How to use a domain I own to self-host services?

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨gedaliyah@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

I’m not really sure how to ask this because my knowledge is pretty limited. Any basic answers or links will be much appreciated.

I have a number of self hosted services on my home PC. I’d like to be able to access them safely over the public Internet. There are a couple of reasons for this. There is an online calendar scheduling service I would like to have access to my caldav/carddav setup. I’d also like to set up Nextcloud, which seems more or less require https. I am using http connections secured through Tailscale at the moment.

I own a domain through an old Squarespace account that I would like to use. I currently have zero knowledge or understanding of how to route my self hosted services through the domain that I own, or even if that’s the correct way to set it up. Is there a guide that explains step by step for beginners how to access my home setup through the domain that I own? Should I move the domain from Squarespace to another provider that is better equipped for this type of setup?

Is this a bad idea for someone without much experience in networking in general?

source

Comments

Sort:hotnew top

eksb@programming.dev ⁨1⁩ ⁨day⁩ ago
Consider getting a VPS to play around with to learn how this stuff works before you expose your data to the internet.

Learn about how DNS works. You will create an A record (and possibly also an AAAA recordy) for your domain pointing to your home IP (or VPS).

If SquareSpace does not let you set records (and will only allow you to use Squarespace-hosted services) you will need to migrate your domain to another provider. I like gandi.net.

Learn how your router does port forwarding. You will forward port(s) for the calendar service from your router to your home PC. (Or learn how to do firewalls on your VPS.)

Before you actually connect to it with credentials over the internet, set up SSL/TLS certificates with LetsEncrypt.
source
- pHr34kY@lemmy.world ⁨23⁩ ⁨hours⁩ ago
  The educational route I took was Hurricane Electric’s free IPv6 online course. It taught me a bunch of networking principles. When you finish the course (and get “sage” status), you get free lifetime DNS access. This includes dynamic DNS that automatically updates when your IP address changes.
  
  source
  - Fedegenerate@lemmynsfw.com ⁨3⁩ ⁨hours⁩ ago
    Oooo this might be the path I take to finally get off IPv4. Cheers.
    
    source
illusionist@lemmy.zip ⁨1⁩ ⁨day⁩ ago
Caddy with caddyfile is very easy although it lacks a gui. Use nginx proxy manager if you want a gui, but it is more work than a caddyfile.

caddyserver.com/docs/quick-starts/caddyfile

source
- CrayonDevourer@lemmy.world ⁨1⁩ ⁨day⁩ ago
  Seconding Caddy – It’s as close to it gets for “Just works”. It handles all the certs, it’s easy to refresh and add a subdomain instantly, handles wildcard domains, and the config file is dead simple to understand.
  
  source
  - illusionist@lemmy.zip ⁨1⁩ ⁨day⁩ ago
    I wish I would understand how to use xcaddy but I failed the last two times setting it up 😅 it was something about another language that was needed iirc
    
    source
    -> View More Comments
littleomid@feddit.org ⁨1⁩ ⁨day⁩ ago
Three steps:

point the FQDN to your network (Dynamic DNS).

set up reverse proxy (Nginx, etc.)

set up certificates (Certbot, etc.) Optional step 4: harden with fail2ban and a firewall.
source
- bruce965@lemmy.ml ⁨1⁩ ⁨day⁩ ago
  I would say this would be the proper way to do it (at least as a sysadmin), but since it’s OP’s first time I would simplify it to:
  
  Install CloudFlare ZeroTrust daemon on your local server;
  
  Set up reverse proxy such as Nginx (optional, the alternative is to use a different subdomain for each service, which might be easier);
  
  Point the FQDN to CloudFlare. Let CloudFlare handle the certificates, DDoS protection, etc…
  
  source
  - ag10n@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Cloudflare isn’t very self-host, unless you want/need to trust a third party I wouldn’t recommend this.
    
    source
    -> View More Comments
  - brian@lemmy.ca ⁨1⁩ ⁨day⁩ ago
    How would you go about using a different subdomain without something like a reverse proxy? Heck, in my head that’s almost the only reason I use a reverse proxy
    
    source
    -> View More Comments
irotsoma@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago
Really the first issue is your IP address. How does your ISP hand out IP addresses IPv4 and/or IPv6?

