Hi all,
I started self hosting nextcloud only. Now I have a domain name and I would like to selfhost more services and websites on subdomains without having to open up more ports on my router.
- Is it reasonable to use a reverse proxy server to avoid opening up more ports?
- Can I use a reverse proxy manager that simplifies SSL certs, etc?
- Can I put the HTTP/HTTPS services behind a reverse proxy, behind a free cloudflare DNS proxy to mask my IP address?
- And put other non-http services on the real IP address.
- Will all of this be more prone to failure and slow compared to forwarding 443 and 80 directly to my nextcloud server?
The other services I would like to eventually host and have accessible externally are
- Jitsi
- Mastodon instance (hoping to make some bots that mirror other social media to bring them into Mastodon)
- blog website
- Veilid maybe
- OpenVPN over TCP on 443 (to get through restrictive firewalls on e.g. school wifi networks that don’t whitelist domains)
- Synology to Synology backup.
I’m hoping to use Yunohost on a RPI to simplify hosting a lot of these things.
Here’s my plan where I’m looking for feedback. Am I missing any steps? Are my assumptions correct?
- Install reverse proxy on yunohost; configure cloudflare DNS and freedns.afraid.org to point towards the reverse DNS server.
- Configure the reverse DNS to redirect various subdomains to
- the raspberry pi running nextcloud
- the other raspberry pi running openvpn
- the Synology running the backup service
- services running on the yunohost raspberry pi
I have not been able to find good documentation about how to configure the yunohost reverse proxy, or how to deal with HTTP headers, or have correct certificates on all the subdomains as well as the reverse proxy. Looking for advice on how to move forward and or simply this setup.
Yeah, what @[email protected] suggested is definitely the easiest thing and super practical - I got family members on my tailnet for this purpose. I am however now also looking into some kind of tunneled, reverse proxied and authenticated way to expose a few of my services to other friends where I don’t want to have to put them on tailscale or potentially expose them to more than needed via that route.
I haven’t started yet, but I am updating my network set up soon to install a dedicated OPNsense router as the edge for my network. From there, the plan is to have a cloudflare tunnel that accesses some of these services via a caddy reverse proxy, with Authelia for authentication. That’s the part I have studied enough to feel confident I can do. I am a little weaker on the networking aspects of this, which is where I need to study some more - like isolating those services that are exposed in my network, while still giving them access to some other needed resources within it, etc.
Tailscale has the Funnel feature, which can funnel traffic into your Tailscale net for you.
Ooooh that looks interesting. I haven’t messed around much with tailscale since I set it up a few years back and hadn’t noticed this. Funny, I was just the other day wondering if they might have something like that, but didn’t look it up. Thanks!