I’ve been making people use VPN, but that’s been a huge barrier to entry. I’m in the process of switching to IP allow list in traefik.

Looks like you should be able to do so:

https://community.traefik.io/t/traefik-as-reverse-proxy-server-to-external-web-server/15619/3

https://community.traefik.io/t/traefik-v3-reverse-proxy-to-external-ip/25899

I just get alerts over telegram. They’re just regular notifications, but you could probably set specific notification behavior and sounds for the app?

Edit: Though that’s not a selfhosted solution. Sometimes it’s a decision between reliability and selfhosted. e.g., I went back to Tailscale from Headscale when I lost connectivity through Headscale and couldn’t figure out how to get it back.