Should I changed to traefik ? reddit / selfhosted ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 05:26 I read on old thread npm has a lot of vulnerabilities by exposing port 81 and many threats are not fixed, but I still saw their github repo being updated daily although their open issue is over thousands. Last time I used traefik very hard to setup, maybe I should learn again from scratch up to replace the NPM ? Or maybe there's a good alternative other than those two ? cloudflared seems great but I don't want to binding my paypal/ CC to use it. ---------------------------------------------------------------------- bobbywaz · 2023-12-18 05:36 NO ---------------------------------------------------------------------- rohit_267 · 2023-12-18 05:41 first time i am hearing someone wants traefik instead of npm ---------------------------------------------------------------------- User453 · 2023-12-18 05:42 I use Caddy. Very simple, does the job and does it well. I migrated from Nginx as I always felt that using Nginx was like bringing a tank to a water fight. ---------------------------------------------------------------------- ElevenNotes · 2023-12-18 05:47 Traefik is easier to use when you just need a proxy. Nginx shines when you start doing advanced stuff. NPM is garbage overlay for Nginx. ---------------------------------------------------------------------- BlockDigest · 2023-12-18 05:52 If you are worried exposing nginx over the internet, and want to use an actually self hosted solution, then I would look into Wireguard or OpenVPN. Move your nginx to be accessing only within your network and only expose the VPN server to the internet. ---------------------------------------------------------------------- ripe-lychee · 2023-12-18 06:11 I switched to traefik for the same reason, there were a lot of concerns about npm ignoring vulnerabilities. Installing code-server made editing traefik configurations a breeze, I highly recommend trying it out ---------------------------------------------------------------------- g-nice4liief · 2023-12-18 06:12 What where you struggling with setting up Traefik ? ---------------------------------------------------------------------- 10031 · 2023-12-18 06:16 Go caddy, the labels are cool but get messy. I went from NPM to Traefik to Caddy. ---------------------------------------------------------------------- dudeskeeroo · 2023-12-18 06:21 I use traefik and I'm quite happy with it. I love the outside-in nature of the configuration. Having said that, getting a working configuration was like running a mile through a field of garden rakes. I probably should have read the docs sooner. Once I had a working configuration for a service, I just used it as a template for all subsequent services. ---------------------------------------------------------------------- zeitue · 2023-12-18 06:21 I'm about you make this change as well. I've been using caddy docker proxy and I've been getting disconnects from it and can't resolve the issue. Before I switch to caddy I used nginx proxy manager which worked pretty well and was easy to configure, and before that I used swag by Linuxserver.io. I think traefik offers a good transition process from running stuff through docker or locally to running things on kubernetes. Unless you're having issues with your current setup or you plan for some sort of transition process I don't see much reason to switch. ---------------------------------------------------------------------- j0hnp0s · 2023-12-18 06:24 I prefer Caddy, but that will solve only part of your problem. Ideally you want to setup some kind of VPN between yourself and the server, and then expose npm's interface on the vpn's interface, so that it's available only if someone is part of that network. Wireguard is quickly becoming the standard for such things. I have also used zerotier and tailscale with great success. ---------------------------------------------------------------------- BabyFaceNelzon · 2023-12-18 06:25 Traefik can do advanced stuffs easier too ---------------------------------------------------------------------- kekonn · 2023-12-18 06:27 Verry happy Traefik user here, but it did take me a couple of attempts to "get" it. ---------------------------------------------------------------------- silverW0lf97 · 2023-12-18 06:32 Hey I use traefik too it's actually pretty great, I didn't like nginx proxy manager for some reason. ---------------------------------------------------------------------- psicodelico6 · 2023-12-18 06:33 I use caddy. Its great . ---------------------------------------------------------------------- psicodelico6 · 2023-12-18 06:34 I need caddy with label for docker compose ---------------------------------------------------------------------- Vogete · 2023-12-18 06:38 I switched from nginx to traefik. Tbe first time it took me 3 days to setup a simple