Heya, I just wanted to post here before doing something that puts my stuff out on the internet for anyone to see 😅

So I have a basic, still in-configuration homelab network going on. It’s Modem --> OPNsense router --> Ubiquiti switch --> Openwrt AP. DNS and DHCP (via Dnsmasq) are working right now, each VLAN (Home Devices, IoT, and Guest) can access the internet. But I’m still tinkering and doing firewall stuff, so sometimes I reactivate the ISP router and switch back to that until I have everything perfect enough to not bother my family

I have a Proxmox homelab that I’ve been running services like Jellyfin and Immich in a Docker Debian VM for a few months now, but I was getting tired of typing out IPs and remembering port nums, especially after bouncing between my router and the original ISP router whenever I’m having network issues. So I wanted to finally map those IPs to human-friendly domains. So like, 192.168.10.247:8096 --> jellyfin.example.com, 192.168.10.247:2283 --> immich.example.com, etc.

I quickly learned that DNS services like Unbound and Dnsmasq do what they say on the tin, DNS only, so I can’t do a override to map ports to a domain, as they can only do IPs. My research led me to reverse proxies, and people said Caddy was simple on OPNsense, so I installed that and followed the official guide/documentation. But then I ran into the issue of needing the domain to be externally resolveable. Which then led me to realizing I need to use some sort of CA.

I know Let’s Encrypt does it for free, plus the guide mentions them as a default so why not? Except I still need an actual external domain so… Cloudflare? DuckDNS? Someone else? I’m so lost…

The biggest concern of mine right now is, if I set up a reverse proxy, does that mean my services are externally accessible? I was using Tailscale so I could avoid that, especially since I know services like Jellyfin have had serious vulnerabilities, and everyone says it’s a good rule of thumb to just not expose services. But how do I map ip + port #s to a domain on OPNsense?

  • Imaginary_Stand4909@lemmy.blahaj.zoneOPEnglish
    1·
    1 day ago

    Sorry, I didn’t specify in my original post but I did plan to use .internal for my domains. And I never planned to open my ports on my firewall either so that’s good to know. But I’m still having issues despite this…

    Here’s my Caddyfile:

    # DO NOT EDIT THIS FILE -- OPNsense auto-generated file


# caddy_user=root

# Global Options
{
	log {
		output net unixgram//var/run/caddy/log.sock {
		}
		format json {
			time_format rfc3339
		}
	}

	servers {
		protocols h1 h2
	}

	email [redacted]
	grace_period 10s
	skip_install_trust
	import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


immich.homelab.internal {
	handle {
		reverse_proxy 192.168.10.247:2283 {
		}
	}
}

import /usr/local/etc/caddy/caddy.d/*.conf

    Here’s my firewall config (I allowed any source IP to Destination “This Firewall” & port 443/80 on my LAN/VLANs):

    Here’s my Caddy configs:

    And I did make a wildcard domain override (*.homelab.internal) in Unbound with this config:

    Host = *
Domain = homelab.internal
Type = IPv4
IP = 192.168.10.247

    I can ping my server’s IP, nslookup the homelab.internal domain, and ping homelab.internal. So the regular DNS entry is working, I just can’t get my reverse proxy to work…

    • frongt@lemmy.zipEnglish
      2·
      1 day ago

      If it’s all internal (and you haven’t set up any extra firewall zones or rules) then you won’t need any firewall rules to allow it.

      You should probably be able to just ping immich.homelab.internal right now, and make an http request and get something back too. Even if it’s an http error, that still means you’re talking to an http server successfully.

      I haven’t used opnsense in years, and I’ve never used caddy, so I don’t know if the config is right, but it looks reasonable and the concepts are the same as what I’m used to.