I have Plex, Radarr, Sonarr, Overseerr etc running in Docker containers, but have never found a good guide on how to access these (safely) from outside. I resort to connecting to a server running VNC. I’ve tried nginx but didn’t understand it, also tried Cloudflare (ditto). Is there a good, easy to understand guide on how to do this?

  • Wander@yiffit.net
    link
    fedilink
    English
    arrow-up
    16
    ·
    1 year ago

    The best way is to have a small server with wireguard installed, which is a VPN. This runs on virtually anything, including a raspberry pi or even a router with open-wrt.

    Anyways, your wireguard server will only accept connections from devices that have its certificate (secure passwordless authentication).

    Once you’re connected to that VPN, it’s effectively as being in your home network.

    You might want to Google for guides on how to setup wireguard on a raspberry pi. Even if you don’t have a PI you’ll surely find the tutorial you need.

  • Veraticus@lib.lgbt
    link
    fedilink
    English
    arrow-up
    14
    ·
    1 year ago

    You’re probably looking for Tailscale. Simple to use, free plan, extensible and powerful.

    • Pivot Wizard@feddit.uk
      link
      fedilink
      English
      arrow-up
      8
      ·
      edit-2
      1 year ago

      In addition to the server and desktop clients, there are mobile apps for both Android and iOS.

      Can be used to connect offsite server for backups or hosting but seen as part of your local network. No need for open ports on your home router.

      Easy way to access you Plex server when away from home.

  • root@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    The safest (but not as convenient) way is to run a VPN, so that the services are only exposed to the VPN interface and not the whole world.

    In pfsense I specify which services my OpenVPN connections can access (just an internal facing NGINX for the most part) and then I can just go to jellyfin.homelab, etc when connected.

    Not as smooth as just having NGINX outward facing, but gives me piece of mind knowing my network is locked down

  • freeskier@centennialstate.social
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    Assuming you don’t want to expose these services directly to the internet (I don’t recommend it) then you want to set up a VPN to connect back to your home network. Wireguard or OpenVPN are the most commonly used. As far as guides that will depend where/how you want to run it.

  • SheeEttin@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    You’ve been given a the usual variety of suggestions, but I suggest also gaining an understanding of networking principles, including RFC 1918 addressing and NAT.

  • techgearwhips@lemmy.world
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    Use cloudflare tunnels. I can access all my localhosts from outside with just one main domain (they are each attached to subdomain of the main domain).

    • SmugBedBug@lemmy.iswhereits.at
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      I’ve found CloudFlare tunnels to be really useful. You can restrict who can have access to your apps outside your nextwork. You can also leave it completely open if you want.

  • FreebooterAmazing@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    Look at Tailscale docker mod. Adds tailscale inside each arr container and treats them each like a tailscale machine, so on app level you can choose if you expose only in your tailnet or expose to internet.

  • Phloating Man@monero.town
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 year ago

    Another option that might work for you is zerotier.

    And you can use sunshine/moonlight to remotely control it.

    • ozillator@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      This is my favorite method. It doesn’t require you to open any ports and minimizes your potential attack surface. You can either install zerotier on each host you want remote access to, or run an instance of zerotier in bridge mode which is essentially acting as a VPN.

  • topnomi@kbin.social
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    I use caddy. Previously used traefik, but it’s more complicated than I needed.

    Caddy can be set to use a single file with all your hosted subdomain listed.

    • tr00st@lemmy.tr00st.co.uk
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Ditto with Caddy. Been using it for a couple of years now and it’s made life a lot simpler. Config format isn’t always obvious, but for most of the cases I’ve needed, a standard 3 line snippet gives you a reverse proxy with automatic working HTTPS with valid certificates.

  • CaptThax@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    1 year ago

    If you are already messaging around with Dockers, check out NGINX Proxy Manager. It simples the NGINX stuff and gives you a nice interface. So if your make that docker with 8080 and 8443 exposed, in your router port forward 80 to 8080 and 443 to 8443. Then when you go to ramble.chat or plex.ramble.chat it will point to the proper service.

    point plex.ramble.chat (cname) to ramble.chat in your registrar. Point ramble.chat (A record) to your public ip (dyndns if you don’t have a static)

    In NGINX you make a host, plex.ramble.chat and point that to where it lives in your network 10.0.10.5 port 32400 for example.

    On the ssl tab, request new cert for plex.ramble.chat with let’s encrypt.

    Check all the boxes. Now when you go to https://Plex.ramble.chat it will take you to your Plex instance! I would do the same with overseer but not the *arrs. I do req.ramble.chat

    Personally I use wireguard. A bit more involved to set up but slimmer IMO. When I put the app on my Android I barely noticed a battery hit with my always on VPN but I can hit my network anywhere from my phone.

    Hope this helps!

  • FreebooterAmazing@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    Look at Tailscale docker mod. Adds tailscale inside each arr container and treats them each like a tailscale machine, so on app level you can choose if you expose only in your tailnet or expose to internet.

  • ramblechat@lemmy.worldOP
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Thanks for all the suggestions - I think Tailscale is the way to go, it didn’t take me long to set up and there is a client for all my devices.