Self-Hosting with Yundera
A common question: "Is this really self-hosting if domains run through Yundera?" Here's the honest answer.
Two things to separate
It helps to separate two layers:
Control plane — naming & reachability
Domain resolution and verification always go through Yundera's backend. That's what gives you automatic subdomains and HTTPS with no DNS or certificate setup.
Data plane — your app traffic
When your PCS is directly reachable from the internet, your app traffic does not pass through Yundera's gateway. Only when your machine can't be reached directly (e.g., behind CGNAT, no public IP, no port-forwarding) does it travel through an encrypted WireGuard tunnel via NSL.SH infrastructure.
Your data lives on your machine. What Yundera intermediates is the naming, and — only when necessary — the network path.
Compared to fully manual self-hosting
Solutions like YunoHost give you the entire stack including the network edge, but assume you can handle reachability yourself: a public IP, port-forwarding on ports 80/443, and DNS configuration.
Yundera removes exactly that step — you're reachable online with no public IP and no network configuration, and you install apps in one click.
The trade-off:
| Yundera / NSL.SH | Fully manual (e.g., YunoHost) | |
|---|---|---|
| DNS & certificates | Automatic | You manage it |
| Reachability behind CGNAT | Works out of the box | Requires workarounds |
| Network edge control | Shared with NSL.SH | Fully yours |
| App installs | One-click from the store | Manual setup |
| Data location | On your machine | On your machine |
Behind CGNAT, this is often the difference between hosting and not being able to host at all.
For strict end-to-end privacy
If you want the strictest possible end-to-end encryption, use your sslip.io address (e.g., 203-0-113-42.sslip.io). In this mode, there is a single TLS session from the visitor's browser to your PCS — nothing in between decrypts.
For the full TLS comparison, see TLS & Privacy.