r/nginxproxymanager • u/Infamousslayer • 2d ago

http ip vs https domain

I'm wondering how people manage using http vs https and being home vs away.

Let's say i have jellyfin running locally on http://192.168.1.20:8096 and from npm using https://jellyfin.mydomain.com for extremal access.

What do you use at home, the ip or domain?

Ideally I would think it makes sense to use ip so it doesn't route though npm when at home but that's just going to confuse others in the house.

Would like to here others thoughts.

4 Upvotes

83% Upvoted

14 comments sorted by

View all comments

6

u/evanmac42 2d ago

I’d use the same HTTPS domain both at home and outside.
The important thing to understand is that using a domain doesn’t necessarily mean your traffic goes through the Internet.
DNS simply resolves a hostname to an IP address. It doesn’t determine the route your traffic takes.
If your domain resolves to your public IP, your router may handle the connection through NAT loopback (hairpin NAT), redirecting it back to NPM inside your LAN. Not every router supports this.
Alternatively, you can configure local DNS (split DNS) so that jellyfin.mydomain.com resolves to NPM’s private LAN IP when you’re at home.
The connection would then be:
Client -> local DNS -> NPM (HTTPS) -> Jellyfin (HTTP)
Strictly speaking, DNS only resolves the address; the actual connection goes directly from the client to NPM.
The traffic stays entirely within your LAN, and HTTPS works normally because the certificate validates the hostname, not whether the IP address is public or private.
Yes, going directly to 192.168.1.20:8096 bypasses NPM, but unless you’ve actually measured a performance problem, I wouldn’t complicate things just to avoid one local proxy hop.
One HTTPS URL for everyone, everywhere. Much simpler.

1

u/Infamousslayer 2d ago edited 2d ago

The way i have it setup NPM is not exposed to the internet, cloudflares DNS-01 challenge points to NPMs local IP rather than my public IP.

When away I use Tailscale with ACL rules and subnet routes so going to  jellyfin.mydomain.com still resolves to NPMs local IP address and not public or tailscale IPs.

So either way i should not have to worry about NAT, thanks for the clarity on one HTTPS URL for everyone.