Remote access with Caddy, Duckdns vs Tailscale for security?

[Balinus]

Don't have a solution, just wanted to give an fyi for tailscale. You can only add 3 users to tailscale, but you can add a lot more users through direct access to your NAS/Server. I think its around 100 or so. And it's even better, because normally i don't want my friends to see all my machienes in my taislcale network. I only want to give them access to my NAS.

I had the same problem as you and was about to set up the whole duckydns/reverse proxy setup, but then i read i can just add way more friends directly to the machiene. And i prefer tailscale because it's just super secure.

I initially tried with sharing my jellyfin node but, somehow, my brother wasn't able to connect. It worked as soon as he joined my Tailnet though. Perhaps it was only a mistake on our part. I might retry this approach one day though!

If you want to use a DNS module you should build your own caddy image that includes the stuff for your specific DNS provider.

All custom images for all supported DNS providers are there : https://github.com/orgs/caddy-dns/repositories?type=all

You can add any other module you'd like to build the image you need

For instance my DNS provider is Infomaniak, and I also use the Crowdsec bouncer module on my Caddy to detect and block known attacks scenarios and offenders IPs, and so I build my caddy image with this docker command :

Code:

  FROM caddy:builder AS builder
 
  RUN xcaddy build \
      --with github.com/caddy-dns/infomaniak \
      --with github.com/hslatman/caddy-crowdsec-bouncer/http
 
  FROM caddy:latest
 
  COPY --from=builder /usr/bin/caddy /usr/bin/caddy

But all this will be tedious if you hardly master docker. And you will have to learn the fundamentals.

Once your image done, you should also configure properly the DNS parameters using a tls{} in your Caddyfile, for instance this is mine for infomaniak

Code:

*.domain.tld, domain.tld {

    crowdsec # this executes the CrowdSec module; if an IP is denied, it won't get access to the reverse proxy

        tls {
                dns infomaniak my_very_long_api_key_provided_by_infomaniak
                propagation_delay 60s
                propagation_timeout -1
        }

The parameters for your DNS might be different than mine, and you should find how to configure yours by yourself. There's generally some explanations on the readme of each caddy-dns sub-github

Thanks! 

Do you "automate" your Caddy build somehow? Or you execute your Docket command once there is a new version? Any benefit to using Docker here? Right now, I mostly run "directly" on the system. It is only hosting Jellyfin and Caddy in the end.

I will add "crowdsec", seems like a nice addition to the Caddy software.