Expose your self-hosted apps to the internet with a secure reverse proxy, automatic SSL certificates, and NAT traversal—all configured in one command. Built for VPS and Docker, this toolkit combines Caddy, frp, and DDNS into ready-to-deploy templates. No more piecing together separate tools for reverse proxy, Let's Encrypt, and tunnel setup. Choose a template, enter your domain, and your services are live with HTTPS.
Just hardened your VPS? Deploy the
websitetemplate first — it gives you a reverse proxy with automatic SSL. Then deploy your apps with compose-recipes and route them through the proxy.
After deploying apps on your VPS, you need to expose them to the internet. This means:
- Reverse proxy — route domain names to the right containers
- SSL certificates — HTTPS, not HTTP, for security and trust
- NAT traversal — expose home services through your VPS
- Dynamic DNS — keep DNS updated if your IP changes
Each of these is a separate tool (Caddy, acme.sh, frp, ddns-go). Configuring them individually is complex and error-prone. This toolkit combines them into pre-configured templates — pick one, fill in your domain, done.
- Automatic HTTPS — Caddy obtains and renews Let's Encrypt certificates with zero configuration
- Security headers — HSTS, X-Content-Type-Options, X-Frame-Options injected automatically
- NAT traversal — frp tunnel server for exposing home services through your VPS
- Dynamic DNS — ddns-go integration for Cloudflare, Aliyun, Tencent, and more
- Cloudflare Tunnel — alternative mode that requires zero inbound ports on your VPS
- Port audit — scan all exposed ports and identify security risks
- Docker network integration — all apps share the
mb-proxynetwork for seamless routing
| Template | Components | Use Case |
|---|---|---|
| website | Caddy + SSL | Expose a single site with HTTPS |
| multi-site | Caddy + SSL | Expose multiple sites with one Caddy instance |
| tunnel | Caddy + frp | Expose home services through your VPS |
| full-stack | Caddy + frp + DDNS | Everything: proxy, SSL, tunnel, and DDNS |
| cloudflare | Caddy + Cloudflare Tunnel | Zero inbound ports — all traffic via Cloudflare |
| traefik | Traefik v3.6 + SSL | Docker-native reverse proxy with dashboard and middleware library |
| socket-proxy | Docker socket-proxy | Filtered Docker API access — never hand out the raw socket |
| sso | OAuth2 Proxy + Authelia | SSO/OIDC authentication — protect any service with Google/GitHub/self-hosted login |
| mtls | mTLS cert scripts + configs | Mutual TLS authentication — CA + server + client cert generation and reverse proxy configs |
| load-balancing | HAProxy + Nginx + Traefik | Load balancing across multiple backends — HAProxy, Nginx upstream, or Traefik WRR |
| edge-firewall | nftables + blocklist | Edge firewall ruleset (default-deny, SSH rate limit, bogon/IP blocklist) |
| edge-ddns | DDNS scripts | Cloudflare / DuckDNS dynamic DNS scripts (cron, IPv4+IPv6) |
# 1. Harden your VPS and install Docker (if not done)
# → https://github.com/0x10debug/vps-bootstrap
# 2. Clone this repo
git clone https://github.com/0x10debug/network-toolkit.git
cd network-toolkit
# 3. List available templates
./mb net list
# 4. Deploy a reverse proxy with automatic SSL
./mb net deploy website
# 5. Add routes for your apps
./mb net proxy add app.example.com app-container:8080
# 6. Check status
./mb net statusmb net list # List available templates
mb net deploy <template> # Deploy a network template
mb net status # Show infrastructure status
mb net proxy add <domain> <target> # Add reverse proxy route
mb net proxy remove <domain> # Remove reverse proxy route
mb net tunnel add <name> # Add tunnel configuration
mb net tunnel status # Show tunnel status
mb net ssl list # List SSL certificates
mb net ssl renew # Force certificate renewal
mb net audit # Audit port exposure
mb net update # Update network components
mb net help # Show helpDeploy the website template: mb net deploy website. Enter your domain and the target container. Caddy starts, obtains an SSL certificate from Let's Encrypt automatically, and routes traffic to your app. Add more routes with mb net proxy add <domain> <target>.
Caddy includes automatic Let's Encrypt integration — no manual certificate management needed. When you deploy any template, Caddy obtains certificates for your domains automatically. Check certificate status with mb net ssl list.
Deploy the tunnel template on your VPS: mb net deploy tunnel. This starts an frp server. Then install the frp client on your home machine, configure it to connect to your VPS, and your home services are accessible via your VPS domain with HTTPS.
Deploy the cloudflare template: mb net deploy cloudflare. This runs cloudflared on your VPS, creating an outbound tunnel to Cloudflare's edge. No inbound ports need to be open on your VPS — all traffic flows through Cloudflare. Configure ingress rules in the cloudflared config file.
Deploy the multi-site template: mb net deploy multi-site. The Caddyfile includes multiple domain blocks. Add new domains with mb net proxy add <domain> <target>, or edit the Caddyfile directly for complex configurations.
- Reverse Proxy Guide — How to expose apps with HTTPS
- Tunnel Setup — NAT traversal with frp
- SSL Management — Certificate management and troubleshooting
- DDNS Setup — Dynamic DNS configuration
- Security Checklist — Network exposure security audit
Reusable configuration snippets for advanced users:
- Caddy — Base Caddyfile and security header snippets
- Traefik — Base static config and middleware snippets (Traefik v3.6)
- frp — Server and client configuration templates
- DDNS — ddns-go configuration for multiple DNS providers
- Cloudflare — Cloudflare Tunnel ingress configuration
- vps-bootstrap — One-command VPS initialization and security hardening
- compose-recipes — Self-hosted app suites for VPS
- monitor-stack — Lightweight monitoring stack
- security-audit — VPS security auditing tool