TrueNAS SCALE Apps remote access using Cloudflare tutorial

[d1gz0r]

(I hope someone experienced could check this post.)

Disclaimer 0: I decided to post it here so that people in my position could more easily find this information. Almost everything I've written here is taken from the excellent tutorials of the TrueCharts community and from their advice. I only tried to gather the information in one place and organize it. I am not an expert and I will not be able to answer most of the questions. However, there are plenty of people here ready to help you if you encounter any troubles. Also, feel free to ask TrueCharts Discord server for help.
Disclaimer 1: This article is intended for newbies. If you know how to configure reverse proxy, dynamic DNS, port forwarding, etc., you don't need it.
Disclaimer 2: I originally wrote this article in my native language and translated it into English using DeepL, so the wording may sometimes seem odd and technical terms may be misused.

Introduction​

Here I want to describe my way of creating self-hosted alternatives to various cloud services. Namely about how you can access your applications over the Internet as cheap and easy as possible. I myself use TrueNAS and its applications. For other systems, the principle will remain the same. There are tons of tutorials on how to host alternatives to Netflix, Spotify, DropBox and other stuff on TrueNAS and other NAS/hypervisor systems, but I couldn't find any complete tutorial on how to setup access without reverse proxy for TrueNAS. I had to collect pieces of information for this tutorial all over the internet.
Why should one use this method if they can get a static IP from their ISP and open several ports you may ask? By opening ports you become an easier target for malware and vulnerable to DDoS attacks. Also, the method described below seems simpler to set up once you get the idea.

Any additions, edits, and advice are welcome!

If you host services in containers or on virtual machines you may find this video helpful: https://www.youtube.com/watch?v=VrV0udRUi8A&t=293s

How do we do this?​

Cloudflare makes many useful services. Among them is Zero Trust. We won't go into the details of what it is. The main thing is that it is free. This service will allow us to connect to services in our local network by referring to them with a domain name and Cloudflare will hide our IP and ports. And most importantly, we do not need a static IP address.

What does it take?​

1. The server itself, in this case TrueNAS Scale with TrueCharts library connected. The applications you want to access must be installed from TrueCharts, because they have an Ingress setting that we need. The applications from the default TrueNAS library do not have these settings. If you deploy containers by yourself then you will have to fiddle with settings manually.
2. Traefik application from the TrueCharts library.
3. Cloudfalre account. Registration is free.
4. Certificate. It's not hard to get one, but to avoid stretching this tutorial I'll just send you to watch this video: https://www.youtube.com/watch?v=TJ5fDiDRcbU&t=9s
5. Domain name. You can try to get one for free, but it's easier to buy one. I bought mine for less than $4 for a whole year. That will be the only expense in this tutorial.

Step 1: Transferring your domain to Cloudflare​

In order for Cloudflare to use our domain, we need to link it to our account. Click the + in the upper right corner and follow the instructions. If you feel unsure, look for video instructions online.

Keep in mind that it may take up to several hours for the domain to be linked, wait until the end of the process.
You should have your domain in the menu on the left. Click on it. In the new menu on the left, look for “SSL/TLS”. On the “Overview” page (under “SSL/TLS”) in the middle of the screen, next to the connection scheme, select “Full”. Then go to “Edge Certificates”, scroll down a little bit and activate the switch next to “Always Use HTTPS”.

Step 2. Creating a tunnel​

Find the “Zero Trust” item in the side menu on the left (you can see it in the first screenshot). When you click it, you will be redirected to the Cloudflare Zero Trust portal. Go to the “Access” menu and select “Tunnels”. Name your tunnel however you like and click “Save tunnel” button.

If you are using the Cloudflare app for TrueNAS, you will only need a token from the next page. If you use a different system, select the option you need and install the application according to the instructions from Cloudflare.

Highlighted code must be inserted into the “Tunnel Token” field during the installation of the Cloudflare application from the TrueCharts library.

If you have done everything correctly, you should see something similar under "Access" → "Tunnels" in your Cloudflare Zero Trust dashboard.

Step 3: Installing Traefik​

IMPORTANT: Before setting up Traefik, you need to change the TrueNAS GUI ports. They both use the same ports by default, so if you do not change them, you will not be able to connect to the web interface of the TrueNAS server anymore!
To avoid this, go to “System Settings” → “General”. At the top right of the GUI window, click “Settings” and in the side menu change “Web Interface HTTP Port” to 81 and “Web Interface HTTPS Port” to 444 and click save. You will now connect to the server through your browser on these ports! (That is, if before you had *ip_server*:443 in your browser, it should now be *ip_server*:444).

