Scan this server from the outside and you find the DNS service: ports 53, 80, 443 and 853, nothing else. The admin panel, the Grafana dashboard and SSH are all running - they answer two specific devices over Tailscale and do not exist for anyone else. A new guide documents the whole pattern on common user settings: stock AdGuard Home, nginx, nftables and Tailscale, no custom software.
The three gates: the panel bound to 127.0.0.1, an nginx geo allowlist of two device IPs that resets every other connection with status 444, and a DNS split view where the resolver itself answers the panel's hostname with a tailnet address while public DNS keeps a record only for certificate validation. SSH gets the bluntest gate of all - the port stays open in the kernel while the nftables input policy drops every packet that does not arrive through the tailscale0 interface. The full nginx vhost is published verbatim, each verification shown from both sides, and the guide closes with the one-command Raspberry Pi version using tailscale serve.