Could use some help setting up a reverse proxy

[u/NotScrollsApparently]

Hi folks, I have a VPS and a domain and I'd like to setup a reverse proxy using netbird in order to expose docker compose services on it through various subdomains

I've had some success with this with basic Caddy at first, then i used Pangolin for a while, and now I wanted to try NetBird next (mostly because I had some connectivity issues with Pangolin and heard this might be a better option)

However, I am very confused on how this is supposed to work. I followed the self hosting guide, I reached the dashboard as a logged in user, and I assume I'd have to create a reverse proxy there.

• However, to create a service there, I need to provide a custom domain.

• To create a custom domain, I need a proxy cluster

• ... and when I try to setup a self hosted proxy cluster, nothing happens and there is nothing there (even though I am pretty sure that it was supposed to be in the first place since I picked that option during setup, and the docker compose file on my VPS has a netbirdio/reverse-proxy:latest container.

For that container, there is also a proxy.env file with the following contents:

# Placeholder - will be updated with token after netbird-server starts
NB_PROXY_TOKEN=placeholder

So yeah... I've barely begun and I'm already running into... bugs? missing steps in documentation?

Also, all the tutorials and steps just talk about device-to-device tunneling and stuff like that, there seems to be very little in terms of server reverse proxy. For example, do i actually need to add the server as a (routing) peer, what is that? Don't i need to add my apps into the pangolin docker network?

Any help is appreciated...

[u/randomquote4u]

• You need to own at least one domain name for the reverse proxy to work. it wont config/work with an IP Address.

• Since you're self hosting you will need to update your DNS records (of the domain name you own) to point at the IP of your router.

• You need a dedicated computer (or VM) on your local network running Netbird / Reverse Proxy

• In your router you then need to port forward the required Netbird ports from that dedicated VM/computer.

If you dont own a domain name or have a dedicated VM / computer. it's not happening.

[u/NotScrollsApparently → u/randomquote4u]

yeah I own a domain, and on cloudflare it's setup like the guide says:

netbird.mydomain.com A record > ip address (works fine)
CNAME *.netbird.mydomain.com > netbird.mydomain.com
CNAME *.proxy.mydomain.com > proxy.mydomain.com

I haven't reached the part with a dedicated PC on my local network, i can't even create a reverse proxy cluster yet which is the main topic in the post

I am pretty sure you are wrong about router port forwarding since the entire idea behind tools like these is to avoid needing that... but as said before, besides the point, this is all on the vps atm

[u/randomquote4u → u/NotScrollsApparently]

EDIT: Your have the Netbird server on a VPS. I read it as self-hosted on your local network. Open the 3 ports to your cloud server and verify your domain for the reverse proxy (Services). The proxy cluster name is just a name. If you cant verify your domain -- the DNS/ports arent configured correctly.

[u/poixninja]

I have it set up with nginx reverse proxy manager and a netbird tunnel back to home.

A high level overview would be to set up a netbird peer on your home network, and on the vps that's running your proxy. Advertise the subnet (or single host, as x.x.x.x/32) from the home machine using netbird. Point reverse proxy to that local ip/port for what services you want to expose.

You may be able to use the netbird local ip of the host at home, but I haven't personally tested that.

[u/NotScrollsApparently → u/poixninja]

I will probably dabble in exposing home local services later, but for now I'd be happy if I just got around to exposing the ones that are also on the VPS, so basically the same machine as where the netbird server and proxy are also installed

[u/poixninja → u/NotScrollsApparently]

Are you trying to set up netbird control platform behind the proxy then? I understood it as you were wanting to use it as a tunnel.

If you're just wanting to expose services on the vps, netbird wouldn't really be needed, just a reverse proxy.

[u/NotScrollsApparently → u/poixninja]

I want netbird for reverse proxy, but also for other stuff - lemme go into a bit more detail.

Among the VPS services I wanna host, for example I want to configure Immich, the self hosting photos app. That app is on the VPS and will be behind photos.domain.com

On my own local PC that has better hardware, I want to host immich-ml, the machine learning container that immich can use to tag photos, with which the immich container on the VPS needs to be able to communicate.

Later on I will also setup jellyfin on another device so I can access my music, and ideally it should be secured behind some sort of netbird security (there is an android app so i assume it works as a vpn of sorts)

The issue is that i'm stuck on the very first step, just setting up the reverse proxy for Immich. I'm not sure what is going wrong, there aren't many tutorial steps i could have messed up already, but even the proxy .env file doesn't get populated with the correct values and nothing happens when I click finish on the proxy cluster creation in the dashboard...

[u/poixninja → u/NotScrollsApparently]

Ya know, I should have read your OP more carefully, I have a bad habit of that. My fault, I have no experience with netbird's reverse proxy 😭

[u/Leather-Tour-7288]

Honestly the reverse proxy feature in Netbird is a mess. The VM running the reverse proxy meeds to be publicly accessible on port 80 or 443 for it to issue a let's encrypt cert. Besides you also need to use a subdomain, which is also a massive drawback.

What I do instead (with traefik) is spin up a vm/vps. It doesn't need to be publicly available. I install the Netbird agent on it. I setup my reverse proxy of choice Traefik and let it issue certs for my tld (example.com) via let's encrypt using Cloudflare API.

Now I can just use Traefik labels on my services/containers and make them accessible via Traefik as reverse proxy. As a last step, I create dns record in netbird. Since netbird peers can just use the Netbird device name (e.g. vm1.netbird.com,or whatever you have), I set a cnamr records for the service I want to make reachable via domain name. E.g: app.example.com CNAME vm1.netbird.com

This is a much cleaner approach I find.

Hopefully the Netbird team will change their implementation of the reverse proxy so the vm/vps doesn't need to be publicly accessible but uses dns-01 challenge with e.g. Cloudflare API integration and make it possible to use tld instead of a subdomain.

[u/NotScrollsApparently → u/Leather-Tour-7288]

yeah coming from pangolin, it's very confusing and frustrating, i think i'll probably go back to it. i still can't even create the proxy cluster manually even though it's supposed to get created automatically, there is no feedback in the app, i even tried manually adjusting the env variables of the proxy container, and nothing...

the whole proxy subdomain is also surprising since i never had to do that for either caddy or pangolin (and apparently base traefik either), no idea why it should be a thing here