Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I’m securing Immich using OAuth.

I don’t have very nerdy friends so not many people appreciate this.

  • valkyre09@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    3 days ago

    I don’t even bother with the internal DNS server. I just set my A records in Cloudflare to point to the private IPs

    • lorentz@feddit.it
      link
      fedilink
      English
      arrow-up
      6
      ·
      3 days ago

      I tired the same, but my router wants to be smart by filtering DNS responses that points to local IP. I guess whoever designed it considered it a security feature. It is a stock router from the ISP, its configuration interface is minimal, borderline to non existent.

    • lka1988@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 days ago

      Sounds like Cloudflare tunnels. I used that for a while, until I realized I didn’t want to be tied to Cloudflare.

    • stetech@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      3 days ago

      Do the private IPs not change at all? Or can you handle that automatically?

      I have next to no experience, but I’m pretty sure that wouldn’t work for me since my IP changes? Idk

      • WolfLink@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 days ago

        Most routers have a feature to assign static IPs to a specific MAC address. You can also tell most devices to try to take a specific IP instead of using DHCP.

        There are multiple ways to set it up, but it’s very possible to set a specific device to always have the same local IP, which is usually the first step to many self-hosting scenarios.

      • valkyre09@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 days ago

        You can either set a DHCP reservation in your router, or manually set the IP on the device.

        When I say private IP, I’m referring to the internal IP e.g 192.168.1.X

        Means internally I just go to the domain without having to remember the IP I set.

        • stetech@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          2 days ago

          Oooh. That makes more sense, thank you.

          I somehow thought you’d meant your global IP addresses, lol

      • starshipwinepineapple
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        2 days ago

        Edit: i see now they’re talking about private IP, but in case you want to learn about getting a static IP for other things…

        Many ISPs will give you a dynamic (changing) IP rather than a static (unchanging) IP. Just check your IP once a week for a few weeks to see if it changes.

        There are some services that get around this by checking your ip regularly and updating their records automatically. This is called a dynamic DNS provider (DDNS). I used to use “noip” but since then there are quite a few like cloudflare DDNS.

        Beyond that you just would want to make sure your router or whatever device is assigning IPs on your network to give a static assignment to the server. Assigning IPs is handled by a DHCP server and it would usually be your router, but if you have a pihole you might be using that as a DHCP server instead.

        Between DDNS and DHCP you can make sure both your external IP and internal IP are static.