Why not use port 80? reddit / selfhosted ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:15 I have several services, (not docker) that run on funky port numbers. 8006 for proxmox, or 8321, or 8080. What stops me from addressing all these to port 80, so I don't have to remember the obscure port number to access? There a security reason for this? Or is it just trying to avoid port conflict? ---------------------------------------------------------------------- levogevo · 2023-09-28 01:27 You can only have one service mapped per port. So your approach would work if each machine/ip address has one service you want to access. The reason they are "funky" is because your strategy is not common and each application would ideally have a default port that is accessible, ie must be a unique port. ---------------------------------------------------------------------- LegitimateCopy7 · 2023-09-28 01:30 >is it just trying to avoid port conflict? yes. imagine every service in existence using port 80 or 443. it's not going to be a fun time changing all the port settings. you want to access every service through port 80 (or 443)? use a reverse proxy. ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:30 So what I'm gathering is these are that way because they are designed to share the same ip, or atleast same target? I run everything within their own lxc or vm, so everything had a unique ip, so port conflicts are unlikely. I just didn't know if there were security implicating ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:34 Sorry, I'm an ME by trade, sys admin by fumbling at night. I'm not sure what industry standards are, just know what works here at home. Crazy port assignments aren't working and didn't know if changing them all to 80 (or 443) would open a can of worms. ---------------------------------------------------------------------- krankykrio · 2023-09-28 01:35 Use a reverse proxy ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:36 I believe that's the next chapter ---------------------------------------------------------------------- shaftofbread · 2023-09-28 01:40 The operating system limits access to port numbers below 1024 to the superuser. If you want a particular service to bind to, say port 80, it needs to start as root. Some can 'downgrade' themselves to an unprivileged user after they bind the port, but it's much safer to never give them superuser access in the first place, particularly if you don't / can't completely trust the code. As others have said, each service needs to bond to a unique port number. If you want everything on port 80, leave them configured with their out-of-the-box unique unprivileged port numbers, and use a reverse proxy - I prefer nginx - to listen on port 80 and direct traffic to services based on the Host: field in the http GET request. ---------------------------------------------------------------------- alphabuild · 2023-09-28 01:41 Your host won’t even let you do it. The service will try to bind to a port that is already in use. Imagine every house on your street having the number 80. Where would the mailman go? ---------------------------------------------------------------------- shaftofbread · 2023-09-28 01:47 > There a security reason for this? Yes (see my other reply). > Or is it just trying to avoid port conflict? Also yes :-) ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:47 Thank you for the detailed response, I did not know this about ports and superuser, interesting. I know others use reverse proxies, but always seemed like an extra step. ---------------------------------------------------------------------- krankykrio · 2023-09-28 01:49 I can recommend nginx reverse proxy for quick and easy or traefik if you like getting your hands dirty. ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:49 As mentioned, I run each service in a different vm or lxc, so each service gets its own ip, so I don't see the issue (again in new at this, so I could be way off base with my understanding). ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 01:50 I've heard of these, haven't messed with them yet. Thanks for the advice. ---------------------------------------------------------------------- alphabuild · 2023-09-28 01:51 Right. But part of your question was why do they have funky port numbers. And that’s why. ---------------------------------------------------------------------- lesigh · 2023-09-28 01:54 That's why you setup one service on port 80/443 that acts as a reverse proxy. Once configured it'll match the hostname and forward it to the correct service/port ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-28 01:54 Yes, if they're each on their own IP address, they could all be on port 80. But there's no particular benefit to doing that. Very frequently, setups in containers or VMs will be cordoned off on their own networks, but with ports forwarded to the host. That may be why the other commenter (as well as myself, until I read this far) thought you were trying to put everything on the same port, on a single IP address. ---------------------------------------------------------------------- _Answer_42 · 2023-09-28 02:07 One thing to note binding on low number ports require root privilege, not required for ports like 1234 and above ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 02:08 Just curious, why? Does that expose my services in any way? ---------------------------------------------------------------------- Nimrod5000 · 2023-09-28 02:15 Http is port 80 and https is 443. If they all map to port 80, you get no ssl cert first off. Second, because they don't have different domains/subdomains attached, you can only use 1 port at a time. So http://localhost goes to port 80 by default and that's one service. Https://localhost would go to 443 and that's one service. If it's being accessed from a browser anything other than http and https needs a port number declared like http://localhost:8080. If you are only working with one "domain" like localhost, only 1 service per port. Otherwise how would your system know what to serve you? ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 02:22 Sorry, my ignorance is good to show. Often when I spin up a new vm on my server, the hosted service gets a new ip. That service might be proxmox host, speedtest, homeassistant, pihole, immuch, etc. Each with the ip of their client. So I need to not only remember the ip, but the port to access the service. So that's why I ask, why I couldnt change each service on each vm to port 80 (or 443) to not have to remember the port. ---------------------------------------------------------------------- port8080dev · 2023-09-28 02:26 No but those lower port numbers can be reserved for critical services, so they're privileged. ---------------------------------------------------------------------- Alone-Hospital-6028 · 2023-09-28 02:28 Because port 80 is HTTP and HTTP is plain text. Plain as day. ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 02:31 Understood, 80 might not be the best idea, but for a home lab might be OK (I think). If I had these service internet facing, yeah, bad news bears. Luckily I trust my home users and zerotier into my network when outside, so sniff doesn't seem like a big concern. ---------------------------------------------------------------------- death_hawk · 2023-09-28 02:48 > I run everything within their own lxc or vm, so everything had a unique ip Which is all well and fine if you have the IP space to do it. Sounds like you're running this at home (or on a private subnet) but trying to do this publicly is going to be costly because of the IPs. If you want to bind everything to 80 and give it a unique IP for each service? That's perfectly fine inside a private address space. You only start running into issues when you start running multiple services on a single machine but you're already VMing each service so this isn't an issue. Security can be an issue, but it's not like port scanners don't exist. 44316 isn't any more secure than 80 because now it's just security through obscurity. Besides... all the popular "obscure" ports are already known/published. ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 02:51 Interesting... yes you are right, all services are only ran at home for personal use. Nothing exposed to the internet. I'm to chicken to expose anything. 🤪 ---------------------------------------------------------------------- themightychris · 2023-09-28 02:52 AFAIK it's from back in the day when many users shared institutional systems, the lower ports were reserved for "official use" and need root privs to bind to Essentially only the "owner" of a machine can offer services on their default ports ---------------------------------------------------------------------- colin_colout · 2023-09-28 02:55 And you need root permissions for lower port numbers Inside containers, you shouldn't be root. Feel free to map to whatever you like on the host or load balancer tho. ---------------------------------------------------------------------- Scoth42 · 2023-09-28 02:59 It's mostly a legacy of the days before VMs, Containers, and the like. A company might have a single server running a ton of services, because hardware was expensive and complicated to set up. So, services were designed with different common ports to avoid conflicts. A list of common services and ports [is here](https://www.pearsonitcertificat ion.com/articles/article.aspx?p=1868080), among other places. There are also [registered ports](https://www.iana.org/assignments/service- names-port-numbers/service-names-port-numbers.xhtml?&page=1) where common services stick to various ports and then dynamic ports from 49152 to 65535. However, there's nothing actually enforcing these, more or less, especially for your own use. You may run into some situations where a particular client is expecting a service to be running on a particular port and won't work if you manage to change the server port, but these are pretty few and far between. So, in the end, no, there's really nothing stopping you from putting everything on port 80 if you really want, but it'll probably confuse anyone else who might be looking at it (colleague or friend or whomever) and might make tutorials and howtos a little trickier since they're usually geared towards default ports. I wouldn't recommend doing this for anything you expect to expose publicly though. The main security reason for not using port 80 for anything other than an actual intentionally-public web server is you'll get a lot of people sniffing around common ports. In the olden days when I had my ssh bastion host on the default port I constantly had people trying to brute force passwords and otherwise muck about with it. Once I stuck it on a random high port number I've had zero. ---------------------------------------------------------------------- seidler2547 · 2023-09-28 03:06 1024 ---------------------------------------------------------------------- Scoth42 · 2023-09-28 03:08 The main use