DNS- and Reverse proxy conundrum reddit / selfhosted ---------------------------------------------------------------------- yawLd · 2023-12-18 14:59 Hey, I've recently gotten into selfhosting a media server. It has so far been a very interesting journey. I've stumbled more times than I can count, but have always been able to sort things out with the vast informations on the internet. That is until today, bear with me if I don't know the correct terms for everything, I'll do the best I that I can to explain. I want to be able to access my containers/services/apps by means of url, and url only. I don't want them accessible by :port. I think I have this working perfectly for all the apps except two, which are running under my ExpressVPN-containers network. I am running OMV6 and docker. My local network adress range is [10.0.0.0/24](https://10.0.0.0/24). All my containers (except Plex) are running on the same network, named flu-network with adress range [172.18.0.0/24](https://172.18.0.0/24), created by me. Currently I am using Pi-hole (10.0.0.2) as my dns where I have an A-record: mediaserver.home -> [10.0.0.10](https://10.0.0.10) (my servers local IP). And a bunch of CNAME-records: [appname.homepage.se](https://appname.homepage.se) \-> mediaserver.home. (I have a registered domain so I can use let's encrypt for SSL). I am using SWAG as reverse proxy and use only the default subdomain configs without modifications so far. This works fine for almost all the containers. They are secured with SSL and (afaik) only accessible via http/[https://appname.homepage.se](https://appname.homepage.se) since I removed the ports in my docker compose. The containers I have problem with are prowlarr and qBittorrent which are set up a little bit different in my docker-compose file where they use the following additons: network\_mode: "service:expressvpn" depends\_on: \- "expressvpn" And their ports are now listed in the ExpressVPN containers compose. Meaning they don't have their own IP-adresses in the flu-network. But I never managed to get the VPN working for the containers in any other way.. I can of course access them by :port Plex is another container that don't quite work yet. But I haven't tinkered with non-host network-mode there yet. * Docker compose for all containers except Portainer: ​ version: "2.1" services: expressvpn: image: misioslav/expressvpn:3.60.0.4 container_name: expressvpn restart: unless-stopped ports: - "6881:6881/tcp" #qbittorrent - "6881:6881/udp" #qbittorrent - "8080:8080/tcp" #qbittorrent web - "9696:9696/tcp" #prowlarr environment: - WHITELIST_DNS=1.1.1.1,1.0.0.1 - CODE= - SERVER=smart - PROTOCOL=lightway_udp - CIPHER=chacha20 cap_add: - NET_ADMIN devices: - /dev/net/tun stdin_open: true tty: true command: /bin/bash privileged: true qbittorrent: image: ghcr.io/hotio/qbittorrent:release-4.6.2 container_name: qbittorrent environment: - PUID=1001 - PGID=100 - TZ=Europe/Stockholm network_mode: "service:expressvpn" depends_on: - "expressvpn" volumes: - "./qbittorrent_config:/config" - "/srv/dev-disk-by-uuid-e343f69e-774b-4b91-86cc- 6409e365753d/data/torrents:/data/torrents" restart: "unless-stopped" prowlarr: image: "linuxserver/prowlarr:1.11.2-develop" container_name: "prowlarr" environment: - "PUID=1001" - "PGID=100" - "TZ=Europe/Stockholm" network_mode: "service:expressvpn" depends_on: - "expressvpn" volumes: - "./prowlarr_config:/config" - "/srv/dev-disk-by- uuid-e343f69e-774b-4b91-86cc-6409e365753d/data:/data" restart: "unless-stopped" radarr: image: "linuxserver/radarr:5.2.6-nightly" container_name: "radarr" environment: - "PUID=1001" - "PGID=100" - "TZ=Europe/Stockholm" volumes: - "./radarr_config:/config" - "/srv/dev-disk-by- uuid-e343f69e-774b-4b91-86cc-6409e365753d/data:/data" restart: "unless-stopped" sonarr: image: "linuxserver/sonarr:3.0.10" container_name: "sonarr" environment: - "PUID=1001" - "PGID=100" - "TZ=Europe/Stockholm" volumes: - "./sonarr_config:/config" - "/srv/dev-disk-by- uuid-e343f69e-774b-4b91-86cc-6409e365753d/data:/data" restart: "unless-stopped" bazarr: image: linuxserver/bazarr:1.4.1-development container_name: bazarr environment: - PUID=1001 - PGID=100 - TZ=Europe/Stockholm volumes: - ./bazarr/config:/config - /srv/dev-disk-by- uuid-e343f69e-774b-4b91-86cc-6409e365753d/data/media:/media restart: unless-stopped heimdall: container_name: "heimdall" image: "linuxserver/heimdall:2.5.8" environment: - "PUID=1001" - "PGID=100" - "TZ=Europe/Stockholm" restart: "unless-stopped" volumes: - "./heimdall/config:/config" ombi: image: linuxserver/ombi:4.43.5 container_name: ombi environment: - PUID=1001 - PGID=100 - TZ=Europe/Stockholm volumes: - ./ombi/config:/config restart: unless-stopped plex: container_name: "plex" image: "linuxserver/plex:1.32.8" environment: - "TZ=Europe/Stockholm" - "VERSION=docker" - "PUID=1001" - "PGID=100" network_mode: "host" restart: "unless-stopped" volumes: - "./plex:/config" - "/srv/dev-disk-by- uuid-e343f69e-774b-4b91-86cc-6409e365753d/data/media:/media" tautulli: image: linuxserver/tautulli:2.13.4 container_name: tautulli restart: unless-stopped volumes: - ./tautulli/config:/config environment: - PUID=1001 - PGID=100 - TZ=Europe/Stockholm swag: image: linuxserver/swag:2.8.0 container_name: swag cap_add: - NET_ADMIN environment: - PUID=1001 - PGID=100 - TZ=Europe/Stockholm - URL=homepage.se - SUBDOMAINS=wildcard - VALIDATION=dns - DNSPLUGIN=cloudflare - PROPAGATION=180 volumes: - ./swag/config:/config ports: - 443:443 - 80:80 restart: unless-stopped networks: default: external: true name: flu-network * Docker compose for portainer: ​ --- version: "3" services: portainer: image: portainer/portainer-ce:latest container_name: portainer restart: unless-stopped security_opt: - no-new-privileges:true volumes: - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock:ro - ./portainer_data:/data ports: - 9000:9000 networks: default: external: true name: flu-network Any ideas to get this working? Regards, yawLd Edit: corrected IP typo. ---------------------------------------------------------------------- adamshand · 2023-12-19 00:35 > All my containers (except Plex) are running on the same network, named flu-network with adress range 127.18.0.0/24, created by me. As far as I know, you should never use `127.x.y.z` addresses for services? Not even for internal Docker networks. ---------------------------------------------------------------------- yawLd · 2023-12-19 05:49 Sorry that was a typo, it's 172.18.0.0/24. ---------------------------------------------------------------------- adamshand · 2023-12-19 05:54 Ah. ---------------------------------------------------------------------- yawLd · 2023-12-19 13:31 So I figured it out. I feel kind of stupid, but here goes. I just changed my $upstream\_app field from qbittorrent / prowlarr to expressvpn in respective SWAG subdomain conf-file and it started working. Really should have thought of that from the start. Hopefully this will help someone out there..