Now we can move on to installing Traefik. Find it in the list of applications and click "Install". We only need to change 2 parameters before starting the installation. They are both under “Service's Port(s) Configuration”. Change the first port to 80 and the second to 443.

This step is described in more detail in the TrueCharts video: https://www.youtube.com/watch?v=bWNPfrKjawI

Step 4: Setting up access to the application​

Let's take the Jellyfin app as an example. In the installation menu (or edit menu, if you already have it installed), check the “Enable Ingress” item. Click “Add” next to “Hosts”, then again next to “Paths” right under “Hosts”. Click “Add” again on” TLS-Settings” and lastly on “Certificate Hosts”. Now we need to fill these items with information:
HostName: *some_name*.*your_domain_name*.*TLD* (ex. jellyfin.hackerman.com)
Path *: leave default “/”
Path Type *: leave default “Prefix”
Certificate Hosts: same as HostName
Select TrueNAS SCALE Certificate: choose 'cert' Certificate

This step is described in more detail in the video from TrueCharts: https://www.youtube.com/watch?v=0Rmav5gyAwI
In the video they change the "Service type" to "Cluster IP". It now looks different in the UI. If you choose the options that says "no exposed ports" or something like that, you will not be able to connect to the app by IP:port anymore. I personally do not change this option to connect to my media server via IP with my smart TV as it is always in my local network.

NOTICE: After configuring ingress, TrueNAS will use the domain name to send you to the application after you click "Open" from the applications list. However, this button will not work until you complete the configuration in Cloudflare. You can still access your TrueNAS applications by entering the IP of your TrueNAS server and the port the application is listening to manually in your browser.

Step 5: Configure access in Cloudflare​

Let's get back to our tunnel. Find it in the list (this should be easy, you probably have just one) and click the “Configure” button next to it. Right under the tunnel name, go to the “Public Hostname” page and click the blue “Add a public hostname” button on the right.

In the “Subdomain” field, enter the name you came up with when you set up ingress. As for "Domain", choose one of your domain names from the list. Choose "HTTP" type connection (HTTPS will not work). For "URL" use TrueNAS IP address in your local network and port which you normally use to connect to the application (indicated on the application tile in TrueNAS).

Save your settings and wait a few minutes. You will soon be able to connect to the app by domain name!

 

[morganL]

(I hope someone experienced could check this post.)

Disclaimer 0: I decided to post it here so that people in my position could more easily find this information. Almost everything I've written here is taken from the excellent tutorials of the TrueCharts community and from their advice. I only tried to gather the information in one place and organize it. I am not an expert and I will not be able to answer most of the questions. However, there are plenty of people here ready to help you if you encounter any troubles. Also, feel free to ask TrueCharts Discord server for help.
Disclaimer 1: This article is intended for newbies. If you know how to configure reverse proxy, dynamic DNS, port forwarding, etc., you don't need it.
Disclaimer 2: I originally wrote this article in my native language and translated it into English using DeepL, so the wording may sometimes seem odd and technical terms may be misused.

Introduction​

Here I want to describe my way of creating self-hosted alternatives to various cloud services. Namely about how you can access your applications over the Internet as cheap and easy as possible. I myself use TrueNAS and its applications. For other systems, the principle will remain the same. There are tons of tutorials on how to host alternatives to Netflix, Spotify, DropBox and other stuff on TrueNAS and other NAS/hypervisor systems, but I couldn't find any complete tutorial on how to setup access without reverse proxy for TrueNAS. I had to collect pieces of information for this tutorial all over the internet.
Why should one use this method if they can get a static IP from their ISP and open several ports you may ask? By opening ports you become an easier target for malware and vulnerable to DDoS attacks. Also, the method described below seems simpler to set up once you get the idea.

Any additions, edits, and advice are welcome!

If you host services in containers or on virtual machines you may find this video helpful: https://www.youtube.com/watch?v=VrV0udRUi8A&t=293s

How do we do this?​

Cloudflare makes many useful services. Among them is Zero Trust. We won't go into the details of what it is. The main thing is that it is free. This service will allow us to connect to services in our local network by referring to them with a domain name and Cloudflare will hide our IP and ports. And most importantly, we do not need a static IP address.

