How to deploy to local network only?

[jcommander]

I want some services to only be reachable (via vpn) on the local network.
With destinations, you can seperate networks but I haven't found a way to keep a network private.
Can't I tell the Proxy to not publish my app via the UI?

[AgoraSecurity]

+1

[BoThomas]

Im selfhosting in my home network and did this by deleting the auto generated domaine and then using the "ports mapping" to map the port of the resource to the host-system.

Now i can access the resource via my servers ip + mapped port in my local network.

The resources i want to reach from the web are using cloudflare tunnel.

I dont think thats exactly what you are asking for, but maybe helps someone out stumbling over this thread.

[brunooomelo]

how?

[BoThomas]

Due to the precision of your question, I don't know exactly which part is unclear. I'll try to help you anyway.

Local Network

1. Removing the auto-generated domain

• Go to your application -> Configuration -> General
• Search for "Domains" and empty its value.
• Click "Save"

2. Add the port mapping

• Search for "Network" Section
  • Put your applications internal Port into "Ports Exposes", e.g. 3000
  • Add a Mapping into "Ports Mappings", to expose this Port onto your local Network. It can be the same one or a different one. Format: [external port]:[internal port], e.g. 2000:3000 to map your applications internal 3000 port to your Coolify-Servers 2000 Port.
• Click "Save"
• Redeploy your Application.
• You should now be able to access your app under [your-servers-ip]:[the external port], e.g. http://192.168.0.10:2000

Cloudflare Tunnel

• I added it manually, but there is a new automated approach documented here: https://coolify.io/docs/knowledge-base/cloudflare/tunnels/#automated
• Don't use Ports-Mapping when using a Tunnel. You need to map the Port inside the Domain Filed like this http://[tunnel-domain]:[internal Port], e.g. http://sub.mydomain.dev:3000

[mono-sudo2]

I just realized that my auto generated domain is still reachable, even after deleting it.

If you take a look at the container labels for traefik and caddy all of the original sslip.io urls remain AND are reachable from an external network.
Setting up Port Mappings didn't help either. It is still able to be called externally via that original domain, deleted or not.

I tried multiple ways to "hide" my service.

1. I set http://localhost as my domain
2. I set http://localhost:[port] as my domain
3. I removed the domain entirely

None of these work.

I did find a possible solution (at least it worked for me):
If you replace the domain with a one string word, like "asd", then the Host does actually get removed and you become no longer able to reach that service via the sslip.io domain.
To reach that service again you have two options:

1. You must set up port mappings and then disable that port on your servers firewall so it is no longer externally reachable.
2. You use Network Aliases and then reach it only via another docker host.

Can somebody confirm this?
@BoThomas can you check your configuration and check if the auto generated domain still appears?
If yes, can you check if you are still exposing your service on that domain?
If so, then this is not just a me problem.

Running v4.0.0-beta.469 btw.

[djsisson]

Labels are immutable, if you remove a hostname you have to redeploy inorder to regenerate new labels to alter proxy routing

[mono-sudo2]

Yes, but if the auto generated domain is set, then deleted and saved, the old domain stays in the labels, even after redeploying.
AND it is also still reachable on that domain.
Have you tested it?

This is happening on both of my servers.

[diego-develops]

Does anyone knows how to do it on coolify v4?

[djsisson]

you can still use an ip based domain with a private ip

e.g if your host lan ip is 192.168.1.10

http://nextcloud.192.168.1.10.sslip.io

no port mappings are required, this would only be accessible on the same local network

[RenSch89]

@djsisson I'm totally new to this, only have some few experience with Docker but I see, it works with: projects > configuration > general > domains and then type in http://nextcloud.192.168.1.10.sslip.io/
Thanks!
Btw why is the "domain" sslip.io?

[djsisson]

sslip.io is a dns provider that resolves the hostname, to the ip in the hostname, there are other ones like traefik.me, sslip.io is probably the most common.

this allows you to easily proxy to different services on the same machine, just using normal urls without needing to map ports, and since the ip can be anything, using a local ip still works fine when running services locally.

[BoThomas]

I usually use port mapping for local access, as sometimes I use a cloudflare tunnel domain as the service-domain, but still want direct local access in parallel.

But I guess if you only want local access using the domain is the easier approach.

[RenSch89]

Thanks guys, for all that knowledge :)