Zoraxy: Open-Source, All in one homelab network routing solution | Hacker News Reader

Zoraxy: Open-Source, All in one homelab network routing solution

zoraxy.arozos.com

148 pointsthunderbong54 comments

My experience with these noob-friendly proxys is that many apps just don't work behind a proxy and need complex configurations.

You end up pasting a confusing snippet found in the internet to make it work.

I've actually been watching this project develop over on /r/selfhosted over the last year at least. The author has put a lot of work into it, and it's definitely worth giving a shot for a homelab/self-hosted project.

What differentiates it from the rest? Does it make oidc sso easy for home labs?

GUI driven is the primary differentiator I believe.

Repo: https://github.com/tobychui/zoraxy

The largest issue with reverse proxies I've seen is that apps don't always offer a configuration to tell the front-end where they are hosted.

The proxy can rewrite app/suffix to /suffix so the back-end sees the the correct Location header.

But for a front-end it's not always that simple. Take a React application with HTML5-mode (where you can go from /foo to /bar without actually invoking a reques to the backend): Your React app needs to know what its base is. Otherwise the URLs just don't work, as it doesn't know which base to inject (or remove) as part of its navigation.

Combine that with the nginx's try_files and you have a recipe for infinite navigation to the index.html: https://nginx.org/en/docs/http/ngx_http_core_module.html#try...

we can't use "network routing" here to mean reverse proxy

These are separate things.

Something happened in higher education the past 5 years. I’ve noticed many new hires at various companies in the bay call layer 3 IP routers “proxies”

never heard that in my life.

NACK.

Will definitely test it, it's definitely in the early stages and more basic stuff oriented but after using the majority of the fancy and more feature complete tools available today like Caddy and Traefik, a GUI is more than welcome.

Actually now that you say it: why is no one just putting a simple gui for editing in traefik. GUI debugging in the dashboard an Jaeger is already great. And the yaml syntax is so simple that it should be easy to model a UI based on it. I only found a five year old project.

Because infrastructure as code is the fashionable mode of operation these days, and we have not yet managed to move beyond considering code as text.

Webmin style solutions were more fashionable in the turn of the century but, outside MS ecosystem, GUIs never got predominant.

OpnSense,pfSense,FreeNAS,NAS4Free would all disagree.

I only lament how they moved from classic lighttpd/PHP to BootStrap.

If you make a script that handles building the traefik config from various inputs, you could make a gui config for it with Configurator [1] which we built and open sourced to make it easy to config stuff!

[1] https://github.com/ipv6rslimited/configurator

Looks like a lot of effort has been put into this, very nice. Your only other option is to figure out best of breed open source solutions like HAProxy. I guess you could also use the the community edition of Zevenet. Makes my commerical Loadbalancer.org appliance interface look a bit clunky actually.. sigh..

I think you're going to get in some hot water for showcasing big companies' logos on your page as if they use your product, despite your disclaimer on a linked page.

Regardless, it's off-putting to potential customers.

Here another similar project based on nginx: https://nginxproxymanager.com/

Don't use it. It have many problems.

- User auth bugs.

- Security issues.

The developer do not care about fixing those.

I wasn't aware of security issues and I'm currently using this proxy manager, do you have a good alternative?

Care to elaborate on both counts? I’ve been using it for years and have had no auth issues in my use case at least. I mainly use it inside lan only though I do have a firewalled instance for a couple public services I host, but I haven’t heard of any security issues, I sort of assumed it had a similar attack surface as regular Nginx as that’s basically all it is.

see the list of issues i had posted in previous comment.

I looked at the issues for the github project, and it's a cesspool of "doesn't work". I can't imagine being the maintainer and having to wade through that.

https://github.com/NginxProxyManager/nginx-proxy-manager/iss...

This seems to be the security vulnerability, with no details.

https://github.com/NginxProxyManager/nginx-proxy-manager/iss...

Would people really be willing to use this to expose their services to the internet?

