this post was submitted on 30 Dec 2025
26 points (96.4% liked)

Selfhosted

54297 readers
284 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
26
reverse proxy over vpn without docker? (lemmy.world)
submitted 1 week ago by early_riser@lemmy.world to c/selfhosted@lemmy.world
30 comments fedilink hide all child comments
 

I'm looking into replacing cloudflare with a VPS running a reverse proxy over a VPN, however, every solution I see so far assumes you're running Docker, either for the external reverse proxy host or the services you're self hosting.

The VPS is already virtualized (perhaps actually containerized given how cheap I am) so I don't want to put Docker on top of that. The stuff I'm self hosting is running in Proxmox containers on a 15 year old laptop, so again, don't want to make a virtual turducken.

Besides, Docker just seems like a pain to manage. I don't think it was designed for use as a way to distribute turnkey appliances to end users. It was made for creating reproducible ephemeral development environments. Why else would you have to specify that you want a storage volume to persist across reboots? But I digress.

Anyway, I want to reverse proxy arbitrary IP traffic, not just HTTP/S Is that possible? If so, how?

My initial naive assumption is that you set up a VPN tunnel between the VPS and the various proxmox containers, with the local containers initiating the connection so port forwarding isn't necessary. You then set up the reverse proxy on the VPS to funnel traffic through the tunnel to the correct self-hosted container based on domain name and/or port.

you are viewing a single comment's thread
view the rest of the comments
[–] LordKitsuna@lemmy.world 5 points 1 week ago* (last edited 1 week ago) (2 children)

I feel like im missing something here. This is pretty trivial and the comments i see are over complicating the hell outta everything. All you need is your VPN tunnel working. Personally i use wireguard for this. Then you just use nginx as the reverse proxy it talks to services on the other side of the VPN.

The nginx server config looks like

server { listen 443 quic; listen [::]:443 quic; listen 443 ssl; listen [::]:443 ssl; server_name my.domain.tld; http2 on; http3 on; quic_gso on; tcp_nodelay on; error_log /var/log/nginx/jellyfin.access.log; ssl_certificate /path/to/ssl/fullchain.pem; ssl_certificate_key /path/to/ssl/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; add_header Alt-Svc 'h3=":$server_port"; ma=86400'; add_header x-quic 'h3'; add_header Alt-Svc 'h3-29=":$server_port"';

location / {
    proxy_pass http://10.159.4.12:8096/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forward-Proto http;
    proxy_set_header X-Nginx-Proxy true;
}

}

I have no idea how to do the proper code block i guess so have a paste from my reverse proxy hosted pastebin lol https://paste.kitsuna.net/upload/snail-seal-pig

[–] InnerScientist@lemmy.world 3 points 1 week ago

Here:

server {
    listen 443 quic;
    listen [::]:443 quic;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name jellyfin.kitsuna.net;
    http2      on;
    http3      on;
    quic_gso   on;
    tcp_nodelay on;
    # You can increase the limit if your need to.
    error_log /var/log/nginx/jellyfin.access.log;
#    ssl on;
#    ssl_certificate /etc/nginx/certificate.crt;
#    ssl_certificate_key /etc/nginx/certificate.key;
#    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # don’t use SSLv3 ref: POODLE
        ssl_certificate /etc/letsencrypt/live/kitsuna.net/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/kitsuna.net/privkey.pem;
#        ssl_certificate_key /etc/letsencrypt/live/kitsuna.net/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        add_header Alt-Svc 'h3=":$server_port"; ma=86400';
        add_header x-quic 'h3';
        add_header Alt-Svc 'h3-29=":$server_port"';
    location / {
        proxy_pass http://10.159.4.12:8096/;
#       proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forward-Proto http;
        proxy_set_header X-Nginx-Proxy true;
    }
}
[–] early_riser@lemmy.world 1 points 1 week ago (1 children)

Well I have the vpn working but the connection seems to close after 2-5 minutes unless the client keeps talking to the server, at which point I have to ping the server from the client to re-open the tunnel. Is there a way to keep the tunnel open?

[–] LordKitsuna@lemmy.world 3 points 1 week ago

That sounds like a lack of port forwarding on at least one side. Ensure the vpn port is properly open on both sides. There is also an option you can add to the wireguard config for keepalive set it to something like 1min