Just learned how to do a reverse proxy
Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I'm securing Immich using OAuth.
I don't have very nerdy friends so not many people appreciate this.
Wrapping my head around reverse proxy was a game changer for me. I could finally host things that are usefull outside my LAN. I use Nginx-Proxy-Manager which makes the config simple for lazy's like me.
NPM is awesome until you have a weird error that the web GUI does not give a hint about the problem. Used it for years at this point and wouldn't consider anything else at this point. It just works and is super simple.
Those ones are fun. If you delete an SSL certificate and haven't removed it from a proxy, the entire container goes down and you have to trawl through logs to find what went wrong.
+1 for NPM! Used to even do things manually, but I'm too lazy for that and NPM fulfils nearly all my use cases lol
came here to leave this exact response! 😁
Used to mess around with multiple Apache Proxy Servers. When I left that job I found Docker and (amongst other things) NPM and I swear, I stared at the screen in disbelief on how easy the setup and config was. All that time we wasted on Apache, the issues, the upgrades, the nightmare in setting it all up...
If I were to do that job again I would not hesitate to use NPM 100% and stop wasting my time with that Apache Proxy mess.
NPM
Nginx-Proxy-Manager. Got it.
I didn't read the parent comment well enough and was wondering what the Node Package Manager had to do with anything 😂
Yeah port forwarding just isnt the same. I pretty heavily rely on Nextcloud and Plex doing the port forwarding for me
Plex can sometimes get by without port forwarding by using UPnP or NAT-PMP, but I had to open a port to use Plex (before I started using Jellyfin and a reverse proxy).
Same with Nextcloud, you either have to open a port or use a reverse proxy. Reverse proxy is more secure. Good stuff!
Worth mentioning that either way you're opening up ports (you need to open 80 and 443 for the reverse proxy), but that's much better than opening a bunch of ports, one for each thing you're running.
The hardcore security minded people will always scream "use wireguard or whatever", which also works really well (even combined with a reverse proxy that's not exposed to the internet (80 and 443 not forwarded)). I do this for some of the stuff I run that I don't want exposed at all, like my password manager. To access my password manager while out and about, I need to connect to my wireguard thing (my router sets it up for me), and then my phone is effectively back inside my LAN, and I can access whatever I need to. Fortunately it's rare that I need to do this, because my password manager keeps a cached copy on my phone.
Sorry, getting long winded. You get the point!
Do you serve things to a public? Like a website? Because unless you're serving a public, that's dumb to do... and you really don't understand the purpose of it.
If all you wanted was the ability to access services remotely, then you should have just created a WireGuard tunnel and set your phone/laptop/whatever to auto connect through it as soon as you drop your home Wifi.
A lemmy instance, a wiki, and a couple of other website type things, yes.
Publicly facing things are pretty limited, but it's still super handy inside the LAN with Adguard Home doing DNS rewrites to point it to the reverse proxy.
I appreciate what you're saying, though. A lot of people get in trouble by having things like Radarr etc. open to the internet through their reverse proxy.
I'm a huge fan of Caddy and I wish more people would try it. The utter simplicity of the config file is breathtaking when you compare it with Apache or Nginx. Stuff that takes twenty or thirty lines in other webservers becomes just one in Caddy.
I moved from swag to caddy and I'm glad i did. So much more simple.
I love Caddy. So easy to configure, and the automatic SSL is almost always what I need.
The only thing I don't like about caddy is that using DNS challenge requires recompiling the program itself, and the plugins themselves can be a bit quirky. Mind you, you can easily handle this with a separate program like lego or certbot so not a huge deal.
Like, good for you, man.
But you should really keep your stuff inside the VPN and not expose things, it opens up a pile of potential risks that you don't need to have. You can still use a reverse proxy inside the VPN and use your own DNS server that spits out that internal address to your devices for your various applications. If you absolutely, positively must have something exposed directly, put it on it's own VLAN and with no access to anything you value.
I want to be able to upload/download/share my photos from anywhere in the world without using a VPN. Additionally, this satisfies the wife requirement. It works in the background without her needing her to turn on the VPN. I don't want her to keep asking me how do I turn on the VPN? If it's just me, then no issue, I'll use a VPN.
Yeah, you always have to account for the wife factor. Same reason I’m using Plex instead of Jellyfin for my video hosting; I’d personally prefer Jellyfin, but the wife factor (really the mother-in-law factor, but whatever…) demands that it doesn’t require a ton of config on the user’s end. If the goal is to encourage use by your family, it can’t be fiddly or difficult to set up on their end.
To be fair, wireguard is pretty painless.
Don’t listen to this guy. You don’t have to turtle all your stuff inside a VPN if you don’t want to. Hosting services on the internet is what the internet was created for. It’s up to you whether what you want to host is exposed to the internet or not, and as long as you’re aware of the risks do what you want man. I will mention that Immich specifically might not be the best idea to expose since it’s so unstable, but that depends on your level of comfortability. Worst case scenario is somebody gets into your Immich and can see all your photos. Would this be a dealbreaker for you? If so don’t expose it publicly. Otherwise you’re perfectly fine.
Absolutely that's what the internet was made for!
