Congrats on getting everything working - it looks great!

One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you’re running your services behind Wireguard so there isn’t too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you’re more likely to run into issues with services not running on HTTPS.

The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won’t know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).

Congrats !!!

Only one day? Lucky you ! It took me a whole week to get it to work with self-signed ssl certificate behind Traefik + docker + Adguardhome.

Adguard home rewrites and the correct certificate configuration solved most of my isues (android can be picky with self-signed root certificates). But I learned ALOT through the whole week, so I didn’t waste my time :).

I hope you too learned alot :) but if I may, I would switch from AdguardHome to Pi-hole.

I know… AdguardHomes functionalities and UI are awesome and overpass Pi-Holes’ but since I saw they add some strange trackers and very sketchy DNS request in their AdguardVPN android application, I don’t trust them anymore !

If you only access your local domain name inside your LAN and via VPN you can also use Caddy to have local SSL certificates https://caddyserver.com/docs/automatic-https#local-https Have not tried this myself yet but I like the idea of not getting any warnings in browser, and this is safe as long as the Caddy CA root certificate is safe.

I also host all my stuff on 192.168.1.2. It’s just my gaming pc with a bunch of services for piracy but it’s good enough until I can build a proper server in the future.

That’s a lovely desktop picture.

Hello again.

I’ve gone through your steps outlined in this post now for LAN. I’ve made my own network name .crypt and added *.crypt to Adguard and pointed it at the IP address of Nginx.

I’ve then gone and mapped my local services in Nginx. So radarr.crypt sonarr.crypt plex.crypt etc and mapped them to ports.

Now what I enjoyed was that I had to map Adguard to forward to Nginx, but in Nginx I can use the IP address of anything on my network, not just on the host.

So it’s map Adguard in DNS rewrites to Nginx IP, then map the IP:ports in Proxy Hosts in Nginx.

Now when I use my Tailscale exit node (that I have from Home Assistant) I can use those addresses outside the house.

I have noticed it only works for the .crypt domains, and not .local despite being set up as well. I guess because .local is a special address it is harder to map to Tailscale.

Anyway, it’s working for me after following what you’ve done, I just did less in Tailscale because of the exit node

deleted by creator

I’ve been wanting to do exactly what you’re doing here on my LAN for a while. I tried to do it on Friday using Zoraxy and managed to get Homarr running on server.local but couldn’t get anything else running with a name (overseerr.server.local and server.local/overseerr just wouldn’t work, although I did get a webpage on server.local/overseerr it wouldn’t resolve properly).

Anyway as to your second point of getting a nameserver in Tailscale. While I haven’t managed to get a nameserver in Tailscale I have managed to get apps running through Tailscale.

My app was Audiobookshelf. I wanted to be able to just turn on Tailscale on my phone and sync to Audiobookshelf and managed to do just that.

I already connected Audiobookshelf at home with it local IP.

I then spun up a Tailscale container in the docker host that Audiobookshelf was on, signed in to it on the Tailscale dash, then just added the Tailscale network in Docker to the Audiobookshelf docker container.

Now I can turn on Tailscale when I’m out of the house and open Audiobookshelf app and it connects to my.home server.

Meaning I don’t need to remember the IP address and portz I set that up once in the Audiobookshelf app and connect to it at will.

I intend to have a go at attaching it to Syncthing next. I don’t have much use case for Syncthing at present so it’s a perfect app to experiment with. I intent to just attach the Tailscale network to my Syncthing container and just see if it connects. Then I’ll try syncing my Keepass database to my host as an experiment from my phone.

In my head it should be that simple. If it is I’ll just connect all my docker apps that way and spin up another Tailscale instance on my other VM that does my Arr, and I’ll have outside access to everything.

Another point to give you for your quest: if you set up Heimdall and a Tailscale exit node, you can put all your self hosted apps in Heimdall for ease of access and then just hit that through your Tailnet. I have a shortcut on my phone home page. You can then just click the service you want in Heimdall and go to that service.

Edit: turned off the exit node I had running inside Home Assistant and now nothing works. Turns out it wasn’t as easy to connect to the Tailnet as I thought, and I must have been hitting audiobookshelf through my Tailscale exit node after all. But that does mean that my final paragraph still stands, exit node plus a home page (Heimdall, Homarr) gives the same results, but without the nameservers.

This exactly what I’m trying to do, get valid https certificates via a domain name on cloudflare. I have nginx proxy manager running and working to serve a couple of sites like home assistant. The problem I’m having is how do I get valid certificates for my internal services via npm but only be able to access them inside my lan not the internet?

I’m running immich on a Debian machine at home. Anyone can point me to a detailed tutorial on how to achieve this including SSL and with no payments or subscriptions needed?

I used chatgpt to create the exact steps, commands and configurations I needed for my setup and achieved this the seemingly cheatful way. I used nginx and certbot. Worked like a charm. Congrats!