this post was submitted on 28 Apr 2024
286 points (100.0% liked)

Selfhosted

45475 readers
760 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
286
Finally got my server to work properly. (Routing with custom local domain instead of ports) (programming.dev)
submitted 11 months ago* (last edited 11 months ago) by [email protected] to c/[email protected]
36 comments fedilink hide all child comments
 

I spent all day today trying to get the routing to work correctly between Tailscale, Nginx and Adguard.

Basically I wanted to be able to be able to use **http://immich.network ** to route to 192.168.1.2:9000

I wanted to share the steps I took so people don't have to go through what I did.

First a few things Local Server IP: 192.168.1.2

  1. I installed Ngnix and Adguard, in a Docker Containers, and gave Adguard IPs 3000, 3001 instead of 80 and 443 because Ngnix took it.
  2. I went to my router and made it use the DNS: 192.168.1.2
  3. I configured Proxy Host in Ngnix ..... immich.network => 192.168.1.2:9000
  4. I configured DNS rewrite in Adguard .... *.network => 192.168.1.2

At this point I was able to use http://immich.network finally. I installed Tailscale to be able to access when I'm outside but http://immich.network didn't work.

These helped me https://tailscale.com/kb/1019/subnets + https://tailscale.com/kb/1054/dns?q=global+nameserver

  1. I created a subnet..... tailscale up --advertise-routes=192.168.1.0/24
  2. I approved it on Tailscale login

At this point I was able to access home server using its local IP 192.168.1.2 but I couldn't get http://immich.network to work.

  1. I created a nameserver dns with split DNS but I used my local ip.. 192.168.1.2 => network

Finally everything is working.. I have a feeling that I'm doing it wrong but I'm too tired and it's finally working.

top 36 comments
sorted by: hot top controversial new old
[–] [email protected] 25 points 11 months ago (2 children)

Congrats on getting everything working - it looks great!

One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you're running your services behind Wireguard so there isn't too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you're more likely to run into issues with services not running on HTTPS.

The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won't know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).

[–] [email protected] 12 points 11 months ago* (last edited 11 months ago) (1 children)

Thank you for the* so much wanted advice, it's one of the reasons I actually posted this, to get advices on how to do things better.

I've been trying to do that for a specific service running (firefly) but I can't figure out what to do exactly, about the domain name, Is there a way to do that without one?

[–] [email protected] 0 points 11 months ago (1 children)

@Mir @rhymepurple Another place you can get free domain names is freedns.afraid.org - they have been around nearly forever and all you have to do is log into their site and go to any page once every six months (I guess so they know you are still alive) but they will email you a notice a couple weeks before that time is up. And at least for me they have always been very reliable.

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago)

Thank you, Might try them because duck dns domain is flagged by the browser for some reason and it's worth than no https warning

[–] [email protected] 1 points 11 months ago (1 children)

Is it possible to issue and update certificates for LAN services? About wildcard certificates, is it possible with Let's Encrypt? Thanks!

[–] [email protected] 2 points 11 months ago (1 children)

Everything I mentioned works for LAN services as long as you have a domain name. You shouldn't even need to point the domain name to any IP addresses to get it working. As long as you use a domain registrar that respects your privacy appropriately, you should be able to set things up with a good amount of privacy.

Yes, you can do wildcard certificates through Let's Encrypt. If you use one of the reverse proxies I mentioned, the reverse proxy will create the wildcard certificates and maintain them for you. However, you will likely need to use a DNS challenge. Doing so isn't necessarily difficult. You will likely need to generate an API key or something similar at the domain registrar or DNS service you're using. The process will likely vary depending on what DNS service/company you are using.

[–] [email protected] 1 points 11 months ago

I'm using Cloud flare, I'll look into it, thanks!

[–] [email protected] 12 points 11 months ago (2 children)

Congrats !!!!

Only one day? Lucky you ! It took me a whole week to get it to work with self-signed ssl certificate behind Traefik + docker + Adguardhome.

Adguard home rewrites and the correct certificate configuration solved most of my isues (android can be picky with self-signed root certificates). But I learned ALOT through the whole week, so I didn't waste my time :).

I hope you too learned alot :) but if I may, I would switch from AdguardHome to Pi-hole.

I know... AdguardHomes functionalities and UI are awesome and overpass Pi-Holes' but since I saw they add some strange trackers and very sketchy DNS request in their AdguardVPN android application, I don't trust them anymore !

[–] [email protected] 5 points 11 months ago (1 children)

I hope you too learned alot :) but if I may, I would switch from AdguardHome to Pi-hole.

+1

  • pi-hole rocks! :)
[–] [email protected] 3 points 11 months ago

It does !! I really like it and was easy peasy to make the switch. But I have to admit, AdguardHome's UI and DNS logs are way more detailed and I'm missing a few features I used with AGH. But nothing to critical that makes pi-hole unusable in my workflow !

But yeah, they do not have the same budget... That's a good tradeoff i'm willing to take for my privacy :).

