I probably wouldn’t expose it, while I don’t think it’s been a problem in the past, with LLMs being used to find vulnerabilities so much in the past few months it seems prudent to do everything you can reasonably do to secure things.

Tailscale is so easy to use it seems worth the bit of extra hassle.

I guess that depends: are you okay with literally anyone accessing this computer? If so, change nothing.

If you’re trying to just give yourself access to your own computer, stop forwarding ports and download Tailscale.

It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.

Never in a million years would I do this

Let me check what’s your IP?

Short answer: No.

Long answer: Hell, no!

I would never do something like that. It’s actually a sad story: I had a server that had to be exposed to the public, and not long ago, it was compromised by the latest PHP vulnerability. Fortunately, the damage wasn’t too severe. Since then, my policy has been to only expose services to the public that must be accessible to strangers, and I never expose administrative access points to the public internet. SSH access is restricted to key-based authentication, and the admin panel is accessible only from the internal network or via VPN. Two-factor authentication protects against password guessing, but it cannot prevent vulnerabilities that can be exploited before the login process even begins.

Why would you want to expose it to the web in the first place? In a homelab scenario, you’re the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.

Jamie is a cool guy. He’s also super smart. But he’s not infallible, and so I must secure this and only run it from the internal admin network. Because that’s best-practice.

I don’t think it’s ever been considered safe to be publicly accessible.