Proxy HTTPS requests without a Certificate?
reddit / selfhosted

----------------------------------------------------------------------
Fernomin · 2023-12-21 18:42

Hi! I have an Oracle free tier VPS to which my home server is
connected via wireguard. On my home-server I have a Jellyfin instance
running, while on the VPS I have some other services, including a NPM
instance I use to reverse proxy Jellyfin.

The problem is that all my HTTPS certificates are stored on the VPS,
and I'd like to move away from that. Is it possible to have NPM
reverse proxy HTTPS requests (without a certificate) to another NPM
instance on my home server, which will then reverse proxy it (with a
certificate) to Jellyfin?

If no, is there any alternative I'm too dumb to think of?

----------------------------------------------------------------------
silence036 · 2023-12-21 18:57

You're looking for an sni proxy and yes it is doable.

I'm using this setup on opnsense with nginx to forward traffic to the
proper backend servers.

----------------------------------------------------------------------
Kv603 · 2023-12-21 18:58

You could pass-through the raw TCP connection using a simple TCP
proxy, not actually reading or acting on any of the HTTPS protocol.

----------------------------------------------------------------------
Fernomin · 2023-12-21 19:03

how can I do that? I see NPM has an option from stream, is that it?

----------------------------------------------------------------------
Fernomin · 2023-12-21 19:04

how are you doing that with nginx?

----------------------------------------------------------------------
silence036 · 2023-12-21 19:06

The settings are called "data streams" and "sni-based routing" in the
opnsense gui, not sure what those params match to underneath.

I can't help much more than that but at least you know it's possible
and you have some words to google in the right direction!

----------------------------------------------------------------------
bz386 · 2023-12-21 21:46

Yes, just stream proxy ports 80 and 443 to your home NPM.

----------------------------------------------------------------------
schklom · 2023-12-22 16:40

As others pointed out, you need to forward the TCP traffic directly.

One problem: your home server see all requests as coming from your VPS
IP, you don't know the original client's IP.

Solution: PROXY Protocol. A packet containing the client IP needs to
be sent from the VPS' NPM, and read by your home's NPM.

----------------------------------------------------------------------
Fernomin · 2023-12-22 17:47

Ok, that's a problem. I'm gonna search for PROXY Protocol, but in the
meantime, how could I do this?

----------------------------------------------------------------------
schklom · 2023-12-22 18:49

You need to add some code on the VPS NPM to add that packet, and some
code on the home NPM to read that packet. Search "proxy protocol
nginx".

https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-
protocol/

Short summary at https://stackoverflow.com/questions/48211083/proxy-
protocol-and-ssl#48217826