Great guide and even better timing! Solved a problem I just couldn't sort out myself with NPM running in a LXC container on Proxmox. Everything up, running and working now. Thanks Frank, you're a star!
I'm pretty much doing all of this using Synology's built in reverse proxy. I probably have 20 different subdomains working exactly as I want. So, my question is what's the advantage to using nginx in a Docker container versus the internal nginx reverse proxy built into Synology? EDIT: Love your straightforward way of explaining things!
Thanks for the video. 2 quick questions- 1. Is this necessary if you are not exposing the services to the internet? 2. Can you create a quick guide on changes we need to do on Pfsense if we want to run NPM inhouse along with Cloudflare? Thanks
Definitely not necessary - it's mainly for usage and there are a few services that require a reverse proxy to work (Vaultwarden is one of them), and if you don't want to expose it externally, this is one way to do it. There aren't really any changes on the pfSense side. You would just create a DNS record in the DNS resolver rather than using Pi-hole.
Great video--thank you! I used your previous guide for Adguard but decided to uninstall it completely to use Pihole+NPM. I was having noob issues getting adguard to work with npm (network/macvlan etc). Could you do a follow-up guide to make this work well with Tailscale? I know you can set a local DNS in Tailscale, but I was having issues connecting to devices. I'm debating just going back to OpenVPN on my router because I could not get my off-network tailscale device to resolve anything DSM related (NAS is enabled for subnet routing with tailscale, and is running Pihole + NPM.)
Thanks! If you're running Tailscale on the NAS, it makes it more complicated because you have to use the bridge network IP as opposed to the NPM IP, but it adds a lot of complexity. I'm not sure I'd do this with that setup if I'm being honest.
Thanks for this great guide. I was able to get it working on my Synology NAS with no issues. I am curious, could I use Tailscale to access my web apps through my tailnet while away from my local network?
Thanks! Yes, you should be able to if you configure a DNS server in Tailscale, but if you're accessing them remotely and using Tailscale on the same NAS, you probably have to use the bridge IP.
Enjoyed the video. Silly question, when referencing the "Accessing Synology Services with Cloudflare..." video, should one follow that entire video/guide prior to completing the steps in this video?
@@WunderTechTutorialsthanks for your response! It’s now working great on my local network. Should this also work outside of my network? If not, what might I have missed? Many thanks in advance!
I have an existing instance of npm running on Synology NAS and pihole running on a separate raspberry pi (not involved at all with npm).. even after watching and trying this I cannot understand how to make this setup work for internal only use. The part that is still very confusing is the npm_network vs npm_zbridge, why and what they are doing. Maybe it would make more sense to move npm to the pi and run both in docker instead of bare metal? or pihole to the NAS? Thoughts?
Those networks are only there to bypass the Synology use of ports 80/443. On a Raspberry Pi, you won't have to do that, so if you have one available, it probably makes sense to run it there.
Sorry for my stupid beginner question. When I have a domain I own and forward my services to the web with cloudflare at 443, doesn't it mean I have an open door for public to access my services? E.g. Synology DSM?
I'm running my NAS on a 12 hours daily basis. Is it possbile to outsource the task to my raspberrypi that is running 24/7? I mean it should make no difference right?
Thank you for this video and tutorial. This is exactly what I need. Just a couple of questions though. Can you explain again the npm_network and npm_bridge for? I think you mentioned these in the video but my thick head is just not getting it. Is this for bridging all the containers running on the Container Manager? Also, I already have pihole running on raspberry pi, and I have my docker containers running on portainer on my NAS, do I just use the generic Docker Compose file for the reverse proxy?
The bridge is strictly used for NAS to Container communication. Since we're using a macvlan network interface (npm_network), the NAS cannot communicate with the NPM container through the npm_network - that's what we're using the bridge for. The gateway (.1) is the NAS, and the IP (.10) is the container. Yes, if you have a separate server, the generic Docker container will do what you're looking for!
@@WunderTechTutorials Hi! Me again :) I cannot get a wildcard SSL certificate on my Cloudflare domain; it's just timing out. Do I need to run the cloudflared tunnel like in the other video you referenced?
@@WunderTechTutorials Hi Frank, thanks for your response. I figured out what was wrong. The container log showed that it couldn't connect to pypi to install the cloudflare module. The docker-compose has the bridge with higher priority than the macvlan network, but the bridge network doesn't have an outside route; only the macvlan network does. So, I temporarily removed the bridge from the container, and then I was able to pull a cert. But if I put the bridge back, this would fail when it comes time to renew the cert, right? And I need that bridge.
By creating macvlan network in docker compose it re-creates the network every time you restart right? I created mine in terminal but have to run a script so that it recreates every time restart NAS.
No, it should create it once (assuming you don't have any other network interfaces with the same name), and it'll reference it every time it starts, but only create it the first time. I just confirmed on my test setup that it all works as expected after a reboot.
@@WunderTechTutorials Thanks, I think it's because the method I was using was creating a nother macvlan interface on the host that communicates with the docker containers on another macvlan network, but it gets removed with each restart. Your way is much better, will redo everything and follow your guide.
Nice video I actually use macvlan on Synology but in different VLANs over a LAGG. Btw I tried in NPM to to set it as well for the Synology drive app, but it's not working, because the app needs two ports. Do you know how to set it in NPM?
Thanks! Did you set it up as a login portal in DSM and assign a port to it? If so, you should be able to use that port - I show it towards the end of the video.
@@WunderTechTutorials Yes, but the problem is when you use the APP, the connections from the appp is done under port 6690, on which the NMP is not listening. And I do not know how to set NPM to listen on this port.
@@MiFonito The app works for me using the method shown in the video. That's how I've been running it, but you can't have two ports for one reverse proxy rule either way.
@@WunderTechTutorials hmm interesting than I probably have somewhere a missconfig in the NPM. I will review it. Many thanks for the input! You gave me some ideas on what to check. Also to be more clear I am speaking about the Mobile or Desktop app client.
So, I got to the point where I set up the DNS record in Pihole, I'm using Duck DNS. when I entered the domain for NPM in the browser it say server not found. What am I doing wrong?
so the DNS record (xyz.subdomain.duckdns.org) is pointing to the NPM server? And you have a proxy host record in NPM with the correct HTTP/HTTPS, server IP, and port?
