Nginx, cloudflare, privacy- CGNAT.
reddit / selfhosted

----------------------------------------------------------------------
DamascusWolf82 · 2023-11-02 23:58

Is this trifecta permitted? I’m currently behind cgnat with no hope of
a public ip, and in need of a method of remote access to my selfhosted
services, eg nextcloud, matrix, and some management ui’s for local
plex etc. I’ve been using cloudflares tunnels up until now, which have
served me very well- however, for services such as matrix, which focus
on privacy and independence from large networking bodies, and
nextcloud which will host my photo library, I’d prefer shelter from
what is essentially an MITM based protocol.
Nginx was supposed to be my hero, with self signed ssl in front of
cloudflare, (to my understanding, please correct me if wrong)
preventing them from reading my precious, precious data. However, no
matter what I do, I cannot seem to get nginx working through a tunnel
while using ssl.                     I’ve set up the proxy through
npm, signed and verified the service, wildcarded the ingress through
tunnels, pointed tunnels to localhost:443 where nginx is supposedly
listening, enabled strict (and everything else) ssl settings, and
toggled no TLS verify to true. When I input a wildcard to my domain, I
get the default nginx page saying congrats on making the thing, this
page doesnt exist yet, go log into the admin panel, meaning it
*works*- however, the second I enter a subdomain ive actually proxied,
I get a 502 from cloudflare.
What (on earth) have I done wrong? All help is appreciated, thank you
all in advance. Go easy on me- this post have been 2 weeks in the
making.

----------------------------------------------------------------------
Lanky_Information825 · 2023-11-03 00:10

What certificates are you with NPM?

Let's Ecrypt, will ler you terminate your services irregardless of the
tunnel and CGNAT.

That said, I'm having a bit of a time interpreting your setup however.

----------------------------------------------------------------------
DamascusWolf82 · 2023-11-03 00:46

Sorry, I definately could have been more clear. I might try drawing
out a diagram at some point, but I’m a little tapped out with an exam
tommorrow, probably could have timed my post better! The setup is
local services on docker routed to and signed for by npm (using
LetsEncrypt), accessed through a cf tunnel. The session will return a
valid cert no matter what, as (to my understanding) CF will apply ssl
if there is none, and if there is one and it’s valid, with tls verify
off will simply pass it through.

----------------------------------------------------------------------
The1ridley · 2023-11-03 00:59

So I added Tailscale into the mix. I have a domain through Cloudflare
and use Cloudflare for DNS back to my Nginx Proxy Manager. The domain
names point back to Tailscale IP addresses and I use Let’s Encrypt
certificates for all of the domains. I have to be on a device that’s
in my Tailscale network to access but all mine are anyway. I am not
using Cloudflare tunnels.