Public and Partially Public Services

A service can be public at the network level while still requiring authentication. It can also be reachable only through an access policy or a private network. Choose the exposure model before selecting a certificate method.

Comparison

Method	Public URL	Client installation	Main dependency	Suitable for
Direct publication	Own domain	No	Firewall, router and certificate automation	Public websites and webhooks
Reverse proxy	Own domain	No	Proxy host and certificate automation	One controlled entry point for several services
Cloudflare Tunnel	Own domain	No	Cloudflare account and connector	Private origin with browser access and optional Access policies
ngrok	ngrok or configured domain	No	ngrok account and agent	Development, demonstrations and selected public services
Tailscale Serve	Tailnet name	Yes	Tailscale clients and tailnet	Private access for known devices
Tailscale Funnel	Tailscale public name	No for visitors	Tailscale account and service limits	Small public services where the application supplies authentication

Direct publication

Direct publication gives users the fewest intermediary dependencies, but the server is exposed to Internet traffic. Use a firewall, current software, rate limiting and an automated certificate renewal process. DNS-01 allows certificate renewal without opening port 80; HTTP-01 requires the validation path to be reachable as described on the Let's Encrypt Certificate page.

Reverse proxy

A reverse proxy terminates HTTPS and forwards requests to the private server. It can centralize certificates, access policies and logging. Configure the forwarded headers and the server's external visible URL so that generated links and redirects use the public address.

Managed tunnels

Cloudflare Tunnel and ngrok use an outbound connector, so the origin does not need an incoming port. Check the provider's identity, access policy, data processing, rate limits and availability before using the service for customer data.

Tailscale Funnel is useful for a small public service with a Tailscale address. It is not a general custom-domain solution and should not be confused with the private Serve mode.

Selective publication

For a partially public installation, use separate hostnames or explicit routes for public and private services. Apply an access policy to administrative paths, keep management interfaces private and require application authentication even when a provider already performs user authentication.

Further information

Provider documentation is available for Cloudflare Tunnel, ngrok and Tailscale Funnel.