Heya, I just wanted to post here before doing something that puts my stuff out on the internet for anyone to see 😅
So I have a basic, still in-configuration homelab network going on. It’s Modem --> OPNsense router --> Ubiquiti switch --> Openwrt AP. DNS and DHCP (via Dnsmasq) are working right now, each VLAN (Home Devices, IoT, and Guest) can access the internet. But I’m still tinkering and doing firewall stuff, so sometimes I reactivate the ISP router and switch back to that until I have everything perfect enough to not bother my family
I have a Proxmox homelab that I’ve been running services like Jellyfin and Immich in a Docker Debian VM for a few months now, but I was getting tired of typing out IPs and remembering port nums, especially after bouncing between my router and the original ISP router whenever I’m having network issues. So I wanted to finally map those IPs to human-friendly domains. So like, 192.168.10.247:8096 --> jellyfin.example.com, 192.168.10.247:2283 --> immich.example.com, etc.
I quickly learned that DNS services like Unbound and Dnsmasq do what they say on the tin, DNS only, so I can’t do a override to map ports to a domain, as they can only do IPs. My research led me to reverse proxies, and people said Caddy was simple on OPNsense, so I installed that and followed the official guide/documentation. But then I ran into the issue of needing the domain to be externally resolveable. Which then led me to realizing I need to use some sort of CA.
I know Let’s Encrypt does it for free, plus the guide mentions them as a default so why not? Except I still need an actual external domain so… Cloudflare? DuckDNS? Someone else? I’m so lost…
The biggest concern of mine right now is, if I set up a reverse proxy, does that mean my services are externally accessible? I was using Tailscale so I could avoid that, especially since I know services like Jellyfin have had serious vulnerabilities, and everyone says it’s a good rule of thumb to just not expose services. But how do I map ip + port #s to a domain on OPNsense?
If you don’t mind the warning “Woah, I don’t trust this website”, you don’t need to buy any domains. Just use local certificates.
Sample caddyfile that I use
#------------- general options { local_certs } #------------- services service.server.lan { reverse_proxy <INTERNAL SERVER IP>:<INTERNAL SERVER PORT> }However, you need to have a DNS entry which points
*.server.lanto the correct server. You can now visithttps://service.server.lan/which should point correctly.Best of luck!
I’m not too worried about lack of tls/https for my websites rn, I just want to get working concept lol.
But thanks for the caddyfile, although I’m not sure I can use it since OPNsense seems to like to auto generate the config based on the settings in the UI.
I’ve narrowed down my issue a little more with the help of frongt@lemmy.zip, and I’ve established that:
Pinging immich.homelab.internal gets a response from the correct IP. When typing http://immich.homelab.internal/ or http://immich.homelab.internal:2283/ in browser I get an ERR_NAME_NOT_RESOLVED page.
If I curl http://immich.homelab.internal/, I get:
curl: (7) Failed to connect to immich.homelab.internal port 80 after 6 ms: Could not connect to serverIf I curl http://immich.homelab.internal:2283/, I do get the html of the site at least.
Through some digging through other people’s forum posts, I made sure to turn off https redirects (auto_https disable_redirects).
I definitely know that it’s failing because Caddy isn’t redirecting my services from port 80 to their upstream port (2283, 8006, etc.), but I don’t know why it won’t redirect, even when looking at logs…
I’ve been thinking about this lately as i was intending to build a 3 node cluster with proxmox. I still need to understand what happens when one node fails and how tbe othes handle exposing services. If the ip changes, bookmarks wont work. So i thought an inter al domain would be the sol ution?