131–140 of 157 posts
Look at https://h2o.examp1e.net/ H2O web server seems to be faster than nginx , litespeed and supports http1/http2/http3 . It's config file is yaml file. For HTTPS, i recommend https://acme.sh . It's very very easy and autorenews certificates using cron job.
If you are on AT&T u-verse you can just assign a part of your IPv6 subnet (which appears to be static) to your RPi and disable the firewall to that host. Then you can accept incoming connections on ports 80, 22 and even 25 (for 25 I had to send a chat message in my AT&t account and it was opened the same day). Then you can have a full IPv6 web server at no additional cost to the price of your u-verse home internet.
Earlier quoted context omitted.
zerotier is nice, but I have migrated to tailscale. Its based on wireguard and seems even better performance wise.
> Its based on wireguard and seems even better performance wise. I hadn't considered that, but it makes sense. Since ZeroTier is layer 2, I'd expect it to become a leaky abstraction (at least for performance) in certain cases where algorithms are expecting other layer 2 hardware to be essentially directly connected with a wire when in reality they're connected over the internet.
I maintain a list of solutions to this problem: https://github.com/anderspitman/awesome-tunneling . There are a surprising number of tools that all do essentially the same thing, and it's often hard to tell how they're different from the other 30 options. Making a really good solution to this problem has been the focus of my free time for the past month since I wrote this comment[0]. The project I'm working on: * 100…
THANK YOU! I still miss Serveo because this was easiest tunnel solution that "just works!"
If you just need ad-hoc tunnels on someone else's servers for free, I'm not sure what the leading options are. localhost.run is one.
Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask…
I've been using ZT for years. It's been absolutely amazing. It had some growing pains and often the network interface would hang, sometimes so badly that a full node restart would have been required, but these days it is super stable even under high load (talking about 1x-1xx TB per month)
Earlier quoted context omitted.
I would personally trust SSH based on OpenSSH the most, WireGuard second, custom SSH third, TLS 4th, and then the rest.
Interesting! I thought Wireguard is 4K lines of code while OpenSSH is hundreds of thousands of lines of code. Thus Wireguard is more secure.
I picked OpenSSH purely because it's been around so long and had so much data tunneled through it.
That said, I would still trust WG with my data. I just don't trust it more than a proven SSH implementation, yet.
I wish we were a little farther along so I'd have more to say, but we're hoping to solve this with https://hoppy.network/ . It's nothing you couldn't do yourself, but we host it for you so you don't have to. We host WireGuard servers which assign a stable public IPv4 and IPv6 on your device's WireGuard tunnel interface. As far as your device is concerned, it's like its tunnel interface is a publicly addressable conne…
Earlier quoted context omitted.
As an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.
At Narration Box we use Tailscale with Caddy's Cloudflare Let's Encrypt DNS-01 for internal DNS resolution + TLS for the apps that need it. In essence you get something like Google's internal "go/ links" except everything's hosted on the external DNS server and automatically protected by default by Tailscale since the IPs pointed to cannot be accessed publicly.
Earlier quoted context omitted.
At Narration Box we use Tailscale with Caddy's Cloudflare Let's Encrypt DNS-01 for internal DNS resolution + TLS for the apps that need it. In essence you get something like Google's internal "go/ links" except everything's hosted on the external DNS server and automatically protected by default by Tailscale since the IPs pointed to cannot be accessed publicly.
if you guys do technical blog posts addressing aspects of your toolchain, i request one on this.
https://news.ycombinator.com/item?id=24436399
I will definitely do a writeup during/before the Christmas break.
If you are on AT&T u-verse you can just assign a part of your IPv6 subnet (which appears to be static) to your RPi and disable the firewall to that host. Then you can accept incoming connections on ports 80, 22 and even 25 (for 25 I had to send a chat message in my AT&t account and it was opened the same day). Then you can have a full IPv6 web server at no additional cost to the price of your u-verse home internet.
One downside is the actual steps are going to be different for every ISP/router combination. Tunneling is a universal solution, and provides other interesting tradeoffs.