I didn’t figure so, just wanted to say that because it’s the more vulnerable attack surface. I hope overlay networks catch on in a bigger way, I share some of my resources with zerotier without having stuff directly exposed.

If you are going to programmatically manage the reverse proxy, traefik is much better than NPM.

You can make NPM’s manager only accessible internally or from a certain IP to reduce your attack surface. I use both.