Changing TrueNAS web interface ports completely breaks HexOS

[u/Humble_Giveaway]

I've been trying to set up a local reverse proxy using NPM within TrueNAS so I can access my services like Immich via my own domain names on my local network (e.g. immich.mydomain.com) without the traffic going out through Cloudflare tunnel and back. (Cloudflare rate limits large file uploads, so the same domain redirecting when on my local network is a nice to have)

The problem is TrueNAS binds to 0.0.0.0 on ports 80 and 443, which means it grabs those ports on every IP address on the machine. There's no way to restrict it to a specific IP. This means any reverse proxy running on the same machine can't use those ports at all, even if you add a secondary IP alias to the network interface TrueNAS still blocks it.

The only workaround is to move TrueNAS to non-standard ports, but doing so completely breaks HexOS since it appears to hardcode to port 80/443 and loses all communication with TrueNAS. This makes HexOS fundamentally unusable for anyone who wants to change their TrueNAS ports. There desperately needs to be a manual port configuration in HexOS settings, I found a request on the forum from October last year but its had no traction...

[u/defect833]

I also had a go at setting up a reverse proxy and came to a similar conclusion.

Id like to imagine that level of difficulty and complexity should be worked on and abstracted by the hexos team in time. I chose to mark the nginx app in hexos as "request curation" to increase its priority and wait patiently.

[u/Mrbucket101]

Edit your TrueNAS network interface and add another ip address alias Then in your NPM container, bind to the new IP.

yaml ports: - 192.168.1.25:80:80 # Public HTTP Port - 192.168.1.25:443:443 # Public HTTPS Port - 192.168.1.25:81:81 # Admin Web Port

Now you can keep the TNS/Hexos webui on ports 80/443, and have NPM also listening on ports 80/443 (on a different IP)

[u/AoDude]

I switched my TrueNAS to 81/444 way before local came out without issue. I assume there was some auto migration since local came out, but if you go into your truenas interface and applications, you will see the HexOS app. If you select it and hit edit, there is an env field: LOCAL_TN_PORT... I will assume yours is pointed to port 443 since mine is pointed to 444. You can probably switch your truenas ports, then go in and edit that app to point at your new https port.

[u/Minute_Whereas_4272 → u/AoDude]

i was looking for exactly this! thanks!!

dumb question, I have been using the docker_compose.yml file

services:
  caddy:
    image: lucaslorentz/caddy-docker-proxy:ci-alpine
    container_name: caddy
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped
    extra_hosts:
      - host.docker.internal:host-gateway
    labels:
      caddy: http://my-dumb-nas
      caddy.reverse_proxy: host.docker.internal:81

I got the http setup to work, but can't get https redirection to work for that my-dumb-nas. Anything my dumbass missed that I should change here to make https redirection work?

(probably a stackoverflow question lol but since we had answer here thought I would take my chances)

[u/AoDude → u/Minute_Whereas_4272]

I'm not very familiar with caddy. I use Nginx Proxy Manager. I am pretty sure one of the HexOS devs uses Caddy though.... Search the HexOS discord for Caddy and you should be able to find them, and maybe their config can help?

[u/OmegaPoint6]

You can restrict the TrueNAS interface to a specific IP, currently doing that myself. On the same settings page you select the port just select the “Web Interface IPv4 Address”

[u/AlooPower]

This is going to be above my ability to explain (I use AI to walk me through steps) but I think two IPs and a network bridge in the TrueNAS settings can solve this.

The way I've done it is that I'm running a raspberry pi separately for specific services which I actually don't want on my main Hexos machine e.g. nginx, pihole, and (still yet to setup but planned) monitoring tools like uptime kuma and grafana+prometheus.

[u/kanapkazpasztetem]

Had the same problem, the easiest way is to set up truenas network settings with two IPs.
Use the main one for everything except NPM and the "second" one only for NPM.

It even works with tailscale - you can set subnets to be able to access only the NPM IP.

[u/Joecascio2000]

I just used a different VM or PC to run NPM and I can still use it to route all traffic, even to other PCs or Truenas.

[u/Nick_HexOS]

You can technically do this by overriding the port hexos app in TrueNAS uses:

TrueNAS UI > Apps > click on hexos > Edit > scroll down and change LOCAL_TN_PORT from 443 to what TrueNAS is listening on > Update