Please check my setup.
from M600@lemmy.world to selfhosted@lemmy.world on 17 Oct 02:43
https://lemmy.world/post/20934375

I have a small homelab that is not open to the internet. I am considering the following setup. Please let me know if there are any glaring issues or if I am over complicating things.

I am not sure if I need the raspberry pi. I like the cloud as the reverse proxy as I do not have a static IP. I would just get a cheap vps from hetzner or something like that.

#selfhosted

threaded - newest

just_another_person@lemmy.world on 17 Oct 03:23 next collapse

Well if you don’t have a static IP, then your reverse proxy is going to break when your lease changes anyway. Not sure what your intended goal is for access and to what, but this is certainly a more costly and complex setup than needed for whatever it is.

avidamoeba@lemmy.ca on 17 Oct 04:57 collapse

The VPN should keep access to the homelab even when the external IP changes. Assuming the VPN connects from the homelab to the cloud. The reverse proxy would use the VPN local IPs to connect to services.

jbloggs777@discuss.tchncs.de on 17 Oct 04:09 next collapse

How will running a CA limit access? eg. Do you want to do client side cert validation? That sounds like an overcomplication. Also not ideal to run a CA (have signing keys) on the proxy server.

harsh3466@lemmy.ml on 17 Oct 04:17 next collapse

You can deal with the non-static IP by using duckdns.org

grehund@lemmy.world on 17 Oct 05:01 next collapse

Have you considered other approaches, such as Tailscale or Cloudflare Tunnels? I think you’re complicating things.

M600@lemmy.world on 18 Oct 01:44 collapse

I’m not very familiar with either option. I’ll look into both of them. I think cloudflare tunnels have bandwidth limits though and I’ll be hosting jellyfin, so it might eat through the bandwidth quickly.

jlh@lemmy.jlh.name on 17 Oct 06:41 next collapse

it might be better to skip the cloud server and use cloudflare for dynamic dns. The standardized way to restrict access to websites is with client certificates or a basic authentication (user/pass) proxy. That would help avoid issues with internet traffic passing through the VPN accidentally.

M600@lemmy.world on 18 Oct 01:43 collapse

Thanks! Last time I checked cloudflare had bandwidth limits. My primary uses for it may use a decent amount of bandwidth as I’ll be hosting jellyfin as well as my backup solution.

mhzawadi@lemmy.horwood.cloud on 17 Oct 07:01 next collapse

That sounds like a great plan, and a great way to learn how this sort of thing works.

mike_wooskey@lemmy.thewooskeys.com on 17 Oct 10:39 next collapse

I have a similar setup. I use d.rymcg.tech (a configuration manager for Docker, as well as a collection of open source web services and config templates) and have Traefik (reverse proxy) on a Digital Ocean dropet connected to a VM in my home lab through wireguard. This framework allows me to put authentication and authoriation in front of any apps/services I’m hosting (HTTP basic auth, oauth2, mTLS). This setup allows me to control what is allowed access from outside of my home, without opening any ports.

mike_wooskey@lemmy.thewooskeys.com on 17 Oct 10:42 collapse

I should add the d.rymcg.tech includes step-ca if you want to host your own CA server, but I agree with @joe@discuss.tchnic.de : it’s not necessary for securely hosting services, and ir can be dangerous I’d not done carefully.

bezoar@lemm.ee on 17 Oct 13:21 collapse

If you use tailscale you can omit the raspberry pi and tunnel directly from the reverse proxy to each server (could do this with wireguard but requires a little more setup). Also you can configure your cloud server as an exit node so that all traffic from your device go through it, sort of as a vpn service. It’s not as anonymous as a paid VPN service but at least you bypass the ISP or local wifi provider if you’re out and about.