Need idiot proof guide for exposing Immich to the internet reddit / selfhosted ---------------------------------------------------------------------- Zealousideal_Jump966 · 2023-11-17 10:38 I've been working on this for a few hours and need help pointing my Immich container to my domain. I tried using Tailscale, but it's confusing. Tailscale found all my services, and I can access my containers using the assigned IP (100.105.75.138) through Docker on Ubuntu 22.04.3 LTS with Portainer. I'm struggling with the DNS and proxy setup and can't figure out how to link it to my domain. When I go to the DNS section, I hit a wall. I'm not sure if I need Traefik, Cloudflare, or something else. I'm also unsure about what nameserver to use for my domain to point it to Immich and how to configure A, AAAA, and DNS records in my domain provider's panel. I apologize if this sounds confusing; I've been at it for a while and feel frustrated with Tailscale. I'm not sure what to do next, and it's getting overwhelming. I'm only new at this sort of stuff so bear with me. ---------------------------------------------------------------------- ithilelda · 2023-11-17 10:55 you use tailscale to punch a hole into your LAN. then, it is exactly the same when you are inside the LAN. you visit it with the same IP address as if you were home. You are not exposing it to the internet. ---------------------------------------------------------------------- thekrautboy · 2023-11-17 11:32 Why not ask /r/Tailscale for the Tailscale issues? And maybe /r/HomeNetworking for the more general stuff? There is also /r/LinuxQuestions and of course /r/TechSupport ---------------------------------------------------------------------- bradza12 · 2023-11-17 12:57 If you’re using docker, spin up an reverse proxy such as Nginx proxy manager (easiest to use imo). In your router port forward port 443, in your dns A record put your public Ip, then add cname entries for each sub domain such as “container.example.com” container being anything you want to call it, example.com being the domain you have bought. Then go back to nginx proxy manager and add an entry with the same sub domain you added on dns, add ip of container,select ssl, and I’m certificate choose generate cert. Once that’s done you’ll have a sub domain that points to your service. You can always add a wildcard certificate which is better but few more steps. This will expose services over the internet with ssl, however it offers no security against other people using these services so look into something like authelia and crowdsec. Probably bad explanation but maybe get some value from it ahahaha ---------------------------------------------------------------------- John_Mason · 2023-11-17 13:16 Wait I don’t think that’s entirely accurate. Tailscale uses special IPs that begin with 100.%, so if you’re not on TS (like on LAN), the service may be at 192.%, but on TS would be a different address. The workaround is to use Tailscale’s subnet router functionality on a single device, which then exposes all other devices from your LAN using their local 192 address. https://tailscale.com/kb/1019/subnets/ ---------------------------------------------------------------------- jkirkcaldy · 2023-11-17 14:29 You can use subnet routers to access using your internal up address through Tailscale. Means you can set up Tailscale on one device in your network and access every device on that network. ---------------------------------------------------------------------- Zealousideal_Jump966 · 2023-11-17 18:11 This has made most sense to me so far - i'll give it a go ---------------------------------------------------------------------- Heas_Heartfire · 2023-11-17 18:17 You can expose a single device using a subnet mask of /32 instead of /24 if that's a concern. I have my homelab setup like that. ---------------------------------------------------------------------- Vae-victus · 2023-11-17 21:21 Don’t do what he said. Use wildcards for certs and dns, otherwise you are providing a blueprint to your network ---------------------------------------------------------------------- bradza12 · 2023-11-18 00:47 Hence why I said “you can always add a wild card certificate which is better”. He said idiot proof so I gave a simple way to get it running, it’s up to him to setup further security for his setup. I even added some examples such as authelia and crowdsec 🤷🏼‍♂️ look I’m just trying to help but yes OP as Vae-victus has said wildcard certificate is the best way to go as your sub domains won’t be publicly listed