I want to expose my services publicly on my own domain name, how would you guys do that?
I have seen people using Cloudflare, but I don’t want to use Cloudflare out of principle. I have also seen stuff on caddy and frp that I’ve done some rough researching.
What do you guys do?
You must log in or # to comment.
For those of us behind double NAT (CGNAT) forwarding ports is not an option as we do not control forwarding on the second gateway. This will limit you to any of the solutions that include a device outside your network with a public port that tunnels traffic into your server.
Netbird has a reverseproxy that’s super easy to setup to point to one of your netbird nodes.
If you have a UniFi gateway, you can enable region based firewall on your port forward ip. This then blocks most of the world (incoming) as a first step. Then like others suggest, a reverse proxy. I use Caddy built with the Maxmind geolocation plugin, and I also run fail2ban on my exposed service.
I figure if you don’t need most of the world accessing your services, it is best to exclude them
Just a reverse proxy, I was using Caddy, moved to Pangolin because it’s neat.
I have a Flint 2 with a vanilla install of openWRT, that hosts wireguard. I have 2 static IPs, because I thought hey running my own mail and smtp services cannot be that hard (turns out yes it is hard and not worth the time to deal). Any who I have Wireguard running on my firewall and Caddy running on one of my pi’s, it gets TLS from lets encrypt.
I have a couple of domains that Caddy uses to point things out to the world or my LAN/vLANs/VPNs. Very few of the things go out to the whole world, but if I wanted to share say a Jellyfin server with someone I could wip up a VPN that only allows Jellyfin through and points DNS to my piholes. Why do I mention my ad blocker? I mention pihole because that what hosts the A records to my domain names that Caddy can serve up, I do not remember why I set it up like this, I would have to look through my notes but pihole points “service”.domain1or2.xyz to caddy which than points to the right service.
Edit: went and looked A records are hosted on pihole for my LAN/vLANs/VPNs to prevent things needing to go out and come back just to tell devices where on my LAN services are.
Netbird reverse proxy: https://docs.netbird.io/manage/reverse-proxy
It’s like Tailscale, but Open Source. You can self-host the components, if you want. I just use the cloud offering. I have a domain name that resolves to my server. There’s different ways you can do auth. I just hard coded an allow list of IPs. Otherwise, devices in my Netbird network can use the private IP.
A reverse proxy is the traditional safe route. Use a web server like Apache, nginx or caddy, and setup to reverse proxy all your services through port 443, and use let’s encrypt and certbot to generate and manage TLS certificates.
I host around 15 public facing web services this way using nginx.
Just be aware, this is very public facing so server security and hardening is important. Things like strong passwords, disabled root, use ssh keys instead of passwords, setup fail2ban, setup crowdsec etc.
The more modern safer way is not to truly expose to full public and use things like tailscale or cloudflare tunnels. But this relies on 3rd party servers and I’m not a fan of that, but it does bring benefits.
A lot of folk decry Cloudflare as a terrible corp (and their AI push now involves the login page shunted to the side while 70% of the screen is a relatively blank section with some sentence about using their AI), but what is the non-3rd party alternative? Does one rely on sharing the IP instead? It is impossible to have public (non-family) traffic without a Cloudflare/Google DNS resolver right?
Being on a standard ISP I cannot use a higher-level rDNS.
im on a basic uk isp, with no fancy router, just the isp provided one. i have a fully exposed web server, im even hosting a lemmy server. Thats my domain, radiantfig.fyi, totally public, has been for nearly 2 years now. From that you can get my servers IP address. My IP is dynamic, changes roughly every 6 weeks. I have a ddns script that updates my server IP address to my domain name provider automatically. I have certbot running updating my TLS certs with lets encrypt, and if a cert dies or fails or is compromised, my server will refuse to serve. Everything is behind an nginx reverse proxy through port 443. I also have an ssh port open on a random port. Have fail2ban setup fairly aggressively to prevent brute force attacks, and have crowdsec which also kind of does the same but in a slightly different way. the internet requires ip addresses. to protect your ip address you have to give somebody elses. that somebody is a 3rd party you have no control or say on the decisions they make. i must have over 20 individual services that are public facing. 3 fully federated, lemmy, forgejo and matrix. Im as secure as any other website. nothing is unhackable, no matter how far down the rabbit hole you go. its all just layers of difficulty.
The important thing is dont listen to random internet people about security. dont listen to me. dont listen to anybody who tells you they know best. do your own research, understand the options, the risks, the compromises. only then do you put anything up. but if you are going to anxious or worried about your server and data, no amount of security guarantees you safety, so be warned.
