There's a moment every self-hoster hits. You've got Grafana, a Postgres admin panel, maybe an internal dashboard or two, and none of them should ever face the public internet. So you start down the rabbit hole: reverse proxy, basic auth, IP allowlists, a Cloudflare tunnel,