As the title suggests, I’m trying to run an ejabberd (xmpp) server behind an nginx reverse proxy. The reason is, I want to be able to run the server on my raspberry pi at home, but have people connect to it through my VPS, which is running nginx. This would be nice because I don’t need a static ip and I don’t have to leak my ip address.
I have looked this up, but have not found an answer that works exactly for my use case.
And I have a DNS entry telling XMPP clients to contact my server at port 6969 (this was just for testing):
I would also need to figure out how to supply ejabberd with the correct certificates for the domain. Since it’s running on a different computer than the reverse proxy, would I have to somehow copy the certificate over every time it has to be renewed?
This would be nice because I don’t need a static ip and I don’t have to leak my ip address.
How does the VPS know how to find your rpi?
Could you not just use something like duck dns on a cronjob and give out that url?
I would also need to figure out how to supply ejabberd with the correct certificates for the domain. Since it’s running on a different computer than the reverse proxy, would I have to somehow copy the certificate over every time it has to be renewed?
Since the VPS is doing your TLS termination, you would need an encrypted tunnel of some sort. Have you considered something like Istio? That provides mTLS out of the box really… I’ve never seen it for this kind of use case but I don’t see why it wouldn’t work.
Istio is a service mesh. You basically run proxies on the vps and the rpi. The apps make calls to localhost and the proxy layer figures out the communication between each proxy.
Duck dns is just a dynamic dns service. It gives you a stable address even if you don’t have a static ip.
How would I use that in this situation? I don’t get it. I already have a vpn set up to communicate between the two devices, and have been successfully running multiple services in this configuration for about a month. It’s just XMPP that I’m having trouble with.
It auto discovers machines/instances/VMs/containers in the mesh and figures out the secure routing on the fly. If you couldn’t ensure a consistent IP from the home address it wouldn’t matter… The service mesh would work it out.
It is probably overkill for this project though… Something to think about…
But since you don’t actually need to multi-plex HTTP with XMPP, why not just configure port forwarding like you would do in a local network (assuming your VPS is connected to your Rasberry via a Wireguard VPN or similar)?
For the certs you can request them again from your Rasberry easily if you use the DNS-01 method. That also allows you to get wildcard certs, which are very useful with the multiple subdomains you usually have for a XMPP service.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
6 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #136 for this sub, first seen 13th Sep 2023, 15:05] [FAQ] [Full list] [Contact] [Source code]
Adding Wikipedia page links would make this bot much more useful for those that need this information 🤔
How does the VPS know how to find your rpi?
Could you not just use something like duck dns on a cronjob and give out that url?
Since the VPS is doing your TLS termination, you would need an encrypted tunnel of some sort. Have you considered something like Istio? That provides mTLS out of the box really… I’ve never seen it for this kind of use case but I don’t see why it wouldn’t work.
The vps communicates with the rpi through a vpn.
I have not heard of duck dns nor lstio, but I’ll check it out when I get home.
Istio is a service mesh. You basically run proxies on the vps and the rpi. The apps make calls to localhost and the proxy layer figures out the communication between each proxy.
Duck dns is just a dynamic dns service. It gives you a stable address even if you don’t have a static ip.
How would I use that in this situation? I don’t get it. I already have a vpn set up to communicate between the two devices, and have been successfully running multiple services in this configuration for about a month. It’s just XMPP that I’m having trouble with.
It auto discovers machines/instances/VMs/containers in the mesh and figures out the secure routing on the fly. If you couldn’t ensure a consistent IP from the home address it wouldn’t matter… The service mesh would work it out.
It is probably overkill for this project though… Something to think about…
I already have a constant ip on the vpn I still don’t get it, sorry
I guess this is based on this guide? https://wiki.xmpp.org/web/Tech_pages/XEP-0368
But since you don’t actually need to multi-plex HTTP with XMPP, why not just configure port forwarding like you would do in a local network (assuming your VPS is connected to your Rasberry via a Wireguard VPN or similar)?
For the certs you can request them again from your Rasberry easily if you use the DNS-01 method. That also allows you to get wildcard certs, which are very useful with the multiple subdomains you usually have for a XMPP service.