[Improvement]: Internal URL for services and other non-database applications

[peaklabs-dev]

Description

I want to deploy phpMyAdmin and some other services on my VPS, but I do not want to add a public facing domain or use sslip.io (as these are accessible from the internet). I want to use an internal URL that is only accessible when I VPN into the coolify/docker instance or something similar that is only locally accessible -> an internal private URL, like there is for databases but for hole services. (I am not sure if this is technically possible though)

Minimal Reproduction (if possible, example repository)

• Add an internal URL to each service -> This Internal URL is reachable from the host VPS (so that I do not have to deploy a VPN connector in each service stack)
• Add internal URL to other applications -> This Internal URL is reachable from the host VPS (so that I do not have to deploy a VPN connector in each service stack)

-> Challenge: Each container has its own destination/ network.

Example structure:
http://ContainerName-[uuid].local

Exception or Error

No response

Version

[stuart-haas]

Have you considered using an ssh tunnel to do this? I'll follow up with an example.

[stuart-haas]

@ayntk-ai

Assuming you have SSH enabled for your VPS you can edit /etc/ssh/sshd_config and enable port forwarding by removing the comment hash from AllowTcpForwarding yes. The example command below assumes you can login using an SSH key-pair. I tested it with an AWS EC2 instance running Amazon Linux 2.

ssh -i /path/to/ssh.pem -N -L local-port:remote-host:remote-port remote-user@remote-host

You can then go to http://localhost:local-port in a web browser to access the remote environment.

[peaklabs-dev]

@stuart-haas I am using Twingate and sometimes another OpenVPN setup but I need a way to access applications deployed on Coolify only through a local URL. Which is a challenge as each container/each service has its own network where a VPN connector would need to be deployed unless there was some kind of structure like an internal URL that would be available for the host VPS.

[stuart-haas]

@ayntk-ai If you have a VPN why not just use that? You could always add a layer of authentication, too.

[peaklabs-dev]

@stuart-haas because how would I access mt ressource, it has its own network? And what would be the URL?

[diogox]

+1 on this. Would be very useful to expose certain ports on deployments to a VPN, for eg.

[sneko]

@peaklabs-dev do you have a working example of using a SSH bridge/tunnel to a resource?

In my case let's say I have a pg database with Coolify, I want to use an UI from my own computer. Since I'm able to connect to my VPS with SSH I guess I could manage a reverse proxy or so, and try to use the internal URL of the database resource (that should be fixed?). But having a sample would help me 👍

Thank you,

EDIT: the idea is to not expose the resource publicly
EDIT2: also, by binding the resource to the host with port mapping (like 3306:3306), in my case I missed a firewall rule so it was accessible from internet... I adjusted the firewall but still, if there is a risk of being publicly exposed I don't get the resource checkbox saying Make it publicly available (or is it just for logs?). Just for note I'm able to do a bridge with ssh -L 5432:localhost:5432 -N -f myRegisteredSshHostName

[BreakSecurity]

Is there any news? I am trying to connect via Datagrip to a mariadb instance on Coolify but I can't connect to the docker instance of mariadb. Thanks in advance for the help.

I want to connect trough an SSH tunnel without making the resource public.

[stuart-haas]

Have you checked out https://tailscale.com?

Without understanding all of your technical needs, this is what I would do:

1. Install and run tailscale with ssh on the coolify instance.
2. Install and run tailscale on your machine. Now both machines are on the tailnet and are able to talk to one another over a private connection.
3. To connect to the mariadb instance, use the machine ipv4 for the hostname as listed on the tailscale dashboard or run tailscale ip -4 on the coolify instance.

With tailscale you could also disable port 22 access or whatever you are using for ssh, but as long as you have ssh password disabled, this shouldn't be necessary.

[djsisson]

you can use WARP client/ WARP connectors for this also

my vps uses a cf tunnel, and i use a split tunnel from a WARP client locally with the vps private ip and docker CIDR excluded

this means i can just use any private ip from my vps locally and it just works

i also run a script to update the hosts file on my vps for all containers with their dns names
so if i dont want to use a container ip i can still run this locally and its fine ssh -L 5432:supabase-db:5432 coolify (where coolify is just 10.0.0.2 with USER root in ssh config)

this way i have 0 ports mapped to host and can access all containers locally using the private network

(there is a way to use DNS fallback and point to my vps for names but then i would need to add a .test domain or something similar to all contaqiner names in hsots file and im not that fussed about it