Putting Raspberry Pi Online with Caddy and SSH Tunnel • Hacker News Board

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#31

Post by kzrdude » Mon, Oct 26, 2020, 10:10 AM UTC

quaintdev wrote: post #20

sneak wrote: post #17

Earlier quoted context omitted.

The solution in TFA works behind NAT and routers/firewalls, and has the added benefit of encrypting all of the traffic between the two machines thanks to SSH. I’m not sure people who aren’t network administrators should be putting public IPv6 all over their LAN behind their router, at least not until v6 is more common and routers have better inbound security features for such things (like how NAT functions today for…

NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.

Security has layers, no layer has to be perfect. What's wrong with having NAT as an obscurity layer?

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#32

Post by birracerveza » Mon, Oct 26, 2020, 10:21 AM UTC

jeromenerf wrote: post #6

> I disabled nginx on the server and installed Caddy instead. I wonder how a somehow simpler config syntax (Caddyfile) compares to a simpler maintenance system (apt).

It is much simpler, to the point it's a fault.

I mean, in 90+% of cases, you just put in your Caddyfile

  *host* {
      reverse_proxy 0.0.0.0:*port*
  }

and you get a fast reverse proxy that just works, with letsencrypt enabled by default to boot, nothing to worry about.

However, if you find yourself against a service that requires a slightly more advanced configuration, good luck making sense of their opaque configuration, especially since they now went v2 so everything old is out of the window, so if you search for something, chances are it's no good anymore.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#33

Post by gprasanth » Mon, Oct 26, 2020, 10:24 AM UTC

Had a similar setup going.

What next? Well I setup some handy shell functions:

1) copy the latest screenshot into webroot/screenshots/${randstr}.png and copy the url to clipboard. this replaces dropbox's cool screenshot sharing feature. love sharing screenshots with coworkers this way, the files stays with you, you can redact easily.

2) serve static files the same way, if needed too. the magic's all in the shell scripts.

3) explore new open source webapps running on local docker.

Further?

Build a sort of like a devtools backend server, and a mobile app paired to it to do all sorts of cool stuff: run crons, get notifications for events, monitor servers / ssl expiry etc.

Limit's your imagination. But, security is also very important.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#34

Post by xorcist » Mon, Oct 26, 2020, 10:26 AM UTC

sneak wrote: post #18

iamd3vil wrote: post #11

Earlier quoted context omitted.

OP has literally written in the gist about exploring a way to map entire port range and avoiding doing this, so the non hacky way of doing this is setting up something like a wireguard tunnel. That's the reason I suggested doing this instead of a tunnel which has other disadvantages like doing TCP on TCP.

SSH tunnels do not run TCP inside of them, just the bytes of the connection data itself. The only TCP in use is the TCP connection of the SSH connection between hosts.

It used to be common (at least not unhead of) to run ppp over ssh, which has this problem.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#35

Post by dominicl » Mon, Oct 26, 2020, 10:30 AM UTC

One can also use the Diode P2P network to get the same without a server: https://support.diode.io/article/ss32engxlq works for ssh remote access, websites and stuff similar to ngrok just without the strings attached.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#36

Post by johtso » Mon, Oct 26, 2020, 10:43 AM UTC

I just set up a raspberry pi with ZeroTier. So far it seems like a really easy way to make the pi accessible whatever network it is in, and took minimal configuration to have it forward requests to any of the other devices on the internal network.

The only drawback is I don't think it would be possible to connect to a peer from something like heroku where you don't have full control over the server..

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#37

Post by mercora » Mon, Oct 26, 2020, 10:45 AM UTC

franga2000 wrote: post #24

quaintdev wrote: post #20

Earlier quoted context omitted.

NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.

Yes, BUT: for many many years, home networks have relied primarily on NAT for security. The firewall was only ever touched when doing something advanced and even people who were doing things like setting up home servers and such rarely had to deal with it. Every single tutorial on the topic is IPv4-specific and until IPv6 isn't more common, people will not write guides and tutorials with IPv6 in mind. So until the kn…

i don't think the typical NAT setup differs too much from a typical filtering setup. That is, only allow return traffic from public interfaces. While that is kinda implicit using NAT the change to being explicit is trivial.

somewhat simplified like this using iptables on linux:

  iptables -t nat -A POSTROUTING -o WAN -j MASQUERADE

vs

  iptables -A FORWARD -i WAN -m state ! --state RELATED,ESTABLISHED -j REJECT

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#38

Post by megous » Mon, Oct 26, 2020, 10:46 AM UTC

rmoriz wrote: post #13

jeromenerf wrote: post #6

> I disabled nginx on the server and installed Caddy instead. I wonder how a somehow simpler config syntax (Caddyfile) compares to a simpler maintenance system (apt).

Caddy underwent a complete rewrite that also invalidated most of the existing config. Personally I don't see any benefits in using caddy or another non mainstream httpd as it adds more risk to my project with usually very little benefits. Nothing against using it for hobby projects but in production I've migrated back to nginx.

I had an itch to look at Caddy, after reading the comments, but breaking configuration backwards compatibility is a huge turn off.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#39

Post by tiku » Mon, Oct 26, 2020, 10:51 AM UTC

Autossh for the tunnel works great.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#40

Post by hnarn » Mon, Oct 26, 2020, 11:08 AM UTC

belzebalex wrote: post #21

An esoteric alternative is to host a Tor hidden service. Tor hidden services don't require you open ports, and you don't need a static IP address. Your residential IP is protected by the onion router, and the .onion domain name is free!

> the .onion domain name is free!

I mean, you’re technically correct, but isn’t this kind of like saying that the .local TLD is free of charge? It’s “free” because it’s not a part of the “normal” internet.