Ahhh i gotcha, so basically it forwards traffic through the pi so that you can send traffic through tailscale on devices that don't support it? Sounds like a cool idea tbh
Good on ya for the tailscale/syncthing though, off-site backups are super important! If Jellyfin supported federation you could merge your library and your parents library and have it all accessible through each of your local instances. Maybe one day they'll add it, i think it would be a killer feature.
Glad the write-up helped though, it should at least help you move towards single instances (at least for immich) since you can just backup on tailscale via the dns entry!
Glad to help, yes that is a perfect example of how you could use this to your benefit. Much easier to just tell people to enable VPN (tailscale) and navigate to an easy to remember URL.
I'm somewhere in the middle, I do cybersecurity professionally so i work a lot with technical stuff but my hobbies are much deeper in it so theres a lot of stuff i don't know. But, thanks to these communities i was able to learn how to do a lot of things and have now levelled up into doing the research on my own and trying to give back :)
In your dream scenario, is that each family member would be hosting immich/jellyfin on their pi zero? Or is the pi zero somehow routing traffic for them back to your server for jellyfin and immich?
Happy to help!
Side note, if you want to make publicly available services, you could use cloudflare tunnels. They work in a similar way -- letting your services be accessible over the Internet without needing to open ports. Some other people in the comments have mentioned that Tailscale funnel can also work for this, but i haven't used it so I can't really advise on that front
Just looked it up, seems to pretty cool. Does it only work with one service though? You proxy one port to your tailscale domain name, but does it do routing for additional ports at the same time?
I've only done surface level research into it, and honestly didn't come across this when i was doing the research for NGINX Proxy Manager, but it seems a little limited in comparison.
Happy to be proven wrong though, any easy solution is a good solution :)
That does work great, but when I'm on mobile i find it a lot easier to just go straight to the service rather than using a dashboard (although i have one set up)
Interesting, i didn't know that but that is definitely something worth looking into if you need it for your usecase:
https://tailscale.com/kb/1223/funnel
Personally, I use a cloudflare tunnel for that. I'll probably end up checking out tailscale funnel at some point for fun though
To my understanding, yes! I touched on it in the post but since tailscale is a VPN that doesn't require open ports to access other devices in the tailnet, you don't need to worry about CGNAT
Same thing,
CNAME: * -> @
Which translates to: * -> example.org
* Is a wildcard DNS character, basically meaning any subdomain will get forwarded to the root domain
Where? All the keys in the screenshots are sample keys
First SS: its 01234456789abcdef repeated Second SS: it just says yourapikeyhere
Yes, that is the intention. I suppose I probably could have just edited it to read 'example.org'. But, it's the shorthand notation @ refers to your domain name.
So the A record @ -> [Tailscale IP]
which DNS translates to example.org -> [Tailscale IP]
🫡 just doing my part, when i set it up it was a lot of digging through documentation and videos (the information is there, but it definitely requires some commitment in the research lol). Wanted to make something that gives it all in one go & helps the community out :)
Honestly, this is probably the enhancement to my homelab which has yielded the greatest QoL improvement. Prior to this, I would have to remember port numbers for every service and every ip address that i have something running on (and as my lab has expanded, this has become a lot more challenging).
https://lemmy.browntown.dev/post/1440768
Not sure if you getting mentioned in the post gives you a notification, but just wanted to drop the link here! Hope it helps, I tried to make the walkthrough pretty basic while still keeping it high level where it matters (like I assume anyone attempting this is familiar enough with selfhosting that they can install a docker container without me walking through the entire process)
As requested by /u/funkless_eck@sh.itjust.works, this is a walkthrough of how I set up NGINX Proxy Manager with a custom domain to give me the simplicity of DNS access to my services with the security of Tailscale to restrict public access. This works great for things that you want easy remote access to, but don't want to have open to the internet in general (unRAID GUI, Portainer, Immich, Proxmox, etc.)
Prerequesites
- A custom domain (obviously, because that's the whole point of this tutorial)
- A Tailscale account with your devices linked to it
Steps
-
On the server that you want to serve as the entry point into your network, install the NGINX Proxy Manager Docker container (you could absolutely use a different installation method, but I prefer Docker so that's how this guide will be written)
I. For this, I have a Raspberry Pi that is dedicated to being my network entry. This method is probably overkill for most, but for me it works wonders because I have multiple different devices working as servers and if one goes down I can still access the services hosted on the others.
