Single webserver for multiple service webinterfaces reddit / selfhosted ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-19 15:24 Hi all, I'm rather new to the whole selfhosting stuff and only have limited experience (ran everything on my Raspberry). Now I've finally a real server I can use and I'm currently planning what I want to host. There will be multiple service which have an web interface, like portainer, wireguard, nhost and so on and then there will be my personal developer portfolio website. Everything dockerized. Say I have the domain "[domain.com](https://domain.com)" which should point at my website. The other services either run on different ports, say [domain.com:1234](https://domain.com:1234) or with different paths like [domain.com/service](https://domain.com/service). Both isn't great. I could either use a reverse proxy which redirects to subdomains or use virtualhosts. Both should work imo (any thoughts on what to use?). Now that every ports other than 80, 443 and 22 are closed things should be somewhat safe. Anyways, I'm a bit concerned about having tens of webservers for each service, how can I be sure that all of them are safe and up to date? That leads to my question: could I use a single webserver for all the service webinterfaces? And if so, how would I configure that? Thanks! ---------------------------------------------------------------------- DadOfLucifer · 2023-11-19 15:50 Single answer use reverse proxy My recommendation caddy as it's good and easy to learn ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-19 16:01 Thank you! Do you maybe have an answer to this part of my question too? >could I use a single webserver for all the service webinterfaces? And if so, how would I configure that? ---------------------------------------------------------------------- Scaredy14 · 2023-11-19 16:26 Check out UnRaid! If you haven't already. UnRaid has Docker built in and a plugin called Community Applications where people make pre-configured Docker containers that most of the time only need you to set the path to where files for that service will be saved or accessed. Then, most things are accessible on your local network by default and can be accessed on any device with a web browser. As somewhat of a party trick, I pull up Blender or my PC desktop in my smart tv's browser. Nothing needs to be installed on the TV other than it's native browser. Now it's not a great user experience using a remote as a mouse. But it just shows you what you can do. Game servers are a bit different. You access the admin gui in a browser, but you need the game client to connect to the game, if that makes sense. Check out this page on UnRaid's site. Search for what you want to host and see if it's already available. https://unraid.net/community/apps You can also install normal Docker containers or use Docker Compose if what you're looking for isn't in Community Applications. Plus, you can even make them available on CA. I've never done so myself, but I've seen tutorials about it. If you want to learn more about UnRaid and how to set it up, the YouTube channels "SpaceInvaderOne" and 'Ibracorp" have the best tutorials. Also check out r/unraid. Edit: forgot to add, you can set up reverse proxy for others to access said services. You can also vpn for yourself. ---------------------------------------------------------------------- dazchad · 2023-11-19 17:10 I’m not sure I understand the multiple web servers issue. If you forward your wan port to a web server in your network, only that one web server will be exposed. Unless you are mistakenly forwarding the other ports (eg 1234) as well? In any case the way to go is reverse proxy. Mine have both subdomains and subpath, and they work perfectly together ---------------------------------------------------------------------- white_devill · 2023-11-19 18:34 [Cosmos-Server](https://github.com/azukaar/cosmos-server) ---------------------------------------------------------------------- tech2but1 · 2023-11-19 20:22 No, I get what OP is saying. Every "thing" has a web interface and therefore a webserver. So every device, even if it's behind a reverse proxy, is in the path of accessing that service so they are all somewhat exposed but not "exposed" exposed. Being open to sideways attacks I guess is what OP is sort of worrying about. ---------------------------------------------------------------------- dazchad · 2023-11-19 20:24 Makes sense. The major risk vector is exposed network. Even if OP secures the web servers, this is the least of concern if their network is vulnerable (which is quite common) ---------------------------------------------------------------------- PaintDrinkingPete · 2023-11-19 20:41 I prefer to make each one it’s own host on the domain, i.e. “portainer.example.com”, “wireguard.example.com”, “whatever.example.com”, etc, and use virtual hosts in my web config to reverse proxy each one. This is generally easier than using sub-directories of a single website, such as “www.example.com/portainer” and “www.example.com/wireguard”, because often those services you’re proxying expect to be at the site root, and won’t work properly without additional configuration is they’re under a sub-dir. Having said that though, you should really think about what services you expose to the world, and which should be kept entirely internal. I, for one, would never expose a portainer instance to the internet. If you need to be able to access this stuff away from home, use a vpn like wireguard to do so instead of exposing to internet. Just my advice. ---------------------------------------------------------------------- SensualHobo · 2023-11-19 20:45 Another +1 for reverse proxy to do this. Caddy is a good option. I am a fan of [Nginx Proxy Manager](https://nginxproxymanager.com/) myself. I have a domain name and in the DNS servers I redirect to the local IP of my host server. This way my website or subdomains can only be accessed if someone is connected to my home network. No ports are exposed outside of the local network so it's relatively safe. ​ After you do this, you need to know the port you exposed the web server on (e.g: *127.0.0.1:9090* ), then go into your proxy manager and make a rule where '*mydomain.com/service'* points to this. However, I prefer to use sub-domains like '*service.mydomain.com*'. The only downside of a reverse proxy is that setting up services that use CORS can be quite fiddly to set up. ---------------------------------------------------------------------- priyajit4u · 2023-11-19 22:14 You can use https://cosmos-cloud.io/ ---------------------------------------------------------------------- eddyizm · 2023-11-20 00:57 Dealing with this on a couple of servers at the moment. I find the hardest part is actually the ssl. Let me know if you need help. I've used apache in the past bit using nginx this time around. