Selfhosted

Congrats on getting everything working - it looks great!

One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you're running your services behind Wireguard so there isn't too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you're more likely to run into issues with services not running on HTTPS.

The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won't know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).

If you only access your local domain name inside your LAN and via VPN you can also use Caddy to have local SSL certificates https://caddyserver.com/docs/automatic-https#local-https Have not tried this myself yet but I like the idea of not getting any warnings in browser, and this is safe as long as the Caddy CA root certificate is safe.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

10 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #719 for this sub, first seen 28th Apr 2024, 06:25] [FAQ] [Full list] [Contact] [Source code]

Hello again.

I've gone through your steps outlined in this post now for LAN. I've made my own network name .crypt and added *.crypt to Adguard and pointed it at the IP address of Nginx.

I've then gone and mapped my local services in Nginx. So radarr.crypt sonarr.crypt plex.crypt etc and mapped them to ports.

Now what I enjoyed was that I had to map Adguard to forward to Nginx, but in Nginx I can use the IP address of anything on my network, not just on the host.

So it's map Adguard in DNS rewrites to Nginx IP, then map the IP:ports in Proxy Hosts in Nginx.

Now when I use my Tailscale exit node (that I have from Home Assistant) I can use those addresses outside the house.

I have noticed it only works for the .crypt domains, and not .local despite being set up as well. I guess because .local is a special address it is harder to map to Tailscale.

Anyway, it's working for me after following what you've done, I just did less in Tailscale because of the exit node

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!