Selfhosted

39937 readers

367 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Traefik for two domains, one internal and one external (lemmy.dbzer0.com)

submitted 7 months ago by [email protected] to c/[email protected]

15 comments fedilink hide all child comments

So, at the moment I'm using Nginx Proxy Manager, but lately I started seeing it moving slower and slower and even though I tried traefik some time ago, I didn't manage to make it work.

Anyway, I want to start using traefik again, but I want to use it like this:

I want to access all my services/containers in my LAN through http (port 80) on something like sub.mylan.home
I want to access some of my services over the internet through https (port 443) on sub.mydomain.com

I know this is possible, but I don't get the hang of the configuration. Somone care to share some tips?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 7 months ago (3 children)

it’s probably not what you want

What do you mean?

[–] [email protected] 3 points 7 months ago

It can happen that your internal services are still reachable from externally, by calling the external IP and setting the Host header manually to sub.mylan.home, even if that were pointing to an internal address. Traefik would only compare the Host header. To secure this you might also add an IP filter for the internal host, but I‘m not sure whether that’d be secure enough.

[–] [email protected] 3 points 7 months ago

Not OP, but generally, you want to separate internal and external services as much as possible. Some even suggest running external services on a cloud server and internal servers on your LAN.

If you run internal and external services on the same host, you need to be careful to not make any configuration mistakes. Take extra time to also test what should NOT be possible.

[–] [email protected] 1 points 7 months ago

You’ll be putting yourself in a situation where a typo, or a wrong docker compose copy/paste, or a default config you forgot to override, will expose stuff to the Internet.