for a reverse proxy is easily exposing lots of services across different hosts on the same port(s), as well as potentially adding layers for authentication, easier SSL certificate management, logging, security checks of whatever kind, load balancing, and any number of other reasons. I use it to expose a number of internal services with one SSL cert managed on my nginx container. I can do things like access my nextcloud at [https://nc.mydomain.com](https://nc.mydomain.com) and my webmail at [https://webmail.mydomain.com](https://webmail.mydomain.com) or whatever else pretty easily and straightforwardly and I don't have to mess with SSL/certs on my individual services or worry about remembering the ports they're on (nb - best practices would still have you encrypting things internally, I'm just lazy, but you can do things like self signed certs internally since you aren't too worried about trust there. Still saves you from having to manage a bunch of certs). I also use nginx to stick a basic HTTP auth layer in the middle of a couple things. It's not the most robust scheme but good enough for my uses. ---------------------------------------------------------------------- death_hawk · 2023-09-28 03:09 As you should be. Even if you need remote access, VPN is the way to go. There'll be a service or two which needs public access for one reason or another but I wouldn't expose anything but a reverse proxy there. ---------------------------------------------------------------------- Scoth42 · 2023-09-28 03:13 From a technical perspective, if you're doing a whole new VM that gets a separate IP for each service, there's nothing stopping you from using port 80 on all of them. As long as there aren't other web servers running on them, you could set them all to port 80, access them in a browser, and they'll all work fine. If any of them have SSL enabled (even with self-signed stuff) then you'd probably want to use port 443 - since web browsers will use port 80 with http and 443 with https by default you'd have to do something silly like [https://ipaddress:80](https://ipaddress:80) which... would probably work but defeat the purpose. If you're doing this for fun and general usage/learning, go for it. Won't break anything. But if you're learning as part of a career path or additional education, I wouldn't recommend it. No company is going to want you to do that with remotely common services and being familiar with common ports is important for a lot of troubleshooting and maintenance work in sysadmin stuff. ---------------------------------------------------------------------- desnudopenguino · 2023-09-28 03:25 Set up haproxy or nginx as a proxy for your services, and route them through domain names/subdomains on your local net. ---------------------------------------------------------------------- brandontaylor1 · 2023-09-28 03:29 It’s not a security thing, ports just tell the packet what service to go to. You can usually reassign them, but it can become a real headache. You can only have one service per IP, integrations expect a standard port and will need to be specified. My preferred practice is a reverse proxy. One websever on port 80 that checks the host header and points the traffic to the correct ip and port. The you can use names instead. i.e. proxmox.domain.net or domain.net/proxmox. ---------------------------------------------------------------------- reercalium2 · 2023-09-28 03:38 Inside containers you're always root inside the container ---------------------------------------------------------------------- NikStalwart · 2023-09-28 03:59 > Inside containers you're always root inside the container *[USER](https://docs.docker.com/engine/reference/builder/#user) directive has entered the chat.* Being root inside a container if you are not using userns-remap is, pardon my french, retarded. ---------------------------------------------------------------------- Nimrod5000 · 2023-09-28 03:59 100% agree. He could also set up a domain name server on the network and use that to setup local domains. Then he would just remember the domain names. OR if it's all accessed from one computer or something, he could just add some entries to his hosts file. I recommend the latter if he only accesses these things from the local network on a few computers. ---------------------------------------------------------------------- pivotpixels · 2023-09-28 04:35 I'd recommend watching the "You suck at subnetting" playlist by Networkchuck. Unless you understand how networking and sub-netting works you won't understand about how ports work. ---------------------------------------------------------------------- montdidier · 2023-09-28 04:44 It is not really about security, although there are some security considerations. Its more that port 80 is the official HTTP port and the default use case for a lot of these services is not production out of the box. Also on many Unix and Linux systems, ports under 1024 are privileged and require enhanced privileges to take. I would argue these ports are chosen mostly to reduce contention for port 80 and or to boot up usably when run by a regular user. Often a proxy or relay runs on port 80 and can be configured to connect to these services. In any case all can be configured to run on port 80 if you want them to exclusively take it. ---------------------------------------------------------------------- sidusnare · 2023-09-28 04:55 Usually you have a caching proxy in front of it, most commonly nginx. Usually a lot of these services are