mirror of
https://github.com/ced4568/ceds-homelab.git
synced 2026-08-13 04:04:01 +00:00
135 lines
2.1 KiB
Markdown
135 lines
2.1 KiB
Markdown
# Adding a New Service to Cloudflare Tunnel + NGINX Proxy Manager
|
||
|
||
## Architecture Flow
|
||
|
||
```text
|
||
Browser
|
||
│
|
||
▼
|
||
Cloudflare DNS (cedshomelab.com)
|
||
│
|
||
▼
|
||
Cloudflare Edge (SSL, Zero Trust)
|
||
│
|
||
▼
|
||
Cloudflare Tunnel (cloudflared)
|
||
│
|
||
▼
|
||
NGINX Proxy Manager (10.10.30.210)
|
||
│
|
||
▼
|
||
Internal Service (10.10.30.X:PORT)
|
||
```
|
||
|
||
---
|
||
|
||
## Step-By-Step Checklist
|
||
|
||
### 1. Gather Service Info
|
||
|
||
- **Subdomain:** `service.cedshomelab.com`
|
||
- **Internal IP:** `10.10.30.X`
|
||
- **Port:** `PORT`
|
||
- **Scheme:** `http` or `https`
|
||
|
||
Test local access:
|
||
- LAN: `http://10.10.30.X:PORT`
|
||
|
||
---
|
||
|
||
### 2. (Optional) Create DNS Route in Tunnel
|
||
|
||
Inside NPM container:
|
||
|
||
```bash
|
||
cloudflared tunnel route dns npm-tunnel service.cedshomelab.com
|
||
```
|
||
|
||
---
|
||
|
||
### 3. Add Proxy Host in NGINX Proxy Manager
|
||
|
||
Open NPM: `http://10.10.30.210:81`
|
||
|
||
Go to:
|
||
**Hosts → Proxy Hosts → Add Proxy Host**
|
||
|
||
**Details tab:**
|
||
|
||
- **Domain Names:** `service.cedshomelab.com`
|
||
- **Scheme:** `http` or `https`
|
||
- **Forward Hostname/IP:** `10.10.30.X`
|
||
- **Forward Port:** `PORT`
|
||
|
||
Enable:
|
||
- Block Common Exploits
|
||
- Websockets Support
|
||
|
||
---
|
||
|
||
### 4. HTTPS Self-Signed Backends (Optional)
|
||
|
||
If backend uses self-signed HTTPS (e.g., Proxmox, TrueNAS):
|
||
|
||
In NPM **Advanced tab:**
|
||
|
||
```nginx
|
||
proxy_ssl_verify off;
|
||
proxy_ssl_verify_depth 1;
|
||
proxy_ssl_name 10.10.30.X;
|
||
```
|
||
|
||
---
|
||
|
||
### 5. SSL Tab
|
||
|
||
Since Cloudflare provides SSL:
|
||
|
||
- **SSL Certificate:** `None`
|
||
- Force SSL: Off
|
||
- HSTS: Off
|
||
- HTTP/2: Off
|
||
|
||
Save.
|
||
|
||
---
|
||
|
||
### 6. Test External Access
|
||
|
||
Open:
|
||
`https://service.cedshomelab.com`
|
||
|
||
If issues:
|
||
- 404: hostname not in ingress
|
||
- 502/504: NPM can’t reach backend
|
||
- Cloudflare 52x: tunnel or DNS issue
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
- Wildcard routing `*.cedshomelab.com` sends all new subdomains to NPM automatically.
|
||
- Only NPM needs to be updated for new services.
|
||
- No need to open router ports.
|
||
|
||
---
|
||
|
||
## Example
|
||
|
||
For Jellyfin on `http://10.10.30.143:30013`:
|
||
|
||
```bash
|
||
cloudflared tunnel route dns npm-tunnel jellyfin.cedshomelab.com
|
||
```
|
||
|
||
In NPM:
|
||
- Domain: `jellyfin.cedshomelab.com`
|
||
- Scheme: `http`
|
||
- IP: `10.10.30.143`
|
||
- Port: `30013`
|
||
- Block Exploits: On
|
||
- Websockets: On
|
||
|
||
Save & test:
|
||
`https://jellyfin.cedshomelab.com`
|