antoniomika

8 ms·

31.
by antoniomika 4y ago
Now that's one I never knew about. I'll have to take a look, should be easy enough to update prose to handle that though. edit: Updated prose to handle this
32.
by antoniomika 4y ago
Yep you’re right! My example was done with a CNAME on a subdomain (replaced the domain for privacy), and most providers provide flattening so I didn’t even think about it! I’ll update the copy to mention that.
33.
by antoniomika 4y ago
Thanks for Caddy :) I use certmagic for a different project, but saw on_demand_tls with the ask feature and knew it was a good fit!
34.
by antoniomika 4y ago
Awesome, glad it’s useful! If there’s anything that could be better or weird issues, please do let me know!
35.
by antoniomika 4y ago
There are many (always) free alternatives out there which you can find in a fairly comprehensive list at awesome-tunneling [0]. I'd caution anyone as there's always risk with downloading a no sources available binary as well, but
36.
by antoniomika 4y ago
You need to bind to at least the wireguard interface/address in order for this to work. The service reverse proxies over the tunnel, and your kernel won’t be looking to handle those connections unless you’re listening on the correct tu
37.
by antoniomika 4y ago
Sorry, meant internal network access related to the computer you set the tunnel up on. I usually refer to local network when speaking about the LAN :) For reference though, all that is needed are some poorly written POSTROUTING rules and ip
38.
by antoniomika 4y ago
It's important to note that if you're not self hosting this, you're giving unlimited internal network access to this service (unless you properly firewall of course). It's not specific to the single port/address tha
39.
by antoniomika 4y ago
At a previous role I made something similar [0] in Golang, but used SSH certificates to manage authentication. This had the added benefit of logging the user connection information in each server’s auth.log based on the generated private ke
40.
by antoniomika 5y ago
I used to provide a public instance of sish (a similar app) [0] and can say abuse is most definitely a problem. People were using sish for command-and-control servers, especially because it used only SSH for establishing tunnels. It was spe
41.
by antoniomika 5y ago
I made sish [0] so this could be done for myself and friends automatically. It’s a binary written in Go that implements the SSH protocol and allows TCP forwards, HTTP(S) w/ built in requesting of certs from LE (including for custom dom
42.
by antoniomika 5y ago
Setup https://github.com/antoniomika/sish and get away from manually setting anything up. Uses SSH, supports HTTP(S)/TCP/Websockets/TLS via SNI and let’s users choose their own tunnel names. Can run it o
43.
by antoniomika 5y ago
You can use tmux to achieve the same using `set synchronize-panes on`. I've been using a little script that allows using this trick to open up multiple ssh sessions for years [1]. Can do cool things like: HOSTS="$(echo runner{0..3
44.
by antoniomika 5y ago
If you are all about self hosting, here’s my method (disclosure, I made this tool): 1. Run https://github.com/antoniomika/sish on any free tier instance or fly 2. On server, ssh -R anythinghere:22:localhost:22 sishinst
45.
by antoniomika 5y ago
I made a little change that allowed setting the day's puzzle based on puzzle ID number via a query parameter so you could play previous day's puzzles. Here's the gist with relevant code block if anyone's curious: https:
46.
Show HN: Sish – Tunnels to localhost using SSH(github.com)
7 points by antoniomika 5y ago|0 comments
47.
by antoniomika 5y ago
I made a tool that does exactly this [0] wrapped up in a tiny little server! Main reason I did that was because I found myself creating "compose apps", where it was some self-hosted thing that I spent a lot of time managing withou
48.
by antoniomika 6y ago
It's free! You only get into having to pay for it once you hit a device threshold (I have a bunch of devices and haven't hit the limits). You can also run a controller yourself, therefore it's free even for super large networ
49.
by antoniomika 6y ago
Heh, I appreciate that! And that's the exact reason I included the other options in my comment. There's a lot of good competition, I'm happy there's more :)
50.
by antoniomika 6y ago
Reading into it more than I was going for :) I firewall all traffic over port 80, so HTTP validation won't work. I also don't actually share the server with anyone that has access to it, it's moreso so I can provide them a si
51.
by antoniomika 6y ago
Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use
52.
by antoniomika 6y ago
Shameless self plug below. Main issue I have with this is the requirement for some binary to establish the shell connection, where you can get by just fine with a bidirectional TCP stream. I’ve been doing something similar to this for a whi
53.
by antoniomika 6y ago
These are all extremely valid points! I guess I should've clarified how things work a bit (which I am currently in the process of documenting how it works and how to deploy it). Ingress management is done with the very useful nginx-pro
54.
by antoniomika 6y ago
I actually developed a system similar to this but used docker compose as an alternative to Procfiles and nginx+le to handle dynamic virtual hosting. It's actually a golang app that will automatically provision git repos with the necess
55.
by antoniomika 7y ago
Shameless self plug, but I wrote something that does the exact same thing as this ( https://github.com/antoniomika/sish ) but has some added benefits: 1. Don't require installing a local client, use something that i
56.
by antoniomika 7y ago
Another shameless plug, but I wrote something that pretty much does the exact same thing: https://github.com/antoniomika/sish . Main difference was I didn't look forward to having to run a proprietary binary to ach
57.
by antoniomika 7y ago
It sounds like what you're looking for is to just forward the TCP port without having nginx do the SSL termination for you. You can achieve that with vanilla SSH though, just by forwarding port 443. If you want the virtual hosting, you
58.
by antoniomika 7y ago
Nice, that's something that's useful too. I think this is especially important as it pertains to home services/exposed things. I just wanted to build my own tools around it mainly for the virtual hosting/websockets suppo
59.
by antoniomika 7y ago
Yep, that's exactly it! Because it supports TCP forwarding, that sounds like it should work!
60.
by antoniomika 7y ago
Shameless self plug That is the exact reason I made sish (ssi.sh). It uses ssh to do local port forwarding and can be self hosted with authentication. It's open source[0] and the only thing you need locally is SSH (which is included by

More ›