Trying to find an alternative to Cloudflare Tunnel when hosting a web service to the internet reddit / selfhosted ---------------------------------------------------------------------- nathan12581 · 2023-12-21 20:00 I use Cloudflare tunnels for all my services and it works great. However my newest service I want to host is a private Docker Image Registry. Everything works apart from pushing images to the server as almost all Docker Images are above 100MB and Cloudflare does not allow anything above 100MB to be uploaded at a single time. As a result, within my GitHub Action to build and push code into an image onto my server, I get a '413 Request Entity Too Large error'. I'd like to host this service on my subdomain ideally without port forwarding a reverse proxy and I cannot use a VPN as obviously GitHub needs access. Any ideas? ---------------------------------------------------------------------- ericesev · 2023-12-21 20:24 If you allow the internet to reach the private Docker Image Registry via Cloudflare, why would you be concerned about allowing the same using a local port forward? ---------------------------------------------------------------------- ericesev · 2023-12-21 22:30 >I'd like to host this service on my subdomain ideally without port forwarding a reverse proxy Could you clarify this a bit? Why would it be ideal not to have a port forward? I'm mainly trying to understand how the attack surface will change if something other than Cloudflare is used for remote access. I'm looking at your current setup, and it appears you have made the private Docker image repository accessible to the internet via Cloudflare. Can anyone access it, or are there access controls in place? Is the domain name visible in your Github action code in the .github/ directory? ---------------------------------------------------------------------- nathan12581 · 2023-12-21 22:37 I use cloudflare tunnels. It’s basically a vpn which I can map a dns record to an internal IP address and port combo. This allows me to access all internal containers outside my network using my domain name. As a result, I have 0 ports open on my network. No one can access my network unless somehow they gain access to one of my tunnels. I tried this same setup on my ‘registry’ docker container running on my server in my internal network on address 192.168.0.71:5030. Using cloudflare tunnels I can map this up address to a subdomain https://registry.domain.com. I map this domain within my GitHub action, and everything works and it is able to log into this private repo. The only problem is when it comes to sending a POST request to this repo as it goes through cloudflare and the request is sending the docker image which is larger than 100MB in size, which is not allowed by Cloudflare and is therefore blocked with a 413 error code. I just want to see if there’s another way to get this functionality, without opening any ports and getting this 413 error code ---------------------------------------------------------------------- ericesev · 2023-12-21 22:39 >No one can access my network unless somehow they gain access to one of my tunnels. This is what I'm interested in What is currently preventing someone from accessing [https://registry.domain.com](https://registry.domain.com) and gaining access to one of your tunnels? Could the same solution that prevents access today with Cloudflare also be implemented in something like a local reverse proxy? ---------------------------------------------------------------------- nathan12581 · 2023-12-21 22:46 Cloudflare provides authentication methods to prevent unauthorised access such as SAML or SSO A local reverse proxy would mean I’d have to punch a hole in my firewall to allow access for the WAN to access my LAN. ---------------------------------------------------------------------- ericesev · 2023-12-21 22:47 Thank you. That's what I was looking for. So you have the authentication methods enabled for the Docker registry and that is what currently prevents access. You can setup the same in a reverse proxy. ---------------------------------------------------------------------- nathan12581 · 2023-12-21 22:49 I want to avoid using a reverse proxy as I don’t want to open any ports on my network ---------------------------------------------------------------------- bz386 · 2023-12-21 23:00 Run a reverse proxy on a VPS, then setup Wireguard tunnel from your home to the VPS (outbound). Reverse proxy can then connect to your image registry over the VPN. No ports need to be opened, as the Wireguard tunnel is outbound (home->VPS). ---------------------------------------------------------------------- ericesev · 2023-12-21 23:07 Sounds good. Thanks for running through the scenarios and explaining the background. This might work for you: https://www.jeffgeerling.com/blog/2022/ssh- and-http-raspberry-pi-behind-cg-nat Both Google & Oracle clouds offer free VMs with public IP addresses. ---------------------------------------------------------------------- nathan12581 · 2023-12-21 23:14 Thank you, good idea. I looked into that however with the free tier VPS the egress is only 1GB every month which definitely is not enough for a private registry. I’m fine with paying a bit for a VPS but at that point I may as well keep my current setup where Docker Hub charges me £6 a month to build and host all my private docker images so I’d ideally like to find a self-hosted/alternative version. At this point I think I either port forward and use a reverse proxy or buy a VPS. I cannot think of any other way ---------------------------------------------------------------------- nathan12581 · 2023-12-22 00:14 Hi, thanks for the detailed response. How much is your bandwidth? ---------------------------------------------------------------------- ericesev · 2023-12-22 00:30 I suppose it depends on how much over the free tier you go. I use their Standard Tier network for the VM. It includes 200GB free per month. After that, it is $0.11 per GiB. [https://cloud.google.com/network- tiers/pricing](https://cloud.google.com/network-tiers/pricing) I've only gone above the free tier once this last year. It cost me an extra \~$2. ---------------------------------------------------------------------- zfa · 2023-12-22 01:45 Two points: 1. Is it possible to use two different hostname in your process - an upload hostname going via your VPS, and a 'general access' hostname which is direct to your registry for downoads? 2. Oracle give you 10TB egress traffic on their free OCI offerings. ---------------------------------------------------------------------- datallboy · 2023-12-22 02:11 I've used Racknerd as my VPS provider for this exact purpose. They often have deals and only cost $17/yr. Great service, I've never had any major issues with them. Black Friday deals are still active here: https://www.racknerd.com/BlackFriday/ ---------------------------------------------------------------------- nathan12581 · 2023-12-22 08:51 >OCI Jesus very cheap, I managed to spend £16 for a 2500GB egress 2GB RAM server because why not, even if I don't use it for this it's always nice to have a secondary off-site server for that cheap. When you say you haven't had any *major* issues, what issues have you had then? ---------------------------------------------------------------------- schklom · 2023-12-22 16:32 Note that if you use HAProxy or Nginx on the VPS, you can even avoid terminating TLS there. I have it set up as a TCP passthrough, so that my only my home server terminates TLS. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-22 16:45 Have you considered using the GitHub Container Registry? It's free up to 500MB of storage and has unlimited data transfer if it's done with GitHub Actions.