Switching from cloudflare to pangolin

Heyy i was fine with my cloudflare setup that was basically

	mnau.org -> Cloudflare -> cloudflared -> caddy -> website
	
cloudflared is tunnel simply set up with docker
caddy that routes traffic
website is another docker container

Okay let me explain why I had it set up like this first. I had to figure out how to connect services on my laptop at home to the internet. The problem was that my ISP wont let me port forward unless I pay for it, so i found out i can use cloudflared to create tunnel and get over this restriction. I also set up caddy so it proxies to my other containers that are not publicly accessible but its nice to be able to do eg. freshrss.mnau.org and get the freshrss :3. How it works for private services is by using tailscale and having the tailscale machine ip in the cloudflare dns record for *.mnau.org. That means that any service that is not using cloudflare tunnel goes through that. Its because exact dns matches have priority over this wildcard one.

Now what happened that i wanted to switch. I was looking at graphaneOS again and after reading more about it i somehow got into email providers proton and tuta. This reading about privacy got me thinking about why i trust cloudflare with my traffic. Somewhere in my mind was pangolin since i saw it mentioned a lot on r/selfhosted so i took a look and though lets try setting it up. Easier said than done, but i enjoy setting things up even if i they are not used after ehm like this blog ehm. I already had free vps from oracle spun up that i was using as proxy for my irc client. Yeah yeah i bascially went from trusting cloudflare to trusting oracle… Okay now about the pangolin setup. The docker setup was simple and after finding how to expose ports in oracle dashboard which was the biggest pain it worked. I replaced cloudflare with newt and pointed the services in pangolin to caddy. I also set crowdsec up which was real fun. I always wanted something to punish the bots trying to access .env files and other that dont even exist. Crowdsec supported discord notifications out of the box so that was nice. For caddy logs i had separate container that was bacially bash script reading access logs and after formating them nicely sending them to discord server.

I enjoyed looking at the logs, but i spend more and more time configuring things. Then another day or so i was paranoid that what if the vps was breached somehow and there is that tunnel to my home server where i also have private stuff. I though that i can just spin up another vm in proxmox and have it dedicated to public applications, but at that moment i though i can just move the public things to the vps itself.

After doing that i realized that pangolin takes a lot of ram at least for my 1gb vps. So now i am kinda burned after days or tinkering with things and then moving them again and again. In the future i will probably just use the tunnel if i plan to host more things that need to be accessible online, because 1gb is not enough. Also i would like to make my whole setup easily deployable using forgejo actions (basically same as github actions i hope). Also i would like to take a look at restic and backing things up from vps requires to have somewhere to put them so i guess i wont be able to escape from the tunnel. I was also thinking about switching from caddy to traefik, i dont really have a reason, i could say that i like their “mascot” and easily adding routes with labels in docker sounds cool. I spin up and down a lot of services that i am trying out. Editing Caddyfile isnt that bad i guess i just want to try something new.

Well thats it for now cya :3.