Not really directly answering your question here so feel free to ignore me. But if I’m understanding right your setup sounds like a more complicated way of doing what I am.
I put tailscale on all my devices. And in every docker compose for the ports I do. TailscaleIP:hostport:containerport
So nothing can be access on local network at all. Only through tailscale. Which I can access from any of my devices locally or remotely without opening a port. All E2E encrypted I’m pretty sure. The only con is having to trust tailscale.
Not really directly answering your question here so feel free to ignore me. But if I’m understanding right your setup sounds like a more complicated way of doing what I am.
I put tailscale on all my devices. And in every docker compose for the ports I do. TailscaleIP:hostport:containerport
So nothing can be access on local network at all. Only through tailscale. Which I can access from any of my devices locally or remotely without opening a port. All E2E encrypted I’m pretty sure. The only con is having to trust tailscale.
I do keep Plex port open for friends though.