I have been self-hosting for a while now with Traefik. It works, but I’d like to give Nginx Proxy Manager a try, it seems easier to manage stuff not in docker.
In my experience, all the 3 big ones work just fine. Caddy, Traefik, Nginx. I use Nginx.
Which reverse proxy do you use/recommend?
Submitted 4 days ago by lena@gregtech.eu to selfhosted@lemmy.world
Comments
hendrik@palaver.p3x.de 4 days ago
starshipwinepineapple@programming.dev 4 days ago
I have had the same experience. Have used all three at some point but mostly use nginx for new servers
AllHailTheSheep@sh.itjust.works 3 days ago
Caddy all the way!
mbirth@lemmy.ml 4 days ago
it seems easier to manage stuff not in docker
Read into Traefik’s dynamic configuration. Adding something outside of Docker is as easy as adding a new config file in the dynamic configuration folder. E.g.
jellyfin.yml:http: routers: jellyfin: rule: Host(`jellyfin.example.org`) entrypoints: websecure tls: certResolver: le service: jellyfin services: jellyfin: loadbalancer: servers: - url: "http://192.168.1.5:8096/"
The moment you save that file it will be active and working in Traefik.
pax0707@lemmy.world 4 days ago
Nginx from day one. Well documented, it works. If something doesn’t work chances are you are a quick googlefu away from the solution.
ikidd@lemmy.world 4 days ago
Stick with Traefik if you’ve figured it out. It’s much more powerful than NPM in my opinion. If you insist on using NPM, you might want to try NPMPlus, it has more bells and whistles and is more actively maintained.
lena@gregtech.eu 4 days ago
Yeah I’ll stick with Traefik, I know how to use it
Tenkard@lemmy.ml 4 days ago
Caddy. I started with npm but I realized it was hiding enough stuff that I wasn’t learning anything about managing networking. Caddy is super easy and has lot of sane defaults.
icmpecho@lemmy.ml 4 days ago
same, i’ve been very happy with Caddy, even with lots of subdomains and weird configs it’s been rock solid.
traches@sh.itjust.works 4 days ago
I’ve been using caddyserver for awhile and love it. Config is nicely readable and the defaults are very good.
midnight@programming.dev 4 days ago
I’ll throw in another recommendation for Caddy. I’ve been using it for years and the few problems/feature suggestions I had got implemented by the developers pretty quickly. They’re super active on their forums and I haven’t yet run into an issue where I couldn’t either figure it out myself or with help from their community forums (usually from a dev.) They’re very friendly and won’t berate you for simple mistakes like other devs.
Xanza@lemm.ee 3 days ago
Traefik is a PITA.
Caddy all the way. If you build it with Docker support (or grab the prebuilt), you can use docker container names to reverse proxy using names instead of any IP addresses or ports. It’s nice because if the IP updates, so does caddy. All automatically.
Here’s what my caddyfile looks like;
{ acme_dns cloudflare {key} } domain.dev { encode zstd gzip root * /var/www/html/domain.dev/ php_fastcgi unix//run/php/php8.1-fpm.sock tls { dns cloudflare {key} } } *.domain.dev { encode zstd gzip tls { dns cloudflare {key} } @docker host docker.domain.dev handle @docker { encode zstd gzip reverse_proxy {portainer} } @test host test.domain.dev handle @test { encode zstd gzip reverse_proxy 127.0.0.1:10000 } @images host i.domain.dev handle @images { encode zstd gzip reverse_proxy 127.0.0.1:9002 } @proxy host proxy.domain.dev handle @proxy { encode zstd gzip reverse_proxy proxy } @portal host portal.domain.dev handle @portal { encode zstd gzip reverse_proxy portal } @ping host ping.domain.dev handle @ping { encode zstd gzip respond "pong!" } }
DNS hosted by cloudflare but because caddy handles ACME certs, all the subdomains automatically get SSL.
lena@gregtech.eu 3 days ago
Actually I found traefik rather easy, I just had to make the proper docker labels and config.