mapped together into a single site that presents as a single portal for the users to log into, and they wouldn't have access to the off-port http services. The nginx layer would handle caching, maybe also SSO, filter API endpoints that are administrative only, and so on. ---------------------------------------------------------------------- Important_Creme_1331 · 2023-09-28 04:57 The pain begins if you want to use your domain or public ip. That only has one port 80. Which one corresponds to that so your service is externally available? In easy sitiations you can port forward what you need without reversenproxy. But most of the time you would proxy that. I concur on networkchucks videos. Takes you from noob to expertish in subjects. ---------------------------------------------------------------------- zarlo5899 · 2023-09-28 05:25 you can do this but i would not i would use a reverse proxy like nginx ---------------------------------------------------------------------- psychowood · 2023-09-28 05:41 You can do that with containers in docker too: create a mac2vlan network with the same subnet handled by your router and assign static ip to each service in the container configuration. I usually set a static mac address (otherwise you'll get a new one when you recreate the container) and let the router handle dhcp and specific hostname for each service. ---------------------------------------------------------------------- ithakaa · 2023-09-28 06:17 port conflicts ---------------------------------------------------------------------- certuna · 2023-09-28 06:35 Yes, it’s to prevent port conflicts with IPv4. With IPv6 this doesn’t matter, each container has its own IP address so they can use the same port. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-09-28 07:09 You discovered what a reverse proxy is for. You place a nice application in front of them and expose their local port only on localhost so that they can only be accessed from the reverse proxy itself. And it will obviously expose just 80 and 443. ---------------------------------------------------------------------- lowerseagate · 2023-09-28 07:15 To simplify your life, use a reverse proxy and tie the service with duckdns domain name. That will make every service go thru ports 80 and 443. To make it even simpler just use nginx proxy manager ---------------------------------------------------------------------- NOAM7778 · 2023-09-28 07:25 If it's a container, just run the reverse proxy on whatever port and just map to the host to 80 and 443 [with docker -p] ---------------------------------------------------------------------- Proxmux · 2023-09-28 07:31 If using multiple vms or containers you can force port 80 if they each use separate ip addresses. I have done just that. I don't need the extra reverse proxy involved just to have 5 or 6 minor services. So home assistant, traccar, Jellyfin to name a few, each in their own container, are now on port 80 but on their own ip address. If they all share ip addresses, then no, you should not try to map the same port to multiple services or containers. ---------------------------------------------------------------------- KXfjgcy8m32bRntKXab2 · 2023-09-28 07:34 By default every container has its own IP (v4 or v6) within the bridge it is attached to! You can run two containers next to each other both listening on TCP/80. Now if you map the port with the host machines you have to map on a free port on the host, though. Same goes if you run your container on the host network (which is not the default behavior) you need to reconfigure one container to run on a different port. Listening on host network is discouraged unless the container needs to integrate with things in the host subnet (home assistant is a good example). ---------------------------------------------------------------------- KXfjgcy8m32bRntKXab2 · 2023-09-28 07:39 For all I care I can run HTTPS on port 80 if I'd like (even though that would confuse modern day browsers with "HTTPS always on" enabled). Or even SSH on TCP/80. Ports are just a convention and nothing set in stone. Only some services like SMTP have to respect the convention for remote peers because there's no way to tell the remote peer on which alternate port the inbound SMTP is running. ---------------------------------------------------------------------- Bambo630 · 2023-09-28 07:49 They have different IPs, but the main problem is that for example i have is: I dont have a public IP so i need to tunnel to a server that has one, but its only one IP so it only has one Port 80 etc. If i tried to access it, it wouldnt know which VM i try to access, or say something like Port already in use. So you could somewhat dodge it by having subdomains for each vm and then you only need to remember the domain name. Im a noob so please correct me if im wrong ---------------------------------------------------------------------- Sem1r · 2023-09-28 07:53 Most services you mentioned are often used with a public IP. Because public IPs (ipv4) are pretty expensive you don’t want to waste a single ip per service. So it’s much easier to handle them if they don’t use the standard ports for every Webserver out there. Most services allow you to change the port they are running at. But if you can’t, there is always the option to do it via a reverse proxy. It’s also a bit saver. If you are not so technical I would recommend nginx proxy manager. This application gives you a UI to configure all your proxies and there is lot of documentation out there to help you. