Use a Reverse Proxy Server for Local SSL Certificates on all Home Lab Services!

[@PolarRed]

Great guide and even better timing! Solved a problem I just couldn't sort out myself with NPM running in a LXC container on Proxmox. Everything up, running and working now. Thanks Frank, you're a star!

[@WunderTechTutorials]

Glad to hear it helped! Thanks for watching!

[@Arctics04]

I was looking exactly for this. Thanks in advanced. You are the best 🙌

[@TechMeOut5]

Excellent video Frank, this is definetly one of the best guides on the topic to date. everything is explained beautifully and clearly. excellent job!

[@WunderTechTutorials]

Thanks, Avi! Appreciate you watching!

[@huskylfp1505]

Excelente!!! Lo Andaba Buscando!

[@lost_donkey9153]

Enjoyed the video. Silly question, when referencing the "Accessing Synology Services with Cloudflare..." video, should one follow that entire video/guide prior to completing the steps in this video?

[@WunderTechTutorials]

Thanks! No, only the first part where you connect the domain to Cloudflare. Then you can pick back up here.

[@Sapious1]

Long live NGINX PM!

[@carlosaraoz1481]

Great video! I’ll try if this setup works with Photostation and custom subdomain. Thanks!

[@lezz27]

Thanks for the video. 2 quick questions- 1. Is this necessary if you are not exposing the services to the internet? 2. Can you create a quick guide on changes we need to do on Pfsense if we want to run NPM inhouse along with Cloudflare? Thanks

[@WunderTechTutorials]

Definitely not necessary - it's mainly for usage and there are a few services that require a reverse proxy to work (Vaultwarden is one of them), and if you don't want to expose it externally, this is one way to do it. There aren't really any changes on the pfSense side. You would just create a DNS record in the DNS resolver rather than using Pi-hole.

[@lezz27]

@@WunderTechTutorials Thank you for your response.

[@JustinTarahomi]

Great video--thank you! I used your previous guide for Adguard but decided to uninstall it completely to use Pihole+NPM. I was having noob issues getting adguard to work with npm (network/macvlan etc). Could you do a follow-up guide to make this work well with Tailscale? I know you can set a local DNS in Tailscale, but I was having issues connecting to devices. I'm debating just going back to OpenVPN on my router because I could not get my off-network tailscale device to resolve anything DSM related (NAS is enabled for subnet routing with tailscale, and is running Pihole + NPM.)

[@WunderTechTutorials]

Thanks! If you're running Tailscale on the NAS, it makes it more complicated because you have to use the bridge network IP as opposed to the NPM IP, but it adds a lot of complexity. I'm not sure I'd do this with that setup if I'm being honest.

[@okanerdem]

I think you are using pfsense as a router/fw. It would be good if you can prepare some of pfsense videos for us :) rules etc

[@WunderTechTutorials]

I'll add it to my list! It's hard for me to tell how much interest there is in pfSense videos.

[@ShortKicks7733]

Thanks!

[@Zedris]

Very nice video thanks. This method doesn’t expose anything externally to the wider internet this is just for internal lan usage correct?

[@WunderTechTutorials]

Thanks! Correct, just for internal usage.

[@Zedris]

@@WunderTechTutorials that's awesome will give it a go tonight on prox. thanks!!

[@tomlong5130]

Great Video! I am using Unbound-DNS from opnsense. There is no CNAME possibility. What to do? Thanks!

[@WunderTechTutorials]

Thanks! Do you have an alias option?

[@djheckler92]

you can create a wildcard A record and point it to the IP of the npm. Then you won't have to add cnames each time you create a sub domain.

[@CelsoBarriga]

Thank you for this video and tutorial. This is exactly what I need. Just a couple of questions though. Can you explain again the npm_network and npm_bridge for? I think you mentioned these in the video but my thick head is just not getting it. Is this for bridging all the containers running on the Container Manager? Also, I already have pihole running on raspberry pi, and I have my docker containers running on portainer on my NAS, do I just use the generic Docker Compose file for the reverse proxy?

