Help me wrap my head around Cloudflare and Nginx Proxy Manager reddit / selfhosted ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 03:08 So, I've been self hosting for about a year now, and up until now, I've used Cloudflare Tunnels to expose my services to the internet. Everything has worked just fine with CF tunnels, but being the tinkerer that I am, I've decided to try new things out and hopefully expand my knowledge when it comes to self hosting. So here I am now running NGINX Proxy Manager and I'm trying to get everything set up properly. I've got NPM up and running and I can access my services over it. My domain is managed via Cloudflare so I have A records set up in CF pointing it to the public IP of my VPS. ​ Here are the questions I've got: In your opinion, should I turn on the DNS proxy on the Cloudflare A record? Do I need the Let's Encrypt certificates if I turned on the DNS proxy in Cloudflare? Is it possible to use my own Let's Encrypt certificates while proxying the DNS in Cloudflare? (Would that prevent Cloudflare from seeing the traffic?) Is there any difference between creating a proxied A record in Cloudflare that points to the public IP of my VPS vs having Cloudflare Tunnels pointing to NPM locally? If I don't want to use Cloudflare as an additional proxy to NPM, do I install Crowdsec? ​ Thanks! ​ ​ ---------------------------------------------------------------------- AZDNice · 2023-10-13 03:42 Remind me ---------------------------------------------------------------------- Vee_King · 2023-10-13 05:17 Well phrased questions, and I'm wondering much of the same! Specifically, if there's a "better alternative" to CF for tunnels and/or proxy DNS, that's maybe more privacy-oriented? Side note: I haven't actually gotten CF Tunnels to work with my Homelab setup yet, but I do like the Proxy DNS just to keep my private IP private (mostly because less likely to be targeted for hacking scans etc and the extra layer of protection, not because I really care that much if somebody knows my IP). ---------------------------------------------------------------------- Last-Beautiful-3747 · 2023-10-13 05:52 You can generate Origin Certificates under SSL/TLS -> Origin Servers for longer term and import those Certificates to NPM to use for your all subdomains. This way, you don't have to disable proxy for your A record in cloudflare. ---------------------------------------------------------------------- trustMeIAmANinja · 2023-10-13 07:32 >Do I need the Let's Encrypt certificates if I turned on the DNS proxy in Cloudflare considering stuff is getting terminated on CF's side? > >Is it possible to use my own Let's Encrypt certificates while proxying the DNS in Cloudflare? (Would that prevent Cloudflare from seeing the traffic?) Not really. But it doesn't hurt to get your own LE certs and its easier. If you don't have LE certs, then you should use Cloudflare's certs and ensure that traffic between your services on the VPS and Cloudflare is still encrypted. If you are using LE certs on your side, Cloudflare will work because its effectively acting like a client and terminating the traffic coming from your services on its servers and then sending it to the actual client of your services over a separate SSL connection. > Is there any difference between creating a proxied A record in Cloudflare that points to the public IP of my VPS vs having Cloudflare Tunnels pointing to NPM locally? From a clinet's perspective they mostly look the same. Cloudflare Tunnels works really well when you are behind CGNAT and/or cannot open a port on your firewall, but you have maintain an extra component on your end for the tunnel. using DNS proxy mode works best when you have a consistent IP address that you can point to and you don't need to run cloudflared on your end. > In your opinion... I would rather not.. you should evaluate and do what works best for you. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 07:34 I switched to using CF's origin certs so there's that. Thanks for the additional info! ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 07:42 >You can generate Origin Certificates under SSL/TLS -> Origin Servers for longer term and import those Certificates to NPM to use for your all subdomains This is what I did in the end ​ >This way, you don't have to disable proxy for your A record in cloudflare. I assume this has to do with renewing LE certs and having the origin IP unproxied and accessible for validation? ---------------------------------------------------------------------- Unable_Ordinary6322 · 2023-10-13 11:49 This is the right way. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-13 11:58 The main difference when doing certificates etc. with Cloudflare is that CF is basically acting like a man-in-the-middle and has access to everything going through the tunnels. As long as you're ok with that and consider it a good trade-off for the services they provide, that's cool. IMHO unless you are forced to use their tunnels because of CGNAT you should not offer them this kind of access into your traffic. And if you have a VPS with its own public IP it mostly loses all meaning and you're trading privacy for nothing. Some people do it to "hide their home IP" and there are cases where it's a legitimate concern, such as that person the other day who lived in a small town and their IP was pinpointing their house almost perfectly. But if you're in a large city and/or your ISP rotates public IPs and your IP