If you have an ISP that gives a static block of IPv6 addresses that simplifies things immensely. But also consider that many legacy, monopoly ISPs have not implemented IPv6 for their customers, especially in the US, and so domains without an IPv4 address aren’t accessible from people’s homes that use those ISPs. But it means you could assign static IPv6 addresses to each service if you wanted to and add subdomains for each. Then you just need to deal with security on that system.

Otherwise you’ll likely need to deal with dynamic DNS. If your router and your domain registrar’s DNS can work together for DDNS that’s ideal. For example, my OpnSense router updates my cloudflare registered domain directly when my ISP changes my IPv4 address (I have one of those ISPs that doesn’t assign IPv6 still but I don’t have any choice if I want > 5-10Mbps upload speeds).

Then you need to deal with routing. The best way is with a reverse proxy like Caddy or I actually like Traefik a lot because it works well with my complex setup with docker and kubernetes among other things. Basically your router needs to route all the inbound traffic on the appropriate inbound ports to the reverse proxy to it to then route to the appropriate service based on the subdomain and/or port of the request.

Once you route the subdomain to the appropriate service you need to deal with security. Once a service is exposed, it’s going to eventually start getting hit by bots trying to access it. Best to implement something like fail2ban to stop them from wasting your processing power with failed logins and 404 errors and such.

source
UndeadDreads@lemmy.world ⁨1⁩ ⁨day⁩ ago
Check out Nginx Proxy Manager nginxproxymanager.com

Create some subdomains and use Nginx Proxy Manager to generate SSL certs and point to your self hosted applications.

source
Blaster_M@lemmy.world ⁨1⁩ ⁨day⁩ ago
A record with your IP address, AAAA record with your IPv6 address. If these addresses change often, either setup a dyndns (your DBS provider needs to support this) or pay for a Static IP from your ISP. Firewall the hell out of your network, have a default deny (drop) inbound rule, and only open ports for your service. Use an nginx reverse proxy if possible to keep direct connections out of your service, and use containers (docker?) for your service(s). Don’t forget to setup certbot and fail2ban. You need certbot to auto update your certs, and you need fail2ban to keep the automated login hacker bots from getting in.

That’s the minimum. You can do more with ip region blocking and such, as well as more advanced firewalling and isolation. Also possible to use Tailscale and point the DNS to the Tailscale IP, which will eliminate exposing youd public IP to the internet.

source
- gedaliyah@lemmy.world ⁨1⁩ ⁨day⁩ ago
  If I use Tailscale as described, how will a request connect to the tailnet? Is there anything you can link that explains how to do this?
  
  source
  - Blaster_M@lemmy.world ⁨20⁩ ⁨hours⁩ ago
    Wheb you put your server’s tailscale IP in the dns, anything that looks up that dns gets the tailscale IP. You only need to connect the devices you want to have connect to the server to the same tailscale network, and your system will handle the routing.
    
    source
    -> View More Comments
qaz@lemmy.world ⁨22⁩ ⁨hours⁩ ago
If you want to expose it publically for others to use consider using Cloudflare for easy setup and avoiding exposing your home IP. If you want to use it for yourself you can access it with Tailscale and forward traffic to certain ports based on the subdomain using Nginx Proxy Manager.

source
vostrik@pol.social ⁨1⁩ ⁨day⁩ ago
@gedaliyah after a lot of thinking I decided that only two things I need available in public internet are my searxng instance and my xmpp server. the rest, like music streaming, file sharing, home automation, etc etc etc could live happily in VPN with clients on trusted devices.
this way you don't have to wake up every night to check, if some piece of software, which has access to your whole network, was pwned because of outdated leftpad version or something.
source
- gedaliyah@lemmy.world ⁨8⁩ ⁨hours⁩ ago
  Thanks, I appreciate your experience.
  
  source
PeriodicallyPedantic@lemmy.ca ⁨18⁩ ⁨hours⁩ ago
It depends on your motivations and security requirements.

If you’re already hosting Home Assistant, there is an add-on for CloudFlared which will take care of most of everything for you, using CloudFlare secure tunnels.
It even does simple subdomain reverse proxy, to serve your other services.

It requires that you use CloudFlare for your DNS entries, and it won’t secure your host for you (they do offer some free services to help a little), and you still end up depending on a cloud service provider so it’s not pure self hosting.
But it’s free, you’re still mostly in control, and it’s less likely to catastrophically mess up your netsec if you’re a beginner.

source
Ek-Hou-Van-Braai@piefed.social ⁨1⁩ ⁨day⁩ ago
Cloudflare makes it pretty easy and is free (or close to free)

source