I want to replace my current bore setup with a more general VPN solution.
Right now my self-hosted services are hosted on ganymede (at home) and galileo (VPS), roughly depending on wether I need to access them outside of my home. There are some edge cases like Jellyfin, which I mostly use at home, but also want to share with other people. For this I use bore, but this frequently breaks and I want a more permanent and robust solution. I also don't want to rely on internet access for some stuff like Pocket-ID and Calendar sync. This is my current proposal to solve this:
Instead of splitting up where my core services are hosted, everything should be at home on ganymede. This way I can always access everything, when I'm home. Also at home *.lua.one should point to the LAN Address of ganymede: this can be achieved in OPNsense. This way I don't have to worry about CORS/CSRF, HTTPS and stuff like that, no matter if I'm home or not.
In this scenario, the role of galileo would be more of a relay or bastion, as it will serve as the sole point of entry into my LAN from outside. To achieve this, ganymede will connect to galileo via wireguard. I can then connect my clients outside my LAN to galileo to access everything at home.
For this to work, *.lua.one has to point to ganymedes wireguard IP inside the VPN, more research needed. I also want my phone, laptop, etc. to auto connect to the VPN, when I'm not connected to my home WiFi - so I don´t have to actively think about this.
The current *.lua.one public DNS entries will stay put, so I can still publish stuff on galileo:
- various relays: syncthing, rustdesk -> Relays aren't needed inside my LAN, so it makes no sense to host them there
- caddy:
reverse_proxy <ganymede_wireguard_ip>:<jellyfin_port>
I want to replace my current bore setup with a more general VPN solution.
Right now my self-hosted services are hosted on
ganymede(at home) andgalileo(VPS), roughly depending on wether I need to access them outside of my home. There are some edge cases like Jellyfin, which I mostly use at home, but also want to share with other people. For this I use bore, but this frequently breaks and I want a more permanent and robust solution. I also don't want to rely on internet access for some stuff like Pocket-ID and Calendar sync. This is my current proposal to solve this:Instead of splitting up where my core services are hosted, everything should be at home on
ganymede. This way I can always access everything, when I'm home. Also at home*.lua.oneshould point to the LAN Address ofganymede: this can be achieved in OPNsense. This way I don't have to worry about CORS/CSRF, HTTPS and stuff like that, no matter if I'm home or not.In this scenario, the role of
galileowould be more of a relay or bastion, as it will serve as the sole point of entry into my LAN from outside. To achieve this,ganymedewill connect togalileovia wireguard. I can then connect my clients outside my LAN togalileoto access everything at home.For this to work,
*.lua.onehas to point toganymedeswireguard IP inside the VPN, more research needed. I also want my phone, laptop, etc. to auto connect to the VPN, when I'm not connected to my home WiFi - so I don´t have to actively think about this.The current
*.lua.onepublic DNS entries will stay put, so I can still publish stuff ongalileo:reverse_proxy <ganymede_wireguard_ip>:<jellyfin_port>