What does it take?​

1. The server itself, in this case TrueNAS Scale with TrueCharts library connected. The applications you want to access must be installed from TrueCharts, because they have an Ingress setting that we need. The applications from the default TrueNAS library do not have these settings. If you deploy containers by yourself then you will have to fiddle with settings manually.
2. Traefik application from the TrueCharts library.
3. Cloudfalre account. Registration is free.
4. Certificate. It's not hard to get one, but to avoid stretching this tutorial I'll just send you to watch this video: https://www.youtube.com/watch?v=TJ5fDiDRcbU&t=9s
5. Domain name. You can try to get one for free, but it's easier to buy one. I bought mine for less than $4 for a whole year. That will be the only expense in this tutorial.

Step 1: Transferring your domain to Cloudflare​

In order for Cloudflare to use our domain, we need to link it to our account. Click the + in the upper right corner and follow the instructions. If you feel unsure, look for video instructions online.

View attachment 62899

Keep in mind that it may take up to several hours for the domain to be linked, wait until the end of the process.
You should have your domain in the menu on the left. Click on it. In the new menu on the left, look for “SSL/TLS”. On the “Overview” page (under “SSL/TLS”) in the middle of the screen, next to the connection scheme, select “Full”. Then go to “Edge Certificates”, scroll down a little bit and activate the switch next to “Always Use HTTPS”.

View attachment 62900

Step 2. Creating a tunnel​

Find the “Zero Trust” item in the side menu on the left (you can see it in the first screenshot). When you click it, you will be redirected to the Cloudflare Zero Trust portal. Go to the “Access” menu and select “Tunnels”. Name your tunnel however you like and click “Save tunnel” button.

View attachment 62901

If you are using the Cloudflare app for TrueNAS, you will only need a token from the next page. If you use a different system, select the option you need and install the application according to the instructions from Cloudflare.

View attachment 62902

Highlighted code must be inserted into the “Tunnel Token” field during the installation of the Cloudflare application from the TrueCharts library.

View attachment 62903

If you have done everything correctly, you should see something similar under "Access" → "Tunnels" in your Cloudflare Zero Trust dashboard.

View attachment 62904

Step 3: Installing Traefik​

IMPORTANT: Before setting up Traefik, you need to change the TrueNAS GUI ports. They both use the same ports by default, so if you do not change them, you will not be able to connect to the web interface of the TrueNAS server anymore!
To avoid this, go to “System Settings” → “General”. At the top right of the GUI window, click “Settings” and in the side menu change “Web Interface HTTP Port” to 81 and “Web Interface HTTPS Port” to 444 and click save. You will now connect to the server through your browser on these ports! (That is, if before you had *ip_server*:443 in your browser, it should now be *ip_server*:444).

Now we can move on to installing Traefik. Find it in the list of applications and click "Install". We only need to change 2 parameters before starting the installation. They are both under “Service's Port(s) Configuration”. Change the first port to 80 and the second to 443.

View attachment 62905

This step is described in more detail in the TrueCharts video: https://www.youtube.com/watch?v=bWNPfrKjawI

Step 4: Setting up access to the application​

Let's take the Jellyfin app as an example. In the installation menu (or edit menu, if you already have it installed), check the “Enable Ingress” item. Click “Add” next to “Hosts”, then again next to “Paths” right under “Hosts”. Click “Add” again on” TLS-Settings” and lastly on “Certificate Hosts”. Now we need to fill these items with information:
HostName: *some_name*.*your_domain_name*.*TLD* (ex. jellyfin.hackerman.com)
Path *: leave default “/”
Path Type *: leave default “Prefix”
Certificate Hosts: same as HostName
Select TrueNAS SCALE Certificate: choose 'cert' Certificate

View attachment 62906

This step is described in more detail in the video from TrueCharts: https://www.youtube.com/watch?v=0Rmav5gyAwI (I did not change the type of service, and everything works as it is, although it may not be the right thing to do)

NOTICE: After configuring ingress, TrueNAS will use the domain name to send you to the application after you click "Open" from the applications list. However, this button will not work until you complete the configuration in Cloudflare. You can still access your TrueNAS applications by entering the IP of your TrueNAS server and the port the application is listening to manually in your browser.

