Which is better hosting apache server directly or using Cloudflare tunnel ? reddit / selfhosted ---------------------------------------------------------------------- sennje · 2023-10-03 11:17 Hi, I have a ubuntu server with few docker container running. And apache server running on ubuntu outside container. I am learning hosting. I came across Cloudflare tunnel. And was wondering which would be better. Making apache accessible directly by opening port 443. or tunneling through Cloudflare tunnel. What issues I could have to deal in future? ---------------------------------------------------------------------- Im1Random · 2023-10-03 11:44 I prefer regular port forwarding wothout Cloudflare since I don't want any 3rd party having access to thedata sent to my server. ---------------------------------------------------------------------- zarlo5899 · 2023-10-03 11:50 using Cloudflare tunnel when its not needed just adds another thing that can break ---------------------------------------------------------------------- survivallama · 2023-10-03 12:31 Im on starlink. I cant port forward. Cloudflare works for me. ---------------------------------------------------------------------- Oujii · 2023-10-03 12:57 If you can open ports directly and feel comfortable doing so, it's the best way moving forwards. Less complexity and less things to break. ---------------------------------------------------------------------- trexxeon · 2023-10-03 13:11 Skip Cloudflare.. Out of curiosity what made you go with apache as server? everyone used apache 20 years ago but now most people seems to have migrated to nginx or caddy.. ---------------------------------------------------------------------- 12_nick_12 · 2023-10-03 13:17 I have a mix of CF tunnels and I have a proxy server running tailscale. Tailscale is useful for non http things like a storj node. ---------------------------------------------------------------------- sennje · 2023-10-03 14:07 >y what made you go with apache as server? everyone used apache 20 years ago but now most people seems to have migrated to nginx or caddy.. I am learning both. I just happened to start with apache. ---------------------------------------------------------------------- AnApexBread · 2023-10-03 14:33 Neither are better or worse inherenetly. Opening port 443 is not a vulnerability. ​ The vulnerabilities exist in the Apache software not the port, so it doesn't really matter how people access the server. ​ That said, if you don't understand this then just use Cloudflare tunnels because they provide some automatic exploit prevention. ---------------------------------------------------------------------- jerwong · 2023-10-03 17:10 Directly. Also go directly when possible. The only time you need a Cloudflare tunnel is if your ISP is using CGNAT i.e. you don't have a real WAN IP. Otherwise, putting in a tunnel is just going to add overhead to your network performance and complexity to troubleshooting. ---------------------------------------------------------------------- opensrcdev · 2023-10-03 18:09 Port forwarding works perfectly fine on Starlink. ---------------------------------------------------------------------- talent_deprived · 2023-10-03 18:11 I use a VPN tunnel rather than expose my home IP (Apache, email), but really, if I could host my email at home, which I can't because Microsoft, Google, AWS, and others block email from residential IP'sin a combined monopolistic action that is probably illegal; then I'd probably host at home, if I could. Since I can't, I use the VPN for web and email and run them all here. ---------------------------------------------------------------------- rafipiccolo · 2023-10-03 19:15 Try traefik ---------------------------------------------------------------------- Im1Random · 2023-10-03 19:18 Nginx better ---------------------------------------------------------------------- maltokyo · 2023-10-03 19:38 But cloudflare can't see any content right? ---------------------------------------------------------------------- kearkan · 2023-10-03 20:22 I'm very confused. Until now I thought a CF tunnel was the preferred method because you can prevent using your public IP in DNS and making it visible to the world... am I wrong? ---------------------------------------------------------------------- sidkcr · 2023-10-03 20:24 I'm had a hard time understanding their docs. Finally went with nginx ---------------------------------------------------------------------- jess-sch · 2023-10-03 21:06 Of course they can, what gave you the impression that they couldn't? ---------------------------------------------------------------------- valdecircarvalho · 2023-10-03 21:22 Dude, you are LEARNING. So, LEARN! Start from the basics and then add more complexity to your environment. Try to keep things simple in the beginning or you will get frustrated. This is your LAB, so Build, Break, Re-Build and break again. It's an infinite circle ---------------------------------------------------------------------- valdecircarvalho · 2023-10-03 21:23 BTW, move to /r/homelab ---------------------------------------------------------------------- sneakpeekbot · 2023-10-03 21:23 Here's a sneak peek of /r/homelab using the [top posts](https://np.reddit.com/r/homelab/top/?sort=top&t=year) of the year! \#1: [It finally happened to me! Ordered 1 SSD and got 10 instead. Guess I'm building a new NAS](https://i.redd.it/zmkbspdfjqpa1.jpg) | [654 comments](https://np.reddit.com/r/homelab/comments/120udu5/it_fin ally_happened_to_me_ordered_1_ssd_and_got/) \#2: [How many of you have memorialized an IP address? I did so for my late wife's computer.](https://np.reddit.com/r/homelab/comments/138j4c 5/how_many_of_you_have_memorialized_an_ip_address_i/) \#3: [A 3D printed stand turns your Unifi access point into a UFO](https://i.redd.it/pf9q5qx3sju91.jpg) | [147 comments](https://np. reddit.com/r/homelab/comments/y746fp/a_3d_printed_stand_turns_your_uni fi_access_point/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| ^^[Contact](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| ^^[Info](https://np.reddit.com/r/sneakpeekbot/) ^^| ^^[Opt-out](ht tps://np.reddit.com/r/sneakpeekbot/comments/o8wk1r/blacklist_ix/) ^^| ^^[GitHub](https://github.com/ghnr/sneakpeekbot) ---------------------------------------------------------------------- valdecircarvalho · 2023-10-03 21:24 ohhhh apache is old, so let's use the new shinny thing? I assume the OP is LEARNING, so he should be learning what industry wants, not what's cool. I have NEVER seen Caddy running on a corp environment. ---------------------------------------------------------------------- trexxeon · 2023-10-03 21:30 I think you are reading too much in from a simple question.. I was just curious.. selfhosted community is pretty conformative so it's interesting to see something different. Your attitude on the other hand, we can pop that in the bin. ---------------------------------------------------------------------- Anejey · 2023-10-03 21:58 Cloudflare tunnels "just work". It has a nice dashboard, ssl certificates, easy customization. But you end up using a third party service that has access to your data. Going directly gives you full control over everything. Making it your responsibility to safeguard stuff. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-10-03 22:18 Create your own tunnel with OpenVPN or Wireguard. ---------------------------------------------------------------------- jerwong · 2023-10-03 22:58 There's no value in doing that. You're just adding latency and overhead for nothing. The only time there's value in a CF tunnel is if your ISP is using CGNAT and you don't have a real IP to host your services from. ---------------------------------------------------------------------- GOVStooge · 2023-10-04 03:01 traefik docker integration is awesome though ---------------------------------------------------------------------- Im1Random · 2023-10-04 05:34 They definitely can and will decrypt all the data sent over Cloudflare Tunnel or Proxy. Otherwise most of the features like caching, https rewrite or email readaction wouldn't even work since they need to directly modify the html code of your site. ---------------------------------------------------------------------- 4bitgeek · 2023-10-04 08:28 >traefik Try out pgrok. Selfhosted. You are in full control of what you want to do. Traffic never leaves your systems. Sufficient for most of the use cases. Host it with a wildcard DNS entry and good to go. Have to been using it for a couple of years without any issues. Can create dynamic tunnels as well as need ad-hoc basis. Else, pretty much similar to ngrok. Though it has not been updated that frequently, it suffices most of the use cases. Combined with letsencrypt's wildcard, it is a good combination for any selfhosted or homelab setup.