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-09-28 07:59 also depends on the orchestration you're using. rootless containers are a thing. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-09-28 08:04 Which is sensible. ---------------------------------------------------------------------- Wf1996 · 2023-09-28 08:08 Heard about bookmarks? ---------------------------------------------------------------------- NikStalwart · 2023-09-28 08:09 In my experience rootless podman is more common than rootless docker. But, in general, you are right. ---------------------------------------------------------------------- arienh4 · 2023-09-28 08:12 It's not _entirely_ back in the day. They're also known as "well-known ports". It's to ensure that if you connect to a machine on port 22, you know that the server that responds was started by someone with superuser privileges, and not another random process. That could be another user on a shared system, it could also be an exploit in an unprivileged process or straight up malware. Of course SSH in particular and many other services have other ways to verifying that you're connecting to the right host, but it's still a valid security consideration. ---------------------------------------------------------------------- Master_Basil1731 · 2023-09-28 08:29 Fuck your French, that's a shitty word to use as an insult ---------------------------------------------------------------------- lilolalu · 2023-09-28 08:34 Install a local proxy server and assign DNS aliases so instead of 192.168.1.100:8832 you can type nextcloud.home ... very easy with a firewall like pfsense but also pihole etc. ---------------------------------------------------------------------- NikStalwart · 2023-09-28 08:34 > Fuck your French, that's a shitty word to use as an insult Says the guy with 32 comments to /r/IdiotsInCars, oh the irony. ---------------------------------------------------------------------- BenChueh · 2023-09-28 08:42 Because then port 80 becomes too common and every services are fighting for it Especially when you’re running multiple different services on your machine, you cant just point all of them to port 80, that ain’t gonna work. Unless you use smth like reverse proxy like most of the dudes here, then you can create better entrances for your services through domain name after configure port 80/443 ---------------------------------------------------------------------- CerberusMulti · 2023-09-28 09:25 Sir, please go easy on the Basil. He hasn't gotten any sunlight recently. ---------------------------------------------------------------------- NikStalwart · 2023-09-28 09:35 Fair enough. I should let the sun do all the burning. ---------------------------------------------------------------------- robberviet · 2023-09-28 10:32 Those are reserved port, usually for your default web server/reverse proxy. ---------------------------------------------------------------------- daedric · 2023-09-28 11:02 Most of what been said bay other users is true. The basis is: * No 2 processes can bind themselves to the same IP:PORT * Usually, only root can LISTEN on ports bellow 1024 (this is not true anymore, that privilege can be granted IIRC) * You can use a reverse proxy listening on port 80/443 to route requests based on the URL asked for, but this only works for HTTP. Anything that creates a direct connection cannot use this. (Also not true, it can be workaround with SSH) ---------------------------------------------------------------------- nullmove · 2023-09-28 11:41 You don't necessarily need root permission for that, `CAP_NET_BIND_SERVICE` capability is enough. ---------------------------------------------------------------------- cyber1kenobi · 2023-09-28 11:42 Port 80 is spoken for ---------------------------------------------------------------------- KrokettenMan · 2023-09-28 11:46 Aside from preventing port conflicts most ports under 8000(iirc) are reserved and require admin privileges to listen to ---------------------------------------------------------------------- ZeeroMX · 2023-09-28 13:50 I don't remember all the ports, I use homarr as the only point of access to all the services I run. The homarr link is in the home page of my browser and it's there whenever I open a new tab in the browser. I would suggest using one of the multitude of dashboards like that or going the proxy route. ---------------------------------------------------------------------- rjr_2020 · 2023-09-28 14:17 There can only be one listener on port 80. Whatever that might be. As others have said, you can use a Reverse Proxy to be that process and have it organize who gets which connections, but everything cannot listen on one port at the same time. If you have separate ports for everything, then you \*could\* do so. I still think a Reverse Proxy service would be better as you only have one place to connect. ---------------------------------------------------------------------- No_Plenty_8329 · 2023-09-28 14:26 Lots of great suggestions above. If the issue is just remembering ports, just simply setup a dashboard for your homelab. Heimdall works well for me. All your hostnames and port are one click away. ---------------------------------------------------------------------- Affectionate_Use8825 · 2023-09-28 14:59 Ok so I’d run ngix or some sort of reverse proxy so all you have to remember is a url not a port ---------------------------------------------------------------------- DWolfUK40 · 2023-09-28 15:43 Ideally you