this post was submitted on 06 Aug 2025
43 points (95.7% liked)

Selfhosted

51636 readers
787 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

Am a bit new to all this so apologies if terminology etc isn't correct.

I have my server with apps in docker containers. I have gluetun set-up and working, serving an internet connection to the rest of the containers.

I'm thinking about going down the Tailscale route so that I can use the apps when I'm away from home - haven't needed to so far but its nice to have the option.

For that to work I think I'll need two VPN connections - one to extend the LAN away from the house, the other to provide internet access.

If so, how the hell do I go about setting that up? Can I do this with Gluetun or do I need something else?

Any wise words or links to set-up guides would be much appreciated.

you are viewing a single comment's thread
view the rest of the comments
[–] JoeKrogan@lemmy.world 4 points 1 month ago* (last edited 1 month ago) (1 children)

I have the arr stack connected to gluetun doing its thing and then wireguard on the host. I only expose my reverse proxy to the host and can connect to the services through that.

Note the networks below, vpn_net allows it to talk to the gluetun network which has the other stuff. The gluetun and arr stuff are in a separate compose file that defines the network. Then the non vpn stuff connects to that network when it comes up

nginx: 
    image: nginx:1.25.4-alpine-slim
    container_name: nginx
    restart: always
    volumes:
       - /etc/letsencrypt/:/etc/letsencrypt/
       - ./nginx/nginx.conf:/etc/nginx/nginx
       - ./nginx/conf/:/etc/nginx/conf.d/:ro
       - ./nginx/htpasswd:/etc/apache2/.htpasswd:ro
       -  /var/log/nginx:/var/log/nginx/
       - ./www/html/:/var/www/html/:ro
       - ./content/Movies:/var/www/media/Movies:ro
       - ./content/Shows:/var/www/media/Shows:ro
    ports:
       - 443:443
    security_opt:
      - no-new-privileges
    networks:
      - reverse-proxy_service1
      - reverse-proxy_serviceN
      - vpn-stack_vpn-net
    depends_on:
      - service1
      - serviceN
[–] jobbies@lemmy.zip 2 points 1 month ago (3 children)

wireguard on the host

Ahh. Of course. I don't know why I hadn't thought of that.

Should I consider deploying a reverse proxy? I hear that setting one up can be painful.

I notice you have multiple reverse-proxy services under 'networks' - do you set up a separate network for each service?

[–] illusionist@lemmy.zip 2 points 1 month ago

Nginx proxy manager is easy to use. It has a nice gui. Caddy is incredibly simple after installing. It just has no gui. It cam't be simpler than caddy, just 3 lines.

[–] JoeKrogan@lemmy.world 1 points 1 month ago

Well i have the rp as i only want one port exposed. I have separate networks per service too to isolate things. Only the things that need to talk to each other can.

My stuff is only accessible on the lan and via the vpn and even then only certain ips have access to certain things.

In your case it might be different , but generally a reverse proxy is better as you can have a single point of access to secure and you are not exposing all of your ports to the host or the internet.

[–] foggy@lemmy.world 1 points 1 month ago

I wouldn't say setting up a reverse proxy (to your home LAN) is painful. Its just generally Ill advised. Its painful if compromised.