NAS, Media Center and Home Automation Server

Create and configure public external traffic stack ​

We will configure the public traffic Docker stack; we will configure the firewall to allow the necessary ports; we will bring the stack up through Arcane; we will do Port Forwarding of the HTTP and HTTPS ports for Nginx; we will configure Nginx to redirect traffic to the containers; and we will allow Nginx to act as a proxy for Home Assistant. The stack consists of the following containers:

  • Nginx Proxy Manager: Reverse Proxy engine and manager.

Steps ​

  1. Run: ./scripts/create_nginx_folder.sh to generate the container directory on the SSD.

  2. Edit the stack file: nano ./files/public-traffic-stack.yml.

  3. Replace TZ=America/New_York with your system time zone. You can use this list as a reference: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.

  4. Replace -subnet: fda6:80d8:cf96:1::/64 with the CIDR you generated during docker install using the subnet 1.

  5. Copy all contents of the file to the clipboard. Save and exit with Ctrl + X, Y, Enter.

  6. Run: ./scripts/public_traffic_firewalld_services.sh. Configure Firewalld for containers. The script opens the ports for HTTP and HTTPS for Nginx.

  7. Add stack in Arcane from the browser.

    1. Access Arcane through https://server.lan:3552.
    2. Click "Projects" on the left menu and create a new project.
    3. Name it "public-traffic" and paste the content of the public-traffic-stack.yml that you copied to the clipboard and create the stack. From now on, modifications to the stack must be made through Arcane and not in the file.

  8. Configure the router. If you don't want to expose your services to the internet, skip this step. Each router is different, so you will have to consult your manual to be able to do the following steps.

    1. Forward port 80 and 443 in TCP protocol to the server so that Nginx can reverse proxy the internal services.

  9. Configure proxy hosts in Nginx using DDNS.

    1. Access Nginx through http://server.lan:8181.
    2. Use admin@example.com and changeme as username and password and change the details and password to a secure one. It is again recommended to use Bitwarden for the same.
    3. Navigate to the SSL Certificates tab.
    4. Press Add SSL Certificate. Select Let's Encrypt as certificate provider.
      1. Set up a wildcard domain SSL certificate with Let's Encrypt. For example *.myhome.duckdns.org (note the * at the beginning of the domain).
      2. You need to enable Use DNS Challenge.
      3. Select DuckDNS as the DNS provider.
      4. Replace your-duckdns-token with the token you generated on DuckDNS.org
      5. Accept the terms of service and save.
    5. Navigate to the "Access List" tab and configure a private access list.
      1. Press Add Access List.
      2. In the Details tab fill out:
        • "Name": Private.
        • "Pass Auth to Host": enabled.
      3. In the Access tab fill out:
        • allow: 192.168.1.0/24. Use your LAN IP range if different.
        • allow: XXXX:XXXX:XXXX:1::/64. Where "XXXX:XXXX:XXXX" is your IPv6 ULA prefix and ":1" is the "lan" subnet. Skip if not using IPv6.
        • allow: 10.13.13.0/24. This is for the WireGuard VPN access.
      4. Click Save.
    6. Navigate to the “Proxy Hosts” tab and configure all the proxy hosts we will need. For now, only the Cockpit, Arcane and Nginx services exist. The rest will be created later.
      1. For each row in the table below, click Add Proxy Host and fill the data. If you don't want to share a service to the internet, you can use the Private "Access List" instead of Public. In the SSL tab always choose *.myhome.duckdns.org as SSL certificate and enable all options.
    ServiceDomainSchemeHostnamePortBlock ExploitsWebsocketsAccess ListAdvanced
    Bazarrbazarr.myhome.duckdns.orghttpbazarr6767enabledenabledPrivateN/A
    Beszelbeszel.myhome.duckdns.orghttpbeszel8090enabledenabledPrivateN/A
    Cockpitcockpit.myhome.duckdns.orghttps172.21.0.19090enabledenabledPrivateN/A
    ComfyUIcomfyui.myhome.duckdns.orghttpcomfyui8188enabledenabledPrivateN/A
    Arcanearcane.myhome.duckdns.orghttparcane3552enabledenabledPrivateN/A
    Flaresolverrflaresolverr.myhome.duckdns.orghttpflaresolverr8191enabledenabledPrivateN/A
    Gotifygotify.myhome.duckdns.orghttpgotify80enabledenabledPublicN/A
    Home Assistanthomeassistant.myhome.duckdns.orghttphomeassistant8123enabledenabledPublicN/A
    Jellyfinjellyfin.myhome.duckdns.orghttpjellyfin8096enabledenabledPublic
    # Disable buffering when the nginx proxy gets very resource heavy upon streaming
    proxy_buffering off;
    # Proxy main Jellyfin traffic
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Protocol $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_headers_hash_max_size 2048;
    proxy_headers_hash_bucket_size 128;
    # Security / XSS Mitigation Headers
    # NOTE: X-Frame-Options may cause issues with the webOS app
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "0";
    add_header X-Content-Type-Options "nosniff";
    Nextcloudnextcloud.myhome.duckdns.orghttpnextcloud80enabledenabledPublic
    client_body_buffer_size 512k;
    proxy_read_timeout 86400s;
    client_max_body_size 0;
    NPMnginx.myhome.duckdns.orghttp127.0.0.181enabledenabledPrivateN/A
    Ollamaollamaa.myhome.duckdns.orghttpollama11434enabledenabledPrivateN/A
    Open WebUIopenwebui.myhome.duckdns.orghttpopenwebui8080enabledenabledPrivateN/A
    Profilarrprofilarr.myhome.duckdns.orghttpprofilarr6868enabledenabledPrivateN/A
    Prowlarrprowlarr.myhome.duckdns.orghttpprowlarr9696enabledenabledPrivateN/A
    qBittorrentqbittorrent.myhome.duckdns.orghttpqbittorrent8080enabledenabledPrivateN/A
    Radarrradarr.myhome.duckdns.orghttpradarr7878enabledenabledPrivateN/A
    Seerrseerr.myhome.duckdns.orghttpseerr5055enabledenabledPublicN/A
    Sonarrsonarr.myhome.duckdns.orghttpsonarr8989enabledenabledPrivateN/A
    Z-Wave JSzwavejs.myhome.duckdns.orghttpzwavejs8091enabledenabledPrivateN/A

  10. You can test that Nginx works by accessing itself through the URL with its subdomain: https://nginx.myhome.duckdns.org. Try it from inside your local network to test split horizon DNS and from outside to test DDNS. From outside, you should get a 403 Forbidden error.

  11. Back in Arcane, edit the public-traffic stack we just created.

    1. Under ports, delete or comment out the 8181:81 mapping. We can now access it through the domain.
    2. Click Update the stack.

  12. Modify the Arcane stack: nano /Apps/arcane-stack.yml.

    1. Delete or comment out the entire ports section. We can now access it through the domain.
    2. Save and exit with Ctrl + X, Y, Enter.
    3. Update the stack after the changes: docker compose -f /Apps/arcane-stack.yml up -d.

Released under GPL-3.0 License.

Copyright © 2024-present Jurgen Cruz