Nginx proxy manager on local-only lab
reddit / selfhosted

----------------------------------------------------------------------
Kalindro · 2023-10-13 19:09

Hi guys!

I have a homelab that has nothing exposed to internet, just local. I
was just about to add NPM to my stack, so it simplifies hostnames
(first resolution in DNS that points to NPM, then NPM redirects with
port). But I realized that this may ruin my subnets isolation a bit.

With NPM, it's NPM that needs port access to various services (for
example VM with Portainer, LXC with Unifi controller). Then, a device
that needs to reach some service just needs 80 and 443 port access to
NPM.

So suddenly if my device A should have access only to service "1", and
device B only to service "2", I will give device A and B access to NPM
which means it will give them both access to service "1", "2" and all
the other services, no isolation. I'm aware there are some NPM
settings that allow to layer it, but it seems like reinventing the
wheel, I currently have router firewall rules that work great, in a
sense I would have to change them and redo it in NPM?

Can you guys let me know if I've missed something? Seems like I'm
better to stick just with DNS overrides/redirects and adding the ports
in the address if my lab is only local?

----------------------------------------------------------------------
EndlessHiway · 2023-10-13 19:26

If all you are wanting is hostnames on your local network, I would use
pihole. It makes it real easy.

----------------------------------------------------------------------
GolemancerVekk · 2023-10-13 20:59

Sounds like you could simply point service1.lan and service2.lan to
certain IPs in your DNS and that's it.

If you need real TLS certificates (verifiable with a real CA) you can
use a real domain for the Let's Encrypt verification but you can do it
separately.

NPM is really just a convenient tool for a very common setup but it's
rather specific. It's not hard to end up needing something that NPM
doesn't do.