Docker & Reverse Proxies (kbin.social)
from dewittlebook@lemdro.id to selfhosted@lemmy.world on 20 Jul 2023 14:41
https://lemdro.id/post/129279

Mooching off this other post

Primary question: What do people do for their reverse proxies (and associated ACME clients)? Do you have a single unified one? Or do you use separate proxies for each stack? Or some mess in between?

My use case question: For example, I have a (mess that is a) Nextcloud instance with a separate stack with nginx and ACME, a SearXng that wants to run caddy (but has shoved into the nginx).

But now I have a Lemmy docker that has a custom(?) nginx instance, should I just port it to my existing nginx or run them side by side?

threaded - newest

witten@lemmy.world on 21 Jul 2023 17:55 next collapse

Since nobody has responded to the ACME / Let’s Encrypt part of the question yet, I’ll chime in: I also use Traefik as a reverse proxy (and an ACME client), one unified instance per machine. (There are some exceptions, like for Mailu that requires its own nginx reverse proxy.) But for Let’s Encrypt, I recently switched from the TLS challenge to the DNS challenge. That required switching my DNS server from CoreDNS to PowerDNS, but thus far it seems totally worth it. Now I can easily get TLS certs for servers on my private network at home without opening them up to the internet for HTTP/TLS challenges.

keyez@lemmy.world on 21 Jul 2023 18:34 next collapse

I run the HAProxy and ACME packages available from PFSense on my firewall.

Certificate rotation is automatic, connected to my domain in cloudflare and I have 1 *:443 listener on a virtual IP with about a dozen backends pointing directly to each app.

AevumDecessus@lm.bittervets.org on 21 Jul 2023 21:23 collapse

I’m running LinuxServer’s swag container which contains nginx + ACME built into one container, and they have an extensive library of reverse proxy configs that are pre-configured for many docker services that you can just drop in, point your DNS entry at, and be done with.