access other nodes behind reverse proxy on VPN network reddit / selfhosted ---------------------------------------------------------------------- legoboom · 2023-12-13 09:15 Hi, I've run into a situation that I don't know a good solution for. I'm hosting several services with docker on 1 physical host and limit access with wireguard. The entry point is the wireguard ([linuxserver.io](https://linuxserver.io)) container that gives access to a docker network (wg\_network). The main containers on this network are: wireguard, pihole (for internal DNS resolution to the services) and a reverse proxy (that handles TLS termination for the services behind it). There are lots of services behind the reverse proxy but I've drawn 2 here to sketch the situation (wiki and plantuml). When a service here consists of multiple containers it also has its own docker network to keep everything seperated. What I'm struggling with is how to let the services behind the reverse proxy talk to each other with their internal DNS name and TLS. Currently those services have no way to reach pihole. Specific example: the wiki generates html pages from markdown and can contain plantuml diagrams for which it needs to connect to plantuml server for rendering. Any ideas how this could be solved cleanly? I've thought about adding a gateway node (and network) between the services and wg\_network but configuring default gateway in docker doesn't seem so straight forward. ​ TL;DR: how to let services behind a reverse proxy talk cleanly to each other with their full DNS name which resolves only on higher up VPN network. https://preview.redd.it/1ypiwxkq016c1.png?width=381&format=png&auto=we bp&s=dc74f4f9cdb7218835c1f5b4b1e86479ce7821ff ---------------------------------------------------------------------- adamshand · 2023-12-13 20:28 Assuming all of these services are on the same server, I wouldn't use the reverse proxy when containers are talking to each other. Instead, use the `:`. So if the name of your wiki is `wiki` and the port it listens on inside the container is `:80`, other containers should connect to it at `wiki:80`. ---------------------------------------------------------------------- legoboom · 2023-12-14 13:00 Yeah I guess I could do it that way. Didn't think it was very clean but don't know anything better. Thanks for your response! ---------------------------------------------------------------------- TheGratitudeBot · 2023-12-14 13:06 What a wonderful comment. :) Your gratitude puts you on our list for the most grateful users this week on Reddit! You can view the full list on r/TheGratitudeBot. ---------------------------------------------------------------------- adamshand · 2023-12-14 18:45 I think it's cleaner and simpler. :-) No need for SSL with communications between container on the same server. Less network/CPU overhead. One less thing to break.