[Improvement]: Internal URL for services and other non-database applications

[peaklabs-dev]

Description

I want to deploy phpMyAdmin and some other services on my VPS, but I do not want to add a public facing domain or use sslip.io (as these are accessible from the internet). I want to use an internal URL that is only accessible when I VPN into the coolify/docker instance or something similar that is only locally accessible -> an internal private URL, like there is for databases but for hole services. (I am not sure if this is technically possible though)

Minimal Reproduction (if possible, example repository)

• Add an internal URL to each service -> This Internal URL is reachable from the host VPS (so that I do not have to deploy a VPN connector in each service stack)
• Add internal URL to other applications -> This Internal URL is reachable from the host VPS (so that I do not have to deploy a VPN connector in each service stack)

-> Challenge: Each container has its own destination/ network.

Example structure:
http://ContainerName-[uuid].local

Exception or Error

No response

Version

[stuart-haas]

Have you considered using an ssh tunnel to do this? I'll follow up with an example.

[stuart-haas]

@ayntk-ai

Assuming you have SSH enabled for your VPS you can edit /etc/ssh/sshd_config and enable port forwarding by removing the comment hash from AllowTcpForwarding yes. The example command below assumes you can login using an SSH key-pair. I tested it with an AWS EC2 instance running Amazon Linux 2.

ssh -i /path/to/ssh.pem -N -L local-port:remote-host:remote-port remote-user@remote-host

You can then go to http://localhost:local-port in a web browser to access the remote environment.

[peaklabs-dev]

@stuart-haas I am using Twingate and sometimes another OpenVPN setup but I need a way to access applications deployed on Coolify only through a local URL. Which is a challenge as each container/each service has its own network where a VPN connector would need to be deployed unless there was some kind of structure like an internal URL that would be available for the host VPS.

[stuart-haas]

@ayntk-ai If you have a VPN why not just use that? You could always add a layer of authentication, too.

[peaklabs-dev]

@stuart-haas because how would I access mt ressource, it has its own network? And what would be the URL?

[diogox]

+1 on this. Would be very useful to expose certain ports on deployments to a VPN, for eg.

[sneko]

@peaklabs-dev do you have a working example of using a SSH bridge/tunnel to a resource?

In my case let's say I have a pg database with Coolify, I want to use an UI from my own computer. Since I'm able to connect to my VPS with SSH I guess I could manage a reverse proxy or so, and try to use the internal URL of the database resource (that should be fixed?). But having a sample would help me 👍

Thank you,

EDIT: the idea is to not expose the resource publicly
EDIT2: also, by binding the resource to the host with port mapping (like 3306:3306), in my case I missed a firewall rule so it was accessible from internet... I adjusted the firewall but still, if there is a risk of being publicly exposed I don't get the resource checkbox saying Make it publicly available (or is it just for logs?). Just for note I'm able to do a bridge with ssh -L 5432:localhost:5432 -N -f myRegisteredSshHostName

[BreakSecurity]

Is there any news? I am trying to connect via Datagrip to a mariadb instance on Coolify but I can't connect to the docker instance of mariadb. Thanks in advance for the help.

I want to connect trough an SSH tunnel without making the resource public.

[stuart-haas]

Have you checked out https://tailscale.com?

Without understanding all of your technical needs, this is what I would do:

1. Install and run tailscale with ssh on the coolify instance.
2. Install and run tailscale on your machine. Now both machines are on the tailnet and are able to talk to one another over a private connection.
3. To connect to the mariadb instance, use the machine ipv4 for the hostname as listed on the tailscale dashboard or run tailscale ip -4 on the coolify instance.

With tailscale you could also disable port 22 access or whatever you are using for ssh, but as long as you have ssh password disabled, this shouldn't be necessary.

[djsisson]

you can use WARP client/ WARP connectors for this also

my vps uses a cf tunnel, and i use a split tunnel from a WARP client locally with the vps private ip and docker CIDR excluded

this means i can just use any private ip from my vps locally and it just works

i also run a script to update the hosts file on my vps for all containers with their dns names
so if i dont want to use a container ip i can still run this locally and its fine ssh -L 5432:supabase-db:5432 coolify (where coolify is just 10.0.0.2 with USER root in ssh config)

this way i have 0 ports mapped to host and can access all containers locally using the private network

(there is a way to use DNS fallback and point to my vps for names but then i would need to add a .test domain or something similar to all contaqiner names in hsots file and im not that fussed about it

[styxlab]

@peaklabs-dev Did you find a solution for your question? I arrived a t the same problem today. I have a private wireguard network between my coolify machines and my home computer. For this example, consider that my coolify host is on 10.0.0.1 and my home machine is on 10.0.0.2. I now added a new service with service name plausible to coolify, that I can access on

http://plausible.<public ip>.sslip.io

I was expecting to be able to connect to that service with my private address, so I can hide the service from the public internet with

http://plausible.10.0.0.1.sslip.io

But I get a connection timeout when loading in the browser.

My host machine is definitely on the private network, e.g. ssh root@coolify.10.0.0.1.sslip.io works just fine. As DNS resolution with .sslip.io seems to work and private network works as expected, this could be something with traefik proxy not being able to forward to the service, but I couldn't figure it out so far.

[djsisson]

What address pool is docker using
Can you check /etc/docker/daemon.json
Check it does not conflict with your lan subnet

[styxlab]

I found the problem, it's a LAN issue. I have a windows machine with WSL, but the private network is only working within the WSL and not from windows. As my browser is running on Windows, it cannot reach the private network. From WSL curl http://plausible.10.0.0.1.sslip.io works just find. So, I have the following options now:

• start the browser from WSL (tested and it worked)
• install wireguard on Windows host and add it as another client to the private network (tested and it worked)
• install the wireguard network on the windows host, so that WSL can use it without adding WSL as a separate client (not tested)

Thanks for your hints @peaklabs-dev!

[Pedromigacz]

I did make it work using consistent container names. I just use http://ug80w4s0kgc08gosgwog44s0:3049/ to connect to my backend resource. The problem is now I do not have rolling out updates.
(ug80w4s0kgc08gosgwog44s0 is the container name of my backend)

[MojtabaTajik]

You can add a network alias to your service

Now all other services in the same network can reach the service by "abc:3001".

[styxlab]

This is a great solution if you are on the same server. If you need to reach a different server where each server has it's own docker network, then the solution with http://<service>.<private ip>.sslip.io is much more versatile. As .sslip.io is quite slow, I am running my own sslip service on coolify which is easily possible.