Beat CGNAT with a VPS reverse tunnel
CGNAT leaves you with no public IP. Put frp on a cheap VPS, dial the tunnel out from home, and terminate HTTPS on the public end with a real certificate.
Reverse proxies
One server, several apps, one public port. How to put nginx or Traefik in front of your containers and route each hostname to the right one.
Filtering by topic #reverse-proxy · clear
dsh web: http://127.0.0.1:3080 explained
dsh prints http://127.0.0.1:3080 because the Web UI binds to localhost only. Reach it safely with an SSH tunnel, and see why publishing 3080 is unsafe.
Put any app behind SSO with oauth2-proxy
Forward auth puts an app that has no login behind your OIDC provider. Wire oauth2-proxy into nginx or Traefik, and avoid the cookie and redirect traps.
Self-host LinkSift, a yt-dlp web UI
LinkSift has no login and binds to localhost on purpose. Run it in Docker Compose, then put it behind Caddy with real auth or on a Tailscale node.
Reach the DSH web UI on your VPS
The DSH web UI binds to 127.0.0.1:3080, so the URL your VPS prints will not open on your laptop. Three safe ways to reach it, and one you should avoid.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
Why n8n keeps going offline on your VPS
Four different failures look like n8n going offline. Learn to tell the websocket banner, a restart loop, an out of memory kill and a dead schedule apart.
Your Ollama API has no password
The Ollama server ships with no authentication, so anything that reaches port 11434 can run your models and pull new ones. The three fixes, in order.
nginx Reverse Proxy Config, Explained
Build an nginx reverse proxy server block line by line: proxy_pass, the four headers your app needs, websockets, trailing slashes, and uploads.
Fix SearXNG Rate Limits and 429 Errors
SearXNG 429 errors have two causes: your own limiter, or the engines blocking your server IP. Read the log, fix the right one, and stop guessing.
Nginx vs Caddy vs Traefik: pick a proxy
Three services, one VPS, one public IP. How Nginx, Caddy and Traefik differ on certificates, config cost per app, websockets and Docker routing.
Traefik v2 to v3 migration: what breaks
Traefik v3 will not start while swarmMode or pilot is in the static config. Fix the incompatible deprecated static option found error, then migrate rules.
Traefik reverse proxy: 5 apps, one Compose file
Run five apps behind one IP with Traefik v3 on Docker Compose: routing by Host rule, automatic Let's Encrypt TLS, and the acme.json trap that blocks startup.
Run Nextcloud on a VPS: Docker, TLS, backups
Run Nextcloud on your own VPS with Docker Compose, Postgres, Redis and a TLS reverse proxy, plus the backup and upgrade steps that keep your data recoverable.