a reverse proxy on a VPS, combined with a wireguard tunnel, pointed to the dev computer's tunnel IP address, with the hot reload dev mode set to listen on 0.0.0.0 or the tunnel IP address of the dev computer, allows you to have both - you can work on the app, while people can see and use it.
i use this setup by default, so i can just show people stuff if i need to, remotely.
https://git.mleku.dev/mleku/reverse is my custom reverse proxy, it has very simple configuration, and incidentally can serve up a nostr.json nip-05, as well as go vanity redirects (that's what makes https://next.orly.dev/ point to my git host - click that and it shows you it's redirecting to the actual host, in a web browser, go uses that to find hosts from your DNS address with A/AAAA name/address mappings to access the repo with HTTP git.
https://github.com/angristan/wireguard-install is the wireguard install script i use, it even prints out a QR code you can use to configure mobile phone wireguard clients, when you run it, it configures the VPS using a questionairre, and then asks if you want to create one client. you can run it again to add or remove more clients also. for pc's you need to `cat` the config file, it prints the path of it under the QR code, and then paste that into your pc into `/etc/wireguard` usually wg0.conf - and then `sudo systemctl enable --now wg-quick@wg0` to enable and run your pc's wireguard connection. windows has a GUI, and mac is obviously a GUI, it's only linux that has it built into the kernel. read the instructions on the script, it explains the dependencies on various linux distros to enable it, i think it's called `wireguard-tools` on ubuntu.
last thing i want to say about wireguard is that once your VPS has it, you can reconfigure the SSH server to only listen on the VPS wireguard address, which blocks internet access to the SSH server, unless you have got a wireguard configuration that the script adds to your server's authorized clients list. this stops the endless logs and need to use fail2ban. and yes, it works EXACTLY the same way as nostr AUTH, a challenge, and a signature on the challenge to prove control of the key
