List of your reverse proxied services reddit / selfhosted ---------------------------------------------------------------------- igotabridgetosell · 2023-12-04 23:16 Hey all, Just started this selfhosted thing a month ago. I currently have jellyfin reverse proxied thru duckdns w caddy. Just wondering what ya'll have setup on the reverse proxy. I'm thinking I want SSH and plex? Other suggestions are welcome. ---------------------------------------------------------------------- shaunjanssens · 2023-12-04 23:27 I have every service reverse proxied. Some with a public available domain name and others with a local only domain so I don’t need to remember on which port which service is running. If you have Jellyfin you don’t need Plex. ---------------------------------------------------------------------- igotabridgetosell · 2023-12-04 23:30 oh so address for local only domain would be like name.192.168.68.server? I didn't know this could be done. ---------------------------------------------------------------------- Senkyou · 2023-12-04 23:32 No, you'd still do service.domain.com, it would only be accessible locally instead of over the internet. ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-12-04 23:33 Everything that i need to externally(mqtt, gitea, plex, arrs, portainer, qnap nas interface) and the list goes on. Basically anything with a webui or and endpoint. But in my case i use docker with traefik as a reverse proxy, so for me it’s just slapping a label on a service and done! ---------------------------------------------------------------------- igotabridgetosell · 2023-12-04 23:35 can I set the domain to whatever I want for local only? where can i read more about this to get it done? any keywords i'm searching for? ---------------------------------------------------------------------- shaunjanssens · 2023-12-04 23:37 There are some reserved tld’s for internal use so I use service.domain.home for internal apps and service.domain.com for external apps. You need a dns server (or hosts file entries) to resolve the internal domains to the correct IP address. https://www.rfc-editor.org/rfc/rfc6762#appendix-G ---------------------------------------------------------------------- igotabridgetosell · 2023-12-04 23:41 oh ok so i need to run a dns server on my server for the local thing, I think I get it. ---------------------------------------------------------------------- EmbajadorDeCristo · 2023-12-04 23:41 Nginx proxy ---------------------------------------------------------------------- frogotme · 2023-12-04 23:48 >If you have Jellyfin you don’t need Plex Unless other users prefer Plex ¯\\\_(ツ)\_/¯ ---------------------------------------------------------------------- igotabridgetosell · 2023-12-04 23:52 lol as a noob that wasn't following the plex drama, I literally forked over the lifetime membership during thanksgiving sale lol. im using plex for a few years for that reason alone... ---------------------------------------------------------------------- frogotme · 2023-12-04 23:54 Bought lifetime myself a couple months ago, even being aware of the drama. Works well enough for me and my family although I do run jellyfin as a fallback ---------------------------------------------------------------------- zakafx · 2023-12-04 23:59 you can even use the same domain you would access services publicly, but use something like \*.int.domain.com (where \* is the service you are proxying, and "int" meaning internal). i set this up over the weekend using DNS challenge by cloudflare for SSL certs, works great. ---------------------------------------------------------------------- zakafx · 2023-12-05 00:00 why wouldnt you tunnel in to access portainer vs making it accessible externally? ---------------------------------------------------------------------- tenekev · 2023-12-05 00:05 Everything is proxied. Docker is proxied with Traefik. The LXCs and physical servers are proxied with HAProxy. Proxmox is actually loadbalanced between all the nodes in the cluster. It's so much easier when everything follows a certain pattern. