advice for reverse proxy setup reddit / selfhosted ---------------------------------------------------------------------- drimago · 2023-11-12 11:58 hello all, I need some advice on how to proceed with my reverse proxy. at the moment I have a proxmox lxc with Debian running nginx as a reverse proxy for some services like homeassistant, nextcloud jellyfin etc. I have a domain and everything works great with letsencrypt certificates. since I started playing with frigate, I learned a bit more about docker and portainer and got a bit crazy with some more stuff like gitea, transmission, bookstack. now I have the following dilema: how do I use my current nginx with the new docker run services? is it just the usual way of proxy passing to the http://IP.address:port? to make matters worse I have found out about nginx proxy manager and saw that it has the ability to easily add authentication to services which is interesting to me because of frigate. But with this one I have another dilema: if I switch from simple nginx to nginx proxy manager, how do I migrate my current setup (i.e. keys and configs)? What is the best way to approach this mixed system? I forgot to mention that my current services are not run through docker and I don't plan to switch them over because I like them as they are now. Sorry if this isn't the right place for this question! ---------------------------------------------------------------------- ElevenNotes · 2023-11-12 12:24 Traefik with docker provider, labels and plugins. ---------------------------------------------------------------------- KennyRX · 2023-11-12 17:44 If you switch to nginx proxy manager from the nginx, it has a built in cert manager, you will not need to handle certificates anymore via letsencrypt.As for "keys and configs", I will need more details on what you are referring to. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-12 17:54 There's nothing different. Just expose the ports using docker, and then point nginx at it like any other application. If it's running on the same server, you can just point it at localhost. For nginx proxy manager, you can define custom configs easily, but for most usage you should be able to set up each redirect with a couple of clicks in the GUI. You should set it up to generate its own certs using the built-in tool though, but if you really want you can import certs manually through the GUI as well. ---------------------------------------------------------------------- drimago · 2023-11-12 19:20 thank you for the detailed explanation. let me see if I understand. take nextcloud as an example: I have a nextcloud.conf in sites- available and certbot pulled encryption keys for it in /etc/letsencrypt/... now, to switch to nginx proxy manager, I take the contents of the conf file and paste it in nginx proxy manager? and then what do I do with the certbot keys? reimport them? or is npm not using certbot? second thing with npm. I will not run it on the same lxc as the one running portainer. it will have its own lxc also with portainer. when you say expose the ports using docker, and point npm at it you mean using the IP and port outside of docker, not the internal docker network up and port ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-12 19:53 [Heres](file:///home/ja/IT/git/selfhosted-apps- docker/caddy_v2/readme.md) a detailed guide for how to setup caddy reverse proxy. Includes many setups and even monitoring who connects from where to what, though to get that running is bit of work. >is it just the usual way of proxy passing to the http://IP.address:port? for caddy it is, if it can ping the machine, it can send traffic its way >how do I migrate my current setup (i.e. keys and configs)? what I like about caddy is that all that is needed is copy paste the simple caddy config file, that is thats needed to move setup from caddy to caddy >What is the best way to approach this mixed system? I think every reverse proxy can do what you need, including your already running nginx, so you get answers based on personal preference of users. I run before trafik, got [guide](https://github.com/DoTheEvo/Traefik-v2-examples) for that too... its too complex with lot of abstraction layers, and it polutes docker compose files with labels which I dont like, but it is powerful. I played bit with nginx but other than being kinda gold standard of reverse proxy it was ugly boilerplate config compared to caddy. Caddy was simple, clean, and really... just worked. Though you listed using authentification through reverse proxy and there caddy has a shortcoming where you need to do every user manually, instead of just telling here use this file of users/passwords like traefik can. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-15 23:20 Hey sorry, I started writing a reply and then got interrupted and forgot to finish. With NPM, most of the configuration can be done from the GUI. You punch in the domain, hostname, port, and various settings for security and feature support, and it generates the config for you. You can also add custom configs too, there's a place in the GUI for that as well. For certificates, it supports generating and applying them for you using a standard reachability test, or DNS challenges with most common DNS providers. You can also upload your own, if you want to generate them manually or self-sign them. For running it in another container, there's no issue with that, you can point NPM at any hostname or IP address. But NPM works particularly well by being inside the same docker network, as then you can expose services *only* through NPM, which gives you some finer control via access lists and basic authentication which cannot be bypassed if the service has no ports of its own exposed. ---------------------------------------------------------------------- drimago · 2023-11-16 08:58 thanks again for this! I will try setting everything up with NPM. The reason I don't want to run it in the same portainer as the rest is because I don't want to risk bricking portainer for whatever reason and losing access to npm too. At the moment I am not at home and I'd rather not risk it! This is the reason that I am investigating it now and will implement it when I also have physical access to the server so I can fix anything that can go wrong. Thanks a lot for all the info! ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-16 22:40 Keep in mind, Portainer isn't a hypervisor, it's just a front-end to run Docker commands on your behalf. If Portainer goes down, your containers will all keep working.