Selfhosted

39435 readers

7 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Traefik for two domains, one internal and one external (lemmy.dbzer0.com)

submitted 7 months ago by [email protected] to c/[email protected]

14 comments fedilink hide all child comments

So, at the moment I'm using Nginx Proxy Manager, but lately I started seeing it moving slower and slower and even though I tried traefik some time ago, I didn't manage to make it work.

Anyway, I want to start using traefik again, but I want to use it like this:

I want to access all my services/containers in my LAN through http (port 80) on something like sub.mylan.home
I want to access some of my services over the internet through https (port 443) on sub.mydomain.com

I know this is possible, but I don't get the hang of the configuration. Somone care to share some tips?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 7 months ago* (last edited 7 months ago) (1 children)

Thanks for the great explanation.

So, currently, as I said, I'm using nginx proxy manager and do this:

reverse proxy to all my services inside the internal network on http: *arr stuff, rss reader, jellyfin and some other minor things. All of them use name.local.home notation. I'm using a local DNS for this, of course.
reverse proxy to just two services externally on https under wildcard certificates - both are non-standard names and the names are not related to the services themselves. For both these services I use Authelia with 2FA, so even if an attacker guesses the subdomain name, they'll have to bypass that. As far as I can see in my logs, there are no attempts to breach my services. This is what I want to replicate and I'm planning on testing it.

On the other hand, You gave me a good idea about using *.lab.domain.com getting resolved by the local DNS and the main *.domain.com by my public DNS. I'll give this a try too in the near future. Another plan for me is to start using Authentik, as I saw it's a bit better than Authelia in some areas, even though it may be overkill for a little project - I'll have to see.

[–] [email protected] 2 points 7 months ago

Since your reverse proxy is nginx you can also look at vouch-proxy. It's smaller and more light-weight than either Authelia or Authentik, but of course it doesn't have all their features, basically just login with an external service.