the simple answer is: me big stupid

i had a domain, but dyndns and all the other stuff required is too complicated for me to figure out.

Normal domain only for allowing others access to specific services (like friends+family into emby/plex/jellyfin). VPN for easily secured access to all the backend interfaces like radarr/sonarr/qbittorrent or private services like vaultwarden.

I also run the VPN to keep mobile devices behind pihole for adblocking.

You didn’t ask me but possible reasons are:

• Only exposing Wireguard leaves your server with minimal attack surface
• Domains cost money
• Can make Firewall management a whole lot easier
• No need to encrypt each service manually