Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Putting Raspberry Pi Online with Caddy and SSH Tunnel

gist.github.com

Post reply on HN
Print view View original

91–100 of 157 posts

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#91

Post by sigmaprimus »

sigmaprimus wrote: post #3

Is your plan to run some sort of IOT application on the PI? I'm a little confused as to why you would go through the trouble of running a reverse proxy on a remote server that is fully capable of hosting your web applications and or just setting up a port forwarding rule on your local wifi router to redirect 10080 to 80.

In the readme it is stated, My ISP blocks incomming traffic. That is the reason I asked.

Yes there are privacy reasons but that is not mentioned.

Im guessing the other commentors did not view the OPs git.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#92

Post by eeZah7Ux »

belzebalex wrote: post #21

An esoteric alternative is to host a Tor hidden service. Tor hidden services don't require you open ports, and you don't need a static IP address. Your residential IP is protected by the onion router, and the .onion domain name is free!

Tor onion services are very underrated! They provide resilient access to any service and with built-in encryption and certificate!

The daemon takes very little memory and CPU.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#93

Post by rexfuzzle »

floatingsmoke wrote: post #43

I use Cloudflare Argo Tunnel for this purpose and am very satisfied. It's easy to setup and if you have TLD on Cloudflare, the daemon(cloudflared) creates new A record for each host and creates a tunnel between your host and the nearest Cloudflare data center. You can also run multiple services on a single host. And all these connections are secure.

$5 per month and 10c per GB or am I missing something?

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#94

Post by granra »

driverdan wrote: post #89
granra wrote: post #83

Earlier quoted context omitted.

Is ip_forward[1] enabled on the rpi? Also is your home network's cidr in allowed ips on the vps' wireguard interface? [1]: https://docs.mysirena.xyz/centos-7/prefilight-configuration/...

Yes, IP forwarding is enabled and my home network is set under AllowedIPs.

You can trace log iptables and see first if the wireguard traffic is being blocked by some rule

`iptables -t raw -I PREROUTING -p udp --dport 51820 -j TRACE` (assuming default 51820 port) and look at dmesg or `journalctl -f`

If that is not being blocked then you can look at `iptables -t raw -I PREROUTING -s -j TRACE` and try pinging or reaching a service on your home network and look at dmesg again.

Just don't forget to remove these rules again as they will continue to log.

Beyond that, I'm not sure.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#95

Post by forty »

antoniomika wrote: post #90

Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask…

> This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine

If you share a server with your domain name pointing on it, can't just other people on the server use HTTP validation to get a valid certificate for your domain, then do mitm?

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#96

Post by jlgaddis »

culopatin wrote: post #44

Side conversation: I'm interested in being pretty good at this sort of thing: setting up servers, making them connect, understand the protocols enough to put them to practice. I believe this is in the realm of IT. What are some good resources to read to get to my goal? Thanks!

Routing TCP/IP, Vol. 1 & 2.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#97

Post by jlgaddis »

alexellisuk wrote: post #70
voltagex_ wrote: post #15

Earlier quoted context omitted.

>You will need an inlets PRO license, start a 14-day free trial.

Why do you view paid software as somehow invalid or lesser than (a bunch of open source tools hacked together), or freemium SaaS products mentioned?

The S.O.P. around here is to disclose any affiliations when recommending products -- especially commercial ones.

You failed to do that twice just in this thread.

For many of us, it's a trust thing.

--

ETA:

Speaking of trust, I just read this FAQ on inlets.dev:

> Does inlets PRO "call home"?

> We trust our users to purchase the correct license for their usage, and in return we make licensing simple with a fixed-term license.

So, a few minutes after mentioning that "it's a trust thing", I came across this very simple, to the point, "yes or no" question ...

... and yet I notice that you|your company) (couldn't|didn't), for whatever reason, actually answer the question.

That, of course, makes me even more distrustful than I was a few minutes ago!

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#98

Post by neurostimulant »

I have a similar setup as a fallback method to make sure I can always access my local server at home on any network (the primary methods are using zerotier and opening a port on my router), but I used autossh managed by supervisord to make sure the ssh tunnel stay up. Without autossh, the ssh tunnel sometimes randomly closed. I tried configuring ServerAliveInterval to some low value but the issue still happen sometimes, and when it happened sometimes the port it binds on the vps can't be reused anymore (port in use error). Autossh fixed all of those issues.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#99

Post by bityard »

bpizzi wrote: post #47

I don't get it, I may be missing some context thought: why the author didn't go for running said webapps directly on the VPS in the first place? Why bother running it on the Pi and set up the tunnel (which is a nice hack in itself, I get that)?

One use case is the cost of RAM when you buy a VPS. Low-end VPSes are cheap ($5 a month and under) but if you have multiple apps (or one big one), getting a decent amount of RAM in a VPS raises the price significantly.

Using Linode as a benchmark, a 512 MB VPS is $5/mo but an 8 GB VPS is $40/mo. But an 8 GB Rasberry Pi 4 is well under $100 with peripherals so after three months it will have paid for itself.

This of course assumes:

1. that the cost of powering the Pi is negligible 2. your home internet connection is stable enough and fast enough 3. your apps run as comfortably on the Pi as on VPS

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#100

Post by antoniomika »

forty wrote: post #95
antoniomika wrote: post #90

Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask…

> This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine If you share a server with your domain name pointing on it, can't just other people on the server use HTTP validation to get a valid certificate for your domain, then do mitm?

Reading into it more than I was going for :)

I firewall all traffic over port 80, so HTTP validation won't work. I also don't actually share the server with anyone that has access to it, it's moreso so I can provide them a similar setup to what I have with some semblance of security even if they don't have the expertise to do so.

Post reply on HN