PITA
Unrelated, I’m going to sound like a grammar nazi here, but holy shit there are so many acronmys, how am I supposed to know every one of them without googling? Please just say “traefik is a pain in the ass”. Also please don’t take this as a snarky reply.
Xanza@lemm.ee 3 days ago
PITA = pain in the ass.
I never said it was hard. Just a real pain in the ass. Like iptables vs UFW. They’re the same thing, but one is easy and a pain in the ass and the other is just easy… So I opt to make my life easier. lol
synapse1278@lemmy.world 4 days ago
Caddy is the only reverse proxy I have ever managed to successfully make use of. I failed miserably with Nginix and Traefik.
Caddy has worked very well for me for several years now. It gets the SSL certificate from my domain name provider and all.
CrankyCarrot@lemmy.world 4 days ago
I use Traefik at home. The initial setup was more complex than others but now it’s set up it’s by far the easiest to add new routes than any other I’ve tried, just by virtue of being right there in the compose/k8s files I’m already writing. Static routes are manual annoyingly, but so are every other proxy so that’s no different. The config files are the same markup language as your Compose/k8s files so you’re not learning a whole new syntax and having to switch languages mentally as you switch between them.
Caddy is super easy, but the fact that the Docker labels thing was a plugin is a con to me, I’d prefer it being first party. It also isn’t as performant as Traefik, higher CPU usage while also having higher latency.
As far as I’m aware, Nginx and Nginx Proxy Manager support no such thing, you have to manually write those routes every time you create a new service.
Nginx Proxy Manager is a lot like Portainer. It’s useful for people who don’t want to learn Nginx and just want to click a few buttons. But anything complex you’re suddenly going to be thrown into the deep end.
You’ve already set up Traefik, you’ve already done the complex bit. IMO there’s no reason to change, from this point everything else is more complicated.
reddwarf@feddit.nl 4 days ago
I use NPM in a docker container. It could not be easier in my opinion but then again, I did not use any of the alternatives so I might be missing out on something, who knows. I did manage a couple of proxy servers in the past based on Apache and I can tell you that NPM is much easier and logical to me than that.
Just create a compose file and start it. Create DNS records pointing to your NPM IP address/exposed IP and make a host in NPM sending traffic to the right container IP:port. The compose file is super simple, could not be easier. Here’s mine for example:
services: nginx-proxy-manager: container_name: nginx-proxy-manager image: 'jc21/nginx-proxy-manager:latest' restart: always ports: - '80:80' - '443:443' volumes: - ./data:/data - ./letsencrypt:/etc/letsencrypt
I just make sure ports 443 and 80 are exposed on my router so DNS records can point to that IP adrdess. All traffic on port 80 gets re-routed to 443.
I’m probably stating all the obvious things here 😀
Tiritibambix@lemmy.ml 4 days ago
I mean yes, that seems obvious now that I’ve learned this.
But I wish I read this comment 3 years ago when I was starting to dive into self hosting. Would have saved me a bunch of time. So always assume some piece of knowledge is not obvious for someone out there and share ᕕ( ᐛ )ᕗ
reddwarf@feddit.nl 4 days ago
So always assume some piece of knowledge is not obvious for someone out there and share
You just described a thing of mine I cannot help but do; explain the ever loving crap out of things
I need to be careful with that though as relatives start to complain and push back on me telling things over and over.
Thing is, until I see a full comprehension on the other side on what I try to convey I just keep explaining in variations, keep finding metaphors and keep pestering you until you ‘get it’. Some say it is a virtue, some say it is a hindrance.I have had therapy on this… 😂
MXX53@programming.dev 4 days ago
I use traefik. I like it. Took a bit to understand, but it has some cool options like ssl passthrough and middlewares for basic auth.
mbirth@lemmy.ml 4 days ago
You can even use it to do the SSL part for a local non-SSL IMAP server. And, there’s a CrowdSec middleware as well, that will block blacklisted IPs.
merthyr1831@lemmy.ml 4 days ago
i use nginx proxy manager but im barely getting by. Theres zero useful documentation for setting up custom paths so everyone uses subdomains. I ended up buying my own domain just so i didnt feel guilty spamming freedns lmao.