merely narrows it down to a radius of a few blocks tightly packed with apartments, you're probably going to be ok. You can also do what Cloudflare is doing if you have a VPS, by running a WireGuard tunnel from a container at home to the VPS and forward all connections on the VPS public network interface through the tunnel, then expose the WireGuard container at home to select other containers as needed. You get full control over your DNS, tunnel, ports, TLS connections etc. What you miss from using Cloudflare is mostly their DoS protection but that's very seldom a concern for a self-hoster. The other thing is CDN but that is mostly relevant if you host websites with large static assets and/or sizable traffic; and there are other CDN providers out there not just Cloudflare. ---------------------------------------------------------------------- trustMeIAmANinja · 2023-10-13 16:20 You don't need certs when using CF Tunnel, since its already end-to- end encrypted from your host to Cloudflare. ---------------------------------------------------------------------- itsmevins · 2023-10-13 16:38 Here is my setup Domain pointing to my VPS ip address (cloudflare proxy enabled) where i run NPM which installed with Cloudflare origin certificate (15yr) imported as custom cert in NPM (enabled full encryption in cloudflare ssl settings). From VPS using tailscale to my home servers for mesh connectivity’. It’s been 5yrs now everything works fine. Note: Initially i used LE cert, i faced some renewal issues with NPM, so switched to this method. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 22:37 So do I get rid of the origin certs or? I assume that's what you're talking about? I still want LE certs for the stuff that I don't want proxied through Cloudflare (I've previously had issues with upload chunking and the CF 100mb chunk size limit). ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 23:03 Thanks for your comment! I am a bit hesitant to put all of my traffic through Cloudflare, but I do like the added protection CF has to offer. You've said that DDoS attacks are pretty rare for self hosters, but I'm still worried about all the port and vulnerability scanning done by bots online, for example I had to disable XML-RPC in Wordpress because I could see attempts at breaching in the CF firewall logs. So if I were to ditch Cloudflare and only stick to NPM, what other forms of security would you recommend when it comes to blocking malicious traffic? I've looked into fail2ban and Crowdsec, but I read fail2ban is kind of old now and Crowdsec it sort of its successor with it's multiplayer like attack mitigation so I'd probably try setting up Crowdsec. Also, I do use CF CDN, but it's mostly for free egress for my Backblaze buckets...which I can continue to do regardless of proxying VPS traffic through CF or not, so that's not really a worry. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-14 00:15 If you want good security you use whitelisting (define who has access) not blacklisting (block bad connections after they've tried something bad). If you use strong authentication that only lets in people with the correct key then drive-by brute force attacks will be merely an annoyance. * Establish a VPN or SSH connection between whatever device you're on and your hosting machine. This is an encrypted tunnel that uses key authentication. Virtually impossible to brute force or break. Can be detected by deep packet inspection if an ISP/uni/work etc. wants to block it. Typically has to be established on each device individually but you can for example establish tunnels from a router if you want to give access to a whole LAN/VLAN/netmask. Needs people to install a VPN app and you need to set each person up with the public/private authentication keys. * Add an authentication layer that uses user + password and maybe 2FA too and uses cookies to let you through to the actual service. This is usually done either with a IAM service like Authelia, Authentik etc. integrated with a reverse proxy, or you can do it with nginx with the auth_request module and vouch-proxy as an authentication validator. This is not encrypted so you need to add proper TLS certificates to all the services (can be added transparently in the reverse proxy). Can't really be blocked by ISP/uni/work because it's normal HTTPS traffic (unless they block by IP or domain). Can be used from any device that has a browser. Easier to setup because it can be used on the fly by anybody who can remember their user & password (or has a password manager). There are solutions like Tailscale that make it really easy to establish VPN between your own devices and machines. But if you want your service to be publicly accessible, or want to be able to access it from anywhere on the fly, you may need to leave it open to the internet. Please remember that an encrypted connection like TLS certificates or Cloudflare tunnel does not mean authentication! Yeah the connection is encrypted meaning it can't be eavesdropped en route, but it still lets anybody in. ---------------------------------------------------------------------- Little-Math5213 · 2023-10-14 03:29 Thanks for teach me some more, so I can get closer to my new project goal. As a start, I've never heard of Tailscale before. And I'm already on their site! Because as a "old school" sysadmin, with 30+ years on the job, I've never cared about exposing my home lab to the big scary world outside my own 4 walls, and therefore never