Selfhosted

42055 readers

592 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

[SOLVED] I've set up docker services behind nginx proxy manager so they're accessible with https, but the http services are still open. How do I close them? (lemmy.world)

submitted 3 days ago* (last edited 3 days ago) by robolemmy@lemmy.world to c/selfhosted@lemmy.world

12 comments fedilink hide all child comments

I'm using a docker compose file, and I have everything running just fine, containers talking to each other as needed, NPM reverse proxying everything via a duckdns subdomain... everything's cool.

Problem is, I can still go to, for example, http://192.168.1.30:8080/ and get the services without http.

I've tried commenting out the ports in the compose file, which should make them only available on the internal network, I thought. But when I do that, the containers can no longer connect to each other.

Any advice for me?

Edit:

Thanks for the quick & helpful suggestions!

While investigating bridge networks, I noticed a mention that containers could only find each other on the default container bridge by container name, which I did not know. I had tried 127.0.0.1, localhost, the external IP, hostnames, etc but not container names.

In the end, the solution was just to use container names when telling each container how to find the others. No need for creating bridge networks or any other shenanigans.

Thank you!

you are viewing a single comment's thread
view the rest of the comments

[–] just_another_person@lemmy.world 1 points 3 days ago (1 children)

Don't forward them, close firewall ports, change configs to not listen on those ports, setup redirects to forward all requests on those ports to whichever you want.......lots of options here

[–] robolemmy@lemmy.world 2 points 3 days ago (1 children)

My firewall is closed, nothing is forwarded. This is all on my LAN only. I just don't want the non-https ports available at all, even on the LAN.

[–] vividspecter@lemm.ee 1 points 3 days ago* (last edited 3 days ago)

There's likely a firewall on the system that hosts the docker services, and docker's default bridge rules bypass it when publishing a port. And since the docker rules are prioritised, it can be quite difficult to override them in a reliable way. I personally wish that the default rules would just open a rule to the host, but there might be some complexity that I'm missing that makes that challenging.

I personally use host networking to avoid the whole mess, but be aware you'll have to change the internal ports for a bunch of services most likely, and that's not always well-documented. And using the container name as the host name won't work when referencing other containers, you'll have to use e.g. localhost: even inside the network.

You can do the bind to localhost thing that others have mentioned, as long as the reverse proxy itself is inside the docker network (likely there are workarounds if not).