You having a domain or not has no bearing on which of these you use lol

I use Synology integrated reverse proxy, stupidly simple and always works for me (only if IPv6 doesn't fuck up itself, I can't fallback to IPv4 because that is CGNATED), if I am missing features that other options have I would like to know

my laziness does though! ill keep that service in mind though

I like NPM, it's simple, but also allows for more complex configs as well if needed. I run it in its own LXC because I have other non-dockerized things that are exposed.

having tried many in past, i always go back to haproxy. it has everything required as proxy and load balancer while also being very efficient.

I've looked at it but never actually given the Synology proxy a go despite using their DNS server. Does it do auto certificate renewal?

Have you considered using a Cloudflare tunnel to bypass the CGNAT? You can do that into a proxy or straight into the service.

same, i've been very happy with Caddy, even with lots of subdomains and weird configs it's been rock solid.

Simple question but can be a complex answer. Basically it depends where your phone gets DNS from: if it's using the ISP DNS (or some other public DNS server) it will resolve the public internet IP of your server and the data will route out to the ISP WAN before being routed back in.

On the other hand you can configure a split DNS system, so say you are using your modem/gateway as your DNS server and it forwards DNS queries up to your ISP (or other) DNS server - a common setup, 1. you can add in a static host entry for your local server. Eg 'yourservice.yourserverdomain.com = 192.168.1.20 (your server's LAN IP)'

Now when your phone is on the WiFi and it looks up your server's address it gets the local IP and routes locally, which will be faster.

If you need more info, search for terms like 'reverse proxy split DNS best practice'.

Traefik is a PITA.

Caddy all the way. If you build it with Docker support (or grab the prebuilt), you can use docker container names to reverse proxy using names instead of any IP addresses or ports. It's nice because if the IP updates, so does caddy. All automatically.

Here's what my caddyfile looks like;

{
        acme_dns cloudflare {key}
}

domain.dev {
        encode zstd gzip
        root * /var/www/html/domain.dev/
        php_fastcgi unix//run/php/php8.1-fpm.sock
        tls {
                dns cloudflare {key}
        }
}
*.domain.dev {
        encode zstd gzip
        tls {
                dns cloudflare {key}
        }
        @docker host docker.domain.dev
        handle @docker {
                encode zstd gzip
                reverse_proxy {portainer}
        }
        @test host test.domain.dev
        handle @test {
                encode zstd gzip
                reverse_proxy 127.0.0.1:10000
        }
        @images host i.domain.dev
        handle @images {
                encode zstd gzip
                reverse_proxy 127.0.0.1:9002
        }
        @proxy host proxy.domain.dev
        handle @proxy {
                encode zstd gzip
                reverse_proxy proxy
        }
        @portal host portal.domain.dev
        handle @portal {
                encode zstd gzip
                reverse_proxy portal
        }
        @ping host ping.domain.dev
        handle @ping {
                encode zstd gzip
                respond "pong!"
        }
}

DNS hosted by cloudflare but because caddy handles ACME certs, all the subdomains automatically get SSL.

Caddy all the way!

If you're just going to VPN in to your home network, I've found caddy to be the simplest.

I tried using PiVPN to route my phone's Internet access through my home network, but it kept breaking and I found I don't have a head for networks.

Would caddy be able to do that in an easier to maintain way?

I had a poor experience with NPM which turned me to SWAG, it worked, but was a tad slow. Moved to Traefik and haven’t looked back.

Set up wireguard in a docker container and then forward the port to wireguard, the default container on docker hub is fairly straightforward and you can always ask me for help if you need :).

However, If you are using ipv4, you need to make sure that you're not behind a CG-NAT (If you think you might be, call your ISP and tell them you have security cameras that need to get out or something like that).

You could also try tailscale which is built using wireguard with nat-busting features and a bit easier to configure (I dont personally use it as wireguard is sufficient for me).

After that Caddy + DNSMasq will simply allow you to map different URLs to IP addresses

• dnsmasq
  • will let you map, E.g. my_computer -> 192.168.1.64
• Caddy (Or nginx, but caddy is simpler)
  • will let you map to ports so e.g.:
    • with DNS (DNSMasq as above)
      • http://dokuwiki.my_computer -> http://my_computer:8080
    • Without DNS
      • http://dokuwiki.192.168.1.64 -> http://192.168.1.64:8080

Caddy and DNSmasq are superfluous, if you've got a good memory or bookmarks, you don't really need them.

VPN back into home is a lot more important. You definitely do not want to be forwarding ports to services you are running, because if you don't know what you're doing this could pose a network security risk.

Use the VPN as the entry point, as it's secure. I also recommend running the VPN in a docker / podman container on an old laptop dedicated just to that, simply to keep it as isolated as you can.

Down the line you could also look into VLan If your router supports that.

I personally would not bother with SSL If you're just going to be providing access to trusted users who already have access to your home network.

If you are looking to host things, just pay for a digital droplet for $7 a month, It's much simpler, You still get to configure everything but you don't expose your network to a security risk.

I want to just mention frp, I use it to get around firewalls

Thank you, that looks like a good set of hooks for me to get into at a weekend, child allowing.

I very much appreciate the guide. I'll let you know when I've had a fiddle.

Does it do auto certificate renewal?

Yes.

Have you considered using a Cloudflare tunnel to bypass the CGNAT?

I did before when I had some free domain over there, but I don't think there are any worthy free domains out there anymore, and even when they are cheap, I really don't need it and don't feel comfortable to pay for something that I can't use in its fullest (due to CGNAT).

For example, I am aware cloudflare tunnels can't be used for a Plex/Video streaming and that is the number 1 service that I want to be exposed to the Internet.

For now I am living with my IPv6 address and the Synology DDNS with the reverse proxy features... My personal fallback are Tailscale and Zerotier.

Nginx installed directly, I use nano over ssh to edit configs. Forces you to learn some things and I never moved passed it because it works so well.

I think NGINX has the best reverse proxy

Yes, but it is a different cron job that needs to run, and you need to monitor it for failures. Caddy does everything out of the box, including retries.