reverse proxy. Then it was only 1 day. Now that I learned it, and have a few services running so I can cheat from those configs, it takes me 2 minutes to configure a reverse proxy with letsencrypt. I personally like it, but I also liked nginx for different reasons. NPM I haven't used personally, I went with SWAG instead, but I found that to have a bit too many moving components. It did work pretty well though. I can recommend traefik but there's less resources out there than with plain nginx (or SWAG), so that's something to keep in mind. ---------------------------------------------------------------------- Bonsailinse · 2023-12-18 06:41 It took me two tries to get into traefik and NPM was the thing I used between those tries. I loved NPM for a good while but the moment you have something slightly non-default it becomes a deep dive into debugging which of the moving parts is responsible for your service not getting connected like you planned. I did the switch to traefik eventually when I moved to a new server because I saw the configuration monster NPM became over the time and I had no good overview what I did where to make everything running smooth. Traefik was just learning a few core concepts, as in how to manage the main config files, after that it is just so easy to maintain, I would never switch back to something like NPM. I still love nginx as a web server and reverse proxy but it had its time. Farewell, my friend. ---------------------------------------------------------------------- itsonlybarney · 2023-12-18 07:01 I just started with NPM but didn't think about using Traefik or Caddy. The tutorial I followed used NPM. Seeing this post is making me question whether I should be using Traefik or Caddy over NPM. ---------------------------------------------------------------------- adamshand · 2023-12-18 07:28 I really like Caddy as well (and dislike Traefik). ---------------------------------------------------------------------- adamshand · 2023-12-18 07:29 I didn't have to provide a CC to Cloudflare to use cloudflared. Has that changed? ---------------------------------------------------------------------- Doctor_Human · 2023-12-18 07:32 Hello, thanks for this topick What vulnerabilities are not fixed for NPM? I switched to NPM from Apache and I can't complain. My port 81 is behind cloudflare tunel with SSO. Thanks ---------------------------------------------------------------------- mousui · 2023-12-18 07:43 I struggled alot while setting up traefik as well, I will try again when I have time, but for now I use caddy ---------------------------------------------------------------------- Drknz · 2023-12-18 08:20 This is NSFW ---------------------------------------------------------------------- StackNeverFlow · 2023-12-18 08:32 Over 33% of the internet runs on nginx. Not on traefik. ---------------------------------------------------------------------- Friendly_Panda3871 · 2023-12-18 08:33 There is also a caddy plugin for docker containers ---------------------------------------------------------------------- Amro3610 · 2023-12-18 08:33 Why do you expose port 81 ? NPM you only need to forward port 80/tcp and 443/tcp, 81 is for administration and should only be accessible with vpn or tunnel. Also you can add extra protection layer with crowdsec. ---------------------------------------------------------------------- Amro3610 · 2023-12-18 08:34 vulns are very nfsw ---------------------------------------------------------------------- qonTrixzz · 2023-12-18 08:56 @all who use Nginx PM, Caddy or Traefik - how do you add OWASP CRS to the reverse proxies for enhanced security? ---------------------------------------------------------------------- NiftyLogic · 2023-12-18 09:27 ... as a web server ---------------------------------------------------------------------- kidpixo · 2023-12-18 09:33 As direct traefik alternative I use https://github.com/lucaslorentz/caddy-docker-proxy/ at home, it is a simple caddy2 implementation that works like traefik for containers. ---------------------------------------------------------------------- Ejz9 · 2023-12-18 09:37 What’s your goal. What do you want out of a proxy? Are you looking to experiment? Ask yourself. It might help. ---------------------------------------------------------------------- Skrivebord22 · 2023-12-18 09:48 Traefik + crowdsec for publicly accessible services, NPM for internal only. ---------------------------------------------------------------------- AuthorYess · 2023-12-18 09:52 Gonna disagree here, npm does not have the same development as traefik. Nginx is obviously what it’s based on but npm is an application on top of that by a smaller developer. Traefik is much safer to use overall. ---------------------------------------------------------------------- purepersistence · 2023-12-18 10:00 Yeah let's discard a good product because of vulnerabilities