Rebuilding Remote Access · June 8, 2026 · 5 min
The gateway: self-hosted NetBird behind Caddy, with a relay
Now the WireGuard control plane. This part stands up self-hosted NetBird on a DMZ gateway, fronts it with Caddy issuing TLS over DNS-01, points it at the SSO for auth, and adds a coturn relay for the peers that can't connect directly.