5 ms·

nginx-proxy becomes almost a must have if you have multiple services and prefer remembering domain names instead of port numbers https://github.com/nginx-proxy/

by TomK32 2y ago

nginx-proxy becomes almost a must have if you have multiple services and prefer remembering domain names instead of port numbers https://github.com/nginx-proxy/nginx-proxy https://github.com/nginx-proxy/nginx-proxy

vlovich123 2y ago
Why not just have a main page on a single domain that has links to all the services? That way you only need to remember one domain name.
- Vaslo 2y ago
  You could do that as long as you protected that page from prying eyes.
  - KomoD 2y ago
    Yeah? That would apply to NGINX Proxy too...
- 63stack 2y ago
  Easier to wire up services to each other with domain names, serviceA.domain.tld is obvious, domain.tld:1234 is not
  - Kerbonut 2y ago
    There is also path based, e.g. domain.tld/serviceA, domain.tld/serviceB
    - cess11 2y ago
      Won't work for many services, either they do some websocket stuff or they make assumptions about the URL or whatever. Subdomains are the way to go.
      - Kerbonut 2y ago
        True enough, the app needs to support it.
- aftbit 2y ago
  Another reason to have a domain for each is to get TLS for each service in a standard way.
- TomK32 2y ago
  Of course, a service map comes handy, just another simple way of getting it done. What I meant with the proxy was using e.g. jellyfin.example.com and portainer.example.com instead of the ports. Not to mention that two apps might have the same default port. For those with a multi-machine setup, like running the easy stuff on a 1L machine and having backupservice at multiple locations or the LLMs on a big setup that might even use WakeOnLan the proxy will keep you from having to remember the IPs as well.
- ParetoOptimal 2y ago
  Many use browser history so type a few characters and hit enter rather than navigating to an index page, locating a link, and clicking it.
windexh8er 2y ago
Most people will use nginx-proxy [0] or Traefik [1] for front ending home labs with LetsEncrypt certs... Beyond that people will protect them with things like Tailscale [2], Cloudflare Tunnels [3] or even just mTLS [4] for protected access. Home labbing today has a lot of amazing software and it's hard to keep up! And as for dashboarding [5] on top of all this there are a lot of options. Also, for those new to the game who want an easier way to approach take a look at Tipi [6]. [0] https://nginxproxymanager.com/ https://nginxproxymanager.com/ [1] https://traefik.io/traefik/ https://traefik.io/traefik/ [2] https://tailscale.com https://tailscale.com [3] https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/ https://developers.cloudflare.com/cloudflare-one/connections... [4] https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi... [5] https://selfh.st/apps/?tag=Dashboard https://selfh.st/apps/?tag=Dashboard [6] https://runtipi.io/ https://runtipi.io/
- domh 2y ago
  I use Tailscale for a bunch of self hosted services on a raspberry pi in my house. Port numbers and TLS certs are my current main problems with this setup but it's not annoyed me quite enough yet to do anything about it.
  - nine_k 2y ago
    BTW why bother with TLS over already-encrypted and authenticated Wireguard tunnels? Is this just so that browsers won't complain, or do you have a more complex threat model?
    - domh 2y ago
      Sorry for late reply, exactly that yeah - so the browser doesn't complain. I'm not worried about the security of HTTP over wireguard or anything like that. And domain names are easier to remember than ports so... http://raspberrypi:8123/ http://raspberrypi:8123/ vs homeassistant.raspberrypi.local (or something)
  - windexh8er 2y ago
rpcope1 2y ago
That doesn't sound like a bad idea, but it's just as easy to create a bunch of LXC containers with their own MAC address and IP for me (and thus own hostname per service).
- Havoc 2y ago
  People do traefik etc for the ssl mostly. A lot of selfhoated things log you out quite fast over http

by TomK32 2y ago

vlovich123 2y ago

Why not just have a main page on a single domain that has links to all the services? That way you only need to remember one domain name.

Vaslo 2y ago
You could do that as long as you protected that page from prying eyes.
- KomoD 2y ago
  Yeah? That would apply to NGINX Proxy too...
63stack 2y ago
Easier to wire up services to each other with domain names, serviceA.domain.tld is obvious, domain.tld:1234 is not
- Kerbonut 2y ago
  There is also path based, e.g. domain.tld/serviceA, domain.tld/serviceB
  - cess11 2y ago
    Won't work for many services, either they do some websocket stuff or they make assumptions about the URL or whatever. Subdomains are the way to go.
    - Kerbonut 2y ago
      True enough, the app needs to support it.
aftbit 2y ago
Another reason to have a domain for each is to get TLS for each service in a standard way.
TomK32 2y ago
Of course, a service map comes handy, just another simple way of getting it done. What I meant with the proxy was using e.g. jellyfin.example.com and portainer.example.com instead of the ports. Not to mention that two apps might have the same default port. For those with a multi-machine setup, like running the easy stuff on a 1L machine and having backupservice at multiple locations or the LLMs on a big setup that might even use WakeOnLan the proxy will keep you from having to remember the IPs as well.
ParetoOptimal 2y ago
Many use browser history so type a few characters and hit enter rather than navigating to an index page, locating a link, and clicking it.

windexh8er 2y ago

Most people will use nginx-proxy [0] or Traefik [1] for front ending home labs with LetsEncrypt certs... Beyond that people will protect them with things like Tailscale [2], Cloudflare Tunnels [3] or even just mTLS [4] for protected access. Home labbing today has a lot of amazing software and it's hard to keep up! And as for dashboarding [5] on top of all this there are a lot of options. Also, for those new to the game who want an easier way to approach take a look at Tipi [6]. [0] https://nginxproxymanager.com/ https://nginxproxymanager.com/ [1] https://traefik.io/traefik/ https://traefik.io/traefik/ [2] https://tailscale.com https://tailscale.com [3] https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/ https://developers.cloudflare.com/cloudflare-one/connections... [4] https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi... [5] https://selfh.st/apps/?tag=Dashboard https://selfh.st/apps/?tag=Dashboard [6] https://runtipi.io/ https://runtipi.io/

domh 2y ago
I use Tailscale for a bunch of self hosted services on a raspberry pi in my house. Port numbers and TLS certs are my current main problems with this setup but it's not annoyed me quite enough yet to do anything about it.
- nine_k 2y ago
  BTW why bother with TLS over already-encrypted and authenticated Wireguard tunnels? Is this just so that browsers won't complain, or do you have a more complex threat model?
  - domh 2y ago
    Sorry for late reply, exactly that yeah - so the browser doesn't complain. I'm not worried about the security of HTTP over wireguard or anything like that. And domain names are easier to remember than ports so... http://raspberrypi:8123/ http://raspberrypi:8123/ vs homeassistant.raspberrypi.local (or something)
- windexh8er 2y ago

rpcope1 2y ago

That doesn't sound like a bad idea, but it's just as easy to create a bunch of LXC containers with their own MAC address and IP for me (and thus own hostname per service).

Havoc 2y ago
People do traefik etc for the ssl mostly. A lot of selfhoated things log you out quite fast over http