• 0 Posts
  • 30 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle











  • Some time ago I’ve done a “public IP implementation” on my VPS when I was on mobile network (no public IP).

    Basically set up IPSec/Wireguard on VPS and connect your router to it. Then setup EoIP over VPN between VPS and your router. Then add EoIP tunnel to your LAN’s bridge in your router.

    Then setup all ports forwarding (using iptables) from your VPS to your router on LAN, so if you connect to your VPS using tcp80, it will be simply forwarded (NAT’ed) to your router. Except tcp22, for SSH to your VPS obviously…

    And now you have yet another public IP lol.

    This is not something you asked, but might give you some ideas.



  • Isn’t “MAC NAT” you are after? I’ve seen Mikrotik has this feature to perform NAT for bridge devices. EDIT: no, since your ISP might check at DHCP leases and realise that you are cheating. Go with regular router instead.

    Also regular router would be sufficient IMO. Also don’t forget to set static TTL value so your “ISP” doesn’t see that you have a router between your devices.

    Also create MAC address and save it. Always change it before connecting - you will have less trouble.






  • Here is the example docker-compose.yml:

    services:
      caddy:
        image: caddy
        container_name: caddy
        volumes:
          - ./caddy/data:/data
          - ./caddy/config:/config
          - ./caddy/Caddyfile:/etc/caddy/Caddyfile
        ports:
          - 80:80/tcp
          - 443:443/tcp
          - 443:443/udp
        restart: always
    
      lemmy:
        image: lemmy
        container_name: lemmy
        ...
    

    Before executing, create a new directory caddy i working directory, then create new file Caddyfile in it (lemmy is a container name):

    mydomain.com {
        reverse_proxy lemmy:<lemmy_container_http_port>
        encode zstd gzip
    }
    

    Then fix your UDP Buffer size, so it’s compatible with QUIC: https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes

    And that’s it. tcp80, tcp443 and udp443 should be reachable from anywhere, as Caddy out of the box uses ACME to retrieve TLS certificates for your domain.

    Give it a try. Honestly Traefik is shit for a simple load balancer. It’s more suited for large enterprises and kubernetes services, but it also has numerous issues, such as basic auth performance issues, lack of headers customization as well as in overall somewhat difficult configuration. Caddy makes it straightforward & simple, which is perfect for simple users who love to self-host.