For people who know about networking, if I setup lesbian.solutions to run in my home and set it up to connect to a reverse proxy somewhere else, I'd point the domain name to that second server's IP right? Would it connect to the fedi from that point or from my house?
fuchsiaaaaaaaaaaaaaaaaa
@dragon with just a reverse proxy the outgoing fedi connections would happen from your house
@dragon as i run pixie.town to a setup like that, here's what I do to prevent that:
- wireguard (vpn software) to make a tunnel between vps and server at home
- server has all outgoing traffic going through that vpn
- nginx runs on vps, reverse proxy to the internal wireguard interface IP for the homeserver (something like 10.0.0.2)
@f0x I think that's about the setup I want, can I ask why you use the reverse proxy and the vpn? It feels like just the VPN would work but I think I'm missing something
@haskal @dragon without the reverse proxy you would have to port-forward to the homeserver's port 80/443 and uhh that sucks (fuck iptables) :p
also that way you can have the vps nginx itself listen on 80/443 so some sites/paths are handled by the vps and some reverse proxied onto the homeserver
but as haskal mentions that's the tradeoff, with a setup like that all traffic has to be decrypted on the vps
@f0x @dragon yeah so here's how to do the thing
you set up a VPN between your cloud gateway vps and your actual server. say the gateway is 10.0.0.1 and the server is 10.0.0.2
on the server you set the default gateway to 10.0.0.1 (or, use policy based routing i can tell you about that too)
on the gateway you do (assuming the interface is eth0)
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i eth0 --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.2 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.2
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.0.0.2
@f0x @haskal oh great!! Will that also grab the incoming traffic and relay it back? I'll look into wireguard thanks a lot