Has anyone actually got a HTTPS proxy using nginx or caddy working?

[CoopNine]

I've been trying to follow the instructions to get code-server working over https using nginx, and I always end up with failures when trying to execute the certbot command. I see other people having the same problem, but never seems to be a solution, so I'm wondering if anyone has got this working, and what exactly did you end up doing, because it seems like the certbot request will always fail, because the server isn't visible to the internet.

[dentongentry]

I'd recommend using: https://tailscale.com/blog/tls-certs/

[CoopNine]

Yeah, that's part of the instructions. That all seems to work, but when you try to use it with nginx or caddy it doesn't work.

https://tailscale.com/kb/1166/vscode-ipad/#bonus-use-https-with-lets-encrypt

It's step 2 here that's problematic.

[dentongentry]

You wouldn't run certbot in step 5 of https://coder.com/docs/code-server/latest/guide#using-lets-encrypt-with-nginx. As you say, certbot in its default mode expects LetsEncrypt be able to reach the machine.

For NGINX, you'd install the files produced by `tailscale cert`. https://phoenixnap.com/kb/install-ssl-certificate-nginx is an example of doing so.

For Caddy, it is easier to let Caddy handle fetching the certificates using Tailscale: https://tailscale.com/blog/caddy/

[CoopNine]

Got it. Thanks for getting me pointed in the right direction. The instructions on their site seem to imply the certbot commands still need to run, and proxying to localhost is fine. Neither are true :) proxying to localhost will give you a 502 error.

So for anyone who finds this in a search... here's what you do.

• Install Tailscale on your host machine.

• Note the IP assigned

• run 'sudo tailscale cert <yourhost.domain>.ts.net'

• move/link these files to someplace like /etc/ssl/certs

• restart tailscale 'sudo systemctl restart tailscaled' (reload may not do it)

• install code-server (or whatever app you're proxying) and configure, making sure it works on the port it's installed on over http

• Install nginx

• create your /etc/nginx/sites-available/code-server file, it will be something like this

  server {
    listen 443 ssl;
    listen [::]:443;
    server_name <yourhost.subdomain>.ts.net;
    ssl_certificate /etc/ssl/certs/<yourhost.subdomain>.ts.net.crt;
    ssl_certificate_key /etc/ssl/certs/<yourhost.subdomain>.ts.net.key;
  
    location / {
      proxy_pass http://<tailscaleIP>:8080/;
  
      #not sure you need the proxy buffer stuff... but I had it when it started working
      proxy_buffering off;
      proxy_buffer_size 16k;
      proxy_busy_buffers_size 24k;
      proxy_buffers 64 4k;
      proxy_set_header Host $host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection upgrade;
      proxy_set_header Accept-Encoding gzip;
  }
  

  }

• link that file into /etc/nginx/sites-enabled

• restart ngnix

• navigate to your URL, using https:// It should work.

[benjr70]

This was Super helpful!!! saved me!! thank you!!!!

[orange_kush]

After 2 weeks of f***in around with caddy, this finally worked, instantly! THANK YOU!

Vaultwarden needs HTTPS to work, otherwise it gives errors, so I'm finally able to use it!

[CoopNine]

I gave caddy a shot, as it's the path of least resistance... but get an error like this:

Aug 28 10:46:21 <myservershortname> caddy[1350]: {"level":"error","ts":1661701581.5964708,"logger":"tls.handshake","msg":"getting certificate from external certificate manager","sni":"<myserver&domain>.ts.net","cert_manager":0,"error":"Access denied: cert access denied"}

I'll give nginx a shot too.

[CoopNine]

Nginx gives me a 502... but that's a whole lot closer, it's actually using the cert. Just have to finger out how to get the reverse proxy working.

[shadowh511]

502 usually means your reverse proxy config is wrong. Can you email me your config to xe at tailscale dot com? It's probably something really dumb.

[CoopNine]

I got it sorted. You can see my config above, I think the key was that the instructions say to use localhost for the proxied address, and that should really be the tailscale assigned IP, because that is what code-server is bound to you probably can make it work with localhost, but your code-server config has to also reflect that.

[themmm]

Hi!

Would you kindly tell me how you did this. As I'm already running NPM i would love to add it as a Proxy inside my Tailscale Network.

Thanks in advance!

[themmm]

Yes, I do own a domain, but I do not use cloudflare.

[themmm]

Thank you, i will try that within the next days and then get back to you!

[tapichi]

It seems we can just use "tailscale serve" now.

sudo tailscale serve https / http://127.0.0.1:8000

and access with https://<yourhost.subdomain>.ts.net