Please can someone show off how smart and sexy they are by answering these questions. I don’t mind if you just link me to a video or guide explaining it (like I’m 5?) instead of typing it out - but please don’t just send me stuff that says something like “To forward to ports correctly, simply forward the correct ports - but be sure to reverse-p the goeanity-2.0 exposed server flange via qPack*7_bingb (IMPORTANT put 1=2 in /conf!!!)” - which is what all the help documents read like to me right now.

Here’s what I think I know, but I have probably got wrong, and would be delighted if you could not only tell me how wrong I am but what is the right answer instead:

-> I have a raspberry pi 4 running raspbian/debian bookworm, all software up to date.

-> I have installed docker and docker compose. Docker lets you run apps/programs in separate little cages so if they crash or do something insecure they don’t crash or expose the whole computer (the Raspberry Pi), the operating system (Raspbian), or the other apps running in other containers. Docker compose allows you to fine-tune the settings of these apps from outside the container by changing a text file. Each docker container, controlled by a compose yml has a port, e.g. Jellyfin’s is :8096

-> I can set up and configure radarr sonarr qbittorrent to download movies, for this I need a VPN. I paid for and installed mullvad (app) but it crashes a lot (for over a minute every 20 seconds), so it looks like I need to configure something like gluetun to do it instead. For this reason I want to stick with mullvad as I paid for it, gluetun is really confusing.

-> However, downloading is only half the battle - assuming I can get a VPN to work without crashing every 20 seconds so it takes less than 5 hours to download a single movie in 1080p(!!!) - I can only watch stuff by plugging an HDMI cable into my raspberrypi and a monitor and using a mouse and keyboard to navigate to the UI and click “play”

-> If I want to watch them on my TV I need to connect something to my TV that talks to the raspberry pi, so I have an NVIDIA shield with Jellyfin installed on it - but in order for the NVIDIA-Jellyfin to connect to the RaspberryPi-Jellyfin it needs to go through the internet (if this is not the case, how does one point the NVIDIA-Jellyfin at the Raspberry Pi jellyfin?)

-> Because it’s going through the internet I need to hide my activities from prying eyes, and because it’s on the internet it will have a web address (I bought the cheapest domain for a few bucks on namecheap), so a proxy and reverse proxy are neccessary to hide my activity on my end (proxy) and the activity on the internet (reverse proxy) from said prying eyes while allowing me to watch my stuff in peace.

-> I can set up my domain to point to Jellyfin, this means I configure mysubdomain.mydomain.com to point to Cloudflare on the internet. Then I set up Cloudflare to point to NGINX on my raspberry pi. But I really don’t know what this entails or how to do it. I changed my nameservers to Cloudflare’s on namecheap and that’s where I stopped because I didn’t understand any further.

-> So, in practical terms, I’m on my sofa and I want to watch a movie in my Jellyfin on my raspberry pi, I open the NIVIDA sheild, I open the jellyfin app and I tell the jellyfin app to go to mysubdomain.mydomain.com

-> I think I’m correct in saying that mysubdomain.mydomain.com is actually an IP address and a public port, so something like 123.456.7.8:443, then Cloudflare - which is the reverse proxy - gets involved (somehow? how?) to say “ah, 123.456.7.8:443, you obviously want to go to funkless.raspberry.pi:NGINX (or rather something like 987.654.3.2:443)” and then NGINX - which is the proxy-proxy, not a reverse-proxy - goes (somehow? how?) “ah, 987.654.3.2:443, you obviously want to go to 987.654.3.2:8096 which is jellyfin”)

-> At some point in that last step SSL certificate(s?) need to be issued and used on Cloudflare and/or NGINX - but I don’t know how or why - and/or a public and private key

Here’s where the questions start:

  • First of all, is that all correct or have I misunderstood something?
  • How does mysubdomain.mydomain.com know it’s me and not some random or bot?
  • How do I tell Cloudflare to switch from web:443 to local:443 (assuming I’ve understood this correctly)
  • Is this step “port forwarding” or “opening ports” or “exposing ports” or either or both? (I don’t understand these terms)
  • If my browser when accessing mysubdomain.mydomain.com is always going to port 80/443, does it need to be told it’s going to talk to cloudflare - if so how? - and does cloudflare need to be told it’s going to talk to NGINX on my local machine - if so how?
  • How do I tell NGINX to switch from local:443 to local:8096 (assuming I’ve understood this correctly)
  • Is there a difference between an SSL cert and a public and private key - are they three things, two things or one thing?
  • Doesn’t a VPN add an extra step of fuckery to this and how do I tell the VPN to allow all this traffic switching without blocking it and without showing the world what I’m doing?
  • Gluetun just looks like a text document to me (compose.yml) - how do I know it’s actually protecting me?
  • From https://nginxproxymanager.com/ : "Add port forwarding for port 80 and 443 to the server hosting this project. I assume this means to tell NGINX that traffic is coming in on port 80 and 443 and it should take that traffic and send it to 8096 (Jellyfin) and 5000 (ombi) - but how?
  • Also from that site: “Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or Amazon Route53” - I assume this is what Cloudflare is for instead of Duck or Amazon? I also assume it means "tell Cloudflare to take traffic on port 80 and 443 and send it to NGINX’s 80 and 443 as per the previous bullet) - but how?

If your reaction is “Asking how how to set up port forwarding from Cloudflare to NGINX is a cowardly question - just figure it out!” Please could you at least link me to something that will help me figure it out if all those words just look like gibberish to me?

Thank you so much for your help and time in advance.

  • Semi-Hemi-Demigod
    14•11 months ago

    First of all, is that all correct or have I misunderstood something?

