I’ve been using Linux for decades, I’ve worked as a software engineer/architect/sre for around a decade, but networking has always been my biggest gap in knowledge.

I have a local server, I have caddy spun up, a glinet router running their version of openwrt, and I have a domain name purchased through porkbun.

I am looking to setup “local.domain.com” to point to my local server, ideally without exposing it publicly, and enable devices on my home network to be able to access it from that url. Id also like to be able to access containers running on that server by something like “searxng.local.domain.com” or “local.domain.com/searxng” aka without using the port suffix. Id also like to enable https.

I have read so many guides that have fragments of what I need, but nothing that ties enough together to get it working. And with all the options around different domain registers, let’s encrypt, reverse proxies, etc, im struggling just a bit.

Are their any guides (prefer text over YouTube, but beggars cant be choosers) that people recommend that encompass the whole process, instead of just pieces? Id like to understand it instead of just fumble through it.

  • Lem453@lemmy.caEnglish
    2·
    6 hours ago

    This is traefik, but its worth watching this because local SSL and external SSL setup is amazing and highly versatile for homelab

    https://youtu.be/liV3c9m_OX8

    When you adapt this to caddy I recommend a similar certificate configuration

  • d13@programming.devEnglish
    5·
    2 days ago

    Lots of overcomplicated answers, imo.

    Here’s what I did:

    1. Set up a DNS server (I just used Pi Hole docker)
    2. Tell router to use the DNS server
    3. Register domain
    4. Set up Caddy with https to use DNS challenge with registrar’s API key for Let’s Encrypt or similar.
    5. Add subdomain DNS entries to the DNS server for each service. The records point to Caddy’s IP (e.g. jellyfin.<domain>.com)
    6. Add each container to Caddy’s list

    Now every device at home can hit all services by domain name over https. No need for any manual configuration on any client device (certs, hosts, etc.)

    Bonus: Set up split DNS and subnet routing with Tailscale so that it uses the DNS server for that domain. Now any device connecting to the tailnet can connect to the services just like at home. No need to reconfigure apps, etc.

    Simple and it works like magic.

    • 123@programming.devEnglish
      2·
      10 hours ago

      To further simplify.

      For step 1+2 , the router might have a built in DNS resolver which would eliminate the need to maintain another container or service.

      For step 5, depending in the router software, with a single target (e.g. a nas running docker services) you might also be able to add a wildcard rule to catch any query for *.local.domain.com to resolve to that machine. This would simplify adding things in the future as the only thing remaining would be the caddy config.

    • dabe@lemmy.zipEnglish
      2·
      1 day ago

      This is the way. Been running (basically) this for years and genuinely keep my eye out for any simpler suggestions, but nothing comes close.

      I do it slightly different where I use an external DNS (bunny) and point the A records to the tailscale IP of the server running Caddy.

      The benefits are:

      • I don’t force the whole house to rely on my local DNS setup.
      • Nothing breaks when I change routers and mess up IP mappings (which I was doing a lot, but I finally got some nice unifi equipment, so maybe I don’t have to worry about that anymore).
      • I don’t “leak my LAN configuration” to public DNS but I don’t care about that anymore.
      • I can use Tailscale DNS override if I want just my tailnet devices to go through some private/premium DNS resolver.
      • Don’t need to set up subnet routing in Tailscale

      The downside is it doesn’t work at all for devices not on Tailscale. Real bummer when, like, I want my smart TV to just be able to find jellyfin on my LAN with the same domain names. But everything else about it is very convenient.

  • Reannlegge@lemmy.caEnglish
    0·
    2 days ago

    I have a flint 2 (glinet) as my firewall as well, I had read somewhere that I should install vanilla OpenWRT so I did (I have added stuff to it so I like coming up with different flavours when talking to people like rocky road). I have Caddy running in docker on a pi in my LAN I have a password file of some sort that Caddyfile references at the top. Don’t ask me how I formatted it because I do not remember that part but take my secondary pihole as an example of using a domain that cannot be reached, from outside of my lan.

    pihole52.reannlegge.ca {
    @allowed {
        remote_ip 10.0.0.0/8
    }
    handle @allowed {
        redir / /admin{uri}
        reverse_proxy http://10.0.69.52:31415/
    }
    handle {
        respond "Not available from this network" 403
    }
    import easydns_tls
    log {
        output file /var/log/caddy/pihole52.log
        format json
    }
}

    While other places on my domain can be reach outside of my vLANs. I have to secure some things up as I found that my SearXNG is open to the WAN.

    Edit: looks like search.reannlegge.ca was available on the WAN if you where in Canada but I have changed that to only on my vLANs and VPNs