HOWTO: Host a Service privately on TrueNAS with a valid SSL Certificate

Resources
,
46

Thanks for writing this! I have some additional setup notes in case it helps anyone with doing this:

  1. In ‘Deploying Nginx Proxy Manager’, if you’re having the app stuck at ‘deploying’, you may need to add the environment variable for S6_STAGE2_HOOK as sed -i $d /etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh (more info in Nginx: Hangs for almost 25 minutes at deploying in npm - #2 by HITMAN )

  2. In Adding a new Host, Cert and Service, as already mentioned you will want to create a record for each service you’re hosting. Nginx proxy manager is going to complain if you attempt to do multiple services at different ports using the same certificate.

  3. In Adding a new Host, Cert and Service → Step 2: Add Proxy Host to NPM, if needed you could set the ‘Forward Hostname/IP’ to the server’s tailscaleIP rather than the lan’s , this could help in situations where you have to use DHCP.

  4. In Adding a new Host, Cert and Service → Step 2: Add Proxy Host to NPM, there could be some app-specific settings here depending on what you’re running. Here’s a shortlist of just a few settings to be aware of, you may need to tinker and search a bit for more:

    • Frigate:

      • Proxy Host setting in Nginx Proxy Manager: you may need to set the ‘Scheme’ as HTTPS (not HTTP), otherwise you might get a “400 Bad Request - The plain HTTP request was sent to HTTPS port” error

    • Home Assistant (two important things here)

      • Home Assistant configuration.yaml: you’ll need to edit your configuration.yaml to setup forwarding with specific IPs for access (e.g. your server’s IP, and possibly whatever IP home assistant logs are seeing you login under), see Nginx proxy 502 bad gateway - #8 by Evanc09 - Configuration - Home Assistant Community for more info. Editing the configuration.yaml can be found by going into the home-assistant container shell (found in truenas app settings). Not doing this will result in your logs saying something like ERROR (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from <IP-TO-ADD-TO-TRUSTED-PROXIES-IN-CONFIGURATION-YAML>, but your HTTP integration is not set-up for reverse proxies
      • Proxy Host setting in Nginx Proxy Manager: you may need to set the ‘Scheme’ as HTTP (not HTTPS), otherwise you may get a “502 Bad Gateway - openresty” error. You’ll also want to have the ssl certificate setup.

    • Linkding:

      • Proxy Host setting in Nginx Proxy Manager: you may need to set the ‘Scheme’ as HTTP (not HTTPS), otherwise you may get a “502 Bad Gateway - openresty” error. You’ll also want to have the ssl certificate setup.
1 Like