101–110 of 157 posts
I have tried a ssh port forward solution earlier, but the connection fell down, did not always come up after boot and was generally unreliable.
I found wireguard to be much easier to set up and highly reliable. It's in my own opinion not that hard to set up either, there are plenty of guides. The wireguard project docs are also quite good.
Earlier quoted context omitted.
If it's just for personal use, you can and should use client certificates to ensure that you're the only person who even can connect.
Then I would have to generate certificates and leave them on random people's machines. Plus when I'm sharing things with other people I can't just send them a link, I have to explain how to install the certificate into their browser (or OS in some cases.) On top of all that openssl is very complex and has had serious CVEs before, I'd feel a lot less comfortable exposing that to TOR than a smaller web server.
It's nothing you couldn't do yourself, but we host it for you so you don't have to. We host WireGuard servers which assign a stable public IPv4 and IPv6 on your device's WireGuard tunnel interface.
As far as your device is concerned, it's like its tunnel interface is a publicly addressable connection. Because it is! Just with one extra encrypted hop at the end.
Nothing to install besides WireGuard itself. WireGuard's biggest papercut (Dynamic DNS) is solved because we provide you a connection to a server with a static IP.
No promotional emails. No spam. Just a simple service for a specific, niche need.
Hope to post about its launch here soon. (logan@hoppy.network for questions!)
Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask…
Is your plan to run some sort of IOT application on the PI? I'm a little confused as to why you would go through the trouble of running a reverse proxy on a remote server that is fully capable of hosting your web applications and or just setting up a port forwarding rule on your local wifi router to redirect 10080 to 80.
Privacy; keep data local, without exposing your residential IP.
Earlier quoted context omitted.
Caddy underwent a complete rewrite that also invalidated most of the existing config. Personally I don't see any benefits in using caddy or another non mainstream httpd as it adds more risk to my project with usually very little benefits. Nothing against using it for hobby projects but in production I've migrated back to nginx.
I had an itch to look at Caddy, after reading the comments, but breaking configuration backwards compatibility is a huge turn off.
I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…
As an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.
https://github.com/anderspitman/awesome-tunneling.
There are a surprising number of tools that all do essentially the same thing, and it's often hard to tell how they're different from the other 30 options.
Making a really good solution to this problem has been the focus of my free time for the past month since I wrote this comment[0].
The project I'm working on:
* 100% open source and MIT licensed
* Strive for simplicity throughout. Very few dependencies. No config files, and only a single CLI parameter required to run the server.
* Clients can be remote controlled by the server, and each client can open an arbitrary number of tunnels. ie you don't have to start a separate ngrok process for each tunnel. Just set up the client on each machine you want to tunnel out of and forget about it. Everything is controlled through a simple web UI (or REST api).
* Automate as much as possible. Tunnel creation and Let's Encrypt are already working. Eventually you'll be able to add an API token from your DNS provider and that'll be automated as well.
It's not quite ready (launch planned for 31 Oct 2020), but you can check it out here: https://boringproxy.io/
Earlier quoted context omitted.
Caddy underwent a complete rewrite that also invalidated most of the existing config. Personally I don't see any benefits in using caddy or another non mainstream httpd as it adds more risk to my project with usually very little benefits. Nothing against using it for hobby projects but in production I've migrated back to nginx.
I had an itch to look at Caddy, after reading the comments, but breaking configuration backwards compatibility is a huge turn off.
To give you an idea about the compatibility differences, it's like the upgrade from Vue.js 2 to Vue.js 3. Some changes to format are necessary for the new architecture. But you can always just run the older version (that's what I do). And swapping to the new one isn't terribly painful if your just using vanilla (for Caddy 1 extensions, which weren't created by the developer himself most of the time, I'm sure Caddy 2 versions will pop up over time).
I wish we were a little farther along so I'd have more to say, but we're hoping to solve this with https://hoppy.network/ . It's nothing you couldn't do yourself, but we host it for you so you don't have to. We host WireGuard servers which assign a stable public IPv4 and IPv6 on your device's WireGuard tunnel interface. As far as your device is concerned, it's like its tunnel interface is a publicly addressable conne…
Happy to add hoppy if you think you're a good fit and submit a PR.
A couple questions:
* Do you provide any sort of reverse proxy service, ie HTTPS termination with Let's Encrypt support, similar to OP?
* Do you provide any DNS integration or automation, or purely IPs?
EDIT: Also how would you compare hoppy to Tailscale?