Built-in Dynamic DNS Service & Reverse Proxy

[Patrizia]

 I would like to propose a pair of features that would work in tandem.

A dynamic DNS system (like DuckDNS) run by Eshtek could work wonders for users that have not purchased a domain name and might find it confusing to set up CNAME records to point multiple services to the same address. The cost of running DuckDNS is apparently negligible, so hopefully there would not need to be a subscription for the service (or if so, then maybe only a few pounds per year).

Combine this with a built-in reverse proxy like Caddy -- which can automatically provision LetsEncrypt SSL certificates -- and curated apps would then be able to be made securely accessible over the internet via an address like:

${service-name}.${user-chosen-name}.hexos.com

Apps could then advertise this as their address in the dashboard, making secure configuration of user apps significantly easier.

The only user-configurable step that would be required would be to open ports 80/443 on the user's router, something that Eshtek cannot control, but crucially, something that the HexOS Deck *would* be able to check for, notifying users if their router is configured correctly. Since there is already a web service running on ports 80/443, this reverse proxy would need alternative ports, but most routers can receive a connection on one port and map it to a different port internally, so this is unlikely to present a major problem.

[Alex Stewart]

I have also long thought this would be the killer feature for HexOS. The user requirement of having all these wonderful new curated apps available from an external network in a secure and convenient manner.

[Todd Miller]

Would you expect this to be at additional cost?  Sounds like they would have management responsibility on their servers and require additional staff.  If it is a cost, how much per month is it worth to you?

[cyildiri42]

even for full-local setup, having an integrated reverse-proxy would be useful.

on my home router, I setup a DNS record pointing to my server

on truenas, I'm running NGINX Proxy Manager, and I have to manually configure subdomains for each app/service I install.
I also created a CA Cert for my homelab to have completely local SSL

since hexos isn't aware of this, it still launches apps as <local-ip>:<port> without HTTPS/SSL which makes this launch button useless for me.
I just setup a folder of bookmarks on my chrome bookmarks bar for each app.

remembering ip addresses/port numbers, and lack of SSL is a dealbreaker for my home lab.
some services I host are missing features because they dont work without SSL (e.g. install a web app as a PWA. lots of services support this: immich, jellyfin, open web ui, home assistant, etc.)

would be a game changer to have builtin:
Certificate Authority (create cert + key + http page to assist in installing it on various devices)
SSL Cert for homelab domain (e.g. jellyfin.home-lab.local)
Reverse Proxy - subdomains for each app automatically, using the SSL Cert for your homelab
Launch button for app would automatically open the subdomain URL (https://jellyfin.home-lab.local) instead of <local-ip>:<port>