II. I'm not going to go super in detail here, because there is plenty of documentation elsewhere but you install it the same way you would install any Docker container and follow the first time setup
-
Log into your Tailscale account and get the Tailscale IP for the entry device (ex. 100.113.123.123)
-
Get the SSL information from NGINX Proxy Manager for your domain
I. Navigate to "SSL Certificates" and then "Add SSL Certificate" !
II. Select "Let's Encrypt"
III. Type in your domain/subdomain name in the first box
IV. Enter your email address for Let's Encrypt
V. Select "Use a DNS Challenge"
VI. Select your DNS provider in the dropdown
VII. From here, you're all set for now. We will continue with this later !
-
In your domain DNS dashboard, you will need to do a few things (I use Cloudflare, but the process should be more or less the same with whatever provider you use):
I. Set up an A record that redirects the root of your domain (or a subdomain, depending on your configuration) to your Tailscale IP from step 2
II. Set up a wildcard redirect that points back to your domain root. This is important because it will redirect subdomain requests (i.e. service.example.org to your root example.org which then points to the Tailscale IP) !
III. (This is going to be dependent on your provider) Generate an API key for NGINX to use for domain verification, this can easily be achieved in the Cloudflare dashboard in the API key section. The key needs to have permissions for Zone.DNS !
-
Back in NGINX Proxy Manager, drop in your API key in the text box where it asks for it (you need to replace the sample key). !
-
The hard part is done, now it's just time to add in your services!
Here's an example of proxying Portainer through NGINX Proxy Manager:
-
Might be obvious, but open up NGINX Proxy Manager
-
Click "Add Proxy Host"
-
Type in the URL that you want to use for navigating to the host, I prefer subdomains (i.e. portainer.example.org) !
-
Type in the IP address and port for the service
I. Here's the neat part: because NGINX is running in Tailscale, you can connect to both other services in your tailnet or other devices running in your network that don't necessarily have Tailscale running on them.
II. An example of this, would be if you have two houses (yours and your friends), where you have services deployed at both locations. You can have NGINX reach out through Tailscale to the other device and proxy the service through your main network without needing to set it up twice. Neat, right?
III. Conversely, if you have a server running in your network that you cannot install Tailscale onto (for support reasons, security reasons, whatever), you can just use the internal IP for that device, as long as the device NGINX Proxy Manager is running on can access it.
-
Navigate to the SSL tab of the window, and select your recently generated Let's Encrypt certificate !
-
And you're done
Now, you can connect your phone or laptop to Tailscale, and navigate to the URL that you configured. You should see your service load up, with SSL, and you can access it normally. No more remembering IP addresses and port numbers! I don't personally meet this usecase, but this solution could also be useful for people running their homelab behind CGNAT where they can't open ports easily -- this would allow them to access any service remotely via Tailscale easily.
EDIT: The picture formatting is weird and I'm not really sure how else to do it. Let me know if there's a better way :)
Sounds good! I'll write something up & post on selfhosted
Just give me a couple days :)
- Tailscale for remote access
- Portainer for GUI docker management
- NGINX Proxy Manager running behind tailscale for accessing your services easier (can go into greater detail on this)
- SSH for anything else
IMO, trying to avoid CLI in server administration is doing yourself a long term disservice. Its not that challenging and you'll learn a lot more about how everything works. Plus, you're pretty much not going to be able to avoid the terminal forever.
Hey now, just dance with Kinect was genuinely the best way to play that game format (and was before the onset of their subscription platform to access the full song library)
Although, I'm a real sucker for rhythm games so maybe I'm just biased
Had a hunch from the bg color: Source
Edit: Paywall Bypass
Jakob is super cool!! I got to meet him in person at LTX 2023, he gave me a mic and told me to start streaming :)
The prospect of the pop megastar endorsing President Biden in the 2024 election has irked conservative stars on the cable network.
Its a gift link, so shouldn't be a paywall :)
As the title states, I have an issue where all images stored in pictrs are returning a 404 when trying to view them. You can see an example of this here https://lemmy.browntown.dev/post/27130.
If i check the pictrs docker volume, I can find the image manually and if I curl pictrs_ip:8080/image/original/[image.ext] i can view it in the browser. So I know for a fact that Lemmy is communicating with pictrs to upload the image, but there's something funky going on with viewing.
Hopefully someone here has an idea of where to go with this, I'm at my wits end lol. I've tried:
- Creating a different pictrs container and using that
- Pointing to an external ip for pictrs (i.e. 192.168.x.xxx instead of pictrs:8080)
Not sure what to do outside of this?
EDIT: Turns out the solution was to disable "cache assets" in nginx proxy manager! Not sure why that helped, but once I did that everything started working as expected.
As thr title states, has the community found a new home yet? Want get back to monitoring for those grail trackers!
I stood up my own instance, and it's federating (kind of?) but none of the posts are showing up with their comments. If I look on the main instance I can see the comments but not on mine.
This also applies to sticky posts not being stickied when i view from my own instance. Is this a bug, a misconfiguration on my end, or a result of servers being overloaded?
EDIT: In case anyone else has this, the issue was that I made the boneheaded mistake of just using the docker container for postgres i already had running without checking versions. Lemmy needs postgres15 and i gave it postgres11, causing comments not to be saved in the db and all sorts of funky issues.