Help me understand if I am doing this right please. reddit / selfhosted ---------------------------------------------------------------------- Namaloomx · 2023-12-14 10:21 Hi. Good afternoon. I have a Pc running ubuntu 22.04 LTS, with plex, tautulli, jellyfin, pihole, qbittorrent running on bare metal. I have a NAS and an External HDD mapped to my home folder. i also have docker installed, but i am kind of new at it lost on how to set it up properly. I installed portainer and homarr by searching images in portainer. what i need: Set everything up in docker and automate the system to my needs. Apps i will need to set up in containers: - Plex (migration from bare metal to container) - Jellyfin (migration from bare metal to container) - Tautulli (migration from bare metal to container) - Radarr - Sonarr - Bazarr - Overseerr - pihole - homarr - watchtowerr - Portainer - Prowlarr - qbittorrent - nzbget - Kasm all these setup to be accessed from outside my network securely, with minimum open ports. please let me know if I'm doing this right or there is something im missing. ---------------------------------------------------------------------- ElevenNotes · 2023-12-14 10:54 Only allow external access via VPN (Wireguard or Tailscale if CGNAT). You can enable auto connect on the Wireguard mobile client, so it will automatically connect your VPN the moment you leave your house, giving you access to all resources at home without exposing any of them to the public internet. ---------------------------------------------------------------------- Marly21 · 2023-12-14 11:19 You can use VPN to access it all from outside your network or you can use Reverse proxy like Caddy or Traefik ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-12-14 12:52 https://yams.media should get you started. ---------------------------------------------------------------------- thekrautboy · 2023-12-14 12:53 Plenty of beginner guides for Docker exist. Learn the basics, dont focus on Portainer, learn how it really works. Then look at Docker Compose to make things a lot easier for yourself. Then look at guides for deploying a reverse proxy as Docker container with Docker networking. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-12-14 13:16 None of these are public services so none should just be accessible on the wide open internet. HTTPS can be a bit of a pain and at some point you will find even with Let’s Encrypt you really need a domain name. With Tailscale it does all the reverse stuff automatically as well as Lets Encrypt. It takes minutes to set up. So once you set it up (from the web site) just enter Tailscale serve… and your application is visible anywhere you run Tailscale. Enter funnel instead and now your service is publicly visible. It’s that simple. You automatically get “myserver.mysubnet.ts.com” (FQDN) for free and you can just use things like ssh myserver (no FQDN needed). Everything just works (slit networking) like normal. You can also set up servers or rent a VPS (see low end boxes) for about $10 a year as exit nodes and run your own outgoing VPN as well as incoming. I map my photo service (for sharing) and Bitwarden onto public access. Everything else is private networking. ---------------------------------------------------------------------- distillari · 2023-12-14 14:06 Looking at the wireguard android client, where is there an auto connect option? Just see version, export to zip, add tile to quick settings, view log, allow remote apps, and donate. Not seeing any other settings ---------------------------------------------------------------------- ElevenNotes · 2023-12-14 14:24 I don’t use Android, so, I don’t know if Android has this setting? On iOS its present or can be used with Shortcut actions (if Wifi not available = connect Wireguard). I guess stuff like this does exist on Android too? This [Reddit](https://www.reddit.com/r/WireGuard/comments /nkn45n/on_android_finally_you_can_automatically_turn/) post has some infos it seems, also with automation. ---------------------------------------------------------------------- distillari · 2023-12-14 14:35 Oh, gotcha. Thanks for the link, should have just googled/searched reddit when I couldn't find it, sorry. ---------------------------------------------------------------------- ElevenNotes · 2023-12-14 14:36 Was literally the first link that popped up in the search engine for *android wireguard auto connect* 😉 ---------------------------------------------------------------------- Civil404 · 2023-12-14 15:23 How do you get fqdn with Tailscale without buying a domain on your internal network? I’ve worked with TS without problems, but only with IPs ---------------------------------------------------------------------- Civil404 · 2023-12-14 15:23 How do you get fqdn with Tailscale without buying a domain on your internal network? I’ve worked with TS without problems, but only with IPs ---------------------------------------------------------------------- adamshand · 2023-12-14 18:58 https://login.tailscale.com/admin/dns ---------------------------------------------------------------------- Effective-Ad8776 · 2023-12-14 19:55 I found ChatGPT helpful, feed it requirements, e.g what containers I need, where my data currently is so it can map volumes etc etc. I get it to create docker compose file so then if something isn't working I make a change and just redeploy. It helped me better understand docker and how to use it for my needs ---------------------------------------------------------------------- LastTreestar · 2023-12-14 21:30 Where do you suggest learning "how it really works"? After moving to linux and finally figuring out it's just clever iptables rules and essentially obfuscated directory trees, it made a little more sense. Nothing told me or suggested that. I went looking for a several gig storage location and discovered the container. Coulda been ton easier. Actually.... What do you mean by "how it really works"? The CLI management, or under the hood functionality? You've left the reader to somehow magically discover things he didn't know even existed. ---------------------------------------------------------------------- thekrautboy · 2023-12-14 21:38 > Nothing told me or suggested that. Why would it? > Actually.... What do you mean by "how it really works"? How Docker works, how to use the basic CLI, how compose works. Using Portainer is not teaching anything, and the time comes sooner than later when manual interference is required when something doesnt work with copy/pasting into Portainer. And then those users are left stranded because they didnt learn anything about Docker actually, even tho they were (indirectly) using it. > Where do you suggest learning "how it really works"? As i already mentioned, plenty of guides exist. I am sure OP is capable to type "Docker beginners guide" into Youtube for example. > You've left the reader to somehow magically discover things he didn't know even existed. Oh god, no! Did i fail at my job here to explain everything like ELI5 to every single post? Oh wait, this isnt even /r/Docker, let alone /r/TechSupport or anything remotely like that. ---------------------------------------------------------------------- LoadingStill · 2023-12-15 03:16 You do not need all of these applications to be accessible from outside your network. Having network access does not mean you can access the application from outside the network. In fact most of these I would not trust to be exposed. Only expose what you NEED for example plex and jellyfin it makes more sense to have exposed vs any of the starr programs. Pihole is a dns synchole and or dns server, you want that only accessible in your network not outside. That can be a very powerful tool for hackers to access. If you must be able to access everything then you will want to set up an internal vpn so you can remote into your own network. Let me know if you have any questions.