DNS for local vs remote services (with Traefik) reddit / selfhosted ---------------------------------------------------------------------- bj_nyc · 2023-11-30 08:12 First time poster, although I have lurked here for a while. Apologies for any stupid questions in advance... I'm in the middle of repurposing an old desktop as a homeserver to host several services. However, I'm fairly new to all of this and more or less just following along some pieces of code that I found on the internet. So, I definitely don't really know what I'm doing and I'd like to ask a few questions on how to do certain things and whether I got things right. I own a domain name and have set up traefik to provide access to several services (right now gitea, portainer and authelia, plan to add others). I definitely see the use case of having some services being available on my lan, while access to others could be global. AT the same time, I like the ability to access all my services through a FQDN and having SSL certificates from Let's encrypt. On my network, I have dnsmasq running on my (Ubiquity edge)router, but until now I have only used that to assign hostnames to my NAS and my new homeserver. For my questions: \- Is this a reasonable set-up in the first place, or should I not be running dnsmasq on my router? In the future I might consider something like AdGuard, but the idea of having a DNS server on my router seems to make some intuitive sense, as 1) this device is reponsible for my network's routing anyway and 2) by using my router for such a critical feature, I'm not introducing additional points-of-failure (e.g. if the machine on which the DNS server is located goes down, but my router isn't, I still might not have internet functioning, whereas if my router is down, internet isn't working anyway). \- Should I add entries to dnsmasq to point the local only services to my homeserver? And is adding these DNS entries something I should do in any case, also for my public services (for example in case my internet connection goes down)? Is there a way to automatically discover these services and register them so that I don't have to maintain entries manually? \- Is there any additional traefik configuration required to only allow local network access (IP whitelisting?) Will the local services remain having an SSL certificate in a set-up like this? ---------------------------------------------------------------------- onlygon · 2023-11-30 08:36 Wolfgang's Channel on YouTube has a good video on setting this up. He uses different services, but the principles are the same so you can get an idea of what's involved. The link is here: https://m.youtube.com/watch?v=qlcVx-k-02E The big issue with setting it up this way with external fqdn and stuff (besides being kinda complicated imo) is that if the Internet is down, your fqdn will not resolve. ---------------------------------------------------------------------- bj_nyc · 2023-11-30 09:16 Thanks a lot! I think I actually saw that video a while ago, but completely forgot about it.... there have been so many rabbit holes that I forgot at least some of the things that I've been looking into. To avoid the issue of domain names not resolving when the internet is down (although that is actually quite unlikely where I live), I thought to add entries to dnsmasq. My understanding is that dnsmasq just can resolve the names that I have provided in its configuration to the address of my homeserver, without forwarding to my external DNS. So if I have service1.mydomain.com and service2.mydomain.com and I configure service1.mydomain.com in dnsmasq to just be pointing at my homeserver, then service1.mydomain.com would not need to be resolved externally and would even work if the internet was down. Conversely, if I don't configure service2, then this will get resolved through the external DNS (which still would point back to my public IP from where requests would get forwarded to my homeserver). Moreover, as long as I would have at least one external service available, traefik would pull SSL certificates, which in the end are just credentials in my acme.json file, so even with the internet down, I would still have certificates on my local only services as well? Is my understanding correct / would this work? Or would you recommend a competely different route? ---------------------------------------------------------------------- onlygon · 2023-11-30 10:06 I havent used dnsmasq before. But if it allows you to resolve DNS requests conditionally (based on internet access or not) then it sounds like it would work. You need the fqdn so the certificate resolves correctly in the browser. I did research before into getting real certificates, registering domains, cloud proxies, reverse proxies, etc. but never pulled the trigger because i realized I just don't run that many services currently to justify the complexity. I really don't have a lot to advise on otherwise except that I found Wolfgang's video helpful. But It sounds like you've got a handle on this. And even if you don't, this is how we learn. ---------------------------------------------------------------------- Couch941 · 2023-11-30 11:16 Why not just like use pihole to do DNS? ---------------------------------------------------------------------- bj_nyc · 2023-11-30 11:28 Several reasons: \- For now I am not looking to do ad-blocking and if I do, I'm not sure if I want PiHole or AdGuard. \- Instead, I just need a DNS server. As far as I can tell, PiHole is based on dnsmasq, so I don't think I gain extra functionality that I want from it. \- As mentioned in my post, by introducing PiHole, I will create (potentially) another point of failure when it comes to my internet access. \- I assume that the performance of PiHole as DNS server will be worse than running dnsmasq on my router. As far as I can tell, with PiHole I have to configure my router to route all DNS request through PiHole, which will then go through the router again externally (where applicable). So there's an additional roundtrip from router to PiHole in this setup? ---------------------------------------------------------------------- NikStalwart · 2023-11-30 12:17 I am running BIND9 to achieve this very thing. You can set up different "views" in BIND. Different zonefiles are served to different clients based on the IP address. I have an external view that allows AXFR transfers to my public slave DNS provider, and an internal view for clients accessible over my VPN. I use DNS-01 challenges to issue valid Let's Encrypt certificates to both LAN-facing and public-facing services. My DNS server is running on my VPN coordination server, but, if I was not doing that, I'd run it on my router. I do not use dnsmasq, so I am not sure if it supports split-view DNS, but if it does not, you can try coredns as a lightweight alternative. ---------------------------------------------------------------------- bj_nyc · 2023-11-30 13:25 Thanks, this does sound interesting. I don't know anything about bind or axfr transfers, but I'll read up on it! ---------------------------------------------------------------------- PatochiDesu · 2023-11-30 17:42 This is how I do it and maybe it helps you understanding and solving your problem. The Frontdoor to your Kubernetes is always your Reverseproxy (Traefik). When you come from WAN, the trafic will usually reach your Kubernetes Node through a portforward. To get trafic to your Gateway you need a Domain on a public DNS pointing to your public ip adress. So externals can resolve your hostname. In your Lan you dont go through the public internet to your nodes. So you can't use the same DNS for resolving your domain. For this case you run a DNS (I use Pihole because for me its easy) in your LAN that resolves the same public Domainnames and forwards it directly to your Kubernetes (or if you have a Layer 2 Loadbalancer to your LAN ip of your Traefik). Do not configure your Kubernetes Nodes to use your local DNS. This allows you to reach your services always through the same URLs. Externally and in your LAN. ---------------------------------------------------------------------- bj_nyc · 2023-11-30 20:33 Thanks, this sounds like what I want. I'll see if I can get this working