Setting up a local domain reddit / selfhosted ---------------------------------------------------------------------- Haliphone · 2023-12-05 18:48 Hey all, I've been super enjoying this subreddit since I found it. I've slowly setup my \*arr services and jellyfin through docker. Soon I'll be adding immich photos (and mealie, and home assistant etc etc) but there is another big step I want to confront first - and I'm (hopefully) ready for it... **Encourage my partner to start using these services.** I'd set her up with her own dashboard that lists all of our current services so she can click into them, but she's a bit apprehensive when she sees the IP address instead of a web address. She's asked for it to be '*more like the real internet'*. So I'd like to be able to create a local domain. 'home.local' (or maybe 'ho.me' if I can pick any domain name - but whatever is easiest) from which I can access all home networked services: e.g. by going to home.local I'd be presented with my dashboard of choice, but also being able to set up subdomains so jelly.home.local (or \*service.ho.me). How would I go about doing this? ​ **What I don't have:** * I don't have a public IP which has made a previous attempt at this fail and gave me the fear. * Loads of technical knowledge - I'm following tutorials 99% of the time. ​ **What I do have:** * Synology 920+ - acting as a NAS and contains most of my services, (and a few Rpi's scattered around the house each with 1 or 2 services). * On the synology I have a Let's Encrypt certificate but I still see the warning when connecting to the server from my browser :/ Any suggestions on how to fix this would be loved too! * I do own a web domain name via IONOS - which currently forwards to my linkedin, but happy to actually make it do something more useful. * I already have tailscale setup on these devices so I can access from outside the network if need be, but this is more about internally accessing stuff. Though if I can still access it from tailscale externally that would be great. * The ability to follow tutorials! If there are already guides kicking about there, let me know and I'll dive into them. Thanks in advance, and somewhat terrified. ​ ---------------------------------------------------------------------- bmaeser · 2023-12-05 19:05 first: dont use \*.local its a name reserved for mdns i use pihole not only to get rid of ads and trackers, but also to resolve internal dns (i use \*.lan) ---------------------------------------------------------------------- Anejey · 2023-12-05 19:15 Since you already own a domain, it makes it fairly easy. What you could do is setup a reverse proxy, like Nginx Proxy Manager (it's one of the most popular and easy to setup), and then setup a DNS server that points your domain at it. NPM also allows you to have Let's Encrypt certificates for any of those services, and you can with some setup make them valid (meaning no warning). Essentially you'd create a proxy host that makes radarr.example.com point to the IP:port of the service. Then inside the DNS server (I recommend Pi-Hole and it's local DNS for this) you'd add an entry that points radarr.example.com at the IP of the reverse proxy. You then need to either change the DNS server on your devices, or if you can, set it in the router so that it's network-wide. If you want some services to be completely public, you can use something like Cloudflare Tunnels. If you want to get fancy, you can rent a VPS (Oracle gives out free ones), setup a Wireguard tunnel between your network and the VPS. This essentially allows you to use the VPS IP as your public IP, but it's quite complicated to set up. Also, all this will work with Tailscale nice as well. You can set Tailscale to also use the local DNS server, and you'll be able to access everything via the domains even if you are away. ---------------------------------------------------------------------- Powerstream · 2023-12-05 19:25 How I do it is with a domain using Cloudflare for DNS. Use Nginx Proxy Manager's DNS challenge to get a wildcard SSL cert from Let’s Encrypt (no need to do port forwarding or expose it to the outside). Use Pi- hole local DNS to point to NPM. Of course you can so similar things with different programs. ---------------------------------------------------------------------- JoeB- · 2023-12-05 19:47 What you want to accomplish is easier than you may think... Step 1. **Install a private DNS server.** [**Pi-hole**](https://pi- hole.net/), for example, is a local DNS server that can: a) protect your browsing from ad and tracking sites, and b) resolve local hostnames. There is a [**pihole/pihole**](https://hub.docker.com/r/pihole/pihole) sponsored Docker container. You won't really need subdomains per se.You'll just need a hostname (eg. **jelly**) and domain (eg. **home.local**). I use just **home** for my private domain, but **home.arpa** is the Internet Engineering Task Force (IETF) [**RFC-8375**](https://www.rfc- editor.org/rfc/rfc8375.html) standard for a unique home domain name. Step 2. **Build a Dashboard**. There are many options for personal dashboards, but I run Ben Phelps' [**Homepage**](https://github.com/gethomepage/homepage) in a Docker container. It is fast and simple to configure with YAML files. Here is a screenshot of [**my home dashboard**](https://i.imgur.com/H6cioUC.png). Homepage has more features than I use. Any ports needed for your services will be added to the URLs in the Homepage config file. Then, all you need to do is create a bookmark to Homepage in your partner's browser. ---------------------------------------------------------------------- Haliphone · 2023-12-05 19:56 Hey thanks for the pointer. I'll check out pihole. The dashboard and the external access I already have courtesy of homerr and tailscale. I did initially use homepage but I couldn't see how to configure it for multiple users. ---------------------------------------------------------------------- Haliphone · 2023-12-05 19:57 Thanks so the order should be NPM, then Pi-Hole? So does NPM intercept my network traffix and reroute it? Do I need to tell