Tailscale.

Very different solutions.

• DuckDNS: you expose your HA to the internet like a public website and register it's address with DuckDNS so you can look it up.
• Wireguard: you VPN to inside your firewall and can access anything on your private network.

Wireguard all the way. Exposing just a VPN endpoint that can't be connected to without the right cryptographic keys is a much more secure and maintainable attack surface.

BTW I assume that's what you meant by "DuckDNS". Using that service is orthogonal to making HA visible externally, but is (I think) the common pairing.

Apples and oranges.

Wireguard is a VPN technology. DuckDNS is a service that lets you create a subdomain on the duckdns TLD and point it at your server. They do completely different things.

You would use DuckDNS if you don't want to rent your own domain ("rent" because it's a recurring payment for something over which you have only nominal control). It provides no security, no access control, and it creates no network. It's just a pointer in the global DNS DB.

Wireguard is a VPN technology, for creating private networks.

One is like a mailing address. The other is like a strongbox. You could give the strongbox to a friend to deliver it to someone who has the key (Wireguard). Or you could write a message on a postcard and mail it (DuckDNS). Or you could put the address on the strongbox and mail it (DuckDNS + Wireguard). The point is, they serve completely different functions.

The two could be used together.

Different services for different use cases.

I use nginx reverse proxy behind Duckdns for anything that requires public access, or that I use very frequently, like jellyfin or immich

I use Wireguard for everything else, to expose as little as possible.

If anything, I would say that Duckdns is harder to setup than Wireguard. You will need something like nginx reverse proxy if you want to host multiple services, and also deal with SSL certificates.

I've currently switched to cloudflare DNS, and it looks like it's doing the job better than duck for me. There's an integration for it, though I don't know how good that works, I initially set it up manually

Tailscale, because it’s a peer-to-peer VPN based on WireGuard with very little setup and Cloudflare Tunnel for external access to HA

Lots of good info here I'm not going to repeat, but I think if you're going to open home assistant to the public Internet, you should not use duckdns. It's better to get your own domain and set up a reverse proxy to use https. Or if it's too technical, subscribe to nabu casa and let them handle it for you.

I used to use a custom DNS solution using Amazon Route 53 (which I already used for my websites) and a Let’s Encrypt certificate. It worked ok but was pretty technical to set up.

Then I switched ISP and the new one doesn’t allow incoming connections by default so I use Nabu Casa. It was super simple to set up and works perfectly and, imo, well worth the cost.

Wireguard. Wireguard is fairly easy to configure and keeping your setup behind the firewall is much less headache in the long run.

First rule of hosting publicly available services is "Don't. Unless you absolutely have to." Second rule is: "If you have to, do it very carefully."

My router has a built in VPN, so I setup my phone with the VPN settings. Just a toggle on my phone and it connects to my home as if I was at my home Wi-Fi.

DuckDNS + LetsEncrypt + Pihole + Tailscale.

I use DuckDNS for my domain name but put in a random IP that isn't mine.

LetsEncrypt to generate certificates for my DuckDNS domain using the DNS Check option.

Pihole to locally route traffic for my domain on my network to my home server

Tailscale to remotely access to my network.