A reverse proxy takes all your web-based services, e.g.

• plex on port 32400
• octoprint on port 8000
• transmission on port 8888

and allows you to map these to domain names, so instead of typing server.example.com:32400 you can type plex.example.com. I have simplified this quite a bit though - you need DNS configured as well, and depending on your requirements you may want to purchase a domain name if you intend on accessing content from outside your home without a self hosted VPN.

Cloudflare is a DDoS mitigation service, a caching web proxy, and a DNS nameserver. Most users here would probably be using it for Dynamic DNS. You can use it in combination with a reverse proxy as a means to mask your home IP address from people connecting to your self hosted web-based services remotely, but on its own it cannot be used as a reverse proxy (at least easily - would not recommend attempting to). Do note that Cloudflare can see all the data you transmit through their systems, something to bare in mind if you are privacy conscious.

In my opinion though, it would be much better for you to use a self hosted VPN to access your self hosted services (can be used in combination with the reverse proxy), unless there is a specific need to expose the services out to the internet

Edit: fix minor typo, add extra info about cloudflare

I use it to manage my subdomains, something like notes.mywebsite.com would point at my trillium instance while photos.mywebsite.com would point at my my immich container it has more uses but that's my extent. I just have an instance of a cloud flare dns updater keeping my domain in sync with my ip so I don't have to do that manually when it changes.

So in my scenario cloud flare is just part of my setup.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

7 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.

[Thread #386 for this sub, first seen 30th Dec 2023, 00:05] [FAQ] [Full list] [Contact] [Source code]

CloudFlare is a good place for beginners to start. Setting up a reverse proxy can be daunting the first time. Certainly better than no reverse proxy.

That being said, having your own reverse proxy is nice. Better security since the certificates are controlled by your server. Also complex stuff becomes possible.

My traefik uses keys encrypt wild card domains to provide HTTPS for internal LAN only applications (vault warden) while providing external access for other things like seafile.

I also use traefik with authentik for single sign on. Traefik allows me to secure apps like sonarr with single sign on from my authentik setup. So I login once on my browser and I can access many of my apps without any further passwords.

Authentik also allows oAuth so I can use that for seafile, freshrss and immich. Authentik allows jellyfin login with LDAP. (This last paragraph could be setup with CloudFlare as well).

Historically, reverse proxies were invented to manage a large number of slow connections to application servers which were relatively resource intensive. If your application requires N bytes of memory per transaction then the time between the request coming in and the response going out could pin those bytes in memory, as the web server can't move ahead to the next request until the client confirms it got the whole page.

A reverse proxy can spool in requests from slow clients, when they are complete, then hand them off to the app servers on the backend, the response is generated and sent to the reverse proxy, which can slowly spool the response data out while the app server moves onto the next request.

If you're asking this you should probably use one to be more safe if you're exposing stuff to the web, there are other ways of doing it including just VPNing into your home network or using a VPS or cloudflare tunnels, but using a reverse proxy manager in combo with cloudflare DNS is a good place to start and is probably good enough if you use good enough security with it: long unique passwords, two factor, security keys, etc.

The benefit is you can only open up 80/443, rather than a port per service/app.

Other than waf stuff, if you have multiple servers behind a small nat, a reverse proxy can service them all from a single exposed public address. You can also do rewrite rules on the proxy vs on each server.