But family photos keep a bit more secure, Particularly if it's syncing directly from your phone, I take a lot of explicit photos of my wife, but also code that I'm writing on my computer, or the kids playing, etc.
I don’t even bother with the internal DNS server. I just set my A records in Cloudflare to point to the private IPs
I tired the same, but my router wants to be smart by filtering DNS responses that points to local IP. I guess whoever designed it considered it a security feature. It is a stock router from the ISP, its configuration interface is minimal, borderline to non existent.
Sounds like Cloudflare tunnels. I used that for a while, until I realized I didn't want to be tied to Cloudflare.
Opening it up lets you use it from devices that aren't on tailscale, or for friends and family. I have the same idea with Nebula instead of Tailscale, if I can figure it out.
You can still use a reverse proxy inside the VPN and use your own DNS server that spits out that internal address to your devices for your various applications.
Excuse me what? Here's my dumb ass navigating to "[device name]:[port] over tailscale.
I've tried this a couple times and I've always failed. I could never figure out how to get a http://service.domain/ request to my Nginx install to be proxied in the first place. I tried putting pihole on tailscale and setting that as tailscale's DNS. It blocked ads but I couldn't navigate to custom domains. I put NPM on tailscale hoping that was the issue. I looked for LocalDNS/CNAMES in tailscale to see if I could do it that way. Do I have to set a local machine as an exit node and do split DNS shenanigans, service.domain goes through to my local and everything else the wider web? Do I set a router node?!
Not expecting you to troubleshoot, I don't have time to see it through anyhow. Just annoyed at myself I couldn't figure it out and driven to try again.
Can someone ELI5? I'm a noob who aspires to set up immich in the near future. I only recently started making efforts to separate myself from the cloud. So far I've got a wireguard server set up and I've disconnected both my Bambu printers from the cloud and I'm currently setting up some home assistant stuff. Pretty soon I'm hoping to set up a NAS, Immich, Plex (or similar) and replace my google nest cameras.
I'll try to ELI5, if there's something you don't understand ask me.
Op has a home server where he's running immich, that's only accessible when he's at home via the IP, so something like http://192.168.0.3:3000/, so he installed Tailscale on that server. Tailscale is a VPN (Virtual Private Network) that allows you to connect to your stuff remotely, it's a nice way to do it because it is P2P (peer-to-peer) which means that in theory only he can access that network, whereas if he were using one of the many VPNs people use for other reasons, other people on the same VPN could access his server.
Ok, so now he can access his immich instance away from home, all he has to do is connect to the VPN on his phone or laptop and he'll be able to access it with something like http://my_server:3000 since Tailscale adds a DNS (Domain Name System) which resolves the hostnames to whatever IP they have on the Tailscale network.
But if you want to give your family access it's hard to explain to them that they need to connect to this VPN, so he rented a VPS (Virtual Private Server) on some company like DigitalOcean or Vultr and connected that machine to the Tailscale network. He probably also got a domain name from somewhere like namecheap, and pointed that domain name to his VPS. Só now he can access his VPS by using ssh user@myserver.com. Now all he needs to do is have something on the VPS which redirects everything that comes to a certain address into the Tailscale machine, Caddy is a nice way to do this, but the more traditional approach is ngnix, so if he puts Caddy on that VPS a config like this:
immich.myserver.com {
handle {
reverse_proxy my_server.tailscale.network.name:3000
}
}
Then any requests that come to https://immich.myserver.com/ will get redirected to the home server via Tailscale.
It is a really nice setup, plus OP also added authentication and some other stuff to make it a bit more secure against attacks directly on immich.
Pretty much I have caddy on a VPS that's pointing to my internal IP using a tailscale tunnel. You are still exposing the web gui to the Internet so I just changed authentication to OAuth to mitigate since risk. There is still a possibility of attacks via zero days, but my immich is on a VM and I'm creating firewall rules to just allow certain ports out.
Good job!
I'm still trying to understand what it is and why I would want it. I see several programs I use recommend it but I just don't get what it does and why what it does is good.
It does a couple things. It's one service that routes requests to multiple services. So if you have radarr, sonarr, etc., you can put a reverse proxy in front and use the same ip-port to connect to all, and the proxy routes the request to the service by hostname.
If you have multiple instances of the same service for HA, it can load balance between them (though this is unlikely for a homelab).
Personally I run all my services through docker and put traefik in front, so that I don't have to keep track of ports. It's all by name.
It's also nice because traefik handles HTTPS termination, so it automatically gets certs for each name, and the backing service never needs to worry about it (it's http on the backend, but all that traffic is internal).
Nice one dude, i know the pain of not having nerdy friends to share shit like this with.
Just out of curiosity, is the tail scale part of this required? If i just reverse proxy things and have them only protected from there by the login screen of the app being shown, that's obviously less safe. But the attackers would still need to brute force my passwords to get any access? If they did, then they could do nasty things within the app, but limited to that app. Are there other vulnerabilities I'm not thinking about?