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-12-05 00:08 Jellyfin and Jellyseerr, but I use tailscale for everything else ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-12-05 00:14 Nothing is directly exposed to the internet directly, everything is on private ip’s using a wireguard VPN. I use a reverse proxy for the ease of use rather than exposing things to the internet. Since i only have my wireguard port opened and all dns entries point to private ip’s. ---------------------------------------------------------------------- zakafx · 2023-12-05 00:15 Your comment didn't state that you were behind a VPN hence why I asked. ---------------------------------------------------------------------- ChocoDarkMatter · 2023-12-05 00:18 I messed around with traefik for about 2 weeks and only got like 3 services configured successfully, switched over to caddy and got all 30+ of my services connected in a little under 24 hours. Can’t get portainer or vikunja to work with caddy though so I’m going to host those services on traefik for now I guess. Unless someone has a working caddyfile config for portainer? ---------------------------------------------------------------------- Reasonable-Ladder300 · 2023-12-05 00:24 With externally i meant from outside my server, but in hindsight i should’ve phrased it better. But generally i’m not a fan of exposing anything to the internet unless it something unimportant on an external vps. ---------------------------------------------------------------------- ericesev · 2023-12-05 00:55 I use the reverse proxy for accessing everything. It works seamlessly inside and outside my home and handles authentication as well. These are the services behind it: * [AirConsole](https://www.get-console.com/shop/en/27-airconsole) web admin interface * [AlertManager](https://prometheus.io/docs/alerting/latest/alertmanag er/) * Multiple Amcrest IP cameras * Multiple wireless access point, and networking switch, web admin interfaces. * [AppDaemon](https://appdaemon.readthedocs.io/en/latest/) * [cAdvisor](https://github.com/google/cadvisor) * [Chisel](https://github.com/jpillora/chisel) \- for emergency/backup access to some servers I maintain remotely * [Code Server](https://github.com/coder/code-server) \- and my entire software development environment * [ESPHome](https://esphome.io/) * [File Browser](https://filebrowser.org/) \- For access to the files on my NAS * [Grafana](https://grafana.com/) \- for [dashboards](https://imgur.com/a/XRWTchM) and [log monitoring](https://imgur.com/a/sKpjHPs) * [Home Assistant](https://www.home-assistant.io/) * [Jellyfin](https://jellyfin.org/) * Kid wifi - Tool I've written to turn on/off wifi access for my kids' devices * [Node Exporter](https://github.com/prometheus/node_exporter) * [Octoprint](https://octoprint.org/) * [PiKVM](https://pikvm.org/) * [Powerwall](https://www.tesla.com/powerwall) web admin interface * My printer's web admin interface * [Prometheus](https://prometheus.io/) * The web interface for my oscilloscope * [LebreSpeed](https://librespeed.org/) * [Uptime Kuma](https://uptime.kuma.pet/) * [Valetudo](https://valetudo.cloud/) \- robot vacuum web interface * Multiple [WLED controllers](https://kno.wled.ge/) ---------------------------------------------------------------------- bobbysteel · 2023-12-05 00:55 Just add this block at the top then in the portainer block use "import theheaders" (theheaders) { header_up X-Forwarded-Ssl on header_up Host {http.request.host} header_up X-Real-IP {http.request.remote} header_up X-Forwarded-Port {http.request.port} header_up X-Url-Scheme {http.request.scheme} } ---------------------------------------------------------------------- ndrewreid · 2023-12-05 01:18 I’ve exposed nothing directly — not even a reverse proxy — and have gone balls-deep on Cloudflare. All services are exposed through a cloudflared tunnel. Most services — for example, Frigate — have Cloudflare’s SSO sitting in front of it. Hit the URL, sign in with Google or whatever, then get presented with Frigate. Couple of services get exposed without SSO (i.e., Home Assistant, Jellyfin) as their own authentication is “required” for the clients to work properly externally. The only time I need to have remote SSH or other service access to my servers is from my own devices (laptop, phone, etc.) and I use the Zero Trust client to connect in. Things I like about this: - It more or less “just works” - It’s pretty secure — multiple authentication factors required to get in. - It’s user-friendly, particularly for the non-technically minded members of the household. - Cloudflare are fronting my services. Don’t have to worry about DDoS and firewalling and whatever else. They do that. - It’s costing me nothing. Things I don’t like: - I’m kind of at the mercy of the superborg that is Cloudflare. I hope they don’t have a breach that compromises me and my network. - If my cloudflared instances ALL crash, I lose remote access, my services go offline. - It’s not a self-hosted solution. It’s the opposite of that. All in all, I think the benefits outweigh the downsides. Cheers! ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-05 01:22 Big list of everything I proxy right here on my [website](https://nintenuendo.tv), where it's actually doing the reverse proxying :) ---------------------------------------------------------------------- LazyTech8315 · 2023-12-05 01:23 What's doing the log monitoring? 