Given it’s small and focused on home users, I’d be afraid of any potential security issues. I’d much rather use tools that get a lot more frequent security scanning (like nginx)

I've cobbled together my own assortment of services that achieves a similar suite of functionality Zoraxy appears to offer. Everything is hosted and accessible (ACLs permitting) via my Tailscale network – nothing gets exposed publicly.

This looks very cool and if it's able to integrate with Tailscale I'd try it in a heartbeat!

Nginx is written in C. It's not the worst offender of the species, but there's been enough RCE-level CVEs over the years that I would assume some remain in its current version.

Something written in e.g. Go at least gives you a fighting chance.

Would this be suitable for a VPN-like setup with some remote servers and distributed home dev machines? In other words, does the 'homelab' in the title imply LAN-specific functionality?

dont call this a network routing solution.

it's ok, he makes himself look amateur

Cool tool. I've had a few problems building it from source. Could only run from the pre-built release. It would be great to see more documentation.

Is this a competitor for opnsense and pfsense?

It seems to be more like a reverse proxy that integrates with ZeroTier.

In the GitHub it's mentioned the the Zoraxy is compatible with ZeroTier but due to licensing issues, ZeroTier is not included in the binary.

Just wondering is there any legit open source alternative for ZeroTier?

Judging by the features, it doesn’t seem predominantly focused on routing and acting as a tool or server you can deploy to operate a network and allow other devices to leverage it to route between networks.

Their GitHub has a simpler explanation.

https://github.com/tobychui/zoraxy

No, it's a reverse proxy.

This is just another one of those cases where the actual github is more informative than the homepage.

https://github.com/tobychui/zoraxy

All you need to know about this Software is at a glance there.

I think “network routing solution” means something different to me and the authors.

That's because you're missing the "homelab" that comes before those words, like it's stated in the title, I opened the link and was greeted by exactly what I was expecting.

Can you explain why you expected this from the title? When I hear „network routing“, the first thing that comes into my mind is IP routing, not a reverse proxy. With a „homelab“, I‘d never associate the need for a reverse proxy or SSL certificates.

you're thinking "computer networking", they mean "webapp experimentation"

Maybe they should use words that mean “webapp experimentation” instead of “computer networking”

imho it's a legitimate use of the term. though the tension of meaning suggests that there is room for clarification

The "homelab" modifier does a lot of work. When I read homelab I was expecting "easy way for non tech person to do computer magic."

When I read about a "gun fight" I am expecting to read about violence and carnage. If you put the word "water" in front of it I am no longer expecting violence and carnage in a wet environment. Homelab changes the definition of everything that comes after it much like water changes the definition of gun fight.

>When I read homelab I was expecting "easy way for non tech person to do computer magic."

Isn't that hypocritical? The very nature of a home lab means whoever owns it is a tech person. A "non tech person" wouldn't even know what a home lab is, at least in the context of computers and technology.

I do not think it is hypocritical. I did not behave in a manner that contradicts something I have said or believe.

I expected that because I didn't just read "network routing", I read "homelab network routing", I don't 100% agree with the title but nowadays a homelab means docker containers and a reverse proxy to expose them all. Also Zoraxy sounds a lot like "proxy", so there's that.

Homelab network routing means pfsense, opensense, vyos, ubiquity.

What does this product have to do with "routing" at all? How is it a router?

It is routing web requests to backend endpoints, I guess.

I think it's an interesting quirk that we don't use the same terms for what are essentially the same concepts.

Switching is $verbing at layer 2, IP routing is $verbing at layer 3, NAT is $verbing at layer 4, and reverse proxying is $verbing at layer 5.

I'd argue that 'route' is the right value for $verb here.

It's a fancy reverse proxy with GUI

yea, the term "routing" was overlaid by the webheads to describe the handling of an http-request after hitting the first webserver.

this is quite confusing to ppl that deal with "routing protocols", "routing tables" and other stuff that makes the internet work.

https://github.com/tobychui/zoraxy/issues/49

Reply on news.ycombinator.com