my router or some other networking elf that I have a DNS server? ---------------------------------------------------------------------- WaffleIron30 · 2023-12-05 19:57 This may be a dumb question but what is the point of the reverse proxy for just internal DNS? I use Nginx Proxy Manager for my external facing services, but for internal services I can just point PiHole or Adguard's DNS to IP:port and reach radarr.example.com internally without NPM. Is it just to standardize the internal & external paths? ---------------------------------------------------------------------- Anejey · 2023-12-05 20:01 DNS can't really deal with ports. Not as far as I know anyway. If only DNS is used it'd be radarr.example.com:port. Reverse proxy is supposed to deal with the ports. ---------------------------------------------------------------------- HiSpartacusImDad · 2023-12-05 20:04 Two things: 1. DNS only works with ip, not port 2. You still wouldn’t have a valid certificate. That’s what the reverse proxy does for you (aside from translating a domain to an IP:port) ---------------------------------------------------------------------- WaffleIron30 · 2023-12-05 20:14 Ah you're right, I have example.com pointed at the IP and am accessing with example.com:port instead of service.example.com. Makes sense to use reverse proxy in that case ---------------------------------------------------------------------- Anejey · 2023-12-05 20:14 The other way around. Setting Pi-Hole as your DNS server means all the queries go through it. It's why it also blocks ads, it just blocks certain domains. For example, when you search up radarr.example.com in your browser, it'd just show an error, as that page doesn't exist on the internet. But if you add a local DNS entry into Pi-Hole that says radarr.example.com belongs to a local IP, it'll load that instead. That's where the reverse proxy comes in. DNS servers mainly deal with IPs, not ports. Just a simple DNS will work with a web server that's on port 80 (since that is just basic http), but if you got a service on port 32400 for example, it'll need a reverse proxy. I'll give you an example. DNS server (Pi-Hole): 192.168.0.10 NPM: 192.168.0.20 Radarr: 192.168.0.30:7878 First step would be to create a proxy host within NPM, which would point radarr.example.com to 192.168.0.30:7878. This on its own won't do anything. Next step is to add a DNS entry, which would point radarr.example.com to 192.168.0.20 (see, no port). So when you search up radarr.example.com now, it'll go through Pi- Hole, which will now know it belongs to the NPM IP. Then NPM does the proxying into the IP:port of the service itself. Search query > DNS server > NPM > service. I'm bad at explaining but i tried my best. My own knowledge of this is fairly limited. And yes, you do need to force your devices to use Pi-Hole as the DNS server. Usually it's fairly easy, you can look up how to do it online. ---------------------------------------------------------------------- Ill-Competition-5978 · 2023-12-05 20:53 Not OP but was wondering how to do the same thing. Great write up! Thx! ---------------------------------------------------------------------- Fishamatician · 2023-12-05 21:01 Thank you for eloquently asking the questions that get me exactly the information I need :) ---------------------------------------------------------------------- Tr4shM0nk3y · 2023-12-05 21:06 That's not quite right, you can use SRV Records to point subdomains to certain ports - I use it to host multiple game servers of the same game with different subdomains on a single server. ---------------------------------------------------------------------- Fuzzdump · 2023-12-05 21:41 This is the right answer, though I’ll add that Caddy is even easier than NPM to setup (particularly for obtaining certificates). Would recommend. ---------------------------------------------------------------------- wplinge1 · 2023-12-05 22:02 Looks like that needs client support though, and web browsers (for example) don't use it. There's talk of a newer SVCB that they will (do?) respect though, so definitely good information to keep in mind. ---------------------------------------------------------------------- Haliphone · 2023-12-05 22:12 I'll take the compliment but I don't think it's too eloquent. I'll update the post a little once I get things working as I intend. ---------------------------------------------------------------------- katrinatransfem · 2023-12-05 23:25 The point is that it gives you ssl for everything in one place, and you have everything on port 443 with different descriptive subdomains. ---------------------------------------------------------------------- Haliphone · 2023-12-05 23:35 No, I think I've got it. Tomorrow I'll start trying to configure everything. Fingers crossed! ---------------------------------------------------------------------- Haliphone · 2023-12-05 23:40 And this is why I love this community. Is Caddy the same as NPM but easier to use? Like I'm a 'user' - the less fiddly bits that can break the happier I am. ---------------------------------------------------------------------- orefat · 2023-12-06 00:09 pfSense with DNS resolver service is one of the possible solutions. ---------------------------------------------------------------------- Fuzzdump · 2023-12-06 00:37 NPM has a web UI, but I found that it has a lot more options than Caddy, which has basically [zero fiddly bits](https://www.reddit.com/r /selfhosted/comments/17ulz9n/caddy_seems_to_good_to_be_true_i_just_set _it_up/). To proxy e.g. jellyfin over HTTPS with a certificate, you just edit the Caddyfile (plaintext config file) and add: jellyfin.mydomain.com { reverse_proxy http://192.168.x.x:8096 } That's all you need to do. `jellyfin.mydomain.com` will point to 192.168.x.x:8096, served over HTTPS, with a signed TLS certificate. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-06 00:42 ports mainly but it also saves you setting up something else later when you inevitably want external access. It always happens at some point so better to set it up first so you're not having to change things around later and upset things. