Disclaimer: I am running personal website on cloud, since it feels iffy to expose local IP to internet. Sorry for posting this on selfhosting, I don't know anywhere else to ask.
I am planning to multiplex forgejo, nextcloud and other services on port 80 using caddy.
This is not working, and I am having issues diagnosing which side is preventing access.
One thing I know: it's not DNS, since dig <my domain> works well.
I would like some pointers for what to do in this circumstances. Thanks in advance!
What I have looked into:
- curling localhost from the server works well, caddy returns a simple result.
curl <my domain>times out, currently trying to inspect packets - it seems like server receives TCP without HTTP.curl <my domain>:3000displays forgejo page, as forgejo exposes at 3000 in its container, which podman routes to host 3000.
EDIT: my Caddyfile is as follows.
:80 {
respond "Hello World!"
}
http://<my domain> {
respond "This should respond"
}
http://<my domain 2> {
reverse_proxy localhost:3000
}
EDIT2: I just tested with netcat webserver, it responds fine. This narrows it down to caddy itself!
EDIT3: (Partially) solved, it was firewall routing issue. I should have checked ufw logs. Turns out, podman needs to be allowed to route stuffs. Now to figure out how to reverse-proxy properly.
EDIT4: Solved, created my own internal network between containers, besides the usual one connecting to the internet. Set up reverse-proxy to correctly connect to the container. My only concern left is if I made firewall way permissive in the process. Current settings:
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
3000/tcp ALLOW Anywhere
222/tcp ALLOW Anywhere
8080/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
8443/tcp ALLOW Anywhere
Anywhere on podman1 ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
3000/tcp (v6) ALLOW Anywhere (v6)
222/tcp (v6) ALLOW Anywhere (v6)
8080/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
8443/tcp (v6) ALLOW Anywhere (v6)
Anywhere (v6) on podman1 ALLOW Anywhere (v6)
Anywhere on podman1 ALLOW FWD Anywhere on ens3
Anywhere on podman0 ALLOW FWD Anywhere on ens3
Anywhere (v6) on podman1 ALLOW FWD Anywhere (v6) on ens3
Anywhere (v6) on podman0 ALLOW FWD Anywhere (v6) on ens3
podman0 is the default podman network, and podman1 is the internal network.
Thanks for looking into it. I am not publishing any ports other than Caddy, and forgejo's ssh port that I think cannot be forwarded. You mean I should block port 3000 from my VPS as well, right?
I am having trouble reading
ss -nltpoutput, could you explain what each entry means?Also I am concerned that allowing access to podman1 private network interface could be too permissive. How do you think?
The only two important columns are "Local address: port" and "process". The later is what process is listening whille the former is the interface that process is listening on and the port.
So you see that I don't have any process listening on any port other than 80 and 443 iin the host and the regular ones.
That said, you containers will still listen on the ports you want but only on a virtual network interface.
Basically you only need to publish ports 80 amd 443 on the container or pod you have your reverse proxy on. Other containers need to only be attached to the same network as you already did.