[@WunderTechTutorials]

The bridge is strictly used for NAS to Container communication. Since we're using a macvlan network interface (npm_network), the NAS cannot communicate with the NPM container through the npm_network - that's what we're using the bridge for. The gateway (.1) is the NAS, and the IP (.10) is the container. Yes, if you have a separate server, the generic Docker container will do what you're looking for!

[@CelsoBarriga]

@@WunderTechTutorials Oh gotcha! Thanks again.

[@CelsoBarriga]

@@WunderTechTutorials Hi! Me again :) I cannot get a wildcard SSL certificate on my Cloudflare domain; it's just timing out. Do I need to run the cloudflared tunnel like in the other video you referenced?

[@WunderTechTutorials]

@@CelsoBarriga No, you should just be able to use the Cloudflare token. Did you set the permissions properly?

[@CelsoBarriga]

@@WunderTechTutorials Hi Frank, thanks for your response. I figured out what was wrong. The container log showed that it couldn't connect to pypi to install the cloudflare module. The docker-compose has the bridge with higher priority than the macvlan network, but the bridge network doesn't have an outside route; only the macvlan network does. So, I temporarily removed the bridge from the container, and then I was able to pull a cert. But if I put the bridge back, this would fail when it comes time to renew the cert, right? And I need that bridge.

[@Arctics04]

I'm running my NAS on a 12 hours daily basis. Is it possbile to outsource the task to my raspberrypi that is running 24/7? I mean it should make no difference right?

[@WunderTechTutorials]

Absolutely! Should run great on a Pi.

[@daddypopp]

So, I got to the point where I set up the DNS record in Pihole, I'm using Duck DNS. when I entered the domain for NPM in the browser it say server not found. What am I doing wrong?

[@WunderTechTutorials]

so the DNS record (xyz.subdomain.duckdns.org) is pointing to the NPM server? And you have a proxy host record in NPM with the correct HTTP/HTTPS, server IP, and port?

[@daddypopp]

@@WunderTechTutorials yes, I'm stumped.

[@daddypopp]

@@WunderTechTutorials Hmmm, it suddenly started working! Didn't change a thing. THanks for your help. Great video as usual.

[@MiFonito]

Nice video I actually use macvlan on Synology but in different VLANs over a LAGG. Btw I tried in NPM to to set it as well for the Synology drive app, but it's not working, because the app needs two ports. Do you know how to set it in NPM?

[@WunderTechTutorials]

Thanks! Did you set it up as a login portal in DSM and assign a port to it? If so, you should be able to use that port - I show it towards the end of the video.

[@MiFonito]

@@WunderTechTutorials Yes, but the problem is when you use the APP, the connections from the appp is done under port 6690, on which the NMP is not listening. And I do not know how to set NPM to listen on this port.

[@WunderTechTutorials]

@@MiFonito The app works for me using the method shown in the video. That's how I've been running it, but you can't have two ports for one reverse proxy rule either way.

[@MiFonito]

​@@WunderTechTutorials hmm interesting than I probably have somewhere a missconfig in the NPM. I will review it. Many thanks for the input! You gave me some ideas on what to check. Also to be more clear I am speaking about the Mobile or Desktop app client.

[@WunderTechTutorials]

My apologies, I thought you meant the mobile app. Right now, this will not work with the desktop app.

[@djheckler92]

By creating macvlan network in docker compose it re-creates the network every time you restart right? I created mine in terminal but have to run a script so that it recreates every time restart NAS.

[@WunderTechTutorials]

No, it should create it once (assuming you don't have any other network interfaces with the same name), and it'll reference it every time it starts, but only create it the first time. I just confirmed on my test setup that it all works as expected after a reboot.

[@djheckler92]

@@WunderTechTutorials Thanks, I think it's because the method I was using was creating a nother macvlan interface on the host that communicates with the docker containers on another macvlan network, but it gets removed with each restart. Your way is much better, will redo everything and follow your guide.

[@priteshtechark4380]

Is it safe compared to Tailscale?

[@WunderTechTutorials]

This is only for internal DNS resolution (though you could use it externally, but Tailscale is more secure in that regard).

[@Snoekverslaafde]

cloudflare tunnel.... problem solved. No open ports etc.

[@WunderTechTutorials]

This is for internal DNS resolution + cert.