Here is the entire decision tree as a flowchart you can run in your head. Apply it every time you stand up a new service.
The flowchart
| Question | Yes | No |
|---|---|---|
| 1. Does anything outside this machine need to reach it? | Go to 2 | 127.0.0.1 — done |
| 2. Do you need access from your phone or other devices remotely? | Go to 3 | Specific LAN IP — done |
| 3. Is Tailscale (or similar) installed on this host? | Tailscale IP — done | Go to 4 |
| 4. Are you publishing this for strangers (real product)? | 0.0.0.0 + auth + reverse proxy + WAF | Install Tailscale; restart at 3 |
Worked example: a home Ollama server
| Choice | What happens | Verdict |
|---|---|---|
OLLAMA_HOST=0.0.0.0 | Open on every interface; if router forwards 11434, anyone on the internet can hit your model | Don't |
OLLAMA_HOST=127.0.0.1 | Only the host itself; cannot reach from another LAN device or phone | Too restrictive |
OLLAMA_HOST=192.168.1.42 | Reachable from LAN devices but not from cellular phone | Works at home only |
OLLAMA_HOST=100.64.0.5 (Tailscale IP) | Phone over cellular works (via tailnet); LAN devices in tailnet work; internet excluded | Right answer |