Issue a valid (preferably wildcard) cert for your domain/subdomain. Sometimes it can be done by the reverse proxy itself. AFAIK, vanilla nginx doesn’t have this functionality built-in.
Specify this cert in reverse proxy configs.
Specify the URLs to your apps in reverse proxy configs. Side-note: the connection between your apps and the reverse proxy would be plain HTTP.
Make sure your domain/subdomain points to the address of your reverse proxy.
The exact steps depend on your choice of reverse proxy.
No, but nobody seems to be able to distinguish between Nginx and Nginx Proxy Manager, often naming the former to mean the latter. And since NPM is the only reverse proxy currently available as an app, that’s likely what’s happening here too.
Well, another solution could be to place pfsense/opensense as an exposed host in front of your router or preferably let it do all the routing. This of course introduces another software which needs to be mastered, but offers a GUI approach for most of the stuff you may need anyways. Acme, dns, dhcp, ntp, tailscale, reverse proxy, CA, dyndns and of course a really solid firewall solution, that adds preconfigured ip and dns blocklists (pfBlockerNG) as a bonus. Uhh i did it again - i promoted pfsense . But hey it works pretty well for me…
It’s been a few days since my last reply.
Thank you very much for the numerous helpful answers!
Based on the new information, I was able to research everything necessary and set everything up to fit our intended use.
This topic is what I’ve been struggling with - unsuccessfully. Like OP, I’d like to have happy browsers using HTTPS: when accessing anything on my LAN (pihole, OPNsense, TrueNAS, Access point, etc.) from within my LAN - no WAN access needed. I thought Wolfgang's Blog would do it for me, but no joy. I’d like to use the Nginx Proxy Manager app from TrueNAS along with a (free) DDNS domain. Dynu offers free domains with the required API access. I couldn’t get the whole thing right. Then I thought I would use port-forwarding to get to NPM, but I couldn’t get OPNsense configured properly. Most of it is that there are so many different players that I couldn’t find which error log might show me what went wrong.
If someone has the same or similar setup working and has documented it, I’d love a link. TIA.
Unfortunately, things like “unsuccessfully,” “no joy,” and “I couldn’t get the whole thing right” don’t give us any idea what problems you’re having. And I doubt anyone has written up exactly the setup you’re looking for, so you’re going to need to combine some guides. But with that said, I’ve successfully tested my guide for Nginx Proxy Manager on TrueNAS:
It’s written using Cloudflare, but using DuckDNS instead if you prefer should be simple enough.
If you want to port-forward with OPNsense, that should be simple enough–just forward 80/443 to your NPM instance. If you’re going to do that, you don’t really need DNS validation to get your cert, since you’ll be exposing your NPM instance to the public Internet–be sure you really want to do that.
Probably a better way to go than forwarding ports would be to install a reverse proxy on OPNsense (either HAProxy or Caddy; I prefer Caddy), expose 80/443 to that, and have it proxy whichever specific hostnames you want to make public. This is how I do it–I want a few of my local services exposed to the Internet, so I proxy those with Caddy on OPNsense (which, for most of them, points to another Caddy instance running on my NAS–guide for that is up-thread–which in turn proxies to the service itself). The remaining ones I only want accessible from my LAN, or via Tailscale; those don’t have entries on my OPNsense box.
I would have listed any error messages etc if there were any shown. I would just finish the procedures and try it and … no connection. As I said, there’s no indication of where to look: TN, NPM, the DNS service, Let’s Encrypt, the target service, the browser, … I definitely don’t want to expose anything to the Internet.
As far as an exact duplicate setup, I think it would be a pretty common goal and a lot of people use TN, so I have hopes that there will be at least one person who’s been successful.
. But hey it works pretty well for me…