that nobody can access. ---------------------------------------------------------------------- Atlasatlastatleast · 2023-12-18 10:07 I mean nginx still runs about a quarter of websites so it’s not going anywhere soon ---------------------------------------------------------------------- uselesslogin · 2023-12-18 10:25 How the heck is this the first I'm hearing of this option? That looks great for my Nomad with Consul setup and it can handle the certs. Right now I'm templating nginx configs but nginx doesn't do the certs. OK, off to change by setup. ---------------------------------------------------------------------- User453 · 2023-12-18 10:30 This was my issue too and why I switched from Nginx. I was able to work with acme.sh & Nginx and it worked perfectly but it just took too long to make most changes. Now I just use caddy and have it linked to the Cloudflare api via the Cloudflare DNS validation extension and making even the slightest change is really simple and quick. I still think Nginx is great and it certainly has its uses, but Caddy is a better tool for a home lab in my opinion. ---------------------------------------------------------------------- linxbro5000 · 2023-12-18 10:47 If you don´t want to expose port 81 using NPM just don´t do it :) A firewall is your friend. [https://github.com/chaifeng/ufw- docker](https://github.com/chaifeng/ufw-docker) might be a good start. ---------------------------------------------------------------------- Torrew · 2023-12-18 10:55 I use Traefik with the \[Modsecurity Plugin\]([https://plugins.traefik .io/plugins/628c9eadffc0cd18356a9799/modsecurity-plugin](https://plugi ns.traefik.io/plugins/628c9eadffc0cd18356a9799/modsecurity-plugin)). In addition to that, i also run Crowdsec & a Geoblock Plugin for the services that are publicly exposed. Like others mentioned, Traefik can indeed be tricky to setup initially, but once it's done, it works amazing. ---------------------------------------------------------------------- revereddesecration · 2023-12-18 11:06 What exactly do you need the labels for? ---------------------------------------------------------------------- StarfishPizza · 2023-12-18 11:06 Does nobody use Swag anymore? 🤨 ---------------------------------------------------------------------- UEF-ACU · 2023-12-18 11:12 As long as you’re not exposing port 81 externally NPM is fine. ---------------------------------------------------------------------- sevlonbhoi1 · 2023-12-18 11:46 Tried traefik, npm, nginx but once I used caddy didn't need to try anything else. Its so simple yet so great. ---------------------------------------------------------------------- primalbluewolf · 2023-12-18 12:00 >Over 33% of the internet runs on nginx I'd be curious how much of the internet uses traefik as the ingress controller, though. ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:03 Yes, I mean it was using port 81 by default to handle the administration, how do you set it up to be accessible with vpn/tunnel only ? I don't think npm come with that feature though. ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:04 Thanks will check it out. ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:04 Thanks will check it out. ---------------------------------------------------------------------- Amro3610 · 2023-12-18 12:06 Port 81 is only to access admin gui, look into WireGuard or Tailscale both free and and secure, Tailscale is super easy to install and use ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:06 >Ideally you want to setup some kind of VPN between yourself and the server, and then expose npm's interface (along with any other admin panels) on the vpn's interface, so that it's available only if someone is part of that network. Well, the doc doesn't show how to that, so it doesn't cross my mind, how to setup so the npm interface only accept from our vpn ? ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:25 traefik need to mess with docker compose everytime I need to start the container, which is not very convenient. ---------------------------------------------------------------------- j0hnp0s · 2023-12-18 12:32 Assuming you are using docker compose to run NPM, you can do something like ``` ports: - "vpnip:81:81" ``` ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-18 12:34 I don't know about it in the past, but it's still free, you need to add to cart even though it cost 0, and need to use CC / paypal to use that tunnel. ---------------------------------------------------------------------- ZUPUP05 · 2023-12-18 12:46 Can i use a domain (like www.nginx.example.com) in a vpn without exposing the site to the internet? Now i am using tailscale but i need to remember the port for every service ---------------------------------------------------------------------- Amro3610 · 2023-12-18 12:48 Yes you can setup reverse proxy for local