Self-host LinkSift, a yt-dlp web UI
LinkSift has no login and binds to localhost on purpose. Run it in Docker Compose, then put it behind Caddy with real auth or on a Tailscale node.
Reverse proxies
One server, several apps, one public port. How to put nginx or Traefik in front of your containers and route each hostname to the right one.
Filtering by topic #reverse-proxy · clear
Disable Sonarr and Radarr authentication
Every way to turn off Sonarr and Radarr login, what the local address option really means on a VPS, and the three setups that are actually safe.
Your Ollama API has no password
The Ollama server ships with no authentication, so anything that reaches port 11434 can run your models and pull new ones. The three fixes, in order.
Traefik reverse proxy: 5 apps, one Compose file
Run five apps behind one IP with Traefik v3 on Docker Compose: routing by Host rule, automatic Let's Encrypt TLS, and the acme.json trap that blocks issuance.
Harden a public SearXNG instance
Open SearXNG to other people safely: bind to localhost, get X-Forwarded-For and trusted_proxies to agree, enable the limiter, and lock down the JSON API.
Why n8n keeps going offline on your VPS
Four different failures look like n8n going offline. Learn to tell the websocket banner, a restart loop, an out of memory kill and a dead schedule apart.
Apache reverse proxy with mod_proxy on Ubuntu
Run Apache as a reverse proxy on Ubuntu, then read a backend log to see what ProxyPreserveHost, X-Forwarded-For and X-Forwarded-Proto really deliver.
Traefik v2 to v3 migration: what breaks
Traefik v3 will not start with swarmMode or pilot in static config. Fix the incompatible deprecated install configuration option error, then migrate rules.
Put any app behind SSO with oauth2-proxy
Forward auth puts an app that has no login behind your OIDC provider. Wire oauth2-proxy into nginx or Traefik, and avoid the cookie and redirect traps.
Nginx vs Caddy vs Traefik: pick a proxy
Three services, one VPS, one public IP. How Nginx, Caddy and Traefik differ on certificates, config cost per app, websockets and Docker routing.
Reach the DSH web UI on your VPS
The DSH web UI binds to 127.0.0.1:3080, so the URL your VPS prints will not open on your laptop. Three safe ways to reach it, and one you should avoid.
Beat CGNAT with a VPS reverse tunnel
CGNAT leaves you with no public IPv4 address. Put frp on a VPS, dial the tunnel out from home, and terminate HTTPS on the public end with a real certificate.
Fix the Sonarr/Radarr Allowed Hosts warning
Sonarr and Radarr warn that Allowed Hosts is not configured. Here is what to type in that field for your setup, and how to get back in if you are locked out.
dsh web: http://127.0.0.1:3080 explained
dsh prints http://127.0.0.1:3080 because the Web UI binds to localhost only. Reach it safely with an SSH tunnel, and see why publishing 3080 is unsafe.
Run Nextcloud on a VPS: Docker, TLS, backups
Run Nextcloud on your own VPS with Docker Compose, Postgres, Redis and a TLS reverse proxy, plus the backup and upgrade steps that keep your data recoverable.
Arr stack ports: what each app listens on
Default ports for Sonarr, Radarr, Prowlarr, Bazarr, qBittorrent, Jellyfin, Seerr and FlareSolverr, plus how to keep every one of them off the public internet.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
Fix SearXNG Rate Limits and 429 Errors
SearXNG 429 errors have two causes: your own limiter, or the engines blocking your server IP. Read the log, fix the right one, and stop guessing.
nginx Reverse Proxy Config, Explained
Build an nginx reverse proxy server block line by line: proxy_pass, the four headers your app needs, websockets, trailing slashes, and uploads.
Caddy Reverse Proxy on a VPS, Pinned to 2.11.7
Put two apps behind Caddy 2.11.7 with automatic HTTPS and a version hold, then fix the 431 errors and dropped headers that recent releases bring.
The SearXNG limiter and why it needs Valkey
The SearXNG limiter keeps its per IP counters in Valkey. Set up limiter.toml in a container or a source install, and see which sections actually matter.
Sonarr and Radarr behind a reverse proxy
Run Sonarr and Radarr behind nginx or Traefik with forward auth: the Allowed Hosts entries that stop Invalid Hostname errors, and why /api must skip login.
tailscale serve: the commands that matter
Every tailscale serve command you will use, checked on Tailscale 1.102.4: foreground versus background, HTTPS ports, path routing, static files and raw TCP.
Authentik forward auth with Traefik
Put Authentik in front of any app with Traefik forwardAuth: proxy provider, outpost address, header pass-through, and the redirect loops explained.