Step 5: Configure access in Cloudflare​

Let's get back to our tunnel. Find it in the list (this should be easy, you probably have just one) and click the “Configure” button next to it. Right under the tunnel name, go to the “Public Hostname” page and click the blue “Add a public hostname” button on the right.

View attachment 62907

In the “Subdomain” field, enter the name you came up with when you set up ingress. As for "Domain", choose one of your domain names from the list. Choose "HTTP" type connection (HTTPS will not work). For "URL" use TrueNAS IP address in your local network and port which you normally use to connect to the application (indicated on the application tile in TrueNAS).
View attachment 62908

Save your settings and wait a few minutes. You will soon be able to connect to the app by domain name!

Thanks for the excellent write-up. Looking forward to seeing the reviews from other users following your recipe.

 

[MyVizDrake]

(I hope someone experienced could check this post.)

Disclaimer 0: I decided to post it here so that people in my position could more easily find this information. Almost everything I've written here is taken from the excellent tutorials of the TrueCharts community and from their advice. I only tried to gather the information in one place and organize it. I am not an expert and I will not be able to answer most of the questions. However, there are plenty of people here ready to help you if you encounter any troubles. Also, feel free to ask TrueCharts Discord server for help.
Disclaimer 1: This article is intended for newbies. If you know how to configure reverse proxy, dynamic DNS, port forwarding, etc., you don't need it.
Disclaimer 2: I originally wrote this article in my native language and translated it into English using DeepL, so the wording may sometimes seem odd and technical terms may be misused.

Introduction​

Here I want to describe my way of creating self-hosted alternatives to various cloud services. Namely about how you can access your applications over the Internet as cheap and easy as possible. I myself use TrueNAS and its applications. For other systems, the principle will remain the same. There are tons of tutorials on how to host alternatives to Netflix, Spotify, DropBox and other stuff on TrueNAS and other NAS/hypervisor systems, but I couldn't find any complete tutorial on how to setup access without reverse proxy for TrueNAS. I had to collect pieces of information for this tutorial all over the internet.
Why should one use this method if they can get a static IP from their ISP and open several ports you may ask? By opening ports you become an easier target for malware and vulnerable to DDoS attacks. Also, the method described below seems simpler to set up once you get the idea.

Any additions, edits, and advice are welcome!

If you host services in containers or on virtual machines you may find this video helpful: https://www.youtube.com/watch?v=VrV0udRUi8A&t=293s

How do we do this?​

Cloudflare makes many useful services. Among them is Zero Trust. We won't go into the details of what it is. The main thing is that it is free. This service will allow us to connect to services in our local network by referring to them with a domain name and Cloudflare will hide our IP and ports. And most importantly, we do not need a static IP address.

What does it take?​

1. The server itself, in this case TrueNAS Scale with TrueCharts library connected. The applications you want to access must be installed from TrueCharts, because they have an Ingress setting that we need. The applications from the default TrueNAS library do not have these settings. If you deploy containers by yourself then you will have to fiddle with settings manually.
2. Traefik application from the TrueCharts library.
3. Cloudfalre account. Registration is free.
4. Certificate. It's not hard to get one, but to avoid stretching this tutorial I'll just send you to watch this video: https://www.youtube.com/watch?v=TJ5fDiDRcbU&t=9s
5. Domain name. You can try to get one for free, but it's easier to buy one. I bought mine for less than $4 for a whole year. That will be the only expense in this tutorial.

Step 1: Transferring your domain to Cloudflare​

In order for Cloudflare to use our domain, we need to link it to our account. Click the + in the upper right corner and follow the instructions. If you feel unsure, look for video instructions online.

View attachment 62899

Keep in mind that it may take up to several hours for the domain to be linked, wait until the end of the process.
You should have your domain in the menu on the left. Click on it. In the new menu on the left, look for “SSL/TLS”. On the “Overview” page (under “SSL/TLS”) in the middle of the screen, next to the connection scheme, select “Full”. Then go to “Edge Certificates”, scroll down a little bit and activate the switch next to “Always Use HTTPS”.

View attachment 62900

Step 2. Creating a tunnel​

Find the “Zero Trust” item in the side menu on the left (you can see it in the first screenshot). When you click it, you will be redirected to the Cloudflare Zero Trust portal. Go to the “Access” menu and select “Tunnels”. Name your tunnel however you like and click “Save tunnel” button.

