Be reachable
| You have | Use |
|---|---|
| A public IP | direct |
| A tailnet | tailscale, with Funnel for the public side |
| A VPS you already run | frp, or the built-in ingress role on your own domain |
| Neither, but an account | ngrok, cloudflare |
| No inbound path at all | a tunnel from the rows above, or let a provider host the identity under a leaf you issue (HDTP §9) |
Then check your work:
hdtp-gateway doctorIt derives your deployment mode, probes your endpoint, and reports what an outside caller would actually see.