Sync-in behind VPN?

[Stephan-P]

My sysadmin at work has strongly suggested that I'd reduce internet exposure of my NAS and container apps and place them behind a VPN; Wireguard or Tailscale or Headscale. Something similar had been suggested to me before by other people as well, so I gather this makes sense.

I've done research on Wireguard and Tailscale, and its open source alternative Headscale and its companion UI Headplane.
But now I'm wondering if Sync-in (and Collabora Office) can work through a VPN tunnel, as their configurations make references to regular open internet urls?

[nonkronk]

Yes, this should work over WireGuard or Tailscale. Those URLs don't have to be publicly reachable; they just need to resolve and be accessible to the devices using them. You can keep a normal HTTPS hostname and point it to a private VPN address (e.g. using split DNS).

The main thing with Collabora is that the browser must reach Collabora, and Collabora must reach Sync-in for document editing. If either side can't reach the URL configured for the other, the editor can fail even though Sync-in itself opens fine.

I'd start with Sync-in over the VPN first, then add Collabora. Keep the database and container ports private, and check the HTTPS names from another VPN-connected device. No public port forwarding should be needed for that setup.

[Stephan-P]

Thank you for this, @nonkronk
New to the Wireguard/Tailscale realm, could you give me some examples of URLs and hostnames, so as to paint me the picture?

For starters, I'm currently using https://sync-in.mydomain.tld and https://collabora.mydomain.tld, which is working fine. How would these change within a WG or TS setting and do I need to reflect these changes in the Sync-in configuration?

[nonkronk]

@Stephan-P You can keep both URLs as they are. Say your reverse proxy has Tailscale IP 100.101.102.103. Set DNS for your tailnet devices so sync-in.mydomain.tld and collabora.mydomain.tld both resolve to that IP (assuming they're on the same proxy). The proxy still routes each hostname to its container. You use the same HTTPS URLs, just while connected to Tailscale.

With WireGuard it's the same idea, but the DNS records point to a private IP reachable through the WG tunnel.

You shouldn't need to change Sync-in's server.publicUrl or Collabora's externalServer if they're already set to those hostnames. Make sure the containers can resolve and reach those addresses too, since Collabora needs to call back to Sync-in. You'll still need valid HTTPS certificates; DNS-01 renewal works without public ports. Once VPN access works, close the public port forwards/tunnel — DNS changes alone won't make it private.