Redirection docker reddit / selfhosted ---------------------------------------------------------------------- Olejka2k · 2023-12-04 11:29 Hi everyone! So here's the task I am working on. There is an application called Notion. That application allows you to expose your pages to the internet, but it lacks password protection, so anyone with the link can enter. Now I have a server with Docker and Portainer on a cloud hosting provider. The task is to make a password protected redirection from a domain to the notion exposed page. The exposed page itself cannot be found via search engines (it is not indexed) and has a long hash-type link. This is the scheme I try to achieve : [page.mydomain.com](https://page.mydomain.com) \-> password -> [notion-exposed.page.com/1234sdfh34-fcdasxb5rs-xt35](https://notion- exposed.page.com/1234sdfh34-fcdasxb5rs-xt35) So I have installed NGinx Proxy, it has the redirect host which works great, but I cannot password protect it, and usual proxy host (which can be password protected) is not working for me for some reason... Finally my idea was to find a docker which will handle the forwarding to the domain So it will be like this : [page.mydomain.com](https://page.mydomain.com) \-> NGinx Proxy forward to docker which asks for a password (or forward is password protected by NGinx Proxy) -> [notion-exposed.page.com/1234sdfh34-fcdasxb5rs- xt35](https://notion-exposed.page.com/1234sdfh34-fcdasxb5rs-xt35) From my explanation, you can see that I am not an advanced-level self- hoster, but I could set up Nginx and domain forwarding. Any help will be much appreciated! Thanks ---------------------------------------------------------------------- Mr-Bitter · 2023-12-04 11:41 I use Authelia for things like this. It's fairly easy to set up and even works with my Yubikey. Set it behind a reverse proxy and it's good to go. ---------------------------------------------------------------------- weischin · 2023-12-04 11:51 Nginx Proxy Manager has an Access List feature where you can allow access to IP addresses and/or password protect it. It's not the most secured but it provides sometime basic. ---------------------------------------------------------------------- Olejka2k · 2023-12-04 11:54 >Authelia Yes, that's the one I am using for my exposed dockers, but it does not work for redirect hosts - there is not access list there. ---------------------------------------------------------------------- Olejka2k · 2023-12-04 11:54 thank you, I will check it out. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-04 12:04 If you're already using Nginx as reverse proxy just add [vouch- proxy](https://github.com/vouch/vouch-proxy). It adds URL protection by requiring OAuth login and it works with lots of accounts. ---------------------------------------------------------------------- Olejka2k · 2023-12-04 12:05 Not sure, but I feel it to be a bit too much for my needs. The setup is quite complicated for me, to be honest... ---------------------------------------------------------------------- domanpanda · 2023-12-04 17:02 It is called 'base auth'. I dont know about NGinx Proxy because i use bare nginx and all expalantion is here: https://docs.nginx.com/nginx/admin-guide/security- controls/configuring-http-basic-authentication/ It's just 2 things: 1. Setting the file with password 2. Setting the server{} section with auth_basic_user_file section pointing to your file. That's it. Nothing else is needed. ---------------------------------------------------------------------- from-nibly · 2023-12-04 21:02 As long as you are ok with people sharing your unprotected link then you are good with the other suggestions. If that is a concern this strategy will not work. ---------------------------------------------------------------------- Olejka2k · 2023-12-05 06:46 Thanks for the explanation. I am hosting on Hetzner and I've already set up everything as needed, but giving this another thought, looks like I will need to use a layer of autentification on top, and it should have 2fa. Thanks, looks like I will need to dive deeper in it. ---------------------------------------------------------------------- Olejka2k · 2023-12-05 06:47 Thing is that I am using nginx proxy and everything is set up with it, also there are services I am using in production, so I cannot just take it down and start learning nginx bare, as I'm sure that will take some time.. ---------------------------------------------------------------------- domanpanda · 2023-12-05 10:27 I think setting up some saas VPN like Tailscale or Zerotier is the easiest solution in your case. You dont have to change your nginx proxy, you dont have to set password, you dont have to do anything with your current setup. Just create account in Zerotier/Tailscale, create network (like 10.250.0.0/24), install the client on your Hetzner server and connect it to your network (you provide id of the network in the network and confirm client acceptation in panel side) - it will get some 10.250.0.x ip. Offcourse you also need second client on your pc -10.250.0.y. Then check if you can access any of your services by 10.250.0.x ip and test if you can use SSH as well. If all this confirmed you can disable access to all ports except VPN ports (9993 in case of Zerotier). Or instead of disabling whole access you can change your service (notion) ports from 80 and 443 to 10.250.0.x:80 and 10.250.0.x:443 so its only visible from tailscale/zerotier network. It's not as secure as closing all ports but should do the job in your case. ---------------------------------------------------------------------- Olejka2k · 2023-12-05 14:23 Hello Thanks for the idea. The issue is that I don't really want to install anything on the client machine. It should be as easy as going to a website and that's it. Looks like I have to check the auth dockers, supporting google logins and etc.