Comment on After 1.5 years of learning selfhosting, this is where I'm at
dataprolet@lemmy.dbzer0.com 9 months ago
What is the proxy in front of crowdsec for?
Comment on After 1.5 years of learning selfhosting, this is where I'm at
dataprolet@lemmy.dbzer0.com 9 months ago
What is the proxy in front of crowdsec for?
7Sea_Sailor@lemmy.dbzer0.com 9 months ago
If you’re referring to the “LabProxy VPS”: So that I don’t have to point a public domain that I (plan to) use more and more in online spaces to my personal IP address, allowing anyone and everyone to pinpoint my location. Also, I really don’t want to mess with the intricacies of DynDNS. This solution is safer and more reliable than DynDNS and open ports on my router thats not at all equipped to fence of cyberspace attacks.
If you’re referring to the caddy reverse proxy on the LabProxy VPS: I’m pointing domains that I want to funnel into my homelab at the external IP of the proxy VPS. The caddy server on that VPS reads these requests and reverse-proxies them onto the caddy-port from the homelab, using the hostname of my homelab inside my tailscale network. That’s how I make use of the tunnel. This also allows me to send the ban decisions from bruteforce attacks on apps at the homelab to the Proxy VPS, which then denies all incoming requests from that source IP before they ever hit my homelab. Clean and Safe!
atzanteol@sh.itjust.works 9 months ago
“pinpoint” is a bit hyperbolic. Country, state and maybe city can be pretty good, at least in the US.
It’s fine if that’s important to you to hide, but entirely unnecessary for most people.
7Sea_Sailor@lemmy.dbzer0.com 9 months ago
Maybe. But I’ve read some crazy stories on the web. Some nutcases go very far to ruin an online strangers day. I want to be able to share links to my infrastructure (think photos or download links), without having to worry that the underlying IP will be abused by someone who doesn’t like me for whatever reason. Maybe that’s just me, but it makes me sleep more sound at night.
dataprolet@lemmy.dbzer0.com 9 months ago
Thanks, but I meant the HAProxy in your homelab.
7Sea_Sailor@lemmy.dbzer0.com 9 months ago
Oh, that! That app proxies the docker socket connections over a TCP channel. Which provides a more granular control over what app gets what access to specific functionalities of the docker socket. Directly mounting the socket into an app technically grants full root access to the host system in case of a breach, so this is the advised way to do it.