N0x0n

Sorry I didn't respond earlier :S !

To let me access the services both from the desktop and the laptop. I’d need to have two DNS resolvers, since for the laptop it needs to resolve to the 192.168.0.* address of the homelab router. While for the desktop it needs to resolve directly to the 10.0.0.* address of the server.

I'm not entirely sure if I get what you mean here. If you have a central DNS resolver like pihole In your LAN it can resolve to whatever is there. I have a pihole which resolve to itself (can access it as pihole.home.lab) and resolves to my server's reverse proxy, which handles all the port shenanigan and services hosted on my server. I think I can try to make a diagram to show how it works in my LAN right now, not sure if this can be helpful by any mean, but this would allow me to have a more visual feedback of my own LAN setup :P. However, I do use Traefik as my reverse proxy for my docker containers, so I won't apply to nginx and I'm not sure if this is possible (It probably is, but nginx is a mystery for me xD)

Also, little question. If I do manage to set it up with subdomains. Will all the traffic still go through port 1403? Since the main reason I wanted to setup a proxy was to not turn the homelab’s router into Swiss cheese.

Your proxy should handle all the port things. Your proxy listens to all :80 :443 Incoming traffic and "routes" to the corresponding service and it's ports.

While I do have my self-learned self-hosted knowledge, I'm not an IT guy, so I may be mistaken here and there. However, I can give you a diagram on How it works on my setup right now and also gift you a nice ebook to help you setup your mini-CA for your lan :)

Subpaths are things of the past (kinda) ! SSL wildcards are going to be a life saver in your homelab !

I have a self-signed rootCA + intermediateCA which are signing all my certificates for my services. But wait... It can get easier just put a wildcard domain for your homelab (*.home.lab) and access all your services in your lan with a DNS provider (pihole will be your friend!).

Here is an very simplified example:

1. Create a rootCA (certificate authority) and put that on every device (Pc, laptop, android, iphone, tv, box...)

2. Sign a server certificate with that rootCA for the following wildcard domaine: *.home.lab and put that behind a reverse proxy.

3. Add pihole as DNS resolver for your local domain name (*.home.lab) or if you like you can manually add the routes on all devices... But that"s also a thing of the past !

4. Let your proxy handle your services

Access all your services with the following url in your lan

• https://myservice.home.lab/
• https://navidrome.home.lab/
• https://whateva.home.lab/

This works flawlessly without the need to pay for any domain name, everything is local and managed by yourself. However, it's not that easy as stated above... OpenSSL and TLS certificates are a beast to tame and lots of reading ^^ so does Ngnix or any other reverse proxy !

But as soon as you get the hang of it... You can add a new services in seconds :) (specially with docker containers !)

https://www.amazon.com/Demystifying-Cryptography-OpenSSL-3-0-techniques/dp/1800560346

It's really a good book :) And the last part is all about a mini-ca for your homelab !

However, don't use the ED448/ED25519 algorithm based certificates for TLS as mentioned in the example... They are still not supported by any browser !

If you can support the author, please do ! If you're on a budget, it's really easy to find in the piracy corner.

Yeah thats correct !

I Wouldn't say heavy though (maybe I see it that way because I got a bit better with bash and the like :p) because you can make use of CRL to revoke your certificates and renew them very easily with your intermediate and ready to use config files.

But yeah, there isn't any automated way to manage certificates like Smallstep does :)

Or simply create your rootCA, IntermediateCA, keys and certifictes with openSSL.

Neither of those are begginer friendly but openSSL is probably a bit easier to get started. There's a nice book with openSSL (if you are interested I migh look how it's called) and the last chapter is all about how to create your mini-CA and everthing else to serve your proxy with valid certificates for your homelab.

They know exactly what they are doing... Some dopamine hits for the road !