Comment on Building a slow web
ohshit604@sh.itjust.works 2 weeks agoWhile i appreciate the detailed response here i did make another comment letting OP know i’m in a similiar situation as them, i use Docker Engine & Docker Compose for my self-hosting needs on machine running Proxmox with a Debian 12 VM. My reverse proxy is traefik and i am able to receive SSL certificates on port :80/:443 (also have Fail2Ban setup) however, i can’t for the life of me figure out how to expose my containers to the internet.
On my iPhone over LTE/5G trying my domain leads to an “NSURLErrorDomain” and my research of this error doesn’t give me much clarity.
This is a snippet of my docker-compose.yml
```
services:
homepage:
image: ghcr.io/gethomepage/homepage
hostname: homepage
container_name: homepage
networks:
- main
environment:
PUID: 0 # optional, your user id
PGID: 0 # optional, your group id
HOMEPAGE_ALLOWED_HOSTS: my.domain,*
ports:
- ‘127.0.0.1:3000:3000’
volumes:
- ./config/homepage:/app/config # Make sure your local config directory exists
- /var/run/docker.sock:/var/run/docker.sock #:ro # optional, for docker integrations
- /home/user/Pictures:/app/public/icons
restart: unless-stopped
labels:
- “traefik.enable=true”
- “traefik.http.routers.homepage.rule=Host(my.domain)”
- “traefik.http.routers.homepage.entrypoints=https”
- “traefik.http.routers.homepage.tls=true”
- “traefik.http.services.homepage.loadbalancer.server.port=3000”
- “traefik.http.routers.homepage.middlewares=fail2ban@file”
# - “traefik.http.routers.homepage.tls.certresolver=cloudflare”
#- “traefik.http.services.homepage.loadbalancer.server.port=3000”
#- “traefik.http.middlewares.homepage.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.0/24, 172.18.0.0/16, 208.118.140.130”
#- “traefik.http.middlewares.homepage.ipwhitelist.ipstrategy.depth=2”
traefik:
image: traefik:v3.2
container_name: traefik
hostname: traefik
restart: unless-stopped
security_opt:
- no-new-privileges:true
networks:
- main
ports:
# Listen on port 80, default for HTTP, necessary to redirect to HTTPS
- target: 80
published: 55262
mode: host
# Listen on port 443, default for HTTPS
- target: 443
published: 57442
mode: host
environment:
CF_DNS_API_TOKEN_FILE: /run/secrets/cf_api_token # note using _FILE for docker secrets
# CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN} # if using .env
TRAEFIK_DASHBOARD_CREDENTIALS: ${TRAEFIK_DASHBOARD_CREDENTIALS}
secrets:
- cf_api_token
env_file: .env # use .env
volumes:
- /etc/localtime:/etc/localtime:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./config/traefik/traefik.yml:/traefik.yml:ro
- ./config/traefik/acme.json:/acme.json
#- ./config/traefik/config.yml:/config.yml:ro
- ./config/traefik/custom-yml:/custom
# - ./config/traefik/homebridge.yml:/homebridge.yml:ro
labels:
- “traefik.enable=true”
- “traefik.http.routers.traefik.entrypoints=http”
- “traefik.http.routers.traefik.rule=Host(traefik.halstead.host)”
#- “traefik.http.middlewares.traefik-ipallowlist.ipallowlist.sourcerange=127.0.0.1/32, 192.168.1.0/24, 208.118.140.130, 172.18.0.0/16”
#- “traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}”
- “traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https”
- “traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https”
- “traefik.http.routers.traefik.middlewares=traefik-https-redirect”
- “traefik.http.routers.traefik-secure.entrypoints=https”
- “traefik.http.routers.traefik-secure.rule=Host(my.domain)”
#- “traefik.http.routers.traefik-secure.middlewares=traefik-auth”
- “traefik.http.routers.traefik-secure.tls=true”
- “traefik.http.routers.traefik-secure.tls.certresolver=cloudflare”
- “traefik.http.routers.traefik-secure.tls.domains[0].main=halstead.host”
- “traefik.http.routers.traefik-secure.tls.domains[0].sans=*.halstead.host”
- “traefik.http.routers.traefik-secure.service=api@internal”
- “traefik.http.routers.traefik.middlewares=fail2ban@file”
Image of my port-forwarding rules (note; the 3000 internal/external port was me “testing”) Image
interdimensionalmeme@lemmy.ml 2 weeks ago
Hi,
The internal port will also be the same as the external port 80 and 443. If the router is running in bridge mode, that would mean that your dhcp, dns and nat is happening on the upstream router. That means you will have to go to the upstream router to setup the port forwarding.
Also depending on how it works internally with the VPN. It might try to port forward the ports on the VPN’s ip address Which none of the VPN I tried allowed to port forward port 80 and 443
With a linux or openwrt router this could be as easy as the following
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.199:80 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.199:443
But the problem with store bought router is that every one of them has a different way of doing the things so it gets confusing really fast.
All of this confusion about port forwarding was engineered to discourage ordinary people from using their internet to host their own files and instead because cloud-dependant techno-serfs.
Another way, would be to go on the forum low end talk and obtain a VPS, and host your apache server there. That would work, but you would be back to renting someone else’s computer (aka cloud bull) but it’s still better than paying squarespace about it.
Keep at it, you’ll figure it out, it’s actually very easy once you know all the complicated bits, I do it all the time.
ohshit604@sh.itjust.works 2 weeks ago
Once again, thank you for your insight! It truly does help a lot.
Today I learned the VPN routing is the cause of my issues, I opted to expose my homelab to WAN and tried to connect over LTE/5G and was surprised to see it actually resolve!
Unfortunately this now throws a wrench in my plans In regard to security so now I’m debating on getting another piece of hardware and labelling one as “front end” and the other as “back end” so that the “back end” doesn’t share the same public IP as the front end.
This has ignited a spark to rework my homelab!
interdimensionalmeme@lemmy.ml 2 weeks ago
Realistically, you don’t need security, NAT alone is enough since the packets have nowhere to go without port forwarding.
But IF you really want to build front end security here is my plan.
ISP bridge -> WAN port of openwrt capable router with DSA supported switch (that is almost all of them) Set all ports of the switch to VLAN mirroring mode bridge WAN and LAN sides Fail2Ban IP block list in the bridge
LAN PORT 1 toward -> OpenWRT running inside Proxmox LXC (NAT lives here) -> top of rack switch LAN PORT 2 toward -> Snort IDS LAN PORT 3 toward -> combined honeypot and traffic analyzer
Port 2&3 detect malicious internet hosts and add them to the block list
(and then multiple other openwrt LXCs running many many VPN ports as alternative gateways, I switch LAN host’s internet address by changing their default gateway)
I run no internal VLAN, all one LAN because convenience is more important than security in my case.