Is it a good idea to reverse proxy a non-localhost server? reddit / selfhosted ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-09 16:22 I have a server with SSL certificates setup (say Server A). And I have another server which is more powerful and runs all my applications but doesn't have https/SSL setup on it (say Server B). I was wondering if instead of installing Nginx/Apache reverse proxy configurations everywhere, I could use use configurations of server B within server A for reverse proxy. Say something like this (Apache): > ProxyPass /plex http://192.168.1.5:9091/ > ProxyPassReverse /plex http://192.168.1.5:9091/ Where 192.168.1.5 is not the localhost. Two questions: 1. Can this be done at all? 2. Is this a good/bad idea? Thanks for helping! ---------------------------------------------------------------------- superior_ · 2023-11-09 16:32 That's how I do it. Although, ServerA and ServerB will communicate unencrypted. The encryption will only be between your client and the Reverse proxy. ---------------------------------------------------------------------- tschloss · 2023-11-09 16:36 Nothing special. In fact the normal situation when you look beyond homemade selfhosted applications. ---------------------------------------------------------------------- Mezutelni · 2023-11-09 16:45 That’s actually standard for big apps. Cloudflare does this if you want, gcp or other clouds too. In homelab I would say that you don’t even need to care about encrypting communicatio between your servers, but you can do it with selfsigned certs ---------------------------------------------------------------------- kengansan · 2023-11-09 18:09 Not only this is a standard practice, but it's a widely supported pattern in many cloud platforms. If you want to increase security, you could add certs or tunnels to encrypt the traffic between different servers ---------------------------------------------------------------------- [deleted] · 2023-11-09 18:10 [deleted] ---------------------------------------------------------------------- TheHeartAndTheFist · 2023-11-09 19:14 1. Definitely doable and a good trick to know if you want to add proper certificates in front of some stupid appliance that makes it hard/impossible to replace its self-signed cert: solution is similar to your setup, the only difference being the addition of HTTPS on the other side too with the reverse proxy knowing exactly what self-signed cert to trust. 2. As others mentioned it depends on the insecurity of the network between your reverse proxy and the backend: if it’s a crossover cable for example then probably no need to add anything else; if I were you I would secure this a bit however, with a light IPsec configuration such as Transport mode with whatever ciphers are fastest on your hardware, with Authentication Header only if you want to make sure nobody can impersonate the IP address(es) but apart from that you have nothing to hide, otherwise use Encapsulated Security Payload for encryption also. ---------------------------------------------------------------------- ComputersWantMeDead · 2023-11-09 19:32 I have this, NGINX Proxy Manager in another docker. It certainly makes external access easier, especially maintaining the certificates side of things - all automatic, massive improvement. But for some this is too much danger. I think running something like Authelia is a prerequisite for some, adding multi-factor authentication. I'm trialling Authelia at the moment, it seems to integrate fine. Having multi-factor authentication for internet traffic makes a lot of sense, I just need to finish testing how it affects the user experience of services like Plex - but you can pick and choose which services pass through Authelia (each service needs to be individually configured to use Authelia within the reverse proxy) ---------------------------------------------------------------------- tech2but1 · 2023-11-09 19:32 That's exactly what everyone does/how it works. One reverse proxy for many servers/services/hosts etc. ---------------------------------------------------------------------- KN4MKB · 2023-11-09 20:04 The proper configuration would have the reverse proxy on a DMZ or separate network from your services all together, separated by a firewall and VLANS as needed. Anything else introduces some security risk, as proper network segmentation between the reverse proxy and internal hosts may prevent a full compromise if the outward facing server (which would be the one attacked) is compromised. ---------------------------------------------------------------------- HearthCore · 2023-11-09 20:07 Can also be used to expose Services via a VPS and FQDN and Reverse Proxy + VPN ---------------------------------------------------------------------- flrn74 · 2023-11-09 22:13 Sure, in most cases this is just fine. Just be aware that your traffic can be intercepted inside the lan, so you might want to add extra precautions for super sensitive apps... ---------------------------------------------------------------------- Drun555 · 2023-11-09 22:42 I proxied several apps on slither host and my vacuum this way, so yes - its actually pretty common idea ---------------------------------------------------------------------- thepenis_mightier · 2023-11-10 00:25 Your vacuum? Pray, tell, I'm intrigued ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-10 04:42 If you close down direct access to server B (firewall) then only the reverse proxy works. ---------------------------------------------------------------------- TheBendit · 2023-11-10 07:48 I switched to Caddy for this kind of thing. I got tired of fighting with Apache TLS. Certificate handling in Caddy is completely automatic without configuration. testssl.sh says A+ for the Caddy proxied sites. ---------------------------------------------------------------------- autogyrophilia · 2023-11-10 07:52 The gold standard application deployment it's as follows : \- Load balancer (HAProxy,Nginx, F5) \- Reverse Proxy (Nginx, HAproxy, Apache, Caddy) \- Redundant application server. Each on a different firewall zone and communicating using locally trusted SSL certificates. Of course, very often a separate load balancer it's not necesary if you are only using HTTP. Or if your load balancing needs are modest and your reverse proxy it's capable of doing L4 balancing (Nginx, HAproxy). Additionally, while a recognized best practice, running a local CA for certificates it's complex and supposes a management and processing overhead. Many opt to keep the unencrypted connection or use self- signed certs without verifying . This is also fine. And lastly, not every app can be made redundant, not everyone it's so lucky to have multiple servers. So small setups end up being rather similar to self hosted stuff. Just better organized than your typical docker mess you see over here. ---------------------------------------------------------------------- zfa · 2023-11-10 20:41 It's a typo. He meant dishwasher. ---------------------------------------------------------------------- thepenis_mightier · 2023-11-10 20:59 ....that's even more intriguing ---------------------------------------------------------------------- Drun555 · 2023-11-11 17:37 Actually no, I meant vacuum cleaner robot with “Valetudo” installed on it. Sorry, English is not my main language