nginx proxy manager and duckdns reddit / selfhosted ---------------------------------------------------------------------- phyraks · 2023-10-02 21:13 I have been using DuckDNS and NGINX Proxy Manager (NPM) for years to host a number of services that I can access outside my network... Recently however, I hit the 5 domain limit with DuckDNS, and I am beginning to wonder if I've been doing this wrong all along... I'm running stuff like Home Assistant, Plex, Nextcloud... I've created a separate subdomain for each one, and then created certs with Let's Encrypt and linked everything in NPM. Is it possible to have everything under one subdomain, and then I can just specify a port or an extra path or something in the URL, so I won't need to make a new domain and cert for each service? Or is this not possible, or not the recommended approach? Basically, I was thinking instead of managing different domains like: myhomeassistant.duckdns.org, mynextcloud.duckdns.org, myplex.duckdns.org ... I could do something like this instead: mydomain.duckdns.org/ha, mydomain.duckdns.org/nxtcld, mydomain.duckdns.org/plex Is this even possible with NPM? ---------------------------------------------------------------------- d4nm3d · 2023-10-02 21:17 yes.. and you can. Set one of your domains to be (examples obviously) * phyraks.duckdns.org then in NPM set up your subdomains to be * myhomeassistant.phyraks.duckdns.org ---------------------------------------------------------------------- -SHINSTER007 · 2023-10-02 21:55 sorry to piggy back on this guy's thread but I've been out of the self hosted space for a few years, do ppl still use portainer, npm or are there better options now? ---------------------------------------------------------------------- Familiar-Newspaper23 · 2023-10-03 00:36 same as the other personsaid, use a wildcard and then do the sub- subdomain thing (that's almost certainly the wrong term for it)...i use google dns as I have a website with then anyway that is hosted on google sites but same deal - i have a wildcard with many services beneath it. for a reverse proxy though and for certs i use HAProxy and let's encrypt and go with the acme cert route..."sudo certbot certonly --manual --preferred-challenges http" from an ubuntu haproxy VM...and then enter all of the sub-subdomains that i use...whoogle, search, airsonic, music, calibre, books, paperless, homeassistant, and i know i am missing some but thats what i can think of...then complete the challenge and take the fullchain.pem and privkey.pem, concatenate them, point to them on the haproxy server which then routes to each of those services and bob's your uncle if youre comfortable with npm though then by all means go that route...its probably easier from what ive seen but i havent tried it so yea, it kinda sucks having to deal with the cert challenges for multiple services but its not like that's something that needs to be done often and once setup it works well and with only one IP address and one subdomain ---------------------------------------------------------------------- Wise-Cash1628 · 2023-10-03 23:26 This, and also use a service like authelia to add security like 2fa using otp for instance. ---------------------------------------------------------------------- arealfunghi · 2023-10-04 14:53 This is exactly what I wish to do, but I'm a little confused about setup & port forwarding on my router. Warning: I'm a n00b when it comes to networking. I initially thought I should configure my router to port forward 80 & 443 to my NPM IP on my network, but this doesn't properly proxy all the hosts (sub-subdomains as another put it) configured in NPM; they all point to NPM when navigating to [any.mysub.duckdns.org](https://any.mysub.duckdns.org). The alternative a lot of folks seem to use is a Cloudflare tunnel, but I'd prefer not to add another service to the mix until I understand the basic networking behind reverse proxies. ---------------------------------------------------------------------- phyraks · 2023-10-06 04:35 Just went and did this today. Wow! It drastically simplified my DuckDNS and NGINX setup. ---------------------------------------------------------------------- phyraks · 2023-10-06 04:41 Thanks for the tip! Thankfully all of my services already use 2FA. But this is super helpful if I want to run something that doesn't have a built-in 2FA. ---------------------------------------------------------------------- phyraks · 2023-10-06 04:42 Yeah, NPM makes the management side of all of this super easy thankfully! I was just unfamiliar with the logic behind the subdomains and wildcard certs. I just set this up today and it drastically simplified my setup. ---------------------------------------------------------------------- phyraks · 2023-10-06 05:21 Yeah, you ONLY need to open ONE port on your router. That's the beauty of NPM (and any reverse proxy). NPM defaults to 443 since that's the port for HTTPS traffic (but I believe you can set a custom port if you want... just don't quote me on that, as I haven't tried it myself). The basics of the reverse proxy networking is it takes ALL external traffic in on a single port (443) and then routes the traffic inside your network to the appropriate local IPs and ports. For example, let's say you had a service like Home Assistant running on your local network. The default port for HA is 8123. You tell NPM the local IP and port of your HA server and you assign it to your external IP. Since most people are still using IPv4 and your ISP would be using NAT to give you an external IP, your external internet IP address is constantly changing, and let's be honest, nobody wants to try and remember a bunch of numbers anyway... So that's where Dynamic DNS services (like DuckDNS) come in. They map your external IP to a more friendly to read domain name that doesn't change... something like ha.mydomain.duckdns.org, for example. When traffic hits the DDNS domain URL, it is mapped to your external IP address, so it's routed to your network. At this point, when NPM sees traffic come in on that DDNS URL (ha.mydomain.duckdns.org) via port 443 (HTTPS), it uses the internal IP and port mapping you assigned for your Home Assistant server to route that traffic internally on your network. The idea is that every time you open a port on your network, you are opening more holes (more attack surface for bad actors). NPM doesn't eliminate the risk of opening ports since you are still opening a port, but it's a lot easier to harden/secure the one port vs trying to secure a whole bunch of them. If I've misspoken, hopefully a smarter person than myself can clarify further, but this is basically how I understand everything. ---------------------------------------------------------------------- Wise-Cash1628 · 2023-10-06 10:09 This is the way then. Personally, I have found out that I am rarely connecting from a device that is not mine. And a good solution for me was to install Tailscale on my server and on my laptop. It is very straightforward and secure. I have both NPM with authelia and Tailscale installed. ---------------------------------------------------------------------- Familiar-Newspaper23 · 2023-10-17 23:55 i'm no expert for sure - but using haproxy definitely forced me to learn so i like that...and now i'll forever be too stubborn to try anything else since i had to learn (this is the "i had to walk uphillto school both ways" mindset...fuck im old now)...but really though i learned of NPM only after already getting all my gear up and running but it looks and sounds awesome so i may have to try it out sometime in docker and see how it goes ---------------------------------------------------------------------- DundasKev · 2023-11-29 00:46 Aand thank you, totally just got this going as well! thanks u/phyraks for your "anyone seeing this later" message, anyone was me.