55
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Jun 2025
55 points (96.6% liked)
Selfhosted
46672 readers
1060 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
But having a reverse proxy would enable someone getting access to it to read traffic, while having a VPN Tunnel won't.
If someone manages to get root (!) access on this VPS it's over either way.
Your reverse proxy should have a cert with HTTPS.
Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.
However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.
Or just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.
This is how I make https and mqtts available on ipv4.
Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?
It's merely a tcp proxy. It doesn't even have to be http since it has no idea. The trick with tls is that it can extract the requested host name via SNI.
Hm, okay, that does sound like the real client IP will get lost and every connection will appear to come from the proxy then. It would be good if that were passed somehow. My current setup adds the X-Forwarded-For header for example.
That is correct. There is a trick where you can set the source ip to the ipv6 mapped ipv4 ip it originally came from. I have implemented that in a transparent tcp proxy I worked on some years ago, but I am not sure if nginx supports that.
I should look into that actually. It would be useful to me as well.
Edit: actually that only works if you are in the routing path. However a nat64 solution would work as well, where you map a /64 back to the proxy.
I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.
The VPS solely serves to move the traffic from an external IP to an internal one.
It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.