of those pieces of received wisdom in self-hosting circles that everyone repeats without necessarily interrogating what threat it’s defending against. For a one-person music server used by you and maybe your sister, the realistic risk isn’t a nation-state actor pinpointing your street. It’s automated bots hammering every IPv4 address on earth looking for known exploits in common software, which they will find regardless of whether your IP is “hidden” behind a VPS or sitting there in the open behind a wildcard subdomain nobody’s ever heard of.

I run a handful of things at home, mostly for the pure, slightly embarrassing joy of having a server rack hum away in the study. A Jellyfin instance, a couple of Docker containers doing not much, a Home Assistant setup that occasionally decides my fan should turn on because it misread a sensor. None of it is secret, exactly, but none of it is advertised either. I exposed one of them directly for about a year, got nothing more exciting than the usual background radiation of scanning traffic, then eventually moved everything behind a reverse proxy with proper TLS and an authentication layer, mostly because it was tidier, not because I thought I was under siege. The real lesson from doing this for a while isn’t “hide everything,” it’s “know what you’re actually defending against, then do the proportionate thing.”

There’s a tension here I don’t think the thread resolved, and I don’t think I can either. On one hand, the “nobody’s coming for your Navidrome server” crowd is largely right: unless you’ve made yourself a target somehow, the opportunistic scanning that hits every exposed port on the internet is just noise, and FQDN-only routing filters out almost all of it for free. On the other hand, the “better safe than sorry” instinct isn’t irrational either, because the cost of being wrong about your own threat model is genuinely bad: your photo library, your financial records, whatever else happens to be sitting on the same network. Both of these things are true at once, and I don’t think there’s a clean answer, just a judgement call about how much friction you’re willing to carry for how much peace of mind you get back.

What struck me most, honestly, wasn’t the security debate. It was watching a bunch of strangers argue in good faith about threat models, mTLS, split tunnelling and Wireguard on a Sunday, correcting each other without being arseholes about it, because they all actually cared about getting it right. That’s increasingly rare anywhere online, let alone on a subreddit about running software on spare hardware in your spare room. Whatever you land on, VPS, Tailscale, plain Wireguard, or just accepting that your home IP is not nearly as interesting to the world as you fear it is, there’s something quietly good about a community still willing to argue the toss over four layers of networking just to stream a Fleetwood Mac album from the train.