Accessing my docker webUI with domain names via tailscale
reddit / selfhosted

----------------------------------------------------------------------
fishfeet_ · 2023-11-24 07:03

I hope I can explain this properly but I have a domain name that I
would like to use to access my dockers hosted on my unraid server but
I do not want to open it out to the internet.

Currently I'd be connecting to tailscale and logging in via http://:

But the port numbers are kinda hard to remember and I have a domain
name so I was wondering if it's possible to connect via:
[https://radar.mydomainname.com](https://radar.mydomainname.com) but
only locally via tailscale?

----------------------------------------------------------------------
TastelessBuild2 · 2023-11-24 07:32

You don't need a domain name, use the hostname from tailscale.

----------------------------------------------------------------------
fishfeet_ · 2023-11-24 07:34

but the hostname given by tailscale still requires me to specify the
port. I’d like to be able to just “bind” the ip:port to a subdomain
and access it that way

----------------------------------------------------------------------
dually · 2023-11-24 07:45

Just put a reverse proxy in front.  You can have infinite virtual
hosts on whatever webserver you use for a reverse proxy and thus you
won't need different ports.

----------------------------------------------------------------------
fishfeet_ · 2023-11-24 07:53

may I know how that works? I currently create the cname record on
cloudflare and in nginx i’ll map that to a ip:port.

----------------------------------------------------------------------
dually · 2023-11-24 11:08

If you are going to use a vpn to get to your services, then cloudflare
is of no use, unless you are using a cloudflare vpn specifically, but
that sound like your scenario.

You also don't need a domain name or subdomains, because the various
virtual hosts in the webserver that you are using for a reverse proxy,
can each respond to a different arbitrary hostname of your choosing.

Each virtual host will be configured to proxy an _upstream_, and that
is the only place that you need to account for the port and (ip
address or hostname) of each upstream server.

I'm not sure if tailscale supports resolution of multiple virtual
hosts to a single ip address, but any dns service will.  So the way I
handle this with wireguard is to have dnsmasq running on the machine
that is at the gateway of the vpn.

----------------------------------------------------------------------
root42_ · 2023-11-24 14:44

Here is what I do to achieve this.

Set up "internal" DNS server.  I use [NextDNS](https://nextdns.io)
since it integrates well with Tailscale.

Set up NGINX Reverse Proxy Manager, create a new record and point to
my hosted service. I deploy this as a docker container and bind it to
my tailscale IP.

Create A record in DNS that points to the reverse proxy.

Done, I can now access my service via a domain name.

----------------------------------------------------------------------
fishfeet_ · 2023-11-24 18:34

Was trying this but could not get it to work but I’ll tinker around
with it a little more, thank you so much!

----------------------------------------------------------------------
Medium-Industry-915 · 2023-11-24 23:04

Here's how I do it, it's the simplest way I've found.


Make a directory for your certificates like /etc/nginx/certs
Use "tailscale certs YourDomainName.ts.net"
Put the certificate in the certificate directory.
The nginx config:

server {
  listen 80;
  server_name YourDomainName.ts.net;

  location / {
    return 301 https://$host$request_uri;
  }
}

server {
  listen 443 ssl http2;
  server_name YourDomainName.ts.net;

    ssl_certificate /etc/nginx/certs/YourDomainName.ts.net.crt;
    ssl_certificate_key /etc/nginx/certs/YourDomainName.ts.netkey;


  location / {
    proxy_pass                  http://127.0.0.1:8080; //Change it for
the port you want to forward
    proxy_http_version          1.1;
    proxy_buffering             off;
    proxy_set_header            Host $host;
    proxy_set_header            Upgrade $http_upgrade;
    proxy_set_header            Connection "Upgrade";
    proxy_set_header            X-Real-IP $remote_addr;
    proxy_set_header            X-Forward-For
$proxy_add_x_forwarded_for;
  }
}

----------------------------------------------------------------------
tweek011 · 2023-11-25 06:19

If you’re only accessing them via tailscale just sync your  bookmarks
between browsers and use them.

I do this exact same thing with Firefox sync - so anytime I make a
change it sends it instantly to all the other devices. Regardless of
the OS or if it’s a cell, tablet, laptop, pc, or vm. All browsers have
the same bookmarks.

Brave, Chrome, and other browsers offer the same functionality.

----------------------------------------------------------------------
5197799 · 2023-11-25 20:27

Not OP, but taking this approach doesn't give you tls, the browser
will complain the connection is not secure (even though it is because
of Tailscale)