31
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 Mar 2024
31 points (91.9% liked)
Selfhosted
39677 readers
681 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
Was referring to using DNS to each individual service rather than one single DNS point for your entire proxy. I have
*.my.domainpointed to my proxy which directs everything underneath it.Ok so what I need to do in my case is have my DNS direct *.crypt to my Nginx (when I get it set up) then have that direct all the bits that the star represents to the right IP/port?
Not *.crypt. say you buy mycooldomain.crypt. you then point the domain service that domain and *.mycooldomain.crypt to your public Ip.
You would then forward the ports on your router (like 80 and 443) to your proxy. This will get your external users working.
Internally you'll need to set up your local DNS so that it knows you are the mycooldomain.crypt. there are multiple ways based on what hardware and software You're running, do some googling. For me in my local DNS then I say *.mycooldomain.crypt points to my local proxy DNS, so that it resolves inside the network.
So, external DNS points to public Ip, router/firewall forwards those ports to proxy. Internally your DNS will reach out to your router/DNS/whatever you use to ask what that domain is and it will respond with the local IP of the proxy.
This is how I do it. It works internally and externally, though it's more than OP needs. :)
To add to what's been said (in case it's useful to others), it's worth looking at SWAG and Authelia to do the proxying for services visible to the Internet. I run them in a Docker container and it does all the proxying, takes care of the SSL certificate and auto-renews it, and adds MFA to the services you run that support it (all browsing, MFA-aware apps, etc).
Another thing I like about SWAG's setup is that you select which services/hostnames you want to expose, name them in the SUBDOMAINS environment variable in Docker (easy to remove one if you take a service down, for maintenance, etc), and then each has its own config file in Nginx's proxy-confs directory that does the
https://name.domain -> http://IP:portredirection for that service (e.g. wordpress.subdomain.conf), assuming the traffic has met whatever MFA and geo-whitelisting stuff you have set up.I also have Cloudflare protecting the traffic (proxying the domain's A record and the wildcard CNAME) to my public address, which adds another layer.