this post was submitted on 27 Jan 2025
452 points (98.3% liked)

Selfhosted

61003 readers
474 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I'm securing Immich using OAuth.

I don't have very nerdy friends so not many people appreciate this.

you are viewing a single comment's thread
view the rest of the comments
[–] merthyr1831@lemmy.ml 2 points 1 year ago (1 children)

Yeah port forwarding just isnt the same. I pretty heavily rely on Nextcloud and Plex doing the port forwarding for me

[–] walden@sub.wetshaving.social 1 points 1 year ago (1 children)

Plex can sometimes get by without port forwarding by using UPnP or NAT-PMP, but I had to open a port to use Plex (before I started using Jellyfin and a reverse proxy).

Same with Nextcloud, you either have to open a port or use a reverse proxy. Reverse proxy is more secure. Good stuff!

Worth mentioning that either way you're opening up ports (you need to open 80 and 443 for the reverse proxy), but that's much better than opening a bunch of ports, one for each thing you're running.

The hardcore security minded people will always scream "use wireguard or whatever", which also works really well (even combined with a reverse proxy that's not exposed to the internet (80 and 443 not forwarded)). I do this for some of the stuff I run that I don't want exposed at all, like my password manager. To access my password manager while out and about, I need to connect to my wireguard thing (my router sets it up for me), and then my phone is effectively back inside my LAN, and I can access whatever I need to. Fortunately it's rare that I need to do this, because my password manager keeps a cached copy on my phone.

Sorry, getting long winded. You get the point!

[–] merthyr1831@lemmy.ml 2 points 1 year ago

Yeah both Nginx and plex handle making themselves public for me already. But I have a handful of other svcs that id like to move behind a reverse proxy too