Asmodean's questions

I created the nginxproxymanager docker compose file and volume mount points outside of portainer.

/home/user/docker/nginxproxymanager/data, letsencrypt, docker-compose.yaml

And portainer, while being able to start and stop the service, display IP and gateway IP, add networks, I still would want full control over this container.

For example I cannot go into CLI (please correct me if the cause is not becase of the container being created outside of portainer), edit the yaml and so on.

Is there a way, for me to move the existing data, /letsencrypt and /data into the portainer volume portainer_data, then redefine the mount points in the compose yaml inside portainer and redeploy the nginxproxy manager?

Thank you for looking.

I use ubuntu 20.04 with portainer and nginxproxymanager to host my apps. Some are still being hosted bare metal but I am planning to transfer all to docker soon enough.

But the problem is ufw, which I have been using does not integrate with docker apps. The set up is:

portainer - docker compose/stacks - nginxproxymanager - Gateway IP with its web UI port - subdomain name and ssl.

1. once ufw is up, docker apps running on ports that is not explicitly allowed is not accessible with the domain (reverse proxied). But once the firewall is down it is okay, or I can also open the ports but I don't want to do that.
2. ufw denied ports are still accessible
3. ufw enabled does not block ports that is not explicitly denied either

What is a way to solve it? Or even better, a firewall app that will work with docker?

So I installed the apache guacamole and got the tightvnc service, which is also on the same machine as guac to connect and work perfectly.

Problem is when I try to set up a connection for a ssh into the local machine, 127.0.0.1 didn't work. Nor if I enetered the actual ip of the server.

The fields like key and key passphrase are provided correctly. And the user (not root) without and with a password has also been tried.

What could have gone wrong? My guess is do I have to somehow enable the localhost connection in the config of sshd or use my linode's internal ip address?

Ps. my vps sshd cofig does not allow password nor root log in.

I installed guacamole from source after a few hours of toil and trying out serveral outdated guides. But at this point I can go to the site and log into the guac web interface and connect to the guacd alright.

Though I couldn't find out what is the correct syntax to be used in the user-mapping.xml in order for me to have a root account that can have all the perms. Right now my account is only limited to joining rdps or vncs I allow within that conf.

Can someone shed some light?

So lets say I host something like netdata dash board on port 6000.

Then I nginx reverse proxy it to the subdomain netdata.domain.com

While basic auth is applied at the nginx.conf to allow site wide protection.

My question is, since my connection to netdata.domain.com is http instead of https, my data is not encrypted. So won't logging into to nginx basic auth under this connection basically expose the password for a MITM attack?

But if I add cloudflare between the real ip, that gives a layer of proxy and basically adds a lot of difficulty for that to happen right?

I don't know if my concern is valid.

I have the two lines of basic auth added in the nginx.conf.

So that all subdomain blocks under reverse proxy are password protected. But I do have a few in which I don't want it to have that.

What do I need to include in those server blocks in order to let them thru?

Thank you!

And sorry I don't know what wildcard is nor if it is applicable in this case.

I want to implement some basic authentication so that when I check my netdata dashboard at the domain it won't be wide open and viewable by everyone.

And I do have other apps I plan to run. Including ZNC which is already running.

Problem is that after I log into to the netdata subdomain, I cannot get into the znc web interface on another subdomain regardless of what password I put in.

Do I need to enable multiple log in sessions or is the native znc log in system making me unable to authenticate?

I have asked before how to forward ports on a VPS running a wireguard service with ufw and iptables as the management.

I had to do this:

(56000 is a random port I chose) (10.66.66.2 is the internal ip of wireguard)

ufw route allow proto tcp to 10.66.66.2 port 56000

Then I would do this to actually forward the ports with iptables:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 56000 -j DNAT --to-destination 10.66.66.2

Is there a way for me to achieve this with firewalld instead? so I won't have to separate the forwarding into two places?

And does masquerading come into use here/is it needed? Since I don't know what it does nor what it is used for.

VPS wireguard wg0 conf for reference purposes:

Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 49503
PrivateKey = ***


[Peer]
PublicKey = ***
PresharedKey = ***
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128

Using applications like qbittorrent and airdcpp to share files. They all need some ports to be forwarded in order to be "connectable".

In the home connection I would go into the router settings 192.168.1.1 and then forward the ports, ex. 56000 to my PC's local ip address: 192.168.1.124. And the services would work alright.

Later set up wireguard on a Linode VPS wishing I can vpn into it and and mask my IP. But when I do that, my ip address is changed when I go to somewhere like https://whoer.net . But the ports used, ex. 56000 is not forwarded and thus the apps are not "connectable".

What are the things I need to add in iptables in order for the VPS to forward those ports like my home router does?

Port 56000 is set to allow in the active VPS ufw firewall.

Many thanks for looking.

This is what my VPS wireguard conf looks like:

Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 49503
PrivateKey = ***


[Peer]
PublicKey = ***
PresharedKey = ***
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128