IPs and they will only be accessible with a VPN or you can make a dashboard with homer or dashy and bookmark your sites so no more ports to remember ---------------------------------------------------------------------- ZUPUP05 · 2023-12-18 12:51 For the reverse proxy server for local IPs can i do it with npm or i should use vanilla nginx/traefik/candy? ---------------------------------------------------------------------- Amro3610 · 2023-12-18 12:51 Either one can work go with the one you’re familiar with ---------------------------------------------------------------------- ZUPUP05 · 2023-12-18 12:52 Ok, I’ll search Thx for the advices ---------------------------------------------------------------------- instant_dreams · 2023-12-18 13:09 I think you might be doing it wrong. It's just labels. ---------------------------------------------------------------------- BabyFaceNelzon · 2023-12-18 13:18 What does this have to do with ? ---------------------------------------------------------------------- nodq · 2023-12-18 13:25 Just use caddy man. And you will never look back. ---------------------------------------------------------------------- cliffwarden · 2023-12-18 13:28 If you value your time more use caddy. If you value learning more try traefik. In between these two is Apache or nginx. ---------------------------------------------------------------------- nerdyviking88 · 2023-12-18 13:35 Simply don't forward port 81 from outside to NPM. Then you can only hit it via LAN/VPN/etc. This is not an app problem, it's a user problem. ---------------------------------------------------------------------- hunkyn · 2023-12-18 13:46 Do we need a domain to use Caddy? I am not planning to expose any of the services but looking for an option to use an url instead of IP address. ---------------------------------------------------------------------- Muizaz88 · 2023-12-18 13:49 Swag gang here! ---------------------------------------------------------------------- megatron36 · 2023-12-18 13:53 I currently use nginx proxy Manager, would it be hard to migrate to caddy? as I see a lot of people recommending it over npm. Also is it really that much more secure or just a matter of preference? ---------------------------------------------------------------------- applesoff · 2023-12-18 13:55 You can use DDNS like duckdns to expose your service if you so choose. ---------------------------------------------------------------------- FrenchTouch42 · 2023-12-18 13:55 How do you manage Consul? How many nodes? Do you have ACLs enabled? If so, how do you manage ACLs as well? Thanks in advance! ---------------------------------------------------------------------- uselesslogin · 2023-12-18 13:59 I do have 3 Raspberry Pi 4s but I'm pretty sure a single node works too. I bind it to my Tailscale ip and then have zero other security turned on though the firewall blocks everything except for specific ports that isn't coming through Tailscale. ---------------------------------------------------------------------- DarkCeptor44 · 2023-12-18 14:00 Do you use the one with Docker labels or manually write the Caddyfile? I want to swap from NPM but I also have non-container applications that run on other machines so I'm wondering if the labels one works in both cases. ---------------------------------------------------------------------- hiiambobthebob · 2023-12-18 14:10 Ah yes a great product with 1.1k open issues ---------------------------------------------------------------------- hunkyn · 2023-12-18 14:13 I was using DDNS with Nginx and then removed it along the way. I will look into Caddy. I was hoping to avoid using DDNS. Seems like it is not possible to do so without a domain (free or not) ---------------------------------------------------------------------- forwardslashroot · 2023-12-18 14:13 Would you be able to do something like block specific paths or location like /admin with Caddy? ---------------------------------------------------------------------- Hawtre · 2023-12-18 14:18 Wait until you realise "issues" can be things like feature requests, user support requests, etc ---------------------------------------------------------------------- hiiambobthebob · 2023-12-18 14:20 99% of them are triaged as bugs with the last 3 issue being closed within a 2 month time frame ---------------------------------------------------------------------- jewbasaur · 2023-12-18 14:25 I just made a card on privacy.com and put a $1 total on it ---------------------------------------------------------------------- Hawtre · 2023-12-18 14:29 You can't generalise, which was the point I was making. Far too many people see the "issue count" as the end-all. I see 300 enhancement requests and a bunch of "bugs" that are probably down to user error. ---------------------------------------------------------------------- Sym0n · 2023-12-18 14:30 In case anyone is