View attachment 62901

If you are using the Cloudflare app for TrueNAS, you will only need a token from the next page. If you use a different system, select the option you need and install the application according to the instructions from Cloudflare.

View attachment 62902

Highlighted code must be inserted into the “Tunnel Token” field during the installation of the Cloudflare application from the TrueCharts library.

View attachment 62903

If you have done everything correctly, you should see something similar under "Access" → "Tunnels" in your Cloudflare Zero Trust dashboard.

View attachment 62904

Step 3: Installing Traefik​

IMPORTANT: Before setting up Traefik, you need to change the TrueNAS GUI ports. They both use the same ports by default, so if you do not change them, you will not be able to connect to the web interface of the TrueNAS server anymore!
To avoid this, go to “System Settings” → “General”. At the top right of the GUI window, click “Settings” and in the side menu change “Web Interface HTTP Port” to 81 and “Web Interface HTTPS Port” to 444 and click save. You will now connect to the server through your browser on these ports! (That is, if before you had *ip_server*:443 in your browser, it should now be *ip_server*:444).

Now we can move on to installing Traefik. Find it in the list of applications and click "Install". We only need to change 2 parameters before starting the installation. They are both under “Service's Port(s) Configuration”. Change the first port to 80 and the second to 443.

View attachment 62905

This step is described in more detail in the TrueCharts video: https://www.youtube.com/watch?v=bWNPfrKjawI

Step 4: Setting up access to the application​

Let's take the Jellyfin app as an example. In the installation menu (or edit menu, if you already have it installed), check the “Enable Ingress” item. Click “Add” next to “Hosts”, then again next to “Paths” right under “Hosts”. Click “Add” again on” TLS-Settings” and lastly on “Certificate Hosts”. Now we need to fill these items with information:
HostName: *some_name*.*your_domain_name*.*TLD* (ex. jellyfin.hackerman.com)
Path *: leave default “/”
Path Type *: leave default “Prefix”
Certificate Hosts: same as HostName
Select TrueNAS SCALE Certificate: choose 'cert' Certificate

View attachment 62906

This step is described in more detail in the video from TrueCharts: https://www.youtube.com/watch?v=0Rmav5gyAwI (I did not change the type of service, and everything works as it is, although it may not be the right thing to do)

NOTICE: After configuring ingress, TrueNAS will use the domain name to send you to the application after you click "Open" from the applications list. However, this button will not work until you complete the configuration in Cloudflare. You can still access your TrueNAS applications by entering the IP of your TrueNAS server and the port the application is listening to manually in your browser.

Step 5: Configure access in Cloudflare​

Let's get back to our tunnel. Find it in the list (this should be easy, you probably have just one) and click the “Configure” button next to it. Right under the tunnel name, go to the “Public Hostname” page and click the blue “Add a public hostname” button on the right.

View attachment 62907

In the “Subdomain” field, enter the name you came up with when you set up ingress. As for "Domain", choose one of your domain names from the list. Choose "HTTP" type connection (HTTPS will not work). For "URL" use TrueNAS IP address in your local network and port which you normally use to connect to the application (indicated on the application tile in TrueNAS).
View attachment 62908

Save your settings and wait a few minutes. You will soon be able to connect to the app by domain name!

If you have your app configured with Traefik ingress via HTTPS you can tell the Cloudflare Tunnel public record to use HTTPS but you need to tell Cloudflare the certificate name / host you expect to be returned or else it will error.

Mine are via Let’s Encrypt and I am doing this with per-app certificates and a wildcard certificate.

If I need to get to my Cloudflare tunnel account and take a picture let me know and I’ll do it tomorrow. From what I recall, it’s fairly obvious in the Cloudflare configuration UI for the public host record.

 

[d1gz0r]

If you have your app configured with Traefik ingress via HTTPS you can tell the Cloudflare Tunnel public record to use HTTPS but you need to tell Cloudflare the certificate name / host you expect to be returned or else it will error.

Mine are via Let’s Encrypt and I am doing this with per-app certificates and a wildcard certificate.

If I need to get to my Cloudflare tunnel account and take a picture let me know and I’ll do it tomorrow. From what I recall, it’s fairly obvious in the Cloudflare configuration UI for the public host record.

