this post was submitted on 10 Sep 2024
15 points (89.5% liked)

Selfhosted

39937 readers
336 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
 

I’m running opnsense on proxmox with some lxc containers and docker hosts.

I’ve never done internal DNS routing, just a simple DMZ with Cloudflare proxies and static entries for some external services. I want to simplify things and stop using my IPs from memory internally.

For example, I have the ports on my docker hosts memorized for the services I use, only a couple mapped hosts in opnsense, but nothing centralized.

What is the best way to handle internal DNS name resolution for both docker and the lxc containers? Internal CA certs? External unroutable (security)?

Any tips and setups appreciated.

you are viewing a single comment's thread
view the rest of the comments
[–] CallMeButtLove@lemmy.world 2 points 1 month ago

I have a similar setup except I use pfSense as my router and pihole for DNS, but I'm sure you can get the same results with your setup. I'm running HAProxy for my reverse proxy and configs for each of my docker containers so any traffic on 443 or 80 gets sent to the container IP on whatever unique port it uses. I then have DNS entries for each URL I want to access the container by, with all of those entries just pointing to HAProxy. Works like a charm.

I have HAProxy running on the pihole itself but there's no reason you couldn't just run that in it's own container. pfSense also let's you install an HAProxy package to handle it on the router itself. I don't know if opensense supports packages like that though.

You can even get fancy and do SSL offloading to access everything over HTTPS.