would run caddy or similar and proxy everything. If using docker everything needs different ports or they conflict because they’re all running on the same ip. If running in seperate vms then you could have things on port 80 to make it easier but then later it might make things difficult because you will inevitably decide you want access to something externally so to me it’s better to get it all “right” from the get go so you have those options later. There is obviously a security aspect to it. If somebody gains access to your network funky port numbers could save you. I personally feel that Proxying everything provides more security. You can easily enable 2fa on anything with caddy and authelia. Restrict access to the services to only talk to the proxy and you’ve massively cut down on areas of attack. A lot of products use different ports because they assume they could be run on the same machine or vm and don’t want the troubleshooting tickets when there’s a conflict. I prefer to let them use the ports they want(sometimes they’re hardcoded in weird places) and proxy them however I wish. Remembering dns names is so much easier than remembering IPs a year down the line for me :) A bit of planning and work now will likely save you down the line. Just because you don’t see it being internet facing now doesn’t mean it’s safe or that you won’t want that later. If any machine gets infected, I’m thinking kids, wife, friends etc that like to play clicky clicky (there’s nothing to say you won’t install something with a back door at some point that’s exploited either) They could potentially open up everything and you will be pleased you have decent safety measures already in place. It’s good knowledge to have and if you’re already playing with vms it’s something that’s relatively simple and that won’t take up more physical hardware :) ---------------------------------------------------------------------- HildemarTendler · 2023-09-28 15:49 I'm not seeing great answers here so I'll take a whack at it. Port numbers are traditionally used to distinguish different applications. The key here is that even in a containerized world where every service is addressable purely by IP, people are familiar with port numbers for different services. Lots of clients and integration applications assume default port numbers, though they should be configurable. So while there isn't a technical reason to run everything on separate ports in your environment, it may still be good practice for consistency with the wider world. That said, I'm more familiar with traditonal network services than homelab applications. It would be surprising for smtp to be running on a port other than 25, but do whatever with your browser based applications that all want to be exposed via 80/443. ---------------------------------------------------------------------- kmisterk · 2023-09-28 16:20 ## Message Removed Harassment, abuse, insults, expletives, or other negative comments or posts *targeting a person* is absolutely not tolerated. Bigotry, excessive elitism, and intentionally-demeaning dialogue will also be removed as deemed necessary. We aim to promote an inclusive, yet constructive community that helps people group. [Message the mods](https://www.reddit.com/message/compose/?to=/r/selfh osted&subject=Removed for Rule 3&message=[Removed Post](https://www.re ddit.com/r/selfhosted/comments/16u2ash/-/k2j6lrr/\)) ---------------------------------------------------------------------- DragoSpiro98 · 2023-09-28 16:53 Simple, because if they all use port 80, you would necessarily need a reverse proxy or change the port for each service (which translates into turning off the currently active service active on port 80, turning on the new one you want to change to port 9000, changing the service to port 9000, turning on the service that was active on port 80 again). Given that in some contexts a reverse proxy is not necessary and given that a software must simplify the life of a sysadmin as much as possible, they choose to use strange ports not used by other services (at least not common services, certainly there are numerous services that by default they conflict) ---------------------------------------------------------------------- dal8moc · 2023-09-28 16:59 It IS a security thing in a way. Reason is you need root or special permissions to bind to a pretty <1024. So by using higher ports the service can (and often should) be run by an unprivileged user. So if it gets compromised the problem should be isolated to that service. With vms and/or containers the whole issue is more or less down to a nuisance as you can nuke a compromised vm. But it still is good practice to run a service with as little privileges as possible to minimise impact in case of a breach. ---------------------------------------------------------------------- t1nk3rz · 2023-09-28 17:56 I understand your frustration,i set up pihole dns to ip's via hostname i redirect all the hostnames to the ip of my ngnixproxy manager with my ssl certs loaded and root ca certificate installed on my machines, i just https://pve.marvel ---------------------------------------------------------------------- ZeroPointMX · 2023-09-28 18:02 Sounds like device devs just assume port 80 is used and default to a random-ish port to prevent conflict during install. ---------------------------------------------------------------------- DragoSpiro98 · 2023-09-28 18:08 That's right, it's the main port for HTTP in general ---------------------------------------------------------------------- Timithius · 2023-09-28 21:51 This is the correct answer, ports have nothing to do with what protocol you are going to use unless you're following the conventions set. And even for things like SMTP, I can see a situation where if I had two SMTP servers relaying to each other, there isn't a reason to have 25 open if they both agree to use 6060 or something. That's what I do for my AWS postfix relay -> on-prem exchange over VPN. ---------------------------------------------------------------------- purepersistence · 2023-09-29 00:34 You get downvotes but you’re right. Docker runs as root so it’s containers do too. You can (and I do) use arguments to make the container run with the permissions of a specific user, but in the end that’s a breakable honor system enforced by docker not the OS. ---------------------------------------------------------------------- colin_colout · 2023-09-29 04:19 Not if you're following best practices ---------------------------------------------------------------------- colin_colout · 2023-09-29 04:38 You CAN run your primary process as root on a home lab, but these containers are often built so you can run it as non root easily. They are getting downvoted because their statement is false. Sure, the docker daemon needs root to use cgroups, but the processes inside the container (the ones that actually open the ports) can and should bee run as a non privileged user. When it does, it won't have access to lower port numbers. In your home lab you can run things as root if you want. You shouldn't do that in a production environment, which is why many containers default to higher ports. ---------------------------------------------------------------------- labnerde · 2023-09-29 06:14 You can do that, but it would be way more comfortable if you run a Dashboard like Dashy or Heimdall. Then there is no need to remember Ports. Combine the Dashboard with an DNS / Proxy services to get your network wide hostnames ---------------------------------------------------------------------- PaulEngineer-89 · 2023-09-29 11:08 Most sites run a web server, most commonly nginx, on 80 and 443. Web sites are the default one or http(s):/:address/site-name?options. With DNS support it still gets called with the same address but the actual URL in the http header will point to subdomain.address so the web server uses this to map it, even to a different server. That is what the term reverse proxy means. If you have to pick a new web server, use caddy. It’s easier. Nginx can do anything but it’s overkill when you always do the same 3 things. Traefik is even worse. And both were before SSL so everything is a hack. That’s the problem with the Linux crowd…given a choice between grossly overcomplicated and difficult to use or simple and elegant, they always choose overcomplicated. ---------------------------------------------------------------------- colin_colout · 2023-09-29 12:37 This is the way ---------------------------------------------------------------------- Patient-Tech · 2023-09-29 14:07 When you get enough things running, you’ll never remember all of them anyway. I just use bitwarden password manager and add keywords in the description so all the links to the address (and logins) are just a click away. ---------------------------------------------------------------------- chyron_8472 · 2023-09-29 15:18 I recommend Nginx Proxy Manager, rather than vanilla nginx. Nginx Proxy Manager has a GUI front end and takes a lot of the headache out of manually configuring things. I use Docker for container services on my homelab, and found that, in Docker, if you add containers to the same docker network, you can use the container name and its internal port instead of the IP. So I can tell nginx to forward abs.local or abs.mydomain.ext to "audiobookshelf" and port 80 rather than my hosts IP address and port 13375 ---------------------------------------------------------------------- ZeroPointMX · 2023-09-29 15:27 Sounds interesting, will take a look. Question, will Nginx or NPM resolve to other IP and port within my network? I can understand use with docker, however I use proxmox vms and lxc. Would I need an instance of nginx running on each client, or could a centrally hosted nginx do the trick? ---------------------------------------------------------------------- chyron_8472 · 2023-09-29 15:52 A centrally located nginx will work. It just needs to be able to talk to whatever VM/LXC you're putting behind it. You can host nginx on a different location on the network, but then you'll have to expose stuff on a different host than it to that host. Think of the IP as the street address and the port like an apartment number. As some people have said, lower apartment numbers are generally reserved for a specific use. Higher ones are generally available for anything. ---------------------------------------------------------------------- chyron_8472 · 2023-09-29 16:13 I don't have experience with Proxmox. The key point really is that if you want to host different things on the same host, and they need to use the host IP to talk to each other, then you need to give them separate ports. Nginx basically hides everything behind itself, so you can just use a domain name and tell Nginx where each subdomain points to. If you want a free domain, you can get one from duckdns. ---------------------------------------------------------------------- thetredev · 2023-09-30 13:58 https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html