First, I think you can close that port. You don't need incoming traffic on that port.
I myself use Vaultwarden. But looking on the documentation you need to configure the enviroment correctly.
First, I think you can close that port. You don't need incoming traffic on that port.
I myself use Vaultwarden. But looking on the documentation you need to configure the enviroment correctly.
Yeah, I did not know it is that bad....
If the containers are all in the same network. You dont need to expose a port.
Lets assume you create a docker network called reverse_proxy and add all your contaiers that you want to be accessed by the reverse proxy to that network (including caddy).
Then you can address all containers through the hostname in you caddy file and the port would be the default configurated port from the container.
So in the end you just expose the caddy container and nothing more.
I switched a year ago to podman and had some trouble to get everything running. But it is possible. I'm not running anything rootful and everything works.
Read the docs, use podman-compose (this sadly has no good docs, but works quit well when you got it) and get ready to play around with permissions and file ownership.
I've got myself a second router and created a second wifi and lan with it. All my smart home devices are in there and also the tv.
Caddy would have the bridge proxy network and the port 443 exposed.
version: "3.7"
networks:
proxy-network:
external: true
# needs to be created manually bevor running (docker create network proxy-network)
services:
caddy:
image: caddy
container_name: caddy
restart: unless-stopped
ports:
- 80:80
- 443:443
volumes:
- ./data:/data
- ./config:/config
- ./Caddyfile:/etc/caddy/Caddyfile:ro
networks:
- proxy-network
Other services:
version: "3.7"
networks:
proxy-network:
external: true
services:
app:
image: app
container_name: app
restart: unless-stopped
volumes:
- ./app-data:/data
networks:
- proxy-network
Caddy can now talk to the app with the apps container_name.
Caddyfile:
homepage.domain.de {
reverse_proxy app:80
}
So the reverse proxy network is an extra network only for containers that need to be exposed.
You need a wildcard cert for ypur subdoman:
*.legal.example.com
Then point that record to 127.0.0.0. This will not resolve for anyone. But you'll have an internal dns enty (useig pihole/adguard/unbound) that redirects to your reverse proxy.
You could also point to your revers proxy internal address instead of 127.0.0.0.
This video could help you: https://www.youtube.com/watch?v=qlcVx-k-02E
I use tandoor, try it. I like it very much.
Very nice write up. Thank you for sharing. One thing I like to add.
I've personally moved away from nginx proxy manager, because I read an article that it has some vulnerability that don't get fixed in time. Also there are a ton of issues open on git hub. So I move to caddy, witch also is super easy to set up.
I'm very happily running openhab!
I'm adding AntennaPod for Podcast.
Immich is very cool. Be carefull to read every release note and do not auto update. There are can be breaking changes! In total im happy with immich!
I played with this problem too. In my case I wanted a zigbee usb to be passed through. I'm not sure if this procedure works with gpu though...
This was also needed to make it work: https://www.zigbee2mqtt.io/guide/installation/20_zigbee2mqtt-fails-to-start.html#method-1-give-your-user-permissions-on-every-reboot
devices:
# Make sure this matched your adapter location
- "/dev/ttyUSB.zigbee-usb:/dev/ttyACM0:rwm"
Also I passed my gpu to immich. But not 100% sure it is working. I've added my user to the render group and passed the gpu like the usb zigbee stick:
devices:
- "/dev/dri:/dev/dri:rwm" # If using Intel QuickSync
The immich image main user is root if imI remember correctly and all permissions that my podman user 1000 has are granted to the root user inside the container (at least this is how I understand it...)
For testing I used this: https://www.zigbee2mqtt.io/guide/installation/20_zigbee2mqtt-fails-to-start.html#verify-that-the-user-you-run-zigbee2mqtt-as-has-write-access-to-the-port It should be working with gpu too.
I can test stuff later on my server, if you need more help!
Hope this all makes sense 😅 please correct me if anything is wrong!
Works well, but struggeled when I tried sending 100+ files or a 80gb files folder. Don't know if my phone was the limitation factor, but the app crashed.
But a very cool software to easily and fast share some files!
Sorry I have no idea how traefik works, but I've seen that this new video ist out. It might help you.
I recommend this: https://www.zigbee2mqtt.io/guide/installation/20_zigbee2mqtt-fails-to-start.html#method-1-give-your-user-permissions-on-every-reboot
with that and also read the tipp after that I was troubleshooting my permission issues.
This should apply to gpu too.
Florisboard
I do. If you run caddy with network_mode: hostor better with network_mode: "slirp4netns:port_handler=slirp4netns" it should work.
also adding:
cap_add:
- net_admin
- net_raw
Podman + Caddy does it for me.
You need to adjust the "minimum" port a user can bind. Podman tells you how to do it (or a quick google search).
Podman does not start your containrs on boot. You need to do some magic yoursefel. Like a cronjob that starts all containers at boot.
I've just posted a little example. I'd recommend doing it this way. No more thinking about what port is allready exposed etc
Audiobookshelf is quite nice too. The ebook reader isn't quite there yet, but it develops very fast. Also apps for Android and iOS
Fluffy Chat works great for me!
On their github they state that mayor releases take time. And there is activity on the github. So I think their working on it!
Invidius user here. But will check this out.
I understand this, but that way you always read the update notes and you control what version you install. This can be a good practice.
That stuff breaks is not so nice though.
I'm sorry to hear that. But the dev points that out very clear on the docs etc.
From what we self hosters are used to, this does not happen often, but it can.
Hope you can recover!
Yes... That is also my understanding.
But does this matter if you just want this to be locally accessible and you're running your own dns?
https://lemmy.world/comment/10089750
This is how I did it.
You don't want the nextcloud to be public for everyone, then I'd go the tailscale route without a vps. Just connect your Server and phone.
If you want it to be public, then I'd still use tailscale and do it like the other comment suggested.
Reverse Proxy on vps connected to tailscale, proxzies the traffic through the tailnet to your server. That's what I'm doing btw.
Does it need to be selfhosted, or is an open source app okay? Okay I've not red all your post... there is no ios client for aegis... I use aegis: https://github.com/beemdevelopment/Aegis