I have a small homelab that is not open to the internet. I am considering the following setup. Please let me know if there are any glaring issues or if I am over complicating things.

  • I want to setup a reverse proxy in the cloud that will also act as a certificate authority. (I want to limit who can access the server to a small group of people.)

  • I will setup a vpn from a raspberry pi in my home to the reverse proxy in the cloud.

  • The traffic will pass from the raspberry pi vpn to my homelab.

I am not sure if I need the raspberry pi. I like the cloud as the reverse proxy as I do not have a static IP. I would just get a cheap vps from hetzner or something like that.

  • Mike Wooskey@lemmy.thewooskeys.comEnglish
    2·
    1 month ago

    I have a similar setup. I use d.rymcg.tech (a configuration manager for Docker, as well as a collection of open source web services and config templates) and have Traefik (reverse proxy) on a Digital Ocean dropet connected to a VM in my home lab through wireguard. This framework allows me to put authentication and authoriation in front of any apps/services I’m hosting (HTTP basic auth, oauth2, mTLS). This setup allows me to control what is allowed access from outside of my home, without opening any ports.

    • Mike Wooskey@lemmy.thewooskeys.comEnglish
      1·
      1 month ago

      I should add the d.rymcg.tech includes step-ca if you want to host your own CA server, but I agree with @joe@discuss.tchnic.de : it’s not necessary for securely hosting services, and ir can be dangerous I’d not done carefully.

  • Justin@lemmy.jlh.nameEnglish
    2·
    1 month ago

    it might be better to skip the cloud server and use cloudflare for dynamic dns. The standardized way to restrict access to websites is with client certificates or a basic authentication (user/pass) proxy. That would help avoid issues with internet traffic passing through the VPN accidentally.

    • M600@lemmy.worldOPEnglish
      1·
      1 month ago

      Thanks! Last time I checked cloudflare had bandwidth limits. My primary uses for it may use a decent amount of bandwidth as I’ll be hosting jellyfin as well as my backup solution.

      • Justin@lemmy.jlh.nameEnglish
        3·
        1 month ago

        Should work well for that!

        If you use cloudflare for dns only and turn cloudflare proxying off, none of your data or traffic goes to cloudflare’s servers. They just act as your dns server, telling your devices what IP to go to.

  • bezoar@lemm.eeEnglish
    12·
    1 month ago

    If you use tailscale you can omit the raspberry pi and tunnel directly from the reverse proxy to each server (could do this with wireguard but requires a little more setup). Also you can configure your cloud server as an exit node so that all traffic from your device go through it, sort of as a vpn service. It’s not as anonymous as a paid VPN service but at least you bypass the ISP or local wifi provider if you’re out and about.