ray
79 lines
2.9 KiB
Markdown
79 lines
2.9 KiB
Markdown
# DuckDNS Temporary Domain Alias
|
|
|
|
Use when a domain is NRD-blocked by corporate firewalls or a new domain needs immediate accessibility. The DuckDNS domain (usually years old) bypasses NRD filters.
|
|
|
|
## When needed
|
|
|
|
- Domain registered less than 30 days ago → corporate networks block it
|
|
- Need a quick workaround while the domain ages past the NRD window
|
|
- Already have a DuckDNS domain set up and pointing to the VPS
|
|
|
|
## Steps
|
|
|
|
### 1. Update DuckDNS to point to VPS
|
|
|
|
```bash
|
|
# If DuckDNS points to 127.0.0.1 or is stale:
|
|
curl -s "https://www.duckdns.org/update?domains=<duckdns-name>&token=<token>&ip=<vps-ip>"
|
|
```
|
|
|
|
### 2. Set up auto-updater
|
|
|
|
DuckDNS requires periodic updates to keep the IP current. Create a simple cron:
|
|
|
|
```bash
|
|
mkdir -p ~/.hermes/scripts
|
|
cat > ~/.hermes/scripts/duckdns-update.sh << 'SCRIPT'
|
|
#!/bin/bash
|
|
# IMPORTANT: &ip=<vps-ip> must be explicit. Leaving &ip= empty causes DuckDNS to
|
|
# auto-detect the requesting server's public IP (the HOME server, not the VPS),
|
|
# which breaks DNS for all services.
|
|
echo "$(date): $(curl -s 'https://www.duckdns.org/update?domains=<name>&token=<token>&ip=<vps-ip>&verbose=true')" >> ~/duckdns/update.log
|
|
SCRIPT
|
|
chmod +x ~/.hermes/scripts/duckdns-update.sh
|
|
```
|
|
|
|
Then schedule via `cronjob` tool: `no_agent=true`, `script=duckdns-update.sh`, `schedule=every 5m`, `deliver=local`.
|
|
|
|
### 3. Add VPS nginx server block for the new domain
|
|
|
|
For a service that sits behind the home server's nginx SSL (like ShopProQuote on port 443):
|
|
|
|
```nginx
|
|
server {
|
|
server_name <duckdns-domain>;
|
|
|
|
location / {
|
|
proxy_pass https://<home-tailscale-ip>:<port>;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host <duckdns-domain>; # MUST match home nginx server_name
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_ssl_verify off;
|
|
proxy_read_timeout 86400;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
listen 80;
|
|
}
|
|
```
|
|
|
|
Link it: `ln -sf /etc/nginx/sites-available/<name> /etc/nginx/sites-enabled/`
|
|
|
|
### 4. Provision SSL
|
|
|
|
```bash
|
|
certbot --nginx -d <duckdns-domain> --non-interactive --agree-tos --email <email>
|
|
```
|
|
|
|
### 5. Critical: Host header must match home nginx server_name
|
|
|
|
The home server nginx has a specific `server_name` in its config. If the VPS proxy sends a different `Host` header, the request hits the wrong server block (or the default), which in SPAs causes redirect loops between login and index pages. Always verify the home nginx config's `server_name` and match it exactly in `proxy_set_header Host`.
|
|
|
|
## Pitfall: localStorage auth tokens
|
|
|
|
PocketBase and Firebase store auth tokens in `localStorage`, which is domain-scoped. Users must re-authenticate on the new domain — their old domain's session won't carry over.
|