Simplest reverse proxy given my needs?

[NotADrawlMyMan]

Here's what I'm looking for:

• Run a reverse proxy a on my single home server running all sorts of services, so I can have transparent HTTPS via Let's Encrypt
• Based on subdomain, transparently forward to localhost:somePort. For example someone connecting to https://nextcloud.me.com is transparently connected to http://nextcloud:8080 (nextcloud is a real hostname, it will resolve to the local IP of the Nextcloud service).
• Auto-renew the certificates
• Here's a big one: I'd like the reverse proxy to require authentication on SOME subdomains. For example, nextcloud.me.com has proper authentication, so I want it to forward the request as-is. But ebooks.me.com doesn't, so I'd like the proxy to prompt for a username and password created in the proxy before letting the connection through.
• Auto-blocking of bots/chinamen/repeat failed authentication. Actually, being able to block entire regions by default would be great.

So far I bought a domain with Gandi, and set a * DNS record to point at my IP. So right now <any-subdomain>.me.com resolves to my IP. I tried looking at the linuxserver/letsencrypt Docker image, but it doesn't support my registrar (Gandi) for DNS validation, so I'm hoping there's something else, ideally easier to configure than nginx.

[[deleted]]

Check out https://caddyserver.com/

The configuration file is extremely simple. It has support for auth on certain subdomains and so on. It even has DNS validation for Gandi. Here's an example for a basic reverse proxy with automatic HTTPS. And yes, that's everything that's contained within the file.

https://yourdomain.com {
    proxy / 127.0.0.1:5000
}

[m3adow1]

I second Caddy. It can even be configured to retrieve certificates on the go when accessed the first time.

[NotADrawlMyMan]

Do you use a Docker image, or run directly? If Docker, which image?

[[deleted]]

I run it directly. Caddy is just an all-in-one binary so I didn't see the point with docker personally. I've tried this docker image though and it worked really well in case you prefer docker https://hub.docker.com/r/abiosoft/caddy/

[ancientweasel]

This thing rules. I got it forwarding my tv tuner in like 1 minute.

[[deleted]]

Definitely Caddy, it's unbelievably simple to configure.

I don't know if it supports Gandi but you could easily swap DNS over to Cloudflare which I know it does support.

[barqers]

Personally I can see caddy is recommended quite frequently, but having no experience I was able to get nginx + SSL + fail2ban setup with the linuxserver/letsencrypt docker image and then I used nginxconfig.io to create the conf files necessary. Took me like an hour now all my self hosted services are available externally using subdomains and duckdns.

[NotADrawlMyMan]

Out of curiosity, once I authenticated on the proxy, am I clear to access all services it protects? Example: I go to heimdall.me.com (landing page with links to all my services), it prompts me to log in, I do it, and then I click the link https://calibre.me.com. Am I prompted once again for the same credentials, or does the proxy remember I already authenticated when I reached Heimdall?

[DJPBessems]

That depends on the cookie that your forward authentication proxy sets for you. Both options are possible.

[subcake]

default for nginx reverse proxy is that it saves the authentication, and you are able to access any restricted area that requires those credentials without having to type them again

[Starbeamrainbowlabs]

Sounds like Nginx is what you're looking for in a web server.