🤔 ---------------------------------------------------------------------- ericesev · 2023-12-05 01:27 Promtail & Loki, with Grafana for the UI. ---------------------------------------------------------------------- spaulli · 2023-12-05 01:50 What did you use for this dashboard? Its nice! ---------------------------------------------------------------------- mondba · 2023-12-05 01:57 How exactly are you turning on/off the WiFi for specific devices? ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-05 01:59 Thanks so much! I actually made it myself, with a bit of html/css and a touch of java peppered on top :p I used bootstrap pre-made css classes for the most part on this site, [but I do have a lot of imports](https://i.imgur.com/a8lN8aA.png) for the icons and so forth But yeah, I wanted an actual site, and not just some dashboard homepage, and it was a fun project! Super useful too, this is literally my home page, and do EVERYTHING from it. ---------------------------------------------------------------------- ChocoDarkMatter · 2023-12-05 02:10 Thank you for taking the time to comment u/bobbysteel I wasnt able to get it to work initially by adding theheaders to the top so i played around with it and this worked for me with no issue. All credit goes to your friend, thank you! portainer.domain.com { reverse\_proxy IPAddress:9000 { header\_up X-Forwarded-Ssl on header\_up Host {http.request.host} header\_up X-Real-IP {http.request.remote} header\_up X-Forwarded-Port {http.request.port} header\_up X-Url-Scheme {http.request.scheme} } } ---------------------------------------------------------------------- ericesev · 2023-12-05 02:14 I have a MAC Address allow-list on my router (Ubuntu). If the host isn't on the allow-list, then it can only access local services and nothing on the internet. I made a web UI to add/remove the MAC addresses of my kids' devices. It uses the ipset feature in the linux firewall. It looks like this: [https://imgur.com/KsIUiin](https://imgur.com/KsIUiin) During the pandemic, when they were attending school virtually, one of their elementary school math teachers told me she could see my kid was laughing in class. Turns out my kid had the class on in the background and was primarily watching Youtube. I was working at home at the time and couldn't keep track all the time; and I didn't want to install something intrusive like those nanny/spyware apps that record everything in the background. Rather I wanted them to be aware of what was happening and be somewhat in charge of giving me access. So I added a feature that required them to Cast their entire screen to kid- wifi thing and it would grab & store screenshots from that feed for review later. If they didn't cast the screen, they just didn't get internet access. That's what the 'Require Recording' toggle enables. I don't really use that feature anymore, but it turn on the feature that required them to do a full screen Cast/screenshare and used WebRTC. I rarely needed to even review the screenshots. Just them needing to enable to recording to get internet access was enough to curb the "Youtube issue". ---------------------------------------------------------------------- throwawayacc201711 · 2023-12-05 02:16 Can you share how you set that up? Any guide or something? ---------------------------------------------------------------------- [deleted] · 2023-12-05 02:21 [removed] ---------------------------------------------------------------------- UnfetteredThoughts · 2023-12-05 02:39 > It’s not a self-hosted solution. It’s the opposite of that. Kinda antithesis to the subreddit, no? ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-12-05 02:48 I don't need reverse proxy. Wireguard on demand works just fine. ---------------------------------------------------------------------- No_Bee_7194 · 2023-12-05 03:06 The only one I expose is the VPN. Once I connect to the VPN, everything becomes local, just like I am at home. No need to handle or maintain the ports. If you are using caddy, nginx, apache or something like this, you need to handle the firewall and ports list, trying to remember every service's port. My suggestion is openconnect GUI and clash. ---------------------------------------------------------------------- ndrewreid · 2023-12-05 03:23 No, not at all. It *enables* my self-hosting. I don’t see self-hosting as a binary thing: it’s a continuum and I enjoy the hobby by self- hosting where it suits me to do so. ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-12-05 03:49 I mean, it would be easier to list the things I don't have reverse proxied. SSH. That is about it. ---------------------------------------------------------------------- ericesev · 2023-12-05 03:53 >If you are using Caddy, Nginx, Apache, or something similar, you need to manage the firewall and ports list, trying to remember every service's port and modifying or even restarting to enable the configuration. Not necessarily. Traefik has a feature to discover all the IP's and ports from Docker. https://doc.traefik.io/traefik/providers/docker/ ---------------------------------------------------------------------- No_Bee_7194 · 2023-12-05 04:13 😍Cool！ ---------------------------------------------------------------------- akanealw · 2023-12-05 05:21 Three things I do: I use Nginx Proxy Manager to reverse proxy every application with the same pattern, subdomain.domain.com. I have my local DNS pointing my domain to my NPM server so I can use the same subdomain.domain.com pattern for both internal and external services. I have an access list in NPM that only allows private IPs for specific subdomains. ---------------------------------------------------------------------- lucassou · 2023-12-05 05:27 I tried to prefer jellyfin but I still prefer plex. I bought plex lifetime but I'll still keep an eye in case jellyfin becomes better! ---------------------------------------------------------------------- Manaberryio · 2023-12-05 05:35 Got my professional infrastructure reverse proxied - appwrite - angular (3 instances, 2 live website, 1 dummy to test changes) - nextcloud - collaboraoffice - Plex - Llama-gpt 2 (for now I'm testing it) - vaultwarden (restricted to local IP) - Adguard home ---------------------------------------------------------------------- THENEXTMOSES · 2023-12-05 05:40 Thank you for taking the time to write this up ---------------------------------------------------------------------- EndlessHiway · 2023-12-05 05:51 It is already better than plex. ---------------------------------------------------------------------- BelugaBilliam · 2023-12-05 06:06 Second this. Nice work! ---------------------------------------------------------------------- matticrisp · 2023-12-05 06:23 Noob question: why do you use reverse proxies? How to configure them? ---------------------------------------------------------------------- digitalindependent · 2023-12-05 06:29 Thanks for linking! That makes it absolutely great to check it out! ---------------------------------------------------------------------- digitalindependent · 2023-12-05 06:32 Great games! ---------------------------------------------------------------------- thePZ · 2023-12-05 06:50 ‘Nginx Proxy Manager’ is a good way to ease in to it ---------------------------------------------------------------------- macentrasher · 2023-12-05 07:50 What great and useful comment. I’m going to check some of these out. ---------------------------------------------------------------------- bobbysteel · 2023-12-05 08:26 Glad it worked! Sorry for poor formatting but I was in bed late at night and just copy pasting from a caddy file I had on my little private github repo :) ---------------------------------------------------------------------- Astorek86 · 2023-12-05 08:30 * [Dokuwiki](https://www.dokuwiki.org/) for Documentation * [Snipe-IT](https://snipeitapp.com/) for Asset Management * [MeshCentral](https://www.meshcommander.com/meshcentral2) for "Teamviewer-activities" * [Uptime-Kuma](https://uptime.kuma.pet/) for Watching Services * [Mattermost](https://mattermost.com/) for Chat, and also for Notifications sent by Uptime-Kuma * [Humhub](https://www.humhub.com/) for local Facebook. * [Jitsi Meet](https://github.com/jitsi/docker-jitsi-meet) for selfhosted Video Meetings * [OsTicket](https://osticket.com/) as Ticket System * [Seafile](https://www.seafile.com/) as Fileserver * [Mealie](https://mealie.io/) as Recipe Management * [Jellyfin](https://jellyfin.org/) as local Netflix * [Joplin](https://joplinapp.org/) as note-taking app * [WikiJS](https://js.wiki/) as Homepage (a bit unusual, I know...) * [Vaultwarden](https://github.com/dani-garcia/vaultwarden) as Password-Safe ReverseProxy: Caddy. Most of the Services are accessible from specific IP-Addresses only (my Work Environment), some are only accessible from my LAN-Network only (Vaultwarden). ---------------------------------------------------------------------- bobowhat · 2023-12-05 08:43 I think I'm up to 89 hosted services being reverse proxied. Some of those (about 9 subdomains) are just pointing at my yunohost. I'm using NPM for my reverse proxy and got it syncing with my pihole (that solution is too convoluted to share right now) ---------------------------------------------------------------------- bobowhat · 2023-12-05 08:45 pihole will be your easiest option for an internal dns server. And it blocks a good number of ads. ---------------------------------------------------------------------- bobowhat · 2023-12-05 08:58 A reverse proxy is used when you have a 1 to many setup. In this case, you have 1 