Is it possible to set up a reverse proxy with AdGuard Home? reddit / selfhosted ---------------------------------------------------------------------- Civil404 · 2023-12-15 19:12 I have AdGuard Home running inside a container similar to [this](https ://gist.github.com/brav0charlie/cba2a62b82b83134a86a9a06fabc87ab). Now I'm trying to set up everything behind Caddy as a reverse proxy to reach my services through Tailscale like \`https://machine.tailnet.ts.net/syncthing\`. The problem is that both Caddy and AdGuardHome seem to need to listen on port 80/443 if I don't want to remember random ports. Is that correct or is there any workaround? ---------------------------------------------------------------------- CranberryLegal6919 · 2023-12-15 19:25 You can reverse proxy an address like [0.0.0.0:11](https://0.0.0.0:11) to be redirected to website.tld/something or sub.website.tld/ but i dont know how to do so with caddy, its quite easy with nginx tho. ---------------------------------------------------------------------- unofficialtech · 2023-12-15 20:21 If you're running it in a container the only port you wouldn't want to mess with is 53 since you usually can't define the dns port on the software using it. You can map 80 and 443 to 8080 and 8443 or something unused. I'm not explicitly familiar with caddy but some google fu shows you can then do `caddy reverse-proxy --from dns.yourdomain.com --to :8080` and if logic works, [dns.yourdomain.com](https://dns.yourdomain.com) should then flow to AGH ​ My reverse proxy setup knowledge is currently stronger with nginx and NPM though, so that's where I'm drawing the fundamental concept from. APologies if it doesn't translate to caddy like that. ---------------------------------------------------------------------- Civil404 · 2023-12-15 20:26 I understood I needed AGH with ports 80 and 443 for DNS over HTTP. And some other ports for other stuffs that is over my head tbh. So in my mind I was forced to have AGH on 80/443 and Caddy on the same ports for obvious reasons. I might try NPM, I just went with Caddy because I read it was the easier to learn. ---------------------------------------------------------------------- ethereal_g · 2023-12-15 20:28 I use Traefik to reverse proxy 'dns.mydomain.com' to the Adguard container port 80. ---------------------------------------------------------------------- thekrautboy · 2023-12-15 20:37 Because youre running Adguard in a container you can simply map the webinterface to a different port with Docker. It doesnt need to be listening on port 80, so just map to whatever else you want and done. If you use your reverse proxy to also proxy the webinterface of Adguard, then you dont need to map Adguards interface at all to the host, you can completely remove it and instead have the proxy and Adguard both be members of the same internal Docker network, and set your proxy to redirect to Adguards containername as the hostname and its internal port. No mapping to the host is required for that at all and you dont get any conflict with ports. Only the actual DNS ports of Adguard need to be mapped. If you want to use DNS-over-HTTPS with Adguard, thats more of a problem because it requires port 443 which is also used by Caddy. Look into Docker network withs MACVLAN then. /r/Docker and /r/Adguard /r/AdguardHome can help. ---------------------------------------------------------------------- thekrautboy · 2023-12-15 20:44 Caddy is very basic to setup and i would say medium difficulty to really learn. It can do a lot, but it takes effort and time to learn. NPM is usually very beginnerfriendly simply because you configure it through a webinterface and not with config files, that makes things a lot easier for many people. However at some point it might reach the limits of its abilities and thats when proxies like Caddy or Traefik are "better". **No matter which reverse proxy you pick, you will face the issue of conflicting ports because you want to use DNS-over-HTTP/S. There is no reverse proxy that magically works around that by itself.** If you wouldnt use DoH then this wouldnt be a problem at all. But if that is what you want to use: One solution would be to use a Docker network with MACLVAN and give the Adguard container its own dedicated IP, then it can use ports 80/443 on that IP without problems. Be warned tho if you then also want to proxy that Adguard webinterface through the reverse proxy, it wont work easily. That is because containers that use MACVLAN networking cannot simply talk to each other like normal containers could. There are workarounds for that tho. ---------------------------------------------------------------------- Civil404 · 2023-12-15 21:40 Great! I’ll look into MACLVAN. I was thinking on having to move everything into VM in order to have different IPs and solve the problem, didn’t knew that docker had that capability. ---------------------------------------------------------------------- really_bad_eyes · 2023-12-16 01:18 Caddy is fine, I have this exact setup myself. Caddy is a lot easier to config imo. Just go to AGH and change the HTTTP(S) ports to something else (I use 88 for HTTP and 444 for HTTPS). Then, edit /etc/caddy/Caddyfile to reverse proxy to the http port. Here's the caddy config: ``` adguard.mydomain.tld { reverse_proxy localhost:88 } ``` Here's the guide to change the http port (admin UI only let you change https port): https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#webaddr ---------------------------------------------------------------------- LazySht · 2023-12-16 08:34 With traefik you don't need to expose the ports. you can have multiple containers with the same port and traefik will make the connection, you can remove almost all exposed ports (except for 53 for example). ---------------------------------------------------------------------- keyNONE · 2023-12-16 10:34 Just give your host a second IP then configure AGH to bind to one of them and NPM to the other. ---------------------------------------------------------------------- Civil404 · 2023-12-16 10:41 Is that something that you do on the OS itself or the router? I've never assigned 2 IPs to a host. ---------------------------------------------------------------------- Civil404 · 2023-12-16 10:45 Sounds like a clean alternative. Not sure exactly how to "bind" each container to different network interfaces. But wouldn't be a problem that port 80 is in use for both? ---------------------------------------------------------------------- keyNONE · 2023-12-16 10:50 The way I did it: spin up agh with network_mode: host. Edit agh config file to bind to one ip, leaving 80 and 443 open on the other ip. Then spin up npm container with 2ndip:80:80… Also, running agh with network_mode: host has some advantages, which is another positiv effect of this solution. ---------------------------------------------------------------------- henry_tennenbaum · 2023-12-16 12:11 Great answer. One issue I had when I tried to use a setup like this, is that mavlans prevent any communication with the host. So Caddy could no longer communicate directly with Adguard. I circumvented that by redirecting to Adguard's ip, but I know there must be a way to bridge that gap somehow, right? ---------------------------------------------------------------------- thekrautboy · 2023-12-16 12:24 A workaround would be to create a macvlan-shim network: https://blog.ivansmirnov.name/set-up-pihole-using-docker-macvlan- network/ ---------------------------------------------------------------------- henry_tennenbaum · 2023-12-16 13:11 Thank you, that's the perfect tutorial I was looking for. ---------------------------------------------------------------------- unofficialtech · 2023-12-18 14:17 Yeah just to expand my answer, an assumption was that you wanted to access the AGH web ui via RP, not the actual DNS functionality/services.