learned these skills. My home lab, have a pfSense (of course) as FW and VPN, so all lan connected phones, PC's etc etc, use one of 3 VPN tunnels, based on IP addressed gadged and Aliases. That's where my skills stops I have a FreeNas Core running NextCloud, for internal use and sync. Now I got the spirits to try get my Nextcloud safe and secure out on the wide web. And as overly security paranoid as a good sysadmin can be, I'm scared! Scared enough to want to do this PERFECT, with no openings in the FW that don't need to be there. I've been reading about "pfSense via NGINX reverse proxy and vpn into Nextcloud" and more for 2 weeks or so, and I get more and more frustrated. Dunno if my old age combined with older guides online makes me lost, or what it is.. At the moment, I have successfully bought me a Domain name via Clodflare, and got ddns working from pfSense box. I've made a couple of certs successfully I installed a Proxy in my pfSense, tried follow a few guides to forward that to my TrueNas Core\Nextcloud, but I got stuck because my skill level or my guides aren't updated... I even signed up to Tailscale, hoping there's any good guides there. And I'm even more lost.. And frustrated haha. Do you kind Sir, have any pointer to a awesome guide, a 55yo old school sysadmin may understand, that can make this magic work? If not, I shall search THIS Reddit sub some more, use Dr. Google more, boil me a new pot coffee, and grind some more. I'm NEVER giving up! Thanks for reading. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-14 15:00 Tailscale gives you "mesh VPN". They have public "rendezvous" servers that intermediate so that your devices can meet each other. But they only intermediate the routing and finding part, the actual device-to- device tunnels will work directly between devices as long as you they can route UDP (ISP not blocking it). This means you're not bandwidth- constricted by Tailscale servers. The Tailscale tunnels are established outgoing from each device so you don't have to open any incoming ports in firewall, you don't need public IP, and CGNAT is not a problem. Tailscale is actually WireGuard VPN, which is a newer alternative to OpenVPN that's faster, more lightweight, and is nowadays natively supported by the Linux kernel. Normally VPN is a chore to establish between two devices, let alone between multiple N-to-N connections. Tailscale manage all that so you don't have to. [Here's a longer list of the stuff](https://www.reddit.com/r/selfhosted/comments/16jgmbi/tai lscale_is_black_magic/k0r646m/) that you'd have to do manually over and over if you were setting up OpenVPN or WireGuard by yourself. And here's a list of [things they make possible](https://www.reddit.com/r/ selfhosted/comments/16t8spd/recently_installed_tailscale_amazing/k2efb hx/). If you choose to use their DNS servers they automatically resolve your devices' names (as defined in their control panel). But there are pros and cons, for example I have all devices on my LAN use my dnsmasq which allocates names and uses DNS over HTTPS and so on so I don't want that. They have clients for every PC OS and mobile so it's very easy to enroll [pretty much any device](https://www.reddit.com/r/selfhosted/co mments/16w8v8g/family_hosted_backup_server/k2vx8ki/) that can run their client+server pair (tailscale and tailscaled). So to answer your question it depends on security vs convenience and what that means for you. If you want to secure your NextCloud very well, what I would do is run Tailscale on the NextCloud machine, and connect to it from devices with NextCloud clients that also run Tailscale clients, over the Tailscale network. There's very little downside to running Tailscale at all times. If you have a paid Tailscale account you can also define ACLs that say which users and which devices enrolled to Tailscale can connect to which ones, you can have multiple users and so on. If you're worried about becoming too dependant on Tailscale there's an open source alternative called Headscale that you can deploy on your own. You would need to deploy it on a VPS somewhere on the internet outside your LAN in order to bypass NATs and establish connections when traveling etc., but you can also use it on your LAN as a simpler VPN solution. You can't really beat the simplicity of just saying `tailscale up` on a machine (or flipping a switch on mobile), logging in to the link it gives you, and that's it. No generating keys, no distributing keys, not worrying about routing and firewalls etc. Now, if you have a legitimate reason to expose your NextCloud to the internet directly I can explain about that too. Like maybe you have lots of users (extended family, friends etc.) that can't/won't run Tailscale on their devices, or maybe running Tailscale all the time in order to access their calendar is too much for them. ---------------------------------------------------------------------- trustMeIAmANinja · 2023-10-14 23:21 > I assume origin certs are only useful when pointing CF to the public IP of my VPS since the connection between the VPS and CF could otherwise be sniffed...basically it wouldn't be encrypted. Thats correct. > And I assume the origin certs are only valid while the DNS feature is turned on on the A and CNAME records? otherwise CF would just act as a DNS resolver and the traffic would go directly to the VPS and use its LE certs, right? yes. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-14 23:33 Awesome. Thanks for your help!