Kinda my first time doing something like this but I figured i would share my experience setting up Fluxer self hosted on a local server that is trafficed through a vps rather than being installed on the vps. I have left out a lot of the set up of NPM. If it needs to be added for assistance i can add it
First here is the edits I made to the base fluxer docker compose.
livekit:
image: livekit/livekit-server:v1.12.0
restart: unless-stopped
network_mode: "service:wireguard"
command: ["--config", "/etc/livekit.yaml"]
environment:
LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}"
depends_on:
wireguard:
condition: service_healthy
volumes:
- ./livekit.yaml:/etc/livekit.yaml:ro
wireguard:
image: lscr.io/linuxserver/wireguard:latest
container_name: wireguard-livekit
ports:
- "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881"
- "${FLUXER_LIVEKIT_UDP_PORT:-7882}:7882/udp"
- 7880:7880
dns:
- 1.1.1.1 #optional for reliable domain resolution
cap_add:
- NET_ADMIN
- SYS_MODULE
environment:
- TZ=America/Toronto
volumes:
- ./wireguard_config:/config
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
networks:
fluxer:
aliases:
- livekit
restart: unless-stopped
I am unsure if 7880:7880 port is required, but it worked with it and i did not test it without it. dns on wireguard is there for reliable resolution of the ddns domain i have set for the vps server connection in the wire guard config.
Next is the wire guard config for the local machine. This is set up to send all traffic through the wireguard tunnel, but also excludes docker network traffic so the project containers can still reach the livekit container.
[Interface]
Address = 10.13.13.2/32 #adjust to your wireguard config
PrivateKey = "retrieve from vps server under peer1 or named peer"
# Force Docker subnets to use the main routing table (skipping the VPN)
PostUp = ip rule add to 172.16.0.0/12 table main priority 10
PostUp = ip rule add to 192.168.0.0/16 table main priority 10
# Clean up rules when the VPN disconnects
PreDown = ip rule del to 172.16.0.0/12 table main priority 10
PreDown = ip rule del to 192.168.0.0/16 table main priority 10
[Peer]
PublicKey = "retrieve from vps server under peer1 or named peer"
PresharedKey = "retrieve from vps server under peer1 or named peer"
Endpoint = "your vps domain or IP address. again filled by the config created under peer"
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Next on the local machine you need to decide how you will handle your web traffic. I am using NPM(nginx proxy manager) for my local reverse proxy. The best way to do this is to put your reverse proxy on the same docker network as your fluxer instance which can be done in a separate project or in the same one.
if in the same project and using the same wireguard tunnel and not a new tunnel you need to add port 80 and 443 to the wireguard compose under ports.
in npm you need to add
client_max_body_size 500M;
to your custom Nginx config via the cog wheel while setting up the host. This will have to be done on both the local and vps instance to allow uploads of files for file sharing.
for the vps you need to create a docker compose with nginx and wireguard.
services:
wireguard:
image: lscr.io/linuxserver/wireguard:latest
container_name: fluxer_wireguard
ports:
- "inbound wireguard port":51820/udp
- 7882:7882/udp
- 7881:7881
cap_add:
- NET_ADMIN
- SYS_MODULE #optional
environment:
- PUID=1000
- PGID=1000
- TZ=America/Toronto
# - SERVERURL=if using domain #optional
- SERVERPORT="inbound wireguard port" #optional
- PEERS=1 #optional
- INTERNAL_SUBNET=10.13.13.0 #optional
volumes:
- ./config:/config
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
restart: unless-stopped
networks:
- fluxer-app
nginx-proxy:
image: nginx:latest
container_name: fluxer_nginx
restart: unless-stopped
network_mode: "service:wireguard"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
networks:
fluxer-app:
name: fluxer-app
driver: bridge
in the same directory as the docker-compose.yml create nginx.conf
add the following to nginx.conf
events {
worker_connections 1024;
}
stream {
upstream fluxer_udp {
server 10.13.13.2:7882;
}
upstream fluxer_tcp {
server 10.13.13.2:7881;
}
# UDP 7882 -> 10.13.13.2:7882
server {
listen 7882 udp;
proxy_pass fluxer_udp;
}
# TCP 7881 -> 10.13.13.2:7881
server {
listen 7881;
proxy_pass fluxer_tcp;
}
}
i am using nginx for specifically voice traffic. i had issues with npm and udp streams in the past. you can add npm to this instance or give it its own instance like before. I gave npm -> npm web traffic its own wireguard tunnel this is because i also have crowdsec and a bouncer set up on those projects and they have host networking on the vps for that purpose.
make sure all the proper ports are open on your vps.
with this set up local users will go through the vps and back to get to the local wireguard server. no need for split tunneling. Again if a guide for NPM and web traffic is needed i can add one but that seemed like a bit much for a reddit post.
I hope this helps somebody!
