WireGuard

The Goal I have a DigitalOcean Kubernetes cluster running services like n8n (workflow automation), SearXNG (search), PostgreSQL, and Redis. I also have a Raspberry Pi 5 running OpenWrt as my home router. I wanted every device on my WiFi – laptops, phones, tablets – to be able to access my K8s services directly by ClusterIP, without installing Tailscale (or any VPN client) on each device. The result: my wife can open http://10.245.15.122:5678 on her laptop and hit n8n. My iPad can reach SearXNG. Any device on the WiFi just… works. The OpenWrt router handles the encrypted tunnel transparently. ...

Series: How I Used Claude Code to Slash My Cloud Bill by 63% Part 1: The $198/Month Wake-Up Call Part 2: Migrating 7 Static Sites to Cloudflare Pages Part 3: Killing the Load Balancer with Cloudflare Tunnel Part 4: Building a Home Router with a Raspberry Pi 5 Part 5: Connecting Everything with Tailscale (you are here) Part 6: The Final Architecture - $74/mo and Zero Regrets The Problem: Private Access Without Public Exposure After the Cloudflare Tunnel work in Part 3, I had one service (n8n) accessible through a tunnel and everything else locked down inside the Kubernetes cluster. But I had other internal services I wanted to reach from my home network – things like SearXNG, Redis Commander, and the Kubernetes dashboard. None of these should be publicly accessible. I don’t want a public endpoint for my search engine or my database admin tool. ...