Yeah, that's something I would like to explore. I planned to do it later because it works as it is and as my understanding goes all non-encrypted communication happens on my end, so I am not concerned much.

I got a certificate from Cloudflare as it was shown in one of the TrueCharts videos, but I haven't figured out how to use it in local network.

 

[MyVizDrake]

This is how mine is setup .. my origin server certificate is a Let's Encrypt Cert used by Traefik. I also have HTTPS/2 enabled (which requires https at the origin)

 

[matthiasnielsen]

If you have your app configured with Traefik ingress via HTTPS you can tell the Cloudflare Tunnel public record to use HTTPS but you need to tell Cloudflare the certificate name / host you expect to be returned or else it will error.

Mine are via Let’s Encrypt and I am doing this with per-app certificates and a wildcard certificate.

If I need to get to my Cloudflare tunnel account and take a picture let me know and I’ll do it tomorrow. From what I recall, it’s fairly obvious in the Cloudflare configuration UI for the public host record.

Mine is via HTTPS. But how exactly do i tell Cloudflare the certificate name. I'm pretty new to all this stuff, and just migrated from a Synology and trying to set it all up properly.

I have my own domain that i can connect to locally - so far so good. My setup is made following this: https://www.youtube.com/watch?v=QSMgfz5zrxo&t=160s - But now i'm confused if that works with this solution?

 

[MyVizDrake]

Just realized my setup was posted Jan 26 so removing the "duplicate" here. You need to provide the FQDN of the Traefik app. As I mentioned mine was via LetsEncrypt.

Hope this helps!

 

[hazzard]

You can also use the internal DNS name of the app, e.g. for Nextcloud, select HTTP and for the URL enter nextcloud.ix-nextcloud.svc.cluster.local:10020. I did this as I use the same fqdn internally and externally and it's probably better keeping the traffic within the kubernetes / docker network? I don't know if that's the correct terminology or whether that's fact either!

 

[fnienstadt]

Can somebody explain why we need Traefik or even a Let's Encrypt certificate to allow secure access from the web into TrueNAS Scale and apps??
Isn't Cloudflare enabling secure routing into the private network (via the Tunnel and Private Hosts configuration) and HTTPS capability via CF certificates once traffic enters the tunnel???
I would like to simplify the setup if at all possible. Is it possible to achieve secure web access to, say, Nextcloud, just using the Cloudflared app to set up the tunnel from the TrueNAS Scale server???

Thanks

 

[hazzard]

Can somebody explain why we need Traefik or even a Let's Encrypt certificate to allow secure access from the web into TrueNAS Scale and apps??
Isn't Cloudflare enabling secure routing into the private network (via the Tunnel and Private Hosts configuration) and HTTPS capability via CF certificates once traffic enters the tunnel???
I would like to simplify the setup if at all possible. Is it possible to achieve secure web access to, say, Nextcloud, just using the Cloudflared app to set up the tunnel from the TrueNAS Scale server???

Thanks

I don't use Traefik, see my post above, so yes you can do as you mention in your last sentence. To access Nextcloud internally using https with my domain name, I imported a LetsEncrypt certificate into TNS. If you're using the TrueCharts version, you can't use cert-manager with Nextcloud yet AFAIK until it's updated to the new common. Make sure you install the TOTP app within Nextcloud so you can enable 2FA if you're exposing it to the wild!

 

[fnienstadt]

Thanks. Everything working now. Had to re-configure Nextcloud (messed up during my original installation - nextcloud datasets).
Now I need to work on accessing my existing TNS SMB shares remotely (over the web). Would like to find a way to do it via Cloudflare tunnels but it seems it will be more straightforward with a VPN setup(OpenVPN, Wireguard, etc...)

 

[Flashy]

Thanks for the guide, it has worked perfectly for me. I even managed to add another subdomain that points to truenas webpage. After more than a week of use today it randomly stopped working. The tunnel reports healthy but if I tried to reach my app through the correct adress it threw an error 502. Cloudlflared, Traefik and the app in question (Nextcloud) were all running and I could reach them by local IP and port. I tried rebooting truenas, restarting all the apps, but what fixed it was clicking on "edit" on cloudflared, deleting the tunnel key and pasting it again (it was the same). I am a bit perplexed and I have no idea what happened. I need a stable access to my apps for when I'm away. Anyone else having strange behaviours?