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-06 00:44 \+1 for caddy. super simple even with wildcard certs ---------------------------------------------------------------------- SeanFrank · 2023-12-06 17:29 Pi hole is great, but beware of the extra burden of unblocking sites for your SO. If you just turn on it's built-in ad blocking, you will likely get constant complaints from her that her sites don't work. And she won't be able to override it easily. This is why I prefer in- browser ad blockers these days. Of course, Google is doing everything in their power to break them in Chrome... ---------------------------------------------------------------------- Haliphone · 2023-12-06 20:44 It doesn't hurt if I take a little look at them both and see what is what ---------------------------------------------------------------------- Haliphone · 2023-12-06 20:46 Yeah I'm currently at the 'distracted by ad-blocking' bit of the install chain. If it comes to it I can set her devices to not block ads can't I? ---------------------------------------------------------------------- Haliphone · 2023-12-06 21:13 If I get this right a wildcard cert would be \*.mydomain.com and then cover whatever nonsense I assign without having to make a cert for each one? ---------------------------------------------------------------------- SeanFrank · 2023-12-06 21:32 I believe you have to unblock per site, but I'm no expert on pi hole. ---------------------------------------------------------------------- Haliphone · 2023-12-06 22:44 Don't suppose you know - could I use the reverse proxy services on the synology instead of NPM or caddy? Or would I be better running caddy on a pi? ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-06 22:54 Yep that’s right. It makes it easier to keep things hidden since certificate requests are published on a public list. It makes sense to me if exposing to the outside world. Some will say that if your wildcard cert is compromised it compromises everything but I’ve had no issues. When I changed to wildcard certs and changed my subdomains I got less than 15% of the hits that I got beforehand so it’s clear to me unscrupulous people are using the public lists to poke and look for vulnerabilities in domains on that list. You need to do it with dns verification. I use cloud flare for my domain dns and caddy has a plugin for that which makes it super easy. Once you get a certificate the domain you requested it for goes on the public list and I’m not sure if it ever comes off. Mine haven’t lol. I wish I’d found caddy earlier. Would have saved me having to rename all my subdomains 🤣🤣🤣 Before caddy I was using cert bot which was a real pita and I could only get it to do http verification which meant no wildcard certs and adding a subdomain meant some faffing around. I’m sure there’s other products that do similar things but caddy is the only one I’ve managed to get working if all my self hosted services. Caddy is great in that it does pretty much everything. I can add a subdomain or proxy forward and it takes care of everything. I don’t need ssl for anything behind it if I don’t want to and all my services have a valid certificates through caddy that no browser complains about. ---------------------------------------------------------------------- darkcyde_ · 2023-12-07 04:09 I use hostname.local to ssh into everything. Avahi is running on the linux boxes that need it, and Win10 speaks mDNS natively now. Is there any reason _not_ to use it if it already works? ---------------------------------------------------------------------- bmaeser · 2023-12-07 10:42 your setup is perfect, no need to change. you are using mdns (avahi) with a tld thats specificly reserved for that protocol. my point was to not use *regular* dns and pick a tld thats reserved by *another* protocol (mdns). you also wouldnt pick .onion, since thats reserved for tor. using .local or .onion via regular dns will work, its just bad style and might cause some problems down the line. its a bit like moving ssh to port 80. it will work, but everyone expects a response from a http server. ---------------------------------------------------------------------- halpoins · 2023-12-08 18:42 How hard is it to set up https local services at a lower-level subdomain? For example, urls like portainer.home.mydomain.com. I have seen in documentation for Cloudflare, pfsense, and traefik some form of the sentiment that "wildcard sub-subdomains are not allowed/supported." Is this true? Inadvisable? If it’s no big deal, I just don’t get why in all this documentation no one writes a quick howto (like if you have to get a cert for home.mydomain.com first and then request *.home.mydomain.com). Rather, they always mention something about what *can’t* be done. ---------------------------------------------------------------------- Haliphone · 2023-12-20 21:24 Sorry to bother you again but I have a new question. What happens if the device pihole is on fails? Will the router automatically revert to using the previous 'global' dns resolvers? Will my wife be left without the Internet or will all be fine? 😂 ---------------------------------------------------------------------- Anejey · 2023-12-21 03:17 Without a working DNS, the internet will be unreachable. You can usually set multiple DNS servers though - both my router and phone/PC allow the setting of a secondary DNS. If you set the second DNS to be something like 1.1.1.1 (Cloudflare DNS), then it'll be fine. ---------------------------------------------------------------------- Haliphone · 2023-12-21 20:28 I might just create 2 pihole. One on my synology, the other on my pi. If both devices are down then I've got bigger issues. ---------------------------------------------------------------------- Anejey · 2023-12-21 20:40 You can use Gravity Sync to then sync those two Pihole instances so that they are the same. ---------------------------------------------------------------------- Haliphone · 2023-12-26 22:33 Legend ill need to Google that and learn more! So it mirrors the rules or?