• 0 Posts
  • 8 Comments
Joined 3 years ago
cake
Cake day: November 29th, 2021

help-circle

  • Everything I mentioned works for LAN services as long as you have a domain name. You shouldn’t even need to point the domain name to any IP addresses to get it working. As long as you use a domain registrar that respects your privacy appropriately, you should be able to set things up with a good amount of privacy.

    Yes, you can do wildcard certificates through Let’s Encrypt. If you use one of the reverse proxies I mentioned, the reverse proxy will create the wildcard certificates and maintain them for you. However, you will likely need to use a DNS challenge. Doing so isn’t necessarily difficult. You will likely need to generate an API key or something similar at the domain registrar or DNS service you’re using. The process will likely vary depending on what DNS service/company you are using.


  • Congrats on getting everything working - it looks great!

    One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you’re running your services behind Wireguard so there isn’t too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you’re more likely to run into issues with services not running on HTTPS.

    The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won’t know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).




  • rhymepurple@lemmy.mltoSelfhosted@lemmy.worldProtectli FW6B
    link
    fedilink
    English
    arrow-up
    2
    ·
    9 months ago

    Some additional ideas for the Protectli device:

    • backup/redundant OPNsense instance for high availability
    • backup NAS/storage
      • set it up at a family/friend’s house
    • a test/QA device for new services or architecture changes
    • travel router/firewall
    • home theater PC
    • Proxmox/virtualization host
      • Kubernetes cluster
    • Tor, I2P, cryptocurrency, etc. node
    • Home Assistant
      • dedicated local STT/TTS/conversation agent
    • NVR
    • low powered desktop PC

    There are so many options. It really depends on what you want, your other devices, the Protectli’s specs, your budget, etc.