EncryptKeeper@lemmy.world 4 days ago
At that point you might be better off just using Nginx without the gui. SWAG is a nice reverse proxy focused implementation of it.
merthyr1831@lemmy.ml 4 days ago
I spent far too much on my domain (£3.86 for the year) to change course now!
Dirk@lemmy.ml 4 days ago
but I’d like to give Nginx Proxy Manager a try, it seems easier to manage stuff not in docker.
NPM is pretty agnostic. If it receives a request for a specific address and port combination it just forwards the traffic to another specific address and port combination. This can be a docker container, but also can be a physical machine or any random URL.
It also has Let’s Encrypt included (but that should be a no-brainer).
lka1988@sh.itjust.works 4 days ago
I like NPM, it’s simple, but also allows for more complex configs as well if needed. I run it in its own LXC because I have other non-dockerized things that are exposed.
lorentz@feddit.it 4 days ago
Nginx for my intranet because configuration is fully manual and I have complete control over it.
Caddy for the public services on my vps because it handles cert renewal automatically and most of its configuration is magic which just works.
It is unbelievable how shorter caddy configuration is, but on my intranet:
- I don’t want my reverse proxy to dial on internet to try to fetch new SSL certs. I know it can be disabled, but this is the default.
- I like to learn how stuff works, Nginx forces you to know more details but it is full of good documentation so it is not too painful compared to Caddy.
Oisteink@feddit.nl 4 days ago
I switched to caddy just for the certs. I get trusted certs on all my internal subdomains without maintenance.
I use haproxy, nginx and caddy at work including a caddy instance with internal CA. 4 lines in config and its signed by our normal CA, so its trusted by all our devices.
x00z@lemmy.world 4 days ago
You can easily get automatic renewal for nginx using certbot.
lorentz@feddit.it 3 days ago
Yes, but it is a different cron job that needs to run, and you need to monitor it for failures. Caddy does everything out of the box, including retries.
boydster@sh.itjust.works 4 days ago
I’ve been mostly using Nginx Proxy Manager, but I recently set up Bunkerweb as a WAF for a couple of public services I’m hosting and I kind of like it. It does reverse proxy along with a bunch of other things (bad behavior blocking, geographic blocking, SSL cert handling, it does a lot).
Mentioning it because I didn’t see any other mention of it yet.
NPM is easy to use. Caddy sounds like something I’d like to try too now.
vfsh@lemmy.blahaj.zone 4 days ago
I’ve been using NPM for a few years now and can’t recommend it enough. I use it to route to both docker containers on an internal proxy network as well at other services within my networks
Hawk@lemmynsfw.com 3 days ago
If you’re just going to VPN in to your home network, I’ve found caddy to be the simplest.
Semjaza@lemmynsfw.com 3 days ago
I tried using PiVPN to route my phone’s Internet access through my home network, but it kept breaking and I found I don’t have a head for networks.
Would caddy be able to do that in an easier to maintain way?
Hawk@lemmynsfw.com 3 days ago
Set up wireguard in a docker container and then forward the port to wireguard, the default container on docker hub is fairly straightforward and you can always ask me for help if you need :).
However, If you are using ipv4, you need to make sure that you’re not behind a CG-NAT (If you think you might be, call your ISP and tell them you have security cameras that need to get out or something like that).
You could also try tailscale which is built using wireguard with nat-busting features and a bit easier to configure (I dont personally use it as wireguard is sufficient for me).
After that Caddy + DNSMasq will simply allow you to map different URLs to IP addresses
dnsmasq- will let you map, E.g.
my_computer->192.168.1.64
- will let you map, E.g.