wondering, looks like this is the vuln OP is mentioning. [#2063](https://github.com/NginxProxyManager/nginx-proxy- manager/issues/2063). From my very limited knowledge this doesn't look like a massive issue if you require authenticated users to access the admin portal and haven't opened port 81. However, it's a 2 year old vuln report and the maintainer has never bothered to reply, merge the PR to fix it or, I assume, fix it themselves. Last commit to the repo was 5 months ago. Probably wise to migrate away from NPM, if you're using it. Caddy or Traefik are my suggestions. ---------------------------------------------------------------------- FrenchTouch42 · 2023-12-18 14:31 Thanks stranger! ---------------------------------------------------------------------- purepersistence · 2023-12-18 14:43 And the size of the user base and how inexperienced or adventurous they are. The more issues the more interest. Of course if you’ve used it a couple years for 25 services in your lab without “issue” there’s that. ---------------------------------------------------------------------- ZUPUP05 · 2023-12-18 15:20 sorry if I'm bothering you but how do I in practice tell Nginx Proxy Manager not to connect to the internet but to only receive requests coming from the VPN? ---------------------------------------------------------------------- Amro3610 · 2023-12-18 15:25 When you setup a proxy host everyone will see the [test.domain.com](https://test.domain.com) redirects to 192.168.X.X if they lookup for the DNS. But only you can access it with VPN. better explanation : [link](https://www.reddit.com/r/nginxproxymanager /comments/15rpcg6/comment/jwn83l3/?utm_source=share&utm_medium=web2x&c ontext=3) ---------------------------------------------------------------------- kindrudekid · 2023-12-18 15:37 I use swag from LinuxServer.io Stands for Secure Web Access Gateway.. Comes with sample reverse proxy configs for subdomains and sub folders for popular self hosted apps. Also comes with templates you can use for configs they do not provide (I have few for Omada, truenas, proxmox behind authelia) Has mods where you can enable auto reload when config changes, crowdsec etc… Supports http auth, authelia and authentik …. Release notes periodically specify what files to delete and recreate (also available on docker logs and the dashboard mod) It’s basically NPM but without GUI and honestly you really don’t need a GUI anyways, how often are you accessing config that you need a GUI ? They also have a few blog post on how to setup with authelia and cloudflared…. They even explain the logic and how the nginx config files work…. Once you grasp these it’s easy peqsy …. ---------------------------------------------------------------------- PrestigiousDay9535 · 2023-12-18 15:39 Absolutely no need to open to the exterior any ports. Just use a Cloudflare tunnel and send all the DNS records through it to your npm. ---------------------------------------------------------------------- doctorowlsound · 2023-12-18 15:43 Usually for automatic service discovery. Deploy a stack with the needed labels and Traefik (for example) will automatically create the route, set up the https certificate, etc. rather than having to deal with an additional config file. ---------------------------------------------------------------------- DirectReflection3106 · 2023-12-18 15:43 Using plain simple nginx. Doing even manually is copy-paste-replace 2 values (name and proxy address ) and reboot takes 5sec and it 1000% works. But of course if it was hundred apps per day its not very convenient. ---------------------------------------------------------------------- firedrow · 2023-12-18 15:48 There shouldn't be a need to tie a CC to your Cloudflare account. They have free tier services, and using the Zero Trust tunnel plus proxied DNS should take care of your security issue. ---------------------------------------------------------------------- ZUPUP05 · 2023-12-18 15:51 ah, it was that simple Now I feel like an idiot for not thinking about it ---------------------------------------------------------------------- Amro3610 · 2023-12-18 16:25 You're learning, everyone is learning. Keep gaining knowledge and tinkering your lab ! ---------------------------------------------------------------------- guptaxpn · 2023-12-18 16:25 This. One. Single. File. Boom. Done. Easy. ---------------------------------------------------------------------- rockypanther · 2023-12-18 16:35 Same. It's hard to figure out configuration at first, but once you have a working config as a template, it makes it very simple for subsequent implementations. I have been using Traefik for a long time now, and have zero complaints. ---------------------------------------------------------------------- guptaxpn · 2023-12-18 16:43 Why are you getting downvoted? Anyway, you should firewall port 81 so that it's