Cloudflare Tunnel vs some other option? reddit / selfhosted ---------------------------------------------------------------------- yeswenarcan · 2023-10-14 11:08 I've recently got into self-hosting some services and am trying to understand the best way to safely access them for my specific use case. While I'm obviously not a pro at this stuff I'm also relatively tech-savy, feel comfortable poking around CLI and things like docker compose files: 1) I'm running docker containers on a Synology NAS, but may eventually move some or all services to a dedicated server. 2) I'm mostly running productivity-type services (linkding, reactive resume, trillium, etc) rather than stuff like Plex. 3) I have my own domain name registered through porkbun that I would like to use for a publicly viewable bio/link page but also be able to use to access my self-hosted services behind some kind of authentication. 4) I'd ideally like to be able to access my services from a work PC that doesn't allow installing anything like a VPN client but does allow access to most sites through the browser. I currently have my domain name redirected directly to a landing page (Homepage) running on my NAS through Synology DDNS, which I'm aware is an insecure way of doing this. From reading through this subreddit and other sources it seems like a cloudflare tunnel might be the best way of achieving my goals but I wanted to make sure I wasn't missing something. ---------------------------------------------------------------------- JeremyMcFake · 2023-10-14 11:26 Cloudflare tunnels would be perfect for this situation. You can set up different types of authentication depending on your needs as well. Very easy to do as well, and plenty of tutorials on YouTube. ---------------------------------------------------------------------- yeswenarcan · 2023-10-14 11:27 Awesome, thank you. ---------------------------------------------------------------------- JeremyMcFake · 2023-10-14 11:32 No problem. I would recommend Lawrence Systems on YouTube... He has some great tutorials to set it up with authentication. ---------------------------------------------------------------------- Phynness · 2023-10-14 11:50 He has a ton of great tech/networking tutorials. Highly recommend that channel as well. ---------------------------------------------------------------------- IWishIHavent · 2023-10-14 20:01 NetworkChuck is pretty good as well. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-15 03:39 There are issues with this as well as Tailscale. You can only do http/https, Tailscale doesn’t allow you to use your domain name, and Cloudflare has a 100 MB hard limit that causes video issues. ---------------------------------------------------------------------- carlinhush · 2023-10-15 08:09 Cloudflare does not work with Nextcloud and Plex, so I have heard (no experience on my side so far). How about running a client PC at home (in VM maybe?) and accessing your services through something like Chrome Remote Desktop? ---------------------------------------------------------------------- yeswenarcan · 2023-10-15 13:03 I'm not planning on doing any media streaming and can use the built-in Synology stuff for NAS capability. I'm 99% sure I can't use chrome remote desktop on work machines because it requires adding an extension. I got cloudflare tunnels set up yesterday for several services and so far it's exactly what I wanted. The ability to add oauth or MFA is also super helpful as I'd like to let other family and friends access a few of the services I'm hosting but also don't want to just leave them open to the web. ---------------------------------------------------------------------- yeswenarcan · 2023-10-15 13:08 I'm not doing any streaming and am using the built-in Synology apps for NAS capability so I don't think the 100 MB limit will be a problem. So far it seems to be exactly what I was looking for. I do think I'm going to be stuck continuing to run tailscale for remote access to my pihole, but all things considered that's not a big deal. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-10-16 09:49 You could use [zrok.io](https://zrok.io). It's an open source alternative which can be self-hosted or has a free SaaS. It also includes cool features like 'private sharing' (which means both sides can be private with no inbound ports) and recently implemented 0Auth for front end authentication - https://www.reddit.com/r/selfhosted/com ments/175hehy/zrok\_office\_hours\_oauth\_public\_frontend/. I work on the parent project. ---------------------------------------------------------------------- yeswenarcan · 2023-10-17 17:51 Looks really interesting. Still looking over the docs but have a couple questions: - Is there a way within zrok to use it with a domain name (like you can with cloudflare) or would I have to run a separate reverse proxy server to redirect to the zrok url? - Obviously you believe in the project because you work on it, but how stable and established is it? If I start using it is it going to be a viable long-term solution for me without concerns about a bunch of bugs or eventual abandonment? ---------------------------------------------------------------------- michael_quigley · 2023-10-17 18:26 I'm the primary author of `zrok`. If you self-host `zrok`, you could use private sharing along with `zrok access public` (which is a single-share reverse proxy) to do your "tunnels" attached to your domain names however you would like. Those are fine questions, regarding stability. We put out regular releases, and address bugs whenever they're reported. `zrok` is fully open-source, and we have no intention of changing that. But that being said, eventual bugs and abandonment are issues that could arise with _any_ software. ---------------------------------------------------------------------- michael_quigley · 2023-10-17 18:27 You could also use the hosted service at zrok.io, and _also_ run your own `zrok access private` to attach those shares to your domains. ---------------------------------------------------------------------- yeswenarcan · 2023-10-17 18:35 Thanks for chiming in. I'll try it out when I get a chance. As trustworthy as Cloudflare seems, I love the idea of being able to keep all my access controls in house, not to mention paring off a bunch of the extraneous Cloudflare stuff I'm not actually using. ---------------------------------------------------------------------- michael_quigley · 2023-10-17 18:47 Feel free to reach out if there's anything you need an assist with. We're actual humans trying to do good in the world working on `zrok` and OpenZiti. ---------------------------------------------------------------------- foolsgold1 · 2023-10-20 18:19 What makes you think you can only do http/https? I do all kinds of protocols, and use a domain name for them. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-21 00:56 Try uploading a video on the photo server app over 100 MB. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-21 01:10 Inside the VPN I agree unrestricted. In that calocal DNS resolves names and you are directly routing to private ip’s and ports. It is not much different from LAN routing. Externally your connections to public names (Cloudflare or Tailscale) connects to the same servers as everyone else. There is no way to reverse lookup a name when they all have the same IP. The solution is not to reverse DNS at all! HTTPS and http have the “host” header. Both allow you to pick ports from a limited list. But what you can’t do with public sites on either one is anything except http and https.