 

[predsfan2]

I don't use Traefik, see my post above, so yes you can do as you mention in your last sentence. To access Nextcloud internally using https with my domain name, I imported a LetsEncrypt certificate into TNS. If you're using the TrueCharts version, you can't use cert-manager with Nextcloud yet AFAIK until it's updated to the new common. Make sure you install the TOTP app within Nextcloud so you can enable 2FA if you're exposing it to the wild!

You don't need Traefik for https over different networks for Nextcloud? I managed to get this tutorial working for Jellyfin, but i do the same things and it doesnt work for nextcloud... I can't figure anything out.

 

[d1gz0r]

You don't need Traefik for https over different networks for Nextcloud? I managed to get this tutorial working for Jellyfin, but i do the same things and it doesnt work for nextcloud... I can't figure anything out.

Nice to see that this thing is still works and help someone.
NextCloud is a bit tricky to set up. I tried different ways to make it accessable through the internet, but non of them worked consistently.
I think your best bet is to use an old good VPN to connect the devices you need to connect on one network.

P.S. Personally, NextCloud never worked for me in its TrueNAS implementation (not TrueNAS official, nor TrueCharts). Every time I set up it something end up breaking the install. So I just gave up on it until I get a separate machine for virtualization.

 

[predsfan2]

If it isnt the author himself, haha...
What i was trying to do was make a link that i could send to people so that they can upload photos/videos to my server, and then whomever i give access to, they can access all those, off network.
Thank you so much for your reply!

 

[d1gz0r]

If it isnt the author himself, haha...
What i was trying to do was make a link that i could send to people so that they can upload photos/videos to my server, and then whomever i give access to, they can access all those, off network.
Thank you so much for your reply!

For this kind of stuff I can recommend ProjectSend (https://www.projectsend.org/). It's not exactly like NextCloud, but it's good for sending and sharing files. No problem connecting to it through CloudFlair too.

 

[predsfan2]

For this kind of stuff I can recommend ProjectSend (https://www.projectsend.org/). It's not exactly like NextCloud, but it's good for sending and sharing files. No problem connecting to it through CloudFlair too.

thank you so much! I really appreciate it... I'll look into it!

 

[tyler72us]

Yeah, that's something I would like to explore. I planned to do it later because it works as it is and as my understanding goes all non-encrypted communication happens on my end, so I am not concerned much.

I got a certificate from Cloudflare as it was shown in one of the TrueCharts videos, but I haven't figured out how to use it in local network.

Did you ever explore and figure out how to do this on https? I've read the comments above, and tried googling it, but I'm completely missing something, because I cannot figure out how to do this.

 

[vampirebyte]

If you have your app configured with Traefik ingress via HTTPS you can tell the Cloudflare Tunnel public record to use HTTPS but you need to tell Cloudflare the certificate name / host you expect to be returned or else it will error.
[...]

Thank you, did the trick for our setup too.

Can somebody explain why we need Traefik or even a Let's Encrypt certificate to allow secure access from the web into TrueNAS Scale and apps??
Isn't Cloudflare enabling secure routing into the private network (via the Tunnel and Private Hosts configuration) and HTTPS capability via CF certificates once traffic enters the tunnel???
I would like to simplify the setup if at all possible. Is it possible to achieve secure web access to, say, Nextcloud, just using the Cloudflared app to set up the tunnel from the TrueNAS Scale server???

Thanks

This is a good question, HTTP/2 maybe? True end-to-end encyption? Otherwise, inside your "private" LAN, somebody can sniff the traffic.

 

[jengle]

This is what helped me get traefik working with Cloudflare and Truecharts Ingress:

Reddit - Dive into anything

www.reddit.com

that also used:

Linking Apps Internally

truecharts.org

to:
So instead of using the IP as URL in the tunnel, you'd use e.g. traefik-tcp.ix-traefik.svc.cluster.local

and in Cloudflare:
Application setup in Cloudflare Tunnel Public Hostname for Traefik

URL:

TYPE: HTTPS
URL: traefik-tcp.ix-traefik.svc.cluster.local
Additional application settings
TLS
No TLS Verify
Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
Content Loaded
Enabled

All else default - not selected.
Hope this helps others reading through all the other recipes found here, redit, etc. Why can't Truenas/Truecharts come up with better cook books?