Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Putting Raspberry Pi Online with Caddy and SSH Tunnel

gist.github.com

Post reply on HN
Print view View original

151–157 of 157 posts

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#151

Post by grep_name »

anderspitman wrote: post #108

I maintain a list of solutions to this problem: https://github.com/anderspitman/awesome-tunneling . There are a surprising number of tools that all do essentially the same thing, and it's often hard to tell how they're different from the other 30 options. Making a really good solution to this problem has been the focus of my free time for the past month since I wrote this comment[0]. The project I'm working on: * 100…

I've had most of my personal self-hosting held up by a problem with ssh port forwarding for over a month now and am willing to re-think the whole setup at this point.

Basically I have a vps running traefik and a bunch of self-hosted services with letsencrypt in a docker-compose stack, but I want it to also be able to take an ssh-forwarded https port and use ssl termination to get it a letsencrypt cert and point it to the domain I want. Apparently the way to do this is to use the traefik file provider option, but at this point I've been trying to get that to work for a month and I have no idea why traefik doesn't recognize the port.

Do you have any recommendations for someone looking for this setup? As I said I'm willing to scrap my current setup, but would still like to be able to have it all run in docker-compose and not renew the certs by hand.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#152

Post by athriren »

narrationbox wrote: post #139
athriren wrote: post #138

Earlier quoted context omitted.

if you guys do technical blog posts addressing aspects of your toolchain, i request one on this.

You are not the first to ask :) https://news.ycombinator.com/item?id=24436399 I will definitely do a writeup during/before the Christmas break.

ha, thanks! i will look for it!

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#153

Post by anderspitman »

grep_name wrote: post #151
anderspitman wrote: post #108

I maintain a list of solutions to this problem: https://github.com/anderspitman/awesome-tunneling . There are a surprising number of tools that all do essentially the same thing, and it's often hard to tell how they're different from the other 30 options. Making a really good solution to this problem has been the focus of my free time for the past month since I wrote this comment[0]. The project I'm working on: * 100…

I've had most of my personal self-hosting held up by a problem with ssh port forwarding for over a month now and am willing to re-think the whole setup at this point. Basically I have a vps running traefik and a bunch of self-hosted services with letsencrypt in a docker-compose stack, but I want it to also be able to take an ssh-forwarded https port and use ssl termination to get it a letsencrypt cert and point it to…

Are you currently taking advantage of traefik's automatic mapping, or are you manually configuring it for each of your docker services? (disclaimer, I've never used traefik. Feels like too much magic for me).

If you're using the auto-mapping stuff, then honestly it sounds like getting traefik to work for the SSH port is probably your best bet. Do you need it to dynamically set up new ports, or is it the type of thing you have a static set of tunnels you always want available?

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#154

Post by BHSPitMonkey »

3np wrote: post #111
BHSPitMonkey wrote: post #105

Earlier quoted context omitted.

Is exposing one's residential IP address such a bad thing? Is the threat model just that someone might wish to target you individually, and that they'll have better luck finding a vuln into your LAN if your services are listening directly on public ports?

There are unlimited imaginable reasons why one may want to de-correlate the data sent in or out from ones software to ones personal identity, yes.

I'd think that using a remote VPN is a better/broader solution to that particular problem. People don't often self-host things at the home, so it's unlikely anyone out there would see my DNS record and assume that it's of value and a useful tool for correlating my IP with my identity (and this actor would need to have eyes on a lot of different services' server logs in order to have data to _maybe_ correlate with me in the first place).

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#155

Post by grep_name »

anderspitman wrote: post #153
grep_name wrote: post #151

Earlier quoted context omitted.

I've had most of my personal self-hosting held up by a problem with ssh port forwarding for over a month now and am willing to re-think the whole setup at this point. Basically I have a vps running traefik and a bunch of self-hosted services with letsencrypt in a docker-compose stack, but I want it to also be able to take an ssh-forwarded https port and use ssl termination to get it a letsencrypt cert and point it to…

Are you currently taking advantage of traefik's automatic mapping, or are you manually configuring it for each of your docker services? (disclaimer, I've never used traefik. Feels like too much magic for me). If you're using the auto-mapping stuff, then honestly it sounds like getting traefik to work for the SSH port is probably your best bet. Do you need it to dynamically set up new ports, or is it the type of thing…

All of my traeffik setup with the exception of some toml for the forwarded port file-descriptor thing are handled in the labels of my docker-compose file. I'm not totally sure if that means I'm using automatic mapping or not, but I do explicitly tell it which ports should be exposed and which domain they should route to (all my language about this is pretty fuzzy since I haven't looked at it in awhile).

I don't need to dynamically set up the new ports really. I just have a shell script on the server that forwards the ports using ssh forwarding, and those ports probably won't ever change.

Have you done something similar with an alternative tool? It wouldn't break my heart to migrate from traefik to something else, although I do REALLY appreciate how it integrates into docker-compose and how easy it makes letsencrypt cert creation / renewal (I didn't really like the nginx solutions I was seeing for letsencrypt)

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#156

Post by alexellisuk »

voltagex_ wrote: post #71
alexellisuk wrote: post #70

Earlier quoted context omitted.

Why do you view paid software as somehow invalid or lesser than (a bunch of open source tools hacked together), or freemium SaaS products mentioned?

I don't, necessarily, but it might have been nice to be up front in your comment that you were advertising for your company.

Inlets is free and open source.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#157

Post by alexellisuk »

jlgaddis wrote: post #97
alexellisuk wrote: post #70

Earlier quoted context omitted.

Why do you view paid software as somehow invalid or lesser than (a bunch of open source tools hacked together), or freemium SaaS products mentioned?

The S.O.P. around here is to disclose any affiliations when recommending products -- especially commercial ones. You failed to do that twice just in this thread. For many of us, it's a trust thing. -- ETA: Speaking of trust, I just read this FAQ on inlets.dev: > Does inlets PRO "call home"? > We trust our users to purchase the correct license for their usage, and in return we make licensing simple with a fixed-term l…

The answer is no, if it wasn’t obvious I’ll make an edit there. Inlets is free and OSS, inlets PRO is not free and optional. You can decide what works for you. In any case it’s much simpler than said hacks with Caddy and ssh
Post reply on HN