Selfhosted

40152 readers

623 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Struggling to Get Started Hosting a Mix of Local and Publicly Exposed Containers (programming.dev)

submitted 1 year ago by [email protected] to c/[email protected]

12 comments fedilink hide all child comments

I'm new to self hosting and just starting to experiment with web development. I've been reading and cross-referencing several guides, but I'm having trouble figuring out how to put together all the pieces to achieve what I'm looking for. Maybe the perfect tutorial is out there, but I just haven't found the right search terms.

On my Raspberry Pi 4, I have a few Docker containers already up and running:

Pi Hole with network-mode set to host so it can handle DHCP too
Watchtower to keep the Pi Hole up-to-date
Portainer to check on the status of things

In addition those, I'm planning to host a personal website, a small Matrix server, and a few other things eventually. For portability reasons and my own professional development, I want to go all-in on Docker Compose and keep each piece in its own separate container.

The main thing I'm struggling with is figuring out how to configure nginx-proxy-manager and my Docker networks to expose only the containers I want to expose while keeping my other containers safe. More specifically, how do I handle the conflicting ports between Pi Hole and nginx-proxy-manager without exposing my Pi Hole's admin page to the public internet? Can I use the same reverse proxy to manage all my local and public services at the same time?

Another piece that I'm feeling unsure about is pointing my domain name to the right IP address and setting up SSL encryption. It feels like there are a lot of ways to mess it up. What do I need to do to keep things safe and secure? How important is something like Cloudflare tunnel?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (2 children)

I will absolutely start doing more research on firewalls, thank you for the suggestion. That's exactly the kind of obvious thing that I was afraid I would miss.

Dnsmasq is actually already built-in to Pi Hole, I'm pretty sure that's how it redirects advertiser domains to 0.0.0.0 and handles DHCP. I see that I can add more local domains right from the web interface. I didn't realize I could give each containers its own local IP addresses, though. That would make getting to local services much more clean and simple.

I don't have a static IP, and I'm certainly not keen on giving my ISP any more money. I'll look more into DDNS services too.

[–] [email protected] 2 points 1 year ago

I haven't gotten in to containers yet, but there should be some way to let each one use a unique IP. At the very least, give your Pi multiple addresses and then have the service in each container only listen on its assigned address.

[–] [email protected] 0 points 1 year ago

Keep in mind that docker can bypass iptables-based firewall like UFW. When in doubt, do a port scan from an external machine to check which ports are actually open to the internet.