Host Guacamole on Linode with VPN or Directly from Home Network?
reddit / selfhosted

----------------------------------------------------------------------
jboouf · 2023-10-24 13:26

I want to be able to access computers on my network from the outside
world. Instead of making sure each remote client can VPN into my
network, Guacamole on a single machine can serve up RDP, VNC, and SSH
through a web interface accessible by many devices.

I had the idea to host Guacamole on a Linode instance that was VPNed
into my home network, but wouldn't it be the same if I just hosted it
on my own network and opened up the necessary port for Guacamole? The
Linode instance would essentially be on my network if I chose Linode,
so I'm getting the same level of security if I self host, right?

I also already have a proxmox box I could easily do this with and it
would be plenty more powerful than the Linode instance I'd want to pay
for.

Am I right in thinking I should just self host this, or is there
something I am not considering?

----------------------------------------------------------------------
thekrautboy · 2023-10-24 13:33

Sure you can run Guacamole directly in your network.

But i would place it directly to the open internet.

Place a reverse proxy in front of it, serve HTTPS only, maybe combined
with something like Authelia for authentication of users.

----------------------------------------------------------------------
jboouf · 2023-10-24 13:51

Reverse proxy is something I haven't learned yet, but your suggestion
seems so obvious now. Guess that's my next project.

Thanks, u/thekrautboy!

----------------------------------------------------------------------
thekrautboy · 2023-10-24 13:53

Youre welcome.

Typical choices are Traefik, Caddy, nginx, Nginx Proxy Manager and
more. Plenty of threads about them exist here and most have their own
subreddit.

----------------------------------------------------------------------
amcco1 · 2023-10-24 15:41

Like thekrautboy said, use a reverse proxy.


If you've not used one before, I highly recommend just using
Cloudflare tunnels. It is free, just need your own domain name. Works
great and super easy.

----------------------------------------------------------------------
-quakeguy- · 2023-10-24 18:00

Guacamole has a Google totp plugin, but yes, you still need a reverse
proxy in front of it for encrypting traffic.

----------------------------------------------------------------------
thekrautboy · 2023-10-24 18:01

Sure, but this being selfhosted i would simply assume that someone
wants to selfhost as much as possible, avoiding Google totp ;)

----------------------------------------------------------------------
-quakeguy- · 2023-10-24 18:18

If you want MFA, you are relying on a 3rd party. And you really do
want MFA for revealing Guacamole to public internet.

----------------------------------------------------------------------
OkOk-Go · 2023-10-24 20:06

Authelia! Looks so nice! It’s a reverse proxy with multi factor
authentication. I just hope I don’t forget the name by the time I need
it

----------------------------------------------------------------------
[deleted] · 2023-10-24 20:46

[removed]

----------------------------------------------------------------------
8-16_account · 2023-10-25 12:04

>If you want MFA, you are relying on a 3rd party

Not necessarily. TOTP works entirely offline.