These are some quick n’ dirty instructions so people can get up and running fast.

I wish I had known this was possible sooner.

Instructions:

Check that your VPN supports port forwarding and you have it enabled.

Grab your VPN’s internal IP with ip a

Find the interface for your VPN. For me it’s called tun0.

Open up /etc/nginx/nginx.conf

You can back it up, or comment everything out, or pick what’s necessary. Here’s what my file looks like.

	worker_processes  1;
	include modules.d/*.conf;

	events {
		worker_connections  1024;
	}
	http {
		server {
			listen [VPN INTERNAL IP]:[VPN FORWARDED PORT];
			server_name  localhost;
			location / {
				root '[ABSOLUTE PATH TO YOUR WEBSITE ROOT FOLDER]';
				index index.html; # Relative to your website root.
			}
		}
	}

Make sure your permissions are correct. For me, the ‘other’ group needs read permissions to the root folder, including where it’s mounted.

Start nginx with systemctl start nginx

You can visit your website on your host machine in a browser at [VPN INTERNAL IP]:[VPN FORWADED PORT]. For me, using the internal IP is required to view the website on my host machine.

To view the website on other machines, you can use [VPN EXTERNAL IP]:[VPN FORWARDED PORT]. The only thing you need to change is the IP address.

I hope this works for you and you are inspired to selfhost and take back power from those who stole it from us.

  • Laser@feddit.org
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    9 days ago

    Let’s Encrypt are rolling out IP-based certs, you may wanna follow its development. I’m not sure if it could be used for your forwarded VPN port, but it’d be nice anyhow

    It shouldn’t be because you’re not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.

    I believe encryption helps prevent tampering the data between the server and user too. It should prevent for example, someone MITM the connection and injecting malicious content that tells the user to download malware

    No, encryption only protects the confidentiality of data. You need message authentication codes or authenticated encryption to make sure the message hasn’t been transported tampered with. Especially stream ciphers like ChaCha (but also AES in counter mode) are susceptible to malleability attacks, which are super simple yet very dangerous.

    Edit: this post is a bit pedantic because any scheme that is relevant for LE certificates covers authenticity protection. But it’s not the encryption part of those schemes that is responsible.

    • SteveTech@programming.dev
      link
      fedilink
      English
      arrow-up
      0
      ·
      9 days ago

      It shouldn’t be because you’re not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.

      They’re ‘shortlived’ 7 day certs, verified using a HTTP challenge. It doesn’t matter who owns the IP, it’s just a matter of who holds the IP.

      • Laser@feddit.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        9 days ago

        Right, and for the challenge, you need to have access to a privileged port (which usually implies ownership), which you won’t get assigned.

        • stratself@lemdro.id
          link
          fedilink
          English
          arrow-up
          1
          ·
          9 days ago

          Ah right, completely forgot about that (80 for HTTP-01, 443 for TLS-ALPN-01). Is a bummer unfortunately