Selfhosted

54613 readers

717 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

Hosting multiple services with one IP address. (piefed.social)

submitted 3 days ago by a_person@piefed.social to c/selfhosted@lemmy.world

27 comments fedilink hide all child comments

Hello people, I recently rented a vps server from OVH and I want to start hosting my own piefed instance and a couple other services. I am running debian 13 with docker, and I have nginx proxy manager almost set up. I want to set up subdomains so when I do social.my.domain it will go to my piefed instance, but how do I tell the machine to send piefed traffic to this subdomain and joplin traffic (for example) to another domain? Can I use nginx/docker natively for that or do I have to install another program. Thanks for the advice.

you are viewing a single comment's thread
view the rest of the comments

[–] a_person@piefed.social 1 points 3 days ago (3 children)

What service would you recommenced for firewall. The firewall I use on my laptop is ufw, should I use that on the vps or is their a different service that works better?

[–] kumi@feddit.online 3 points 2 days ago* (last edited 2 days ago)

Firewalld

sudo apt-get install firewalld  
systemctl enable --now firewalld # ssh on port 22 opened but otherwise most things blocked by default  
firewall-cmd --get-active-zones  
firewall-cmd --info-zone=public  
firewall-cmd --zone=public --add-port=1234/tcp  
firewall-cmd --runtime-to-permanent

There are some decent guides online. Also take a look in /etc/firewalld/firewalld.conf and see if you want to change anything. Pay attention to the part about Docker.

You need to know about zones, ports, and interfaces for the basics. Services are optional. Policies are more advanced.

I suggest it for your laptop, too.

[–] deadcade@lemmy.deadca.de 3 points 3 days ago (1 children)

UFW works well, and is easy to configure. UFW is a great option if you don't need the flexibility (and insane complexity) that manually managing iptables rules offers,

[–] kumi@feddit.online 2 points 2 days ago* (last edited 2 days ago)

Please don't recommend UFW.

One main problem with UFW, besides being based on legacy iptables (instead of the modern nftables which is easier to learn and manage), is the config format. Keeping track of your changes over track is hard, and even with tools like ansible it easily becomes a mess where things can fall out of sync with what you expect.

Unless you need iptables for some legacy system or have a weird fetish for it, nobody needs to learn iptables today. On modern Linux systems, iptables isn't a kernel module anymore but a CLI shim that actually interacts with the nft backend.

It is also full of footguns. Misconfigured UFW resulting in getting pwned is very common. For example, with default settings, Docker will bypass UFW completely for incoming traffic.

I strongly recommend firewalld, or rawdogging nftables, instead of ufw.

There used to be limitations with firewalld but policies maturing and replacing the deprecated "direct" rules together with other general improvements has made it a good default choice by now.

[–] K3can@lemmy.radio 1 points 2 days ago

ufw is just a fancy frontend for iptables, but hasn't been updated for nftables, yet.

Firewalld is an option that supports both, and if you happen to be running cockpit as well, the cockpit-firewall plugin provides a simple GUI for the whole thing.