I got off CloudFlare by using Pangolin. Ideal for my use-case, I didn’t use any of CF’s advanced features, so Pangolin is the ideal replacement for me.
Publicly serves everything from static sites to forgejo (+the ssh endpoint for git pushes).
I rent a cheap VPS with iptables routing ports through a wireguard tunnel to a peer on the local network that acts as a firewall and reverse proxy, this gives you a static IP with a local control plane and no ddns.
Similar here. Just a Digital Ocean droplet running Pangolin. Functions basically the same as the cloudflare tunnel it replaced.
Can expose the service directly if needed, or from behind a login page.
Same but nftables and also crowdsec.
Also I had some trouble with the wireguard tunnel dropping lots of packets, which resulted in my services not loading 50% of the time. I did a lot of suggestions at the same time so I’m not sure which one fixed it but here is a list in case anybody has similar troubles:
- lowering MTU
- routing ipv6 through the tunnel as well
- rewriting nftables rule order (will update after work, notes are at home)
What’s a cheap vps you recommend?
I hop around a lot. I’ve used Akamai (fka linode), Vultr, DigitalOcean, AWS EC2, and GCP Compute Engine. I wouldn’t recommend the last 2 anymore because fuck big tech. A lot of people will mention Oracle’s free tier, but I don’t trust anyone that looks like Larry Ellison to own a machine with a direct connection into my local network.
I resonate with you as well, so what kind of set up do you use now?
I use a cheap racknerd vps via low end box. $12/yr.
That’s crazy cheap price. Does it really have enough bandwidth to stream jellyfin?
Yes. (Depending on load) I run a server with 10 users, probably 2-3 active at any given time. Works fine.
Look into Oracle cloud’s Always Free tier of cloud instances. I have a few of those and they’re decent for free.
Linode has a $5/month option.
@TheRedSpade @pineapplelover Linode got acquired by Akamai and their service (or at least, *my* VPS) has really gone downhill over the past few years.
Oracle has a free tier where I run my Wireguard.
I use traefik combined with crowdsec, there is a plugin for that. There is some pretty good tutorial (in german) on goneuland.de
Why do you want to expose them? This might limit the solutions.
The way I do this is in 2 different ways:
-
Tailscale, my server connects to tailscale so all I have to do is connect to it from my phone and I can access things remotely easily. This is the best for most things, but has the downside that others can’t access it as easily
-
I have a VPS (two actually at the moment as I’m switching providers from Vultr to IONOS) that also connects to tailscale so it can access my home server through it, then using Caddy I expose the services on a subdomain of the VPS. This is what I do for things that others might want to access, or things I don’t want to have to connect to tailscale to access.
If you’re going down the second route do consider that you will need to:
- Add something like fail2ban or crowdsec to the VPS as attacks will happen.
- Same reason you should add a dedicated authentication on front of most things. While I don’t expect the auth on services to be weak, it might be more vulnerable than a dedicated authentication service. You should look into Authelia, Authentik, or similar to put on front of your services so any attacker would first have to pass that to even get to your services.
-
Authentication & single sign-on service
Plugged into Reverse proxy, routing to each service by name
With a wild card cert so there are no name leaks.
Make your urls unexpected. If your domain is example.com, don’t put your jellyfin server at jellyfin.example.com. Instead, use watch.example.com or telly.example.com. Anything that’s memorable to you about what the service is without using a specific brand name.
With a wildcard dns record to point all names to your IP, and a wildcard certificate that works for all names loaded on your load balancer, it becomes hard for a hacker to know what name to use to get the load balancer to send them to the service they want to hack.
If you then use a sso tool like traefik’s ForwardAuth middleware, you won’t even get to the service until you’ve first authenticated.
If you use TLS like you should, your domains will be on the internet in the certificate transparency log. Yes, you should use a wildcard cert if you want this security by obscurity, but it’s still security by obscurity.
Or run an internal CA, if you’re the only one accessing the services.
Of course. The goal here is to not advertise. Make it hard for the bots to find you. With these steps, they can try your IP, but there’s nothing directly on your IP.
You still need proper security. Authentication is a good start, and it has the extra effect of adding an extra layer to prevent the bots from going further if they get lucky and guess a host name.
Reverse proxy is what you need. I would post instructions here but honestly they wouldnt be that good. Just search it up and follow along.
Make it publicly available to the world or just for you (and people you know)?
Publicly to the world. For example, I wanted to self host temporary file sharing and temporary link shortener to the world. Stuff like jellyfin I would have that public but only specific users would have the credentials to log in.
I can’t answer your question as I haven’t taken that step yet, everything is still confined to my LAN.
Here’s a similar thread from last month that had a lot of replies. Hopefully will be some useful info there for you. Good luck!
