Coolify behind Pangolin tunneled reverse proxy

[maikbasel]

Hi everyone,

I have the following setup: A Pangolin Server running on a VPS with a static ipv4 address. Pangolin proxies request through a VPN tunnel to my actual homelab server in my private home network. I use this setup because I have to work around DS-lite.

Now while I was able to make the Coolify Dashboard available via my custom domain and even access the applications deployed via Coolify, I feel that this is not an optimal solution. This is because the only way I was able to reach my deployed services is by adding port mappings to the docker-compose and then configure seperate sub-domains in pangolin to proxy them to my homelabs private IP address and the respective port of the service.

So to my actual question: Is there a better way to make my deployed resources available via my pangolin server using Coolify's "native" features?

I already found a similar question here, but I didn't quite understand the answer. Any help would be greatly appreciated, thanks.

[djsisson]

you just need the proxy to be running on the private server with 80/443 mapped to the host (doesn't have to be those 2 ports)

then you just proxy everything, including the coolify dashboard for your domains to that internal ip:80 and set everything to be http in coolify

if you need https at the container level, then you will need to add the relevant certs or use dns challenge in the proxy before you can switch to using https in your containers and then proxy to 443 as well

the proxy on coolify will proxy the incoming traffic to the correct containers based on the incoming hostname and match it to what you have set for each project (including instance domain setting for coolify itself)

[maikbasel]

I think I could make it work...kind of work.

I added my root domain as Wildcard Domain:

...and added a Sub-Domain address that points to my VPS IP in Instance's Domain as well as the IP itse;f in Instance's IPv4:

In my Pangolin Server I configured a resource for access via my home sub-domain address:

...with the target IP 192.168.178.201 which is the IP of my homelab in my private network (SSL is enabled so pangolin handles SSL certificates):

But when I try to access the Coolify Dashboard via the home subdomain, then the browser is not able to load the entire web app:

Also the traefik proxy logs:

Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [home.<my_domain>.com]: error: one or more domains had a problem:\n[home.my_domain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: <vps_ip>: Invalid response from http://home.<my_domain>.com/.well-known/acme-challenge/<token>: 404\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["home.<my_domain>.com"] providerName=letsencrypt.acme routerName=coolify-https@file rule=Host(`home.<my_domain>.com`)

I guess I have to serve the certificates via the Coolify traefik proxy then, but I don't understand how. Could you elaborate on that?

[maikbasel]

I finally made it work. Here is what I changed for everyone struggling with the same problem:

I configured the resource in pangolin to proxy all https traffic to the Coolify server in my local network.

In my Coolify server I configured the Instance's Domain to the sub-domain address I want to use to access the Coolify dashboard (this is of course the same subdomain I created a resource for in pangolin). Also I configured the public IP of my VPS as Instance's IPv4 address.

For accessing applications deployed in Coolify create new resources for each service in Pangolin all pointing to the Coolify IP address in your local private network i.e. https://192.168.178.201:443 in my case. The Coolify proxy will handle the routing based on the subdomain you choose for each app. Also make sure to configure the Domains of your service to equal the the domain you configured in Pangolin.