I don't think a tailscale tunnel helps this anyway, maybe just from standard antispoofing and geoblocks, but it still gets to the application in full eventually, when they can do what they'd do if it was directly exposed. The attack surface might be an entire API, not just your login screen. You have no idea what that first page implements that could be used to gain access. And they could request another page that has an entirely different surface.
If someone has Nextcloud exposed, I'm not stopping at the /login page that comes up by default and hitting it with a rainbow table; I'm requesting remote.php where all the access goodies are. That has a huge surface that bypasses the login screen entirely, might not be rate limited, and maybe there's something in webdav that's vulnerable enough that I don't need a correct token, I just need to confuse remote.php into letting me try to pop it.
You can improve this by putting a basic auth challenge at least in front of the applications webpage. That would drastically reduce the potential endpoints.
It's not required, but probably OP has a home server with Immich and a VPS which exposes it to the internet. In that setup you need Tailscale for the VPS to access your home server. Sometimes you can't directly expose your home server for different reasons, e.g. ISP doesn't give you an external IP directly (I've had this, where my router would get a 10.x IP so I couldn't port forward because the internet IP was being shared between multiple houses), or the ISP gives you a dynamic IP so there's no guarantee that your IP won't change next time you reset the router, etc.
Also it provides an extra layer of separation, so for example a DDOS would hit the VPS which probably has automatic countermeasures, and even if someone were to gain access to the VPS they still need an extra jump to get to the home server (obviously if they exploit something on immich they would get direct access to the home server).
Gotcha. Thanks for the insight!
It's annoying, as I'd like to expose things for other people in my family (like Overseerr or whatever) without hassling them to also start a VPN or other stumbling block steps.
I was hoping that reverse proxy to overseerrs login screen would be safe enough. 8(
Does docker help limit things at all? I'm running my services through docker, which seems to limit the folders the container can hit. Feels like that would limit the damage someone could do even if they bypassed the login page of Overseerr or whatever app it is?
Edit: thanks for all the replies! Always more to learn and do, haha
I only let things I trust are secure (e.g. ssh) have access from the internet, other services I hide behind a VPN (e.g. Tailscale).
Same boat (in the learning cycle that is). No idea what immich is, but I got Stirling-PDF hosting in docker. I only learned the other day that localhost, is localhost for the container. I couldn't get a bunch of stuff running for.ever, till I learned the way I was calling things needed to be to host.docker.internal.
I just finally got it this weekend when I got Matrix-synapse and Pixelfed working on the same box.
All I can say is good for you! It wasn’t easy. And it’s so powerful.
O have a very similar setup but have a couple of questions if you don't mind me asking, what did you used for OAuth? and where is it running? I tried athelia on the VPS but had some problems I can't remember now and decided it wasn't worth the time at the time, but probably should set it up.
Authelia is great. Recently added protection for multiple domains.
I just use google OAuth since everyone I know has a google account. It just can't use OAuth on private IP addresses, just FQDNs.
Wow, so my understanding of the terms 'reverse proxy' and Tailscale must be wrong then, because I thought they were mutually exclusive. I'll go do some more research, unless someone feels like explaining how you can do both at the same time.
Also, I think the 'Risks' section of this page is informative:
I think self hosting the proxy with the services at hobbyist scale mitigates most of the security risks. The single point of failure risk is another matter. I once had to effectively reverse-hack my services by uploading a Jenkins test job through an existing java project to regain access. Ever since then, I maintain a separate ddns address that's just used for emergency ssh access.
Congratulations!
It feels really good when you learn something new and get it working the way you like.
If you want more challenges take a look at this:
This would be useful if you ever wanted to share albums with other people outside your tailscale network and that lack an account for your immich server.
Tailscale?
Is this setup advisable for the CGNATED environment?
You will need a VPS as your other endpoint
Ah, I figured... I used to do this with Wireguard instead of Tailscale.
I know that feeling ! My first service hosted via docker + Treafik outside my lan with a wireguard tunnel felt like a big dopamine hit ! Congrats !
Now I have over 20 services and It feels trivial :( I still love the easy to read/write syntax of Treafik ,however I feel like I'm missing a lot of important networking knowledge while avoiding Nginx !
Maybe one day when I'm too bored I will switch everything to Nginx, see how it goes !
Just be sure to read up on network security and set yourself up for success! Even tunnels can still be an attack surface. Always keep everything up to date! And plan for the worst case.
Nice work! 😎
Congrats! I just pulled off the same thing last week using cloudflare tunneling? The phrase “reverse proxy” scared me too much lol. So props to you.
I just got this set up last week too. Same setup with caddy on a free oracle vps, tailscale on vps and home pfsense router, tailscale on pfsense advertising routes (private IPs of my docker hosted services).
CGNAT sucks 🤮
me too like last week!!! yay us!!
haven't gotten oauth going yet but soon
I've been wanting do something similar, but with Authentik. Does anyone know a good guide on this?
Yes! Authentik is a great self-hosted OAuth platform. They actually publish integration guides in their documentation.
Integrate with Immich
There is an official guide by Authentik on how to integrate with Immich. There is an official guide by Immich on how to integrate with Authentik.
Quick, now lean a firewall with a good IDS
and fail2ban
I prefer wazuh. Much more powerful and preconfigured with tons of rules