Tailscale funnel lets you expose services to the internet without opening any ports.
There’s also the option of inviting your friends to your Tailscale network and limiting them to specific services. But they’ll have to install it on their devices.
Just chiming in about Tailscale.
The initial connection uses their server just to reach / connect to the other peer. After that, the peers are connected directly and all communication is direct.
I might have misunderstood you, but data transferred inside the tailnet will always be encrypted by Tailscale.
So if you’re connected to a public wifi and someone’s looking at your traffic, accessing a random http site would be clear text, but accessing an http site inside your tailnet will be encrypted.
Unless you define an exit node and tell Tailscale to use it. And then all your traffic will be encrypted from the view of the one looking at your traffic logs from the public wifi (and clear text from the exit node to the random http site).
There’s no need, but if you really want to, you can do it through Tailscale - Provision TLS certificates for your internal Tailscale services
Transcend ssd220s (4tb SATA) can be found for really nice prices.
Even had a thread about this one on Lemmy cuz I wasn’t sure how good it is (it’s great).
Another option: Pine64’s board
Just be aware that for a period of time the MX 500 had many reports of high failure rate. Not sure if it was due to a change of components or firmware.
Example post about it: https://www.reddit.com/r/sysadmin/comments/whr5ek/crucial_mx500_historically_good_recent_batches/
An article (In Portuguese).
And another post about it.