this post was submitted on 07 Nov 2024
34 points (94.7% liked)

Selfhosted

40651 readers
236 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud
Loki
CannaVet
devve
HybridSarcasm
[email protected]
34
Looking for feedback on simplifying self hosting (lemmy.blahaj.zone)
submitted 1 month ago by [email protected] to c/selfhosted
29 comments fedilink hide all child comments
 

Hi all,

I started self hosting nextcloud only. Now I have a domain name and I would like to selfhost more services and websites on subdomains without having to open up more ports on my router.

  1. Is it reasonable to use a reverse proxy server to avoid opening up more ports?
  2. Can I use a reverse proxy manager that simplifies SSL certs, etc?
  3. Can I put the HTTP/HTTPS services behind a reverse proxy, behind a free cloudflare DNS proxy to mask my IP address?
  4. And put other non-http services on the real IP address.
  5. Will all of this be more prone to failure and slow compared to forwarding 443 and 80 directly to my nextcloud server?

The other services I would like to eventually host and have accessible externally are

  • Jitsi
  • Mastodon instance (hoping to make some bots that mirror other social media to bring them into Mastodon)
  • blog website
  • Veilid maybe
  • OpenVPN over TCP on 443 (to get through restrictive firewalls on e.g. school wifi networks that don't whitelist domains)
  • Synology to Synology backup.

I'm hoping to use Yunohost on a RPI to simplify hosting a lot of these things.

Here's my plan where I'm looking for feedback. Am I missing any steps? Are my assumptions correct?

  1. Install reverse proxy on yunohost; configure cloudflare DNS and freedns.afraid.org to point towards the reverse DNS server.
  2. Configure the reverse DNS to redirect various subdomains to
  • the raspberry pi running nextcloud
  • the other raspberry pi running openvpn
  • the Synology running the backup service
  • services running on the yunohost raspberry pi

I have not been able to find good documentation about how to configure the yunohost reverse proxy, or how to deal with HTTP headers, or have correct certificates on all the subdomains as well as the reverse proxy. Looking for advice on how to move forward and or simply this setup.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 11 points 1 month ago (1 children)

Yes this is possible. I have a few hosted items with subdomains and I have it set up as follows:

All subdomains point to the same IP. Router port forwards all 80/8080 traffic to server. I use Caddy in Docker to forward the requests based on the subdomain to the appropriate docker container hosting the actual service.

This makes spinning up something new simple. You get a docker container of New Thing going, edit the CaddyFile to point to it too, set up new subdomain in cloudflare. No new open ports needed.

Hope this helps!

[–] [email protected] 2 points 1 month ago (1 children)

Thanks, this is definitely the way I would like to go!

  1. Can Caddy forward requests to other machines on the LAN?
  2. Have you ever had to mess with HTTP headers?
  3. Do the docker containers have to get certificates from let's encrypt, or is caddy the only part that needs to manage a wildcard certificate?
[–] [email protected] 2 points 1 month ago
  1. I think it can, you just need to give it the machine's name or local IP and the port.
  2. Nope!
  3. Caddy handles all certs from LE and renews them for you too. Nothing you need to do on your own.