external IP, and since 99% of consumer ISP's block port 53 (dns), you need to come in through port 80 (http) or 443 (https). The reverse proxy allows it to seperate based on the domain name. so as an example, in your home you have snipe.example.com on 192.168.1.10 port 3000, but also have plex.example.com on 192.168.1.11 port 32400. The reverse proxy acts like a traffic cop on an asterisk shaped intersection that only has one enterance. ---------------------------------------------------------------------- marvbinks · 2023-12-05 09:01 Lol. In what way? ---------------------------------------------------------------------- LCZ_ · 2023-12-05 09:28 Awesome IP map! Looks so damn cool. Any chance you can talk about it, and how you put an IP address on the map coming from Traefik? Got my instance pulling data through Prometheus already and have been looking to set up a map with blocked IPs over the past few days but couldn’t find anything and yours looks exactly the way I’d envision one. ---------------------------------------------------------------------- tenekev · 2023-12-05 10:07 These are two different things with different use cases. Most people don't use a reverse-proxy for security but convenience. ---------------------------------------------------------------------- triksterMTL · 2023-12-05 10:20 I'm curious to also see in what way Jellyfin is better than Plex! ---------------------------------------------------------------------- tenekev · 2023-12-05 11:03 Important to point out that RPs aren't used just to proxy external traffic. That's something many newbies get wrong. They see RPs as a security measure that guards your entrance. And yes, they can be a security measure because they reduce the attack surface but that's not the only thing they can do. Many people describe them as funnels, but the analogy that drives my point home is "a power strip with multiple outlets". Your wall socket is your port. For some reason you want to use that particular wall socket, maybe because it's hidden or most convenient. You would like to use a particular port because a protocol uses it - most often http/https. But what if you have lots of devices (services) that need that exact wall socket (port)? Well, you add a power strip (reverse proxy) that allows for more connections. But newbies don't hit this constraint that easily. On their local network they have the freedom to change ports, even assign new IPs to services. At this stage RPs are largely overlooked. It's only when people try to expose several competing services to the internet, they hit a snag - one public IP. Lets expand the analogy. You want to offer power outside your home but the wall socket (port) is inside. Well, you either let the front door open for anyone to enter OR your chuck the power strip outside your door and run the cord to the wall socket. This is what most newbies think of as a Reverse Proxy because that's the first time they encounter it. "It's used to connect from the outside so it's for outside traffic. It has rules and filters so it's a security measure." But who says you need to use the power strip outside, we use them inside our homes for convenience all the time. Convenience - I don't want to go halfway across the room to plug a device behind the sofa. Security - I don't wan to type IPs and ports every time, instead of a simple domain name. I don't want my children to touch that socket. And I'm going to set authentication on that service. All I'm trying to underscore is that RPs are very versatile services that have MANY uses. ---------------------------------------------------------------------- kagayaki · 2023-12-05 11:34 I actually use both wireguard and reverse proxying together. I have a Linode VPS running nginx which reverse proxies web requests through wireguard that goes to my server in my apartment. This allows me to internet expose some of my services without having to open any ports on my router. I think this is probably similar to how CloudFlare Tunnels works but without the issue of encrypting traffic with CF's certificates. ---------------------------------------------------------------------- malferro · 2023-12-05 12:32 I would \_love\_ to see your Wireguard set up (properly redacted of course) for both VPS and local server. TIA ---------------------------------------------------------------------- washapoo · 2023-12-05 13:03 \*everything. :) ---------------------------------------------------------------------- washapoo · 2023-12-05 13:19 I have to say, you are one of the most helpful people I have seen around Reddit. Your straight forward and helpful responses are a breath of fresh air! ---------------------------------------------------------------------- kagayaki · 2023-12-05 13:39 There's probably easier ways to do