And one day, when I get a job I will surely donate to them.

[–] [email protected] 1 points 11 months ago (1 children)

I just finished the SSL today, but have you gotten Syncthing GUI to work though? I can't seem to get it to work with the domain for some reason.

[–] [email protected] 1 points 11 months ago (2 children)

Hummm, I have a syncthing instance in a docker compose, so yeah I can access it through my ssl domain (https://syncthing.home.lab) but traefik takes care of everything.

Now if it's on your local machine you're trying to use your SSL certificate I don't know, I always access it through the local ip (127.0.0.1:8384).

If I had to guess or give it a try, I would point the IP to my dns through my host file on my machine. But that's just a wild guess :/

I think syncthing has a good documentation about it :)

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago)

You could use split DNS on your router (or wherever your DNS is) so that when you visit the syncthing address on your local network, you’re being directed to traefik.

I use a domain override in pfsense for syncthing.myhomelab.com which points to my reverse proxy’s local IP.

[–] [email protected] 1 points 11 months ago

I can access using the local ip but I can't access using the ssl domain, I can access it but I can't login for some reason. I can't figure out how to fix it

[–] [email protected] 5 points 11 months ago (1 children)

If you only access your local domain name inside your LAN and via VPN you can also use Caddy to have local SSL certificates https://caddyserver.com/docs/automatic-https#local-https Have not tried this myself yet but I like the idea of not getting any warnings in browser, and this is safe as long as the Caddy CA root certificate is safe.

[–] [email protected] 1 points 11 months ago

That looks great, I may switch to it from nginx, thank you

[–] [email protected] 4 points 11 months ago (1 children)

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!

[–] [email protected] 6 points 11 months ago (1 children)

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!

It's impressive that you was able to get it to help you correctly. It usually just spew things i need to fix that's why I didn't ask him, thank you for the tip.

Btw did you use a custom local domain name or did you use an actual domain ?

[–] [email protected] 1 points 11 months ago (1 children)

Thanks, it took some prompts but it worked in the end! I used a few subdomains of an actual domain I use for email...

[–] [email protected] 1 points 11 months ago (2 children)

I just finished the SSL today, but have you gotten Syncthing GUI to work though? I can't seem to get it to work with the domain for some reason.

[–] [email protected] 1 points 8 months ago (1 children)

Don't mean to necrobump. But I have Syncthing GUI working over a very similar setup. Let me know if you still need help setting it up.

[–] [email protected] 1 points 7 months ago

It took me a week suffering to get syncthing to work but it finally did. Thank you

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago) (1 children)

No, sorry I haven't tried it with Syncthing. Mainly using it for immich, seafile, a matrix server, some arr apps and a status monitor called dashdot. Would be useful for syncthing though, never thought of trying it - I'll give it a shot over the weekend and let you know how it goes!

[–] [email protected] 1 points 11 months ago

Thank you, looking forward to hearing from you

[–] [email protected] 3 points 11 months ago* (last edited 7 months ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
CA (SSL) Certificate Authority
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
IP Internet Protocol
SSL Secure Sockets Layer, for transparent encryption
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)
XMPP Extensible Messaging and Presence Protocol ('Jabber') for open instant messaging
nginx Popular HTTP server

10 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #719 for this sub, first seen 28th Apr 2024, 06:25] [FAQ] [Full list] [Contact] [Source code]

[–] [email protected] 3 points 11 months ago

I just click the "install" button on Yunohost 🤷

[–] [email protected] 3 points 11 months ago (1 children)

I also host all my stuff on 192.168.1.2. It's just my gaming pc with a bunch of services for piracy but it's good enough until I can build a proper server in the future.

[–] [email protected] 1 points 11 months ago

Mine isn't a proper server, it's just an old desktop

[–] [email protected] 2 points 11 months ago (1 children)

That’s a lovely desktop picture.

[–] [email protected] 1 points 11 months ago (1 children)

I'm running immich on a Debian machine at home. Anyone can point me to a detailed tutorial on how to achieve this including SSL and with no payments or subscriptions needed?

[–] [email protected] 4 points 11 months ago* (last edited 11 months ago) (1 children)

Just follow my steps to achieve this, and the ssl comes after. For SSL follow this https://www.youtube.com/watch?v=qlcVx-k-02E

[–] [email protected] 1 points 11 months ago

I've also used this and can also recommend it.

[–] [email protected] 1 points 11 months ago (1 children)

This exactly what I'm trying to do, get valid https certificates via a domain name on cloudflare. I have nginx proxy manager running and working to serve a couple of sites like home assistant. The problem I'm having is how do I get valid certificates for my internal services via npm but only be able to access them inside my lan not the internet?

[–] [email protected] 1 points 11 months ago (1 children)
[–] [email protected] 3 points 11 months ago

Here is an alternative Piped link(s):

https://www.piped.video/watch?v=qlcVx-k-02E

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.