KId put a reverse proxy in front from your homelab, something like nginx proxy manager, and then get the pems,certs from cloudflare and then reverse proxy to your app internally. Not as good as tunneling, but should with Cloudflare proxy cache enabled hide your IP in front of cloudflare, while directing the traffic directly to your app
Khttps://nginxproxymanager.com/
I dont recommend nginx proxy manager for anything other than home usage
I dont recommend nginx proxy manager for anything other than home usage
Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt
KI believe it can do that same, but I dont know for sure
KI use caddy nowadays
KBut when you stick the SSL in front and reverse proxy, you can not deal with zitadel needing it
KSure, but your entry point into your homelab should really manage that or your gonna deal with chain of authority inside your network.
https://community.traefik.io/t/reverse-proxy-with-wildcard-cert-to-all-my-internal-services/7603
So there ways to solve this WITHOUT having to get Zitadel involved, but I mainly hide everything behind my caddies and cloudflare, and I dont tunnel
https://community.traefik.io/t/reverse-proxy-with-wildcard-cert-to-all-my-internal-services/7603
So there ways to solve this WITHOUT having to get Zitadel involved, but I mainly hide everything behind my caddies and cloudflare, and I dont tunnel
Traefik Labs Community Forum
I am using Cloudflare to manage my DNS for my homelab.com domain and have a wildcard cert *.homelab.com created via Letsencrypt and auto renewed via certbot on my Pihole server. I manually copy the certs to all my other services like unifi.homelab.com, edgemax.homelab.com, and nextcloud.homelab.com, and the SSL is working fine. I want to automa...
KBut if you want Zitadel to handle the certs, then hopefully someone else will chime in
KCloudflare would give you the cert, and traefik should be able to handle that with a reverse proxy
This has SOME gems in it that might help
https://medium.com/@leandrobarral/traefik-2-setup-reverse-proxy-with-lets-encrypt-and-cloudflare-support-46d68b39ca71
This has SOME gems in it that might help
https://medium.com/@leandrobarral/traefik-2-setup-reverse-proxy-with-lets-encrypt-and-cloudflare-support-46d68b39ca71
Medium
How to get a VPS with Docker + Traefik (reverse proxy and load balancer) + Let's Encrypt + Cloudflare working together with just few steps
Kand you want a dynamic dns???
KYou run docker?
KI use https://github.com/timothymiller/cloudflare-ddns
You can run the docker container, give it cloudflare API key, and it will update cloudflare for you when ip changes
You can run the docker container, give it cloudflare API key, and it will update cloudflare for you when ip changes
GitHub
Dynamic DNS (DDNS) service based on Cloudflare! Access your home network remotely via a custom domain name without a static IP! - timothymiller/cloudflare-ddns
Dynamic DNS (DDNS) service based on Cloudflare! Access your home network remotely via a custom domain name without a static IP! - timothymiller/cloudflare-ddnsKAlso if you are not I recommend proxmox with an lxc running the docker setup. Portainer can make it easy to manage and deploy docker containers, so can Coolify
KFeel free to tag me btw, our setups are probably different, but ive been down this path last year.
I have my local apps push to a local docker registry to deploy them automically within my homelab server.
I use cloudflare and my subdomains to expose any apps. And I use dynamic ddns to keep my network synced when ip changes.
I use cloudflare as the cache/proxy so that if my site get hit, it can handle very very high volumes of traffic WITHOUT stressing my homelab PC
I have my local apps push to a local docker registry to deploy them automically within my homelab server.
I use cloudflare and my subdomains to expose any apps. And I use dynamic ddns to keep my network synced when ip changes.
I use cloudflare as the cache/proxy so that if my site get hit, it can handle very very high volumes of traffic WITHOUT stressing my homelab PC
KI think your on the right track then, I belive you neerd traefik to consume the cert and then you can have it pass to you zitadel, that SHOULD work
KYou don't need LXC for docker, its just such a THIN layer it helps maximise resources, so if you got it working, that matters more than the LXC
KYah ive never used traefik which is where I am blocked. but if you try "traefik cloudflare ssl reverse proxy" there a lot of different scenarios in the results
Kand zitadel picky about its domain instances, so you'll have to make sure that the domain matches in your configuration too
KGoodluck! Tag me when you solve it PLEASE
KYou can either setup your environment for TLS mode disabled, TLS mode external or TLS mode enabled.
KThere origins to requests, they get added to headers, and you will see Zitadel can discover the domain based on the username signing in too
KDont see it as sad, just more stuff to learn. We always start from being dumb about something and then learn it. Definitely dont be sad about that, seriously your setup already a beast and very complex
KI wouldn't be shy about posting in general, this Discord isn't active enough to have a Q&A like this and expect too much attention
KYah, they just trying to maintain organization, try again later in general, you want to get non mods/maintainers.
And as long aas your asking questions and not trolling, they will only ask again to put it in QA
And as long aas your asking questions and not trolling, they will only ask again to put it in QA
KIll ask in my professional discord, but we dont use stuff like traefik or reverse nginx proxy
KI am not, just another user like you