Would it be possible to use ports 443 and 80 for both Adguard Home and Vaultwarden? They’re both on the same machine, Vaultwarden will be in a docker container and Adguard Home not. I’m doing this on an Ubuntu server.
As others have said, a reverse proxy is what you need.
However I will also mention that another tool called macvlan exists, if you’re using containers like podman or docker. Setting up a macvlan network for your containers will trick your server into thinking that the ports exposed by your services belong to a different machine, thus letting them use the same ports at the same time. As far as your LAN is concerned, a container on a macvlan network has its own IP, independent of the host’s IP.
Macvlan is worth setting up if you plan to expose some of your services outside your local network, or if you want to run a service on a port that your host is already using (eg: you want a container to act as DNS on port 53, but systemd-resolved is already using it on the host).
You can set up port forwarding at your router to the containers that you want to publicly expose, and any other containers will be inaccessible. Meanwhile with just a reverse proxy, someone could try to send requests to any domain behind it, even if you don’t want to expose it.
My network is set up such that:
- Physical host has one IP address that’s only accessible over lan.
- Containerized web services that I don’t want to expose publicly are behind a reverse proxy container that has its own IP on the macvlan.
- Containerized web services that I do want to expose publicly have a separate reverse proxy container, which gets a different IP on the macvlan.
- Router has ports 80 and 443 forwarding only to the IP address for my public proxy
Not OP, but thanks for the write up !
Regarding macvlan’s with docker, I tried to use them in the past and while I liked the idea of having every container on it’s own mac /ip address in the home network space, I couldn’t get the host to communicate directly with them.
Everyone on the LAN could talk to my containers, except the host itself. IIRC there was/is some tricky part where you have to change the default route and create new iptables to make it work that way, but It seemed rather hacky and not secure at all.
Now that I’m a bit more experienced with docker and all, do you know if this is possible or still one of the downside of macvlan’s?
Edit: reference. I see he updated his post in 2023, maybe worth a new shot !!
Yeah, I believe there’s some kind of bridge mode you must enable on the host’s interface.
Just as a warning, the macvlan stuff isn’t well documented and seems to have hard limits. I worked with it a couple of years ago and had to eventually read a lot of Docker code to figure some stuff out, and the host was only able to successfully set up 4 macvlan networks at a time - the fifth (and any following ones) were never reachable, even though I used the same scripts as for all other ones.
Things might have improved in the meantime.
You could use Nginx reverse proxy and map the proper domain names to the right ports
Directly no. How would Adguard know the request is for Vaultwerden and suppress the 404?
As others have said, you will need a reverse proxy to make this work. The proxy will listen on port 80/443 and direct the request to the correct application based on path or domain name. Adguard and VW will need to listen on other ports.
If you’re using them for your private use them just put them on different ports. Why do you want them both on the same ports?
You’ll have to do this even if you use a reverse proxy. And also for a reverse proxy to work you’ll need domains defined in DNS.
