Selfhosted

60281 readers

705 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

129

I finally understand Cloudflare Zero Trust tunnels (david.coffee)

submitted 7 months ago by artifex@piefed.social to c/selfhosted@lemmy.world

51 comments fedilink hide all child comments

Everything you wanted to know about using Cloudflare Zero Trust Argo tunnels for your personal network. For those like me who were still confused even after reading the article, I think this is the lowdown:

ZT tunnels let you expose private resources/services to the internet (or your users) via Cloudflare’s edge network. You install cloudflared on an internal host, and register a “tunnel” so that requests to a hostname or IP get forwarded securely into your network (similar to tailscale).
Unlike classic VPNs (which open full network access) or traditional Cloudflare tunnels (which merely publish a service), this approach adds granular access control; you can define exactly who can access which resource, based on identity, device posture, login method, etc.
It also solves NAT/firewall issues often faced by P2P-based overlays (e.g., Tailscale) by routing everything through Cloudflare’s network, avoiding connectivity failures when peer-to-peer fails.

For in-browser auth you can then use Cloudflare Access, or you can install the cloudflare Warp client which is a VPN-like thing that would give you full control over the access to whatever service(s) you were exposing this way.

you are viewing a single comment's thread
view the rest of the comments

[–] theparadox@lemmy.world 1 points 7 months ago (1 children)

Do you have any solution for services that aren't over a browser? I've been using Tailscale but I'm looking for alternatives. Pangolin only seems to work for either browser-based services or opening ports to the Internet, unless I'm missing something.

Ex. How do I connect a client app on my phone to my subsonic server for music without opening my home server to the net?

[–] q7mJI7tk1@lemmy.world 1 points 7 months ago

Pangolin is a reverse proxy, so it can forward a URL to any backend service on any port. But you're right in that you have to be signed in on the browser you access it on. Therefore an app won't directly work without prior login. You can create a 'shareable link' in Pangolin, which I use for the Immich app. This gives me header tokens that the Immich app can take in its advanced settings, and that's how that one works.

I've recently moved away from dedicated apps for mobile services and toward web-based access for most things (I use Music Assistant in browser). This isn't perfect for everything and everyone, but I realise now with your question that it's worked well for me transitioning to Pangolin (and at least Immich app works).