5 ms·

Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier ne

Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask? You can forward TLS connections down to an edge device without needing to have the TLS certs on the cloud server. This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine. This also has the added benefit of allowing me to forward full wildcard subdomains down to the edge device without having to create a new config entry for it each time. Now, I use (shameless self plug) sish [2] to set this up. It uses SSH, so I get the added benefit of all of the above, but I don't really worry about using an internal network for ingress communication. It's also very easy to share the service with friends/coworkers so they can get the added benefit of it too. I also make use of the loadbalancing feature for test pi clusters when doing distributed testing which is a breeze now. There are a bunch of these popping up now which I'm happy to see (serveo, remotemoe, even ngrok has a SSH gateway!) so there's a ton of competition here. I definitely recommend checking at least one of them out since they're pretty easy to setup and can be used in a variety of ways! [1] http://nginx.org/en/docs/stream/ngx_stream_core_module.html http://nginx.org/en/docs/stream/ngx_stream_core_module.html [2] https://github.com/antoniomika/sish https://github.com/antoniomika/sish

forty 6y ago
> This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine If you share a server with your domain name pointing on it, can't just other people on the server use HTTP validation to get a valid certificate for your domain, then do mitm?
- antoniomika 6y ago
  Reading into it more than I was going for :) I firewall all traffic over port 80, so HTTP validation won't work. I also don't actually share the server with anyone that has access to it, it's moreso so I can provide them a similar setup to what I have with some semblance of security even if they don't have the expertise to do so.
varispeed 6y ago
I've been using ZT for years. It's been absolutely amazing. It had some growing pains and often the network interface would hang, sometimes so badly that a full node restart would have been required, but these days it is super stable even under high load (talking about 1x-1xx TB per month)
- anderspitman 6y ago
  Is it free at those usage levels? If not, how much?
  - antoniomika 6y ago
    It's free! You only get into having to pay for it once you hit a device threshold (I have a bunch of devices and haven't hit the limits). You can also run a controller yourself, therefore it's free even for super large networks.
anderspitman 6y ago
I do want to mention that of all the 30+ options I've researched, sish looks like one of the best. Even though in the end I decided to implement my own[0]. [0]: https://xkcd.com/927/ https://xkcd.com/927/
- antoniomika 6y ago
  Heh, I appreciate that! And that's the exact reason I included the other options in my comment. There's a lot of good competition, I'm happy there's more :)

forty 6y ago

> This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine If you share a server with your domain name pointing on it, can't just other people on the server use HTTP validation to get a valid certificate for your domain, then do mitm?

antoniomika 6y ago
Reading into it more than I was going for :) I firewall all traffic over port 80, so HTTP validation won't work. I also don't actually share the server with anyone that has access to it, it's moreso so I can provide them a similar setup to what I have with some semblance of security even if they don't have the expertise to do so.

varispeed 6y ago

I've been using ZT for years. It's been absolutely amazing. It had some growing pains and often the network interface would hang, sometimes so badly that a full node restart would have been required, but these days it is super stable even under high load (talking about 1x-1xx TB per month)

anderspitman 6y ago
Is it free at those usage levels? If not, how much?
- antoniomika 6y ago
  It's free! You only get into having to pay for it once you hit a device threshold (I have a bunch of devices and haven't hit the limits). You can also run a controller yourself, therefore it's free even for super large networks.

anderspitman 6y ago

I do want to mention that of all the 30+ options I've researched, sish looks like one of the best. Even though in the end I decided to implement my own[0]. [0]: https://xkcd.com/927/ https://xkcd.com/927/

antoniomika 6y ago
Heh, I appreciate that! And that's the exact reason I included the other options in my comment. There's a lot of good competition, I'm happy there's more :)