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:45 That's exactly what I want. What I don't quite get is the combination of a reverse proxy and named virtual hosts. Could you please elaborate that? >Having said that though, you should really think about what services you expose to the world, and which should be kept entirely internal. That is a good point which I haven't considered. I think I only need to expose a few services I want to use (like OSRM, cyberchef, pastebin and my personal homepage), the other "admin panels" shouldn't be exposed. I could easily SSH to the server or use a VPN (side question, what makes more sense for my use case?). So with this configuration it would look something like this: [domain.com](https://domain.com) points to my website, [osrm.domain.com](https://osrm.domain.com) points to my OSRM and so on. If I want to configure something or want to access my Nextcloud, I'd use a VPN to access my network and from there go to say [panel.domain.com](https://panel.domain.com) from where I access my other configs, like [portainer.domain.com](https://portainer.domain.com). All done with virtual hosts and on port 80. For [osrm.domain.com](https://osrm.domain.com) I could use a reverse proxy, which is the TLS encryption endpoint and redirects to my containers. Am I looking into the right direction? An regarding my initla question: There are still a few different webserver exposed ([osrm.domain.com](https://osrm.domain.com), [cyberchef.domain.com](https://cyberchef.domain.com) etc), can I be sure that the these webservers are all configured safe? Thank you! ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:46 Thank you, that sounds interesting, I'll look into it. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:46 Exactly, I'm just no sure how "safe" the webserver of some container I use is. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:48 >The major risk vector is exposed network. I'm aware of that, but I think my configuration isn't too unsafe, since I don't have much different from a usual home user setup. I have no ports other than 80, 443 and 22 open and that's basically it. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:49 That is a great solution, thank you! Not exactly what I wanted but since eveything is secured behind a login interface, no webservers should be exposed, that sounds great. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:50 Thank you, I think I'll use this for my project! ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:51 Thanks! What exactly do you mean with SSL is the hardest part? I'm going to use NGINX for my website since I used it a few times and I don't need any of Apaches features. ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-11-20 20:53 Thank you for your insight! I too prefer subdomains. I don't want every service only accessible when I'm connected to my network, but most of them should be. For the few things I wan't accessible I think I'm going to use a reverse proxy so that only port 80 and 443 remains open. ---------------------------------------------------------------------- PaintDrinkingPete · 2023-11-20 21:10 for what it's worth, I'm going to be using terms specifically with Apache web server in mind...there are a lot of options when it comes to web servers, like nginx, caddy, traefik, etc... and all may have slightly different terms for what I'm about to mention, but conceptually are the same. a "virtual host" is nothing more than a single site. a web server can serve multiple virtual hosts, or sites, and can differentiate them based on **either** the dns name, **or** which port it's hosted on. each of these virtual hosts will have its own site configuration... if your web server is hosting the site directly, you'd point it to the root directory of your web site, such as `/var/www/html`, where you might have an "index.html" file as the site's landing page, for example... but if you just want it to act as the front end and to forward web requests to another, already running service, you use a "reverse proxy" configuration to tell it where to forward that traffic to. so, you could have one virtual host, pointed to "www.example.com" with several sub-directories that all have a reverse proxy configured, such as "www.example.com/osrm/"... or, as previously mentioned, you can setup a multiple virtual hosts, one for each named service, so "www.example.com", and "osrm.example.com", with each having it's own reverse proxy config for each. tl/dr: "virtual host" = configuration of one web site instance "reverse proxy" = part of virtual host config that tells web server to forward specific traffic to another, already running, web service. ---------------------------------------------------------------------- dazchad · 2023-11-20 21:17 I mean your internal network. For example, if a friend comes over to your house with a laptop full of viruses. If your internal network is not protected, then your exposed doors on your router are the least of your concerns. Ideally you will have a guest network that can't talk to any of your devices. ---------------------------------------------------------------------- eddyizm · 2023-11-20 21:25 Getting your certificate installed ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:48 This might be what you're looking for https://github.com/NOXCIS/Wiregate ---------------------------------------------------------------------- Annual-Advisor-7916 · 2023-12-04 20:39 Thank you!