Self Hosted - Self-hosting your services.

11419 readers

1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules

No harassment
crossposts from c/Open Source & c/docker & related may be allowed, depending on context
Video Promoting is allowed if is within the topic.
No spamming.
Stay friendly.
Follow the lemmy.ml instance rules.
Tag your post. (Read under)

Important

Beginning of January 1st 2024 this rule WILL be enforced. Posts that are not tagged will be warned and if not fixed within 24h then removed!

Lemmy doesn't have tags yet, so mark it with [Question], [Help], [Project], [Other], [Promoting] or other you may think is appropriate.

Cross-posting

[email protected] is allowed!
[email protected] is allowed!
[email protected] is allowed!
[email protected] is allowed if topic has to do with selfhosting.
[email protected] is allowed!

If you see a rule-breaker please DM the mods!

founded 3 years ago

MODERATORS

[email protected]

[Help] How can I use a VPS to protect my home's ip? (mander.xyz)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

18 comments fedilink hide all child comments

I have a nextcloud instance being hosted from my home network. The URL associated with it points directly at my home's IP. I don't want to host the instance on a VPS because disk space is expensive. So, instead, I want to point the URL at the VPS, and then somehow route the connection to my home's nextcloud instance without leaking my home's ip.

How might I go about doing this? Can this be achieved with nginx?

EDIT: Actually, not leaking my home's IP is not essential. It is acceptable if it is possible to determine the IP with some effort. What I really want is to be able to host multiple websites with my single home IP without those websites being obviously connected, and to avoid automatic bots constantly looking for vulnerabilities in my home network.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 1 year ago (1 children)

You can set up nginx to do reverse proxy to your home IP, and then limit the traffic on your home IP to the VPS IP.

You can also setup a wireguard VPN between VPS and your home machine, so the traffic between VPS and your hoke machine is encrypted.

For DNS you just point to the VPS, and manage connections there, and on home network allow only VPS IP to connect. Then manage your security on the VPS.

[–] [email protected] 2 points 1 year ago (1 children)

Thanks a lot! This is kind of the configuration that I have converged to, with nginx and WireGuard. The last thing I need to set up correctly is for the SSL handshake to occur between the client and my home server, and not between the client and the internet-facing VPS, such that the information remains encrypted and unreadable to the VPS. The two strategies that I have seen can do this is SNI routing with nginx or to use stunnel. I still have not been able to set up either!

[–] [email protected] 1 points 1 year ago (1 children)

In that case, you're better off just using the VPS machine as port forwarding port 443 to your home machine's wireguard IP address and handle the SSL/TLS termination on the home machine.

This way all HTTPS traffic will be passing trough the VPS and being decrypted on your home machine, and encrypted data will be sent from your home machine back to the client. Anyone gets in or sniffs traffic will see encrypted traffic. Plus it's already sent over encrypted VPN network. To really see what's happening, they need to get into the machine and technically could use the wireguard private keys to decrypt the traffic, but they will still see the encrypted HTTPS traffic. So you're good, technically.

[–] [email protected] 2 points 1 year ago (1 children)

In that case, you’re better off just using the VPS machine as port forwarding port 443 to your home machine’s wireguard IP address and handle the SSL/TLS termination on the home machine.

This is what I would like to do! I was trying to handle the SSL termination 'automatically' by simply forwarding the connections to 443 of my machine's wireguard IP using nginx, but I did not manage to get it to work. That's when I found that I need to use something like 'stunnel' to handle the SSL termination. But I think that you may be suggesting an even simpler method of using port-forwarding instead of the reverse proxy. I am not sure how to achieve that, I will look into it using these terms.

[–] [email protected] 3 points 1 year ago

You did kinda push me in that direction to try the same thing. Once I have bit more time, I'll try it out and send an example. Unless you beat me to it 😂