- Caddy (Or nginx, but caddy is simpler)
- will let you map to ports so e.g.:
- with DNS (DNSMasq as above)
http://dokuwiki.my_computer->http://my_computer:8080
- Without DNS
http://dokuwiki.192.168.1.64->http://192.168.1.64:8080
- with DNS (DNSMasq as above)
- will let you map to ports so e.g.:
Caddy and DNSmasq are superfluous, if you’ve got a good memory or bookmarks, you don’t really need them.
VPN back into home is a lot more important. You definitely do not want to be forwarding ports to services you are running, because if you don’t know what you’re doing this could pose a network security risk.
Use the VPN as the entry point, as it’s secure. I also recommend running the VPN in a docker / podman container on an old laptop dedicated just to that, simply to keep it as isolated as you can.
Down the line you could also look into VLan If your router supports that.
I personally would not bother with SSL If you’re just going to be providing access to trusted users who already have access to your home network.
If you are looking to host things, just pay for a digital droplet for $7 a month, It’s much simpler, You still get to configure everything but you don’t expose your network to a security risk.
korthrun@lemmy.sdf.org 4 days ago
For a while now I’ve been using either haproxy or nginx depending on my needs. I’ve hit instances with both where the functionality I want is in the paid version.
Other@lemmy.ca 3 days ago
I am using nginx on a separate machine (VM) I have yet to try it in docker, I just have not found a reason to change it yet.
I’ve tried npm, caddy and traefik but they are always way more complicated then adding a new config file in nginx…
I feel the others add too much to the docker configs and limit what can be added to the reverse proxy. I have control of access from the nginx server, without having to change the apps configuration.
NPM is the closest to what I would like (only needing the same network in docker) if I go the docker way but for some reason it never works as it should when I configure it. So I am sticking to plain nginx.
ALERT@sh.itjust.works 4 days ago
npm/npmplus
kevincox@lemmy.ml 4 days ago
I’ve been using nginx forever. It works, I can do almost everything I want, even if more complex things sometimes require some contortions. I’m not sure I would pick it again if starting from scratch, but I have no problems that are worth switching for.
0x0@programming.dev 4 days ago
potentiallynotfelix@lemmy.fish 3 days ago
I think NGINX has the best reverse proxy
PieMePlenty@lemmy.world 3 days ago
Nginx installed directly, I use nano over ssh to edit configs. Forces you to learn some things and I never moved passed it because it works so well.
WhyFlip@lemmy.world 2 days ago
I highly recommend npm. It’s also the only one I’ve used, so please keep that in mind.
sandwichsaregood@lemmy.world 2 days ago
I really like Zoraxy. Similar to NPM but it’s its own thing and I like it a lot more
I know how to use raw nginx/Caddy/traefik to do it, but I find the WebUI and all the extra features Zoraxy has to be very convenient and easy to use.
Kusimulkku@lemm.ee 4 days ago
Caddy is really simple and easy. Just werks and gives you https
sxan@midwest.social 4 days ago
I mean, the basic config file for Caddy is 1 line, and gives you Let’s Encrypt by default. The entire config file for a reverse proxy can be as few as 3 lines:
It’s a single executable, and a single 3-line file. Caddy is an incredible piece of software.
merthyr1831@lemmy.ml 4 days ago
Ive got a basic workflow for nginx proxy manager now so this isnt super useful but good god that’s exactly what i wish nginx was.
Kusimulkku@lemm.ee 4 days ago
When I was researching reverse proxies I first stumbled upon nginx and traefik and especially nginx seemed a bit intimidating. As someone who hadn’t done it before I was worried if I’d do it right. Then I found caddy and yeah just used a threeliner like that in config and that was that. Simple and easy to get it right.
I’ve since switched to having my stuff behind wireguard instead of reverse proxy, but I keep caddy around so I can just spin it back up if I want to access Jellyfin on someone’s tv or something.
HurlingDurling@lemmy.world 4 days ago
Honest noob question. I currently connect to my self hosted server using Twingate. How would this be different? can you give me an Eli5 what a proxy manager would make my setup better?