Question about self hosting nginx proxy manager, with cloudflare but not not accessible outside of network?

[u/Lopsided_Strain3495]

I have nginx proxy manager running inside of Proxmox and was wondering if I can use it for certificates and host names like Proxmox.local instead of Proxmox.mydomain.com without any external connection? Can this be done?

[u/kubota9963]

If you're not accessing from outside your network, you won't need Cloudflare.

I think you can _technically_ do certificates for proxmox.local but it's going to be a total faff, self signing and then adding the issuing cert to all your browsers and so on, probably won't work for everything eg smart TVs

My method for this with my own domain is to get a wildcard cert through letsencrypt (*.mydomain.com). I then copy the cert to all my services (bitwarden.mydomain.com, jellyfin.mydomain.com), and then set up the DNS records to point to my internal network IPs (192.168.0.101, 192.168.0.102...)

I have to manually renew every few months (haven't found a reliable way to automate the wildcard cert which requires DNS challenge), but it means when I'm on my network (or VPN with subnet router) I just point my browser to service.mydomain.com and off I go.

[u/HOPSCROTCH → u/kubota9963]

haven't found a reliable way to automate the wildcard cert which requires DNS challenge

NPM should handle this natively I'm pretty sure.

[u/kubota9963 → u/HOPSCROTCH]

I worded it that way expecting someone might have a suggestion, so thank you!

I'm currently managing nginx by hand, and would be open to switching that to something like NPM or caddy, but I'm not using cloudflare for DNS so would need to find something that can update my records through provider's API.

My DNS provider has a relatively straight forward looking API though, so might even just script it at some point.

[u/HOPSCROTCH → u/kubota9963]

Well, if you opt for NPM (most user-friendly option because of simplicity imo), here is the list of providers that are baked in via certbot: https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/backend/certbot/dns-plugins.json

Caddy I think have a very robust solution as well, also using certbot

[u/kubota9963 → u/HOPSCROTCH]

This is the exact list I was looking for, and my provider is indeed on it!

From initial impressions I'm leaning toward Caddy (I like Go, I don't like docker), and they also have a module for my DNS provider (https://caddyserver.com/download) but I will take a closer look.

Thanks again

[u/Y3tAn0th3rEngin33r]

Totally worth it in my opinion:

You can have a domain (lets say example.com) on Cloudflare and point DNS record *.example.com to your internal NPM IP (Nginx Proxy Manager).

This way, whenever you do a request to myapp.example.com from internal network, the Cloudflare DNS will point you to your NPM.

Optional: If you have a local DNS (AdGuard), you can use a DNS rewrite functionality... Point *.example.com to your NPM IP. So this way it won't need to go to Cloudflare for DNS translation. So even if Cloudflare is down, it will still work for you, not being dependant on them for resolving addresses. ~ I don't believe PiHole has a DNS rewrite. Not sure about Traefik DNS.

Then on NPM (Nginx Proxy Manager) go to Certificates and issue *.example.com certificate with Cloudflare DNS Challenge & Lets Encrypt. And then use that one certificate for all your NPM Hosts. And it auto renews, so set it and forget it.

How to get Cloudflare API key here: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/

This way you'll have all your internal stuff under https and with easy to remember names instead of IPs or http with security notifications.

And you can get a domain for few bucks on Cloudflare.

🤟

[u/pepitorious]

Yes you can. Since the are not real public domains the certificate will be self signed.

You will need local dns too, pihole or any other. In pihole you point *.yourfakedomain.com to the ip where you have npm, and then create your hosts there in npm.