it, but I set this stuff up before I realized there were easier to setup approaches. I'm using Gentoo using OpenRC on both my personal server and VPS so I'm initializing wireguard through [netifrc](https://wiki.gentoo.org/wiki/Netifrc). If you are familiar with the wireguard [wg-quick util](https://manpages.debian.org/unstable/wireguard-tools/wg- quick.8.en.html), it's initialized similarly except that the ip/routes are assigned through netifrc rather than wg-quick. If you're using systemd and systemd-networkd, you can probably use that instead to achieve what I'm doing in terms of initializing the interfaces. On my personal server: /etc/conf.d/net: #wg0 - wireguard to vps wireguard_wg0="/etc/wireguard/wg0-netifrc.conf" config_wg0="192.168.3.5/32" mtu_wg0="1492" routes_wg0="192.168.3.0/24 dev wg0" /etc/wireguard/wg0-netifrc.conf: [Interface] PrivateKey = private key for personal server [Peer] PublicKey = public key for VPS AllowedIPs = 192.168.3.4/32 Endpoint = x.x.x.x:51820 PersistentKeepAlive = 25 And of course I have net.wg0 in the default runlevel so net.wg0 is started automatically during the boot process. I don't remember the exact reason why, but the PersistentKeepAlive option is important for the use case of setting up the tunnel without port forwarding on my home internet. If I recall, wireguard essentially puts a tunnel to sleep after a certain amount of inactivity, so this essentially makes it so the tunnel never goes asleep which is needed for the way that web requests works I suppose. Something like that. The "Endpoint" is the public IP (not LAN or Wireguard IP) of my VPS since this defines what wireguard will try to connect to on the Internet in order to establish the tunnel. This can also be a hostname instead of an IP if you prefer. In my config below, you'll notice that I'm setting a ListenPort on my VPS for wireguard which obviously coincides with the port I'm referencing in the Endpoint definition. And then on the VPS: /etc/conf.d/net: #wg0 wireguard_wg0="/etc/wireguard/wg0-netifrc.conf" config_wg0="192.168.3.4/32" mtu_wg0="1492" routes_wg0="192.168.3.0/24 dev wg0" /etc/wireguard/wg0-netifrc.conf: [Interface] ListenPort = 51820 PrivateKey = ... [Peer] AllowedIPs = 192.168.3.5/32 PublicKey = public key of personal server So to establish the connection, my personal server connects to the VPS and then effectively stays connected while it's alive. After all that, I have the following IPs handled by the wireguard "devices": * personal server: 192.168.3.5 * VPS: 192.168.3.4 In order to send traffic over wireguard, all I have to do is point to that IP. On the VPS, I'm currently using bare nginx with proxy_pass to do the actual reverse proxying, so here's an example of how I use proxy_pass to forward traffic over wireguard to my home network: /etc/nginx/conf.d/servicesubdomain.mydomain.com.conf: server { if ($limit_bots = 1) { return 403; } server_name servicesubdomain.mydomain.com; location / { proxy_pass http://192.168.3.5:3000/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } listen 443 ssl; # managed by Certbot } There's a bit more to that config like lets encrypt cert references but I clipped that for brevity. I don't think bare nginx is particularly special for this use case, and I assume that traefik or NPM should work as well if that's what you prefer. And then of course on my personal server I have a service running through docker on port 3000. I have maybe 10 services internet exposed this way, so whenever I want to make a new service available to the internet, I basically just make a new website.conf for nginx (/etc/nginx/conf.d style configs) proxying to the appropriate port. The one kind of annoying thing about my current setup is that I'm managing two separate instances of nginx and two separate certificates since when I'm accessing my services locally, I don't want to proxy traffic to my VPS and then back to my apartment through wireguard, so I have local DNS that overrides my services to point directly to my server instead of to the VPS. I haven't figured out a way to reduce the redundancy yet. ---------------------------------------------------------------------- malferro · 2023-12-05 14:12 Wow, thanks. That's a lot more than I expected. I've been messing adding some iptables commands in WG that I found around the interwebs with no luck. I use wireguard to access everything but I have one file sharing service I need public. Thanks again for the info. ---------------------------------------------------------------------- gwild0r · 2023-12-05 14:13 Amazing! I went through the same scenario you are describing, but didn’t have the smarts to make this happen. I went with the Nanny Spyware solution and it didn’t work well. ---------------------------------------------------------------------- DarkKnyt · 2023-12-05 14:13 This is excellent. I love all the lab-y stuff (led controls, oscope, 3D printing). ---------------------------------------------------------------------- DarkKnyt · 2023-12-05 14:14 If you reverse proxy ssh, you should use ssh key login. I wireguard into the network and then still use ssh key. ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-12-05 16:36 All of my services are directly available at all times through Wireguard. No need to reverse proxy anything. What other use case is there? ---------------------------------------------------------------------- ericesev · 2023-12-05 16:50 Thank you! I use Promtail to read logs and Loki to store and search them. The graph is using the [Worldmap](https://grafana.com/grafana/plugins/grafana-worldmap- panel/) panel in Grafana. When Promtail reads the logs, I have it configured to also add geolocation data, including latitude/longitude, whenever there is an IP address that appears in the logs. This is done using the Promtail [geoip stage](https://grafana.com/docs/loki/latest/send- data/promtail/stages/geoip/) and Maxmind's GeoIP database. Promtail then sends the log, with the extra geolocation data, to Loki for storage. Grafana populates the map by fetching the logs from Loki and using the IP address and latitude/longitude data stored in the log. Here is my Promtail config that uses the geoip stage: [https://gist.gi thub.com/esev/5ae688a5253a943df5921b2961a7bacb](https://gist.github.co m/esev/5ae688a5253a943df5921b2961a7bacb) I also needed to make a small patch to Promtail to make this work: https://github.com/grafana/loki/pull/10256 ---------------------------------------------------------------------- wubidabi · 2023-12-05 18:32 There’s already an insightful discussion on this exact topic right here in this community: https://www.reddit.com/r/selfhosted/s/yeXJIgY7We ---------------------------------------------------------------------- tenekev · 2023-12-05 19:01 I wrote a[ lengthy reply here](https://old.reddit.com/r/selfhosted/com ments/18axcgd/list_of_your_reverse_proxied_services/kc2x8qz/). In your case, you are probably using lan IP:PORT or HOSTNAME:PORT. A reverse proxy would improve several things: - You will use domains and subdomains. Way easier than ports. - You can set up TLS and have secure connections to your server. Even on LAN. You would need to use a valid domain (read buy a cheap domain from porkbun/cloudflare). Services like vaultwarden require https anyway. - Finer control over access. Since my services are accessible only via their subdomain, I have Authelia authentication in front some of them. This allows for things like SSO. - Finer control over availability. Availability is another important thing for me. I have 3 servers in a proxmox cluster. You can manage the cluster from any server's web ui but if the server goes down, you need to jump to another server which is annoying. My RP load-balances pve.lan.mydomain.tld to the fastest proxmox node and I never experience timeouts. - General mish-mash of connections. I have another server in another city with Frigate NVR. The two places are connected via wireguard. Think for a second what do I need to do to access that server. Whatever you think it is, I use a RP to access the remote Frigate instance as cams.lan.mydomain.tld. I don't need wireguard on my computer - the connections are done behind the reverse proxy and it appears on my network. You can do a lot of things with a RP. Using it for service exposure is just scratching the surface. ---------------------------------------------------------------------- barrows_arctic · 2023-12-05 19:46 Awesome list. How exactly do you use Chisel for fallback access? I’ve bumped into it online before but never really messed around with it. Do you just keep a port open for it as a backup hole/tunnel? I have everything all closed up and only access things through Wireguard, but have had an occasional desire to be able to remotely and temporarily open up SSH or otherwise for short-term temporary access in those rare situations where I don’t have WG-VPN access (e.g. my phone battery dies or is stolen and all I have is a friend’s machine). Been looking for tools to help me there. ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-12-05 19:50 Wow, OK, I understand now. Thanks for the write up. ---------------------------------------------------------------------- tenekev · 2023-12-05 19:55 Yeah, I still use wireguard to access my services like you. Just everything is local. I was going to ask how do you automatically connect clients via wireguard when they are away from home? I recall something about ios having this feature but I'm firmly into windows/Android land. ---------------------------------------------------------------------- SirPoopsAlot7 · 2023-12-05 20:36 Look into splunk or graylog. Way better imo ---------------------------------------------------------------------- ericesev · 2023-12-05 20:46 >How exactly do you use Chisel for fallback access? I’ve bumped into it online before but never really messed around with it. Do you just keep a port open for it as a backup hole/tunnel? I manage a few servers that don't have a stable IP address, and one that is behind a NAT that is outside my control (I can't port forward). I don't have physical access to any of them, without traveling by air, or long conversations where I try to walk someone through fixing it. The ones with dynamic IP addresses will update a dynamic DNS entry when they get a new IP. And the one behind the NAT is accessible via a Cloudflare tunnel. I also used Wireguard on that one for a bit too. That said, I've gotten into a couple of cases where I've either broken the Cloudflare tunnel, screwed up the Wireguard routing, or the DDNS client failed to update. Sometimes just simple things, like `apt upgrade`, will break things in unexpected ways. So the Chisel backup is simple/reliable solution of last resort. It just connects directly to my reverse proxy using mTLS, and it provides me a reverse tunnel back to the localhost ssh port on the server. As long as the remote server can reboot, and get an IP address, it can connect to my reverse proxy. And from there I can use `ssh -p XXX me@chisel_ip` to connect to the remote server. Chisel on the remote server runs with these command line options: `/usr/bin/chisel client --auth= --tls-cert=/fullchain.pem --tls-key=/privkey.pem https://chisel.domain.tld R::localhost:22`. That last bit, with the R:, configures the listening port on my local Chisel server instance, and if I connect to that port with the previously mentioned command, I get tunneled to localhost:22 on the remote server. It is similar to the reverse tunnel syntax for SSH. To keep everything secure, each chisel client has a separate TLS private key. And on the server side, the `--auth=` part allows that particular client to bind to the specific `XXX` port. https://github.com/jpillora/chisel/blob/master/example/users.json ---------------------------------------------------------------------- ericesev · 2023-12-05 21:45 Looks like maybe Grafana Labs [may be phasing out Promtail](https://gi thub.com/grafana/loki/pull/10256#issuecomment-1799893427). So this is timely advice. Thank you. ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-12-05 22:34 I use IOS, so I do use the on demand feature. I was an Android person for years until I implemented IPS on my home network. I quickly switched to IOS. For Android, I used Tasker to automate VPN management. ---------------------------------------------------------------------- ghulican · 2023-12-06 02:51 I have huge respect for people that will be self hosted no matter what. After being in this for a few years, I’m glad for the services that I’ve made compromises while I wait for other things to be built up (Doppler vs. Infisical for example). Soon everything I use the “internet” for will be self hosted with the progression of the communities, but for my own house I still have to maintain a wife’s uptime expectation. ---------------------------------------------------------------------- BorkenRefrigerator · 2023-12-06 11:26 I use Cloudflare tunnels. It allows north south and east west traffic. Warp makes it easy. And it gives me a website to access private resources. ---------------------------------------------------------------------- EndlessHiway · 2023-12-06 13:39 In every way. But an easy one is it is self hosted unlike plex. ---------------------------------------------------------------------- hhs99 · 2023-12-07 01:32 what did you use for the Oregon trail? my kids would love that ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-07 03:18 That version of Oregon Trail is actually open source, and free for anyone to use - I got it from github, which is a place where people can post public projects in their own repositories. Here's the link for the github project! https://github.com/n8cotoa/oregon-trail Here's a pic of the "README" file that's in the repo, so you don't have to look too far for it https://i.imgur.com/uFDiy4p.png Enjoy! ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-07 03:22 That version of Oregon Trail is actually open source, and free for anyone to use - I got it from github, which is a place where people can post public projects in their own repositories. Here's the link for the github project! https://github.com/n8cotoa/oregon-trail Here's a pic of the "README" file that's in the repo, so you don't have to look too far for it https://i.imgur.com/uFDiy4p.png Enjoy!