[Advice Request] Looking for some guidance on how I should set up HTTPS/VPN in my home network reddit / selfhosted ---------------------------------------------------------------------- zombie_soul_crusher · 2023-11-01 13:16 Hi, [I currently have a setup like so](https://imgur.com/nPMvS1y) and I am struggling to grok how I should be setting this up for local HTTPS and external access via VPN. I would also like to factor in the possibility of exposing a public service at some point, either from another VM on PVE, or from another mini pc. Please go easy on me but I would like some advice on how best to achieve the following: * I would like to have SSL/HTTPS set up for all of these services so that I can access them locally something like so: https://pihole.home- gateway.my-domain.com or https://jellyfin.ubuntu-home-server.my- domain.com. [I've found this guide on this sub but not entirely sure if this is a good fit for my setup or not](https://www.reddit.com/r/se lfhosted/comments/146c2yd/guide_free_dynamic_dns_nginx_proxy_manager_l ets/) and would like some advice on this. * At this time, aside from the Wireguard clients, I do not require anything to have external access, however, I would like to factor in that somewhere in the future, I may decide to expose something publicly. * Is my current setup ok? e.g. is it safe to expose the Wireguard port like this? Is there an alternative approach I should consider? * Would it be safe in future to expose a service from another VM pve Here is some more detail on my setup: **router** - DHCP disabled and one port forwarded to home-gateway for external WireGuard access **home-gateway** is a low spec/power mini pc running ubuntu server which is always on. It runs a number of service, either natively or as docker containers: * PiHole - network DHCP and DNS server which uses the local Unbound instance as an upstream DNS server. * I've set up both home-gateway and ubuntu-home-server here as A records and can access services via, e.g. http://gateway.home:5000/ but I think this setup could be better to the point where I would not need to specify port number for each service, but rather the service name, e.g. https://octoprint.gateway.home * Octoprint - the mini pc sits beside my 3d printer and is connected via USB. * WireGuard - allows full external access to my home network via Wireguard client on our laptops/phones. * Flask App - very basic python web server which allows to run two scripts - wake-on-lan and shutdown the proxmox server. * Homarr(docker) - dashboard for home network. Has links to most network services/interfaces where appropriate. Also has a link to the Flask app above. * Unbound(docker) - upstream DNS used by PiHole. * DuckDNS(docker) - allows for dynamic DNS when connecting externally via WireGuard. **pve** is a Proxmox server which is used on-demand to save on power usage. Primary use is currently as a media and file server on ubuntu- home-server VM. I have other VMs but they are purely private dev machines at the moment. At some point, I may decide to run some publicly available service or other from here. ---------------------------------------------------------------------- thekrautboy · 2023-11-01 14:08 > I've found this guide on this sub but not entirely sure if this is a good fit for my setup or not and would like some advice on this. What advice exactly? > Is my current setup ok? e.g. is it safe to expose the Wireguard port like this? Its perfectly fine. And Wireguard is made to be exposed, you need it to connect from the outside. ---------------------------------------------------------------------- zombie_soul_crusher · 2023-11-01 14:36 Hi thanks. I'm just trying to figure out if the content of that guide is suitable to achieve what I want given the setup and current requirements I've described. Also, whether such a setup would be extensible enough should my requirements change and I wanted to expose a service publicly. Honestly, I've done some reading on the subject but still a little confused at there appear to be many different options available. Just looking for some advice as to other options available or whether the guide I've linked is 'good enough' and I can incorporate that with my dynamic DNS setup. ---------------------------------------------------------------------- zombie_soul_crusher · 2023-11-01 21:58 Ok, I got to spend more time on this and I followed [this guide by Wolfgang](https://notthebe.ee/blog/easy-ssl-in-homelab-dns01/), and I've set up a new `local-only` DuckDNS domain for this. I set up npm as per that blog/video and added a proxy host with the cert for my service, e.g: Source: jellyfin.my-duck-dns.duckdns.org Destination: http://192.168.0.10:8096 I then added my new domain and nginx-proxy-manager IP as a DNS A-record on the PiHole, e.g: Domain: my-duck-dns.duckdns.org IP: 192.168.0.8 Now, after adding a proxy host in nginx, I can add each service in that domain as a CNAME record on the PiHole and that appears to work, e.g. Domain: jellyfin.my-duck-dns.duckdns.org Target: my-duck-dns.duckdns.org Does this seem correct? Is there anything I'm missing? Thanks ---------------------------------------------------------------------- thekrautboy · 2023-11-02 05:08 Sort of. Having the CNAME only in your local Pihole isnt enough, when you want to get the LE cert it needs to be a valid domain for the public internet. So all you need to do is add a wildcard CNAME to your DuckDNS, like `*.my-duck-dns.duckdns.org` and with that `jellyfin.my- duck-dns.duckdns.org`works but also any others you want to use in the future like `portainer.my-duck-dns.duckdns.org` and `something.my- duck-dns.duckdns.org` etc. Using a wildcard instead of specific subdomains also keeps your subdomains from appearing in public cert lists, so it adds a bit more privacy, possibly security. ---------------------------------------------------------------------- zombie_soul_crusher · 2023-11-02 11:22 Ok, it appears that PiHole doesn't allow adding wildcards via the UI, so I did this instead: root@HOME-GATEWAY:/etc/dnsmasq.d# cat 03-custom-dns.conf address=/my-duck-dns.duckdns.org/192.168.0.8 This appears to work now after restarting pihole dns, unbound and flushing all dns on host ---------------------------------------------------------------------- thekrautboy · 2023-11-02 11:24 Good :) ---------------------------------------------------------------------- zombie_soul_crusher · 2023-11-02 11:32 Yes, thanks for the help! ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:13 This might be what you're looking for https://github.com/NOXCIS/Wiregate