this post was submitted on 28 Apr 2024
1 points (100.0% liked)

Selfhosted

39167 readers
378 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
1
Finally got my server to work properly. (Routing with custom local domain instead of ports) (programming.dev)
submitted 4 months ago* (last edited 4 months ago) by Mir@programming.dev to c/selfhosted@lemmy.world
14 comments fedilink hide all child comments
 

I spent all day today trying to get the routing to work correctly between Tailscale, Nginx and Adguard.

Basically I wanted to be able to be able to use **http://immich.network ** to route to 192.168.1.2:9000

I wanted to share the steps I took so people don't have to go through what I did.

First a few things Local Server IP: 192.168.1.2

  1. I installed Ngnix and Adguard, in a Docker Containers, and gave Adguard IPs 3000, 3001 instead of 80 and 443 because Ngnix took it.
  2. I went to my router and made it use the DNS: 192.168.1.2
  3. I configured Proxy Host in Ngnix ..... immich.network => 192.168.1.2:9000
  4. I configured DNS rewrite in Adguard .... *.network => 192.168.1.2

At this point I was able to use http://immich.network finally. I installed Tailscale to be able to access when I'm outside but http://immich.network didn't work.

These helped me https://tailscale.com/kb/1019/subnets + https://tailscale.com/kb/1054/dns?q=global+nameserver

  1. I created a subnet..... tailscale up --advertise-routes=192.168.1.0/24
  2. I approved it on Tailscale login

At this point I was able to access home server using its local IP 192.168.1.2 but I couldn't get http://immich.network to work.

  1. I created a nameserver dns with split DNS but I used my local ip.. 192.168.1.2 => network

Finally everything is working.. I have a feeling that I'm doing it wrong but I'm too tired and it's finally working.

top 14 comments
sorted by: hot top controversial new old
[–] Decronym@lemmy.decronym.xyz 1 points 4 months ago* (last edited 1 month ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
CA (SSL) Certificate Authority
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
IP Internet Protocol
SSL Secure Sockets Layer, for transparent encryption
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)
XMPP Extensible Messaging and Presence Protocol ('Jabber') for open instant messaging
nginx Popular HTTP server

10 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #719 for this sub, first seen 28th Apr 2024, 06:25] [FAQ] [Full list] [Contact] [Source code]

[–] rhymepurple@lemmy.ml 1 points 4 months ago (1 children)

Congrats on getting everything working - it looks great!

One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you're running your services behind Wireguard so there isn't too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you're more likely to run into issues with services not running on HTTPS.

The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won't know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).

[–] Mir@programming.dev 1 points 4 months ago* (last edited 4 months ago) (1 children)

Thank you for the* so much wanted advice, it's one of the reasons I actually posted this, to get advices on how to do things better.

I've been trying to do that for a specific service running (firefly) but I can't figure out what to do exactly, about the domain name, Is there a way to do that without one?

[–] Lifebandit666@feddit.uk 0 points 4 months ago (1 children)

You can get pretty cheap domain names if you google around. I managed to get mine for £35 for a number of years (3 I think, I was high when I set it up) and got a .com name out of that.

You could look into DuckDNS. I know I used them many moons ago for Home Assistant but can't quite remember what the capabilities were, I just remember it was free and a bit rubbish. But as a stopgap it works.

Try that for a bit until you have a few quid spare, then get yourself a domain name paid for a while.

[–] toffi@feddit.de 1 points 4 months ago (1 children)

I used dynv6.com to get a free subdomain e. g. [name].dynv6.net and then a swag docker to do the reverse proxy subfolder->dockerport matching. Trafic in my home network is http and the swag ports are the only one exposed to the public. When I find the time I'll do in depth setup guide including the ipv6 setup problems.

[–] Mir@programming.dev 0 points 4 months ago (1 children)

ok I just did that and my problem is that I wanted to access my services with a custom domain like .homes

Now I need to access them for x.y.duckdns.org

[–] Lifebandit666@feddit.uk -1 points 4 months ago* (last edited 4 months ago)

Have a look into Heimdall or Homarr. Much easier, don't need to worry about addresses at all. Single set up and add Tailscale exit node for external access.

I've been fiddling with it again today and (using Homarr) my only services that don't work when I access through Tailscale are the ones I use names for (are.local, server.local, etc) and I can access them when I use the IP:port so when I get home I'll just change them to IP:port on Homarr and I'll be all good

[–] lemmyreader@lemmy.ml 1 points 4 months ago

If you only access your local domain name inside your LAN and via VPN you can also use Caddy to have local SSL certificates https://caddyserver.com/docs/automatic-https#local-https Have not tried this myself yet but I like the idea of not getting any warnings in browser, and this is safe as long as the Caddy CA root certificate is safe.

[–] dutchkimble@lemy.lol -1 points 4 months ago (1 children)

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!

[–] Mir@programming.dev 1 points 4 months ago (1 children)

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!

It's impressive that you was able to get it to help you correctly. It usually just spew things i need to fix that's why I didn't ask him, thank you for the tip.

Btw did you use a custom local domain name or did you use an actual domain ?

[–] dutchkimble@lemy.lol 0 points 4 months ago (1 children)

Thanks, it took some prompts but it worked in the end! I used a few subdomains of an actual domain I use for email...

[–] Mir@programming.dev 0 points 4 months ago (1 children)

I just finished the SSL today, but have you gotten Syncthing GUI to work though? I can't seem to get it to work with the domain for some reason.

[–] SexualPolytope@lemmy.sdf.org 1 points 1 month ago (1 children)

Don't mean to necrobump. But I have Syncthing GUI working over a very similar setup. Let me know if you still need help setting it up.

[–] Mir@programming.dev 1 points 1 month ago

It took me a week suffering to get syncthing to work but it finally did. Thank you