If you decide to not got the YunoHost route, I like the way this guide did reverse proxies with Caddy: https://github.com/DoTheEvo/selfhosted-apps-docker.

You can also run a free cloudflare tunnel. It’s what I us3 so I don’t have to open a port for my nextcloud but still want it to be able to sync to my phone while not on vpn

Yes this is possible. I have a few hosted items with subdomains and I have it set up as follows:

All subdomains point to the same IP. Router port forwards all 80/8080 traffic to server. I use Caddy in Docker to forward the requests based on the subdomain to the appropriate docker container hosting the actual service.

This makes spinning up something new simple. You get a docker container of New Thing going, edit the CaddyFile to point to it too, set up new subdomain in cloudflare. No new open ports needed.

Hope this helps!

You seem pretty focused on reverse proxies for some reason, but that isn’t security. An alternative is a VPN into your network. Simple solution that solves all of your asks if you don’t need many people accessing your services.

Check out yunohost.org (and similar projects) If you’re in for a turnkey-solution.

But yes, a reverse proxy that does all the work and handles SSL is a nice solution. I also use that. It’s relatively easy to set up, doesn’t really slow down anything and makes a lot of stuff easier to manage.

I use NGinx, but Caddy or Traefik will do the same. And I don’t use Cloudflare, so I can’t comment on that.

And btw, Jitsi-Meet is going to require some more dedidated ports for the WebRTC, STUN, etc

I’d look at wireguard / tailscale / headscale and hide your services behind a vpn

There’s a good document from the SWAG reverse proxy that explains it all. I reverse proxy everything on my unraid server through swag and have for years.

Yeah, what @[email protected] suggested is definitely the easiest thing and super practical - I got family members on my tailnet for this purpose. I am however now also looking into some kind of tunneled, reverse proxied and authenticated way to expose a few of my services to other friends where I don’t want to have to put them on tailscale or potentially expose them to more than needed via that route.

I haven’t started yet, but I am updating my network set up soon to install a dedicated OPNsense router as the edge for my network. From there, the plan is to have a cloudflare tunnel that accesses some of these services via a caddy reverse proxy, with Authelia for authentication. That’s the part I have studied enough to feel confident I can do. I am a little weaker on the networking aspects of this, which is where I need to study some more - like isolating those services that are exposed in my network, while still giving them access to some other needed resources within it, etc.