Selfhosted

60887 readers

863 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Traefik for two domains, one internal and one external (lemmy.dbzer0.com)

submitted 2 years ago by clmbmb@lemmy.dbzer0.com to c/selfhosted@lemmy.world

2 comments fedilink hide all child comments

So, at the moment I'm using Nginx Proxy Manager, but lately I started seeing it moving slower and slower and even though I tried traefik some time ago, I didn't manage to make it work.

Anyway, I want to start using traefik again, but I want to use it like this:

I want to access all my services/containers in my LAN through http (port 80) on something like sub.mylan.home
I want to access some of my services over the internet through https (port 443) on sub.mydomain.com

I know this is possible, but I don't get the hang of the configuration. Somone care to share some tips?

you are viewing a single comment's thread
view the rest of the comments

[–] clmbmb@lemmy.dbzer0.com 0 points 2 years ago* (last edited 2 years ago)

Thanks for the great explanation.

So, currently, as I said, I'm using nginx proxy manager and do this:

reverse proxy to all my services inside the internal network on http: *arr stuff, rss reader, jellyfin and some other minor things. All of them use name.local.home notation. I'm using a local DNS for this, of course.
reverse proxy to just two services externally on https under wildcard certificates - both are non-standard names and the names are not related to the services themselves. For both these services I use Authelia with 2FA, so even if an attacker guesses the subdomain name, they'll have to bypass that. As far as I can see in my logs, there are no attempts to breach my services. This is what I want to replicate and I'm planning on testing it.

On the other hand, You gave me a good idea about using *.lab.domain.com getting resolved by the local DNS and the main *.domain.com by my public DNS. I'll give this a try too in the near future. Another plan for me is to start using Authentik, as I saw it's a bit better than Authelia in some areas, even though it may be overkill for a little project - I'll have to see.