    There’s a couple things you’ve got a bit wrong:

    I think I’m correct in saying that mysubdomain.mydomain.com is actually an IP address and a public port, so something like 123.456.7.8:443, then Cloudflare - which is the reverse proxy - gets involved (somehow? how?) to say “ah, 123.456.7.8:443, you obviously want to go to funkless.raspberry.pi:NGINX (or rather something like 987.654.3.2:443)” and then NGINX - which is the proxy-proxy, not a reverse-proxy - goes (somehow? how?) “ah, 987.654.3.2:443, you obviously want to go to 987.654.3.2:8096 which is jellyfin”)

    I’m not sure what Cloudflare product you’re using, but I use it as a DNS server for my domain. If you’re doing the same thing - you’ll have configured A records and such if so - then what’s happening is this:

    1. You request subdomain.mydomain.com. Your device needs the IP to connect to, so it asks Cloudflare for the IP address. Think of this like calling information to find a phone number.
    2. Then your device initiates a request to the IP address it gets back. This is where TLS gets used, and encrypts your connection to that IP address. It also includes the domain requested in a header for the request.
    3. Nginx (which is a reverse proxy, meaning it handles incoming rather than outgoing connections) receives the connection and looks at the domain header. Then it looks in its configuration for the IP and port it should connect to, and forwards the request

    However, if you’re using some other thing at Cloudflare to make a VPN this might be entirely wrong.

    How does mysubdomain.mydomain.com know it’s me and not some random or bot?

    Unless you’ve implemented some kind of filtering or authentication in Nginx, it doesn’t. I got around this by configuring HAProxy - which is like Nginx - to only allow requests from my local network except for specific domains that I want to be public.

    Is this step “port forwarding” or “opening ports” or “exposing ports” or either or both? (I don’t understand these terms)

    Exposing or opening ports is something you do with a firewall. The purpose of Nginx is to make it so you only have to open 1-2 ports, and Nginx will handle redirecting traffic based on its configuration.

    If my browser when accessing mysubdomain.mydomain.com is always going to port 80/443, does it need to be told it’s going to talk to cloudflare - if so how? - and does cloudflare need to be told it’s going to talk to NGINX on my local machine - if so how?

    If you’re using Cloudflare like I described above, you will only need to tell Cloudflare the public IP address of your Nginx server. Generally you do this by telling your domain registrar (where you buy domain.com) to use Cloudflare’s “nameservers” and then configure Cloudflare to point to your public IP address.

    How do I tell NGINX to switch from local:443 to local:8096 (assuming I’ve understood this correctly)

    You edit the Nginx config to add something like this:

    server {
    server_name subdomain1.example.com;
    location / {
        proxy_pass       http://hostname1:port1;
    }
 }

    Then, when Nginx receives a connection request for subdomain1.example.com for any location, it will proxy it to the configured hostname (or IP address) and port.

    Is there a difference between an SSL cert and a public and private key - are they three things, two things or one thing?

    There are two parts to an SSL cert: A public key and a private key. How SSL works is… complicated, but suffice to say the public key is shared with the connection, and the private key is hidden on the server. You can encrypt data with either one, and only the matching key can decrypt it. This allows both sides to trust the connection and for nobody else to see the data.

    Doesn’t a VPN add an extra step of fuckery to this and how do I tell the VPN to allow all this traffic switching without blocking it and without showing the world what I’m doing?

    The Internet is like an ogre: It has layers. HTTP and DNS are on one layer, VPNs are a different layer. HTTP and DNS traffic can travel over the Internet, or your local network or over the VPN.

    If you’re just setting up a local Jellyfin server, you technically don’t need Cloudflare. Your home router will probably let you hard-code a DNS entry for a local IP address, which will keep all of that traffic on your local network. And if you do that right you won’t even need SSL.

    Gluetun just looks like a text document to me (compose.yml) - how do I know it’s actually protecting me?

    I’m not familiar with how Gluetun works, but it’s not just compose.yml. When you start it with docker-compose run it will download and extract the code to run Gluetun, and configure networking and other things.

    • @funkless_eck@sh.itjust.worksOPEnglish
      3•11 months ago

      Thank you, this was really helpful.

      I don’t know if I’ve configured the A records correctly - but someone else I was asking says that all this is against CloudFlare’s TOS so maybe I need to abandon CloudFlare completely.

      The NGINX example will help when I start digging into that, thank you.

      Yes, perhaps I over-simplified my gluetun example, I know it’s doing something in the container, but when I run the mullvad app it shows in green when it’s connected, and red when it’s not, and when the kill switch is engaged it shows “blocking internet” - how do I understand this same level of protection is active with a docker container? I think I read somewhere that I download something, then I docker pause gluetun and the download rate in qBittorrent should drop to near-zero to show it’s paused? Does that sound correct?

      • Semi-Hemi-Demigod
        1•11 months ago

        Pausing Gluetun might do that, or it might route the Torrent traffic over the regular network, in which case you might see a blip in the download rate before it goes up again.

        Personally I prefere this docker-ized torrent client, since it’s got the VPN built right in, and I don’t need a VPN to do anything other than torrents.

    • Semi-Hemi-Demigod
      2•11 months ago

      Also from that site: “Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or Amazon Route53” - I assume this is what Cloudflare is for instead of Duck or Amazon? I also assume it means "tell Cloudflare to take traffic on port 80 and 443 and send it to NGINX’s 80 and 443 as per the previous bullet) - but how?

      Yes, this is configuring Cloudflare’s DNS to point to your home IP address. You shouldn’t need to tell it which port, because that’s on a different layer.