Sharing port 443 between a real website and a VLESS+Reality tunnel
One VPS, one IP, port 443 shared between a real public website and a VLESS+Reality tunnel on the same TCP socket. DPI cannot split them apart because both are real TLS.
Networking
Public services from a residential line, without publishing the home IP
Host public services from a residential line without the home IP ever landing in DNS. A 5 EUR VPS, a WireGuard tunnel, and three OPNsense NAT rules.