only accessible from the machine it's running on and maybe another machine in the LAN if you absolutely need to, keep the whitelist short. ​ You'd set up a VPN/Tunnel to either the machine itself or that other machine to punch through your outer NAT/Firewall and get access to administrative ports. I have zero clue about NPM or this port 81 business, but that's true for all admin type ports or other insecure services. ---------------------------------------------------------------------- my_name_is_winter · 2023-12-18 16:52 I use both Traefik and Caddy for different purposes, but Caddy is great for a simple reverse proxy setup. ---------------------------------------------------------------------- Tanukishouten · 2023-12-18 17:47 Totally agree with this. I use swag + authelia with cloudflare (+Adguard home lol). It is really cool and works for me. Never tried the other options as I tend to choose whatever exist on linuxserver.io as they keep high standards, so can't really say if it's the best. ---------------------------------------------------------------------- User453 · 2023-12-18 18:13 Depends on how comfortable you are with writing config. The main difference with proxy manager vs Caddy is that the main interface for Caddy is the “Caddyfile”. The Caddyfile is very easy to learn providing that you are comfortable with editing a file and restarting the service. ---------------------------------------------------------------------- l13t · 2023-12-18 18:27 I use Traefik together with Nomad and its service a u to discovery. So all my containers that require https(a) endpoint, are automatically added into Traefik. ---------------------------------------------------------------------- lemniskegg · 2023-12-18 18:43 Traefik is really great and I really like their approach on middlewares, but I encountered an issue with apps that send a response with chunked encoding. It's great for service mesh but I'd prefer nginx or haproxy for edge servers ---------------------------------------------------------------------- halpoins · 2023-12-18 18:58 Reading the docs beforehand did NOT help. They’re a mess. ---------------------------------------------------------------------- psicodelico6 · 2023-12-18 19:27 Exactly. Gitlab runner ---------------------------------------------------------------------- MaxGhost · 2023-12-18 19:53 You can use Caddy without a domain (just use `:8080` or whatever as your site address) but if you want HTTPS then you should use a domain. You can use this Caddy plugin https://github.com/mholt/caddy- dynamicdns to automatically update your domain's IP. Works well with DuckDNS for example. ---------------------------------------------------------------------- MaxGhost · 2023-12-18 19:54 Yes, you can proxy to `host.docker.internal` to connect to the host machine, or the IP address of your other servers. You put labels on the Caddy container itself so that they're always available. ---------------------------------------------------------------------- MaxGhost · 2023-12-18 19:55 Absolutely. Use request matchers to set up conditional routing. ---------------------------------------------------------------------- adamshand · 2023-12-18 20:12 Got all excited, and then ... > Privacy is currently available to US citizens or legal residents with a checking account at a US bank or credit union, and who are 18+ years of age. :-( ---------------------------------------------------------------------- revereddesecration · 2023-12-18 22:13 It’s not *that* hard to set up, I’d argue it’s easier with Caddy than any alternative. But fair enough. ---------------------------------------------------------------------- fishfacecakes · 2023-12-18 22:50 You can use IP’s, or internal domains with your own certs. You don’t need a domain but it can make life easier. ---------------------------------------------------------------------- fishfacecakes · 2023-12-18 22:52 Many ways to do it yes - at its simplest you can just respond to a path with a 403: https://caddyserver.com/docs/caddyfile/directives/respond But of course you can do authenticated paths etc ---------------------------------------------------------------------- itsonlybarney · 2023-12-18 23:14 I need to investigate ---------------------------------------------------------------------- forwardslashroot · 2023-12-18 23:38 My use case is I am using NGINX plugin from OPNsense. It works but too much work. The nice thing about the NGINX plugin is that I can use LDAP for basic auth for services that do not have login such as drawio or Frigate. Can Caddy do the same thing? There is a Caddy plugin, but it is a 3rd party plugin. When I installed it, I can see two options - Enable checkbox and Caddy file box where I can paste some configuration. At this point, I have no idea what to write or paste in the box. ---------------------------------------------------------------------- MrDephcon · 2023-12-18 23:48 Ditto ---------------------------------------------------------------------- ThrowAllTheSparks · 2023-12-18 23:53 I tried NGINX front end proxy and didn't get it to work with Docker but that was back when I knew less about the latter. It would probably be a fine solution now. I get Caddy working with Docker but the configuration kept eating itself. Then I tried Traefik. I struggled a bit to get it working but eventually succeeded. I changed hosts and expected my Docker Compose script to get me back up to speed lickety split and it just didn't. It was then that I learned about forced rebuilds and augmented the yaml script along the way. Anyway, if you want my Docker Compose yaml files for Traefik, Portainer, and/or Umami (analytics) OP send me a chat message. I just need to remove things like [passwords] or [ports]. ---------------------------------------------------------------------- kihaji · 2023-12-19 00:24 I have all letsencrypt signed ssl certs on a custom domain with no ports forwarded. Steps: Get a domain, park it somewhere like Cloudflare (it's what I use) Set your A Name for your domain to your server/reverse proxy's internal IP eg. 192.168.1.2 I use traefik, but Ngnix proxy also works, pull your SSL certs using the DNS Challenge method. With cloudflare this requires you to pass an API key, for others it may mean putting a specific value in your DNS record. Now all your internal sites are SSL secured with legit certificates. Your sites resolve when you are on your internal network, and if you VPN in, they will also resolve. Rejoice, because you don't poke holes in your firewall, don't have to worry about dynamic IPs, and can sleep at night. ---------------------------------------------------------------------- jewbasaur · 2023-12-19 02:25 Ah dang. I use their service for everything online it’s great ---------------------------------------------------------------------- doctorowlsound · 2023-12-19 02:34 Caddy is definitely awesome and easy, but one less separate config to maintain means one less thing to have to troubleshoot. ---------------------------------------------------------------------- fishfacecakes · 2023-12-19 03:28 Is it the security plugin you're talking about? I haven't personally used LDAP auth, but based on this doco it does look possible: [https://authp.github.io/docs/authenticate/ldap/ldap](https://authp.gi thub.io/docs/authenticate/ldap/ldap) I just went down the route of putting that stuff behind zero trust VPN, binding them only the VPN interface, and then writing ACL's at the VPN level to control access instead. ---------------------------------------------------------------------- User453 · 2023-12-19 07:57 Caddy can do something similar I believe. However I personally use Authentik for authentication as it has a built in authentication proxy. It’s much simpler ---------------------------------------------------------------------- forwardslashroot · 2023-12-19 13:01 Can this be applied to specific services and not all services behind caddy? ---------------------------------------------------------------------- fishfacecakes · 2023-12-19 13:09 I can only speak broadly, having used caddy but not this plugin. But yes, each site can have its own configurations with their own options. I presume this one works the same way ---------------------------------------------------------------------- UEF-ACU · 2023-12-20 05:34 You should know your port forwarding rules more than your own mother lol ---------------------------------------------------------------------- BlockDigest · 2023-12-20 07:21 Yess npm is its own can of worms and doesn’t compare to a plain proxy, sorry for the confusion. Granted OP was talking about npm, I want to mention that the threat profile of nginx and other popular proxies are similar, so it doesn’t make much difference changing one for the other (provided you know how to configure them securely). Furthermore, since they mentioned they didn’t want to use cloudflare etc. for tunnelling their connections, a secure solution is to deploy a VPN which is free to use and addresses the security issues associated with exposing proxies to the internet. ---------------------------------------------------------------------- Imaginary-Ice-5792 · 2023-12-21 14:02 I tried it and it still allow other ip to open and login ---------------------------------------------------------------------- ElevenNotes · 2023-12-21 19:36 It can, I'm aware, but Nginx too. Right tool for the right job, as always. ---------------------------------------------------------------------- BabyFaceNelzon · 2023-12-21 20:07 You are insinuating that nginx do a better job when it comes to advanced configurations? ---------------------------------------------------------------------- TestTxt · 2023-12-23 12:11 Hey, how did you manage to get NPM to work with CrowdSec?