New(ish) to self-hosting. Question about reverse proxy setup

Hey all, I started my self-hosting by using the script here and modifying it to suit my needs:

My only question is how I get the authentik/headscale/tailscale/cloudflare pieces working as a reverse proxy.

I think I've configured cloudflare correctly since I can hit my external url and it will try to redirect to authentik, but that's really where I'm stuck.

Has anyone else used a similar stack and got it to work? Is there a guide (other than the ones used for this exact stack because they aren't good) I can use somewhere?

Edit: to be clear, I'd like to be able to access my jellyseerr and jellyfin instances from an external url at minimum, but the more I can access, the better. I have cloudflare DNS entries for the whole stack, pretty much

mustard57 4 points a year ago

You don't need a reverse proxy if your using tailscale. Make the server you exit node and you can access jellyfin and everything else from outside the network.

save

path: 0 20522128, hotness: undefined, score: 4, children: 4

kn0wmad1c 1 point a year ago

Alright, I've configured tailscale as an exit node, but I'm getting an error that might be related to cloudflare? I'm not sure.

Tailscale logs show Received error: fetch control key: 403 Forbidden

Is there a guide for configuring cloudflare for this?

save

path: 0 20522128 20522900, hotness: undefined, score: 1, children: 3

ragingHungryPanda 2 points a year ago

tailscale is a vpn. you don't need cloudflare for it. you do need to set up the tail scale container with your credentials from tail scale, which they have guides for. after that, log in on your machine and click the connect toggle and you're in.

the exit node is if you want to look like you're at your host computer.

save

path: 0 20522128 20522900 20525086, hotness: undefined, score: 2, children: 2

kn0wmad1c 1 point a year ago

If you look at the docker compose for the stack I'm using, cloudflare is definitely a part of it:

https://github.com/...

Headscale requires cloudflare, and tailscale requires Headscale. The documentation for how all of this ties together is really sparse, but I think I'm getting the 403 Forbidden from this part of the tailscale yml:

--login-server=https://headscale/.$%7BCLOUDFLARE_DNS_ZONE:?err}

Edit: Lemmy won't let me remove the / in front of the . in the url above, and it keeps url-encoding the open curly bracket for some reason. The code block markdown should be displayed as a literal, so this feels like a bug.

save

path: 0 20522128 20522900 20525086 20528098, hotness: undefined, score: 1, children: 1

ragingHungryPanda 2 points a year ago

that's quite a long compose file.

the way that I use cloud flare is with tunnels since my ISP blocks my ports. I have cloudflared running that connects to the cloudflare tunnel, which has a map of domain name to a service name, which is how services are accessed externally.

tailscale connects to tail scales main service and that's how I access internal systems. at least that's how I'm running it.

save

path: 0 20522128 20522900 20525086 20528098 20528728, hotness: undefined, score: 2, children: 0