aion

IPv4 proxy for services hosted at home.

aion is a Hetzner VPS that serves a bridge to expose my services on a stable public IPv4 address. My Caddy VMs are accessible directly from the outside world via IPv6, but since I have a pretty typical home internet connection, I can't rely on having a stable IPv4 address.

For some time, I tried exposing things via IPv6 exclusively, but I found there were too many situations where that made things unusable for me or others. So I set up this basic VPS to proxy the traffic to the Caddy VMs. For publicly exposed services, my A records point to aion's public IP, and the AAAA records point to the Caddy VMs directly.

Originally I was doing this via haproxy, which was working well until I realized it wouldn't be a good solution if I wanted to support HTTP/3. Since that works via QUIC which in turn works on top of UDP, a TCP proxy wasn't going to cut it. haproxy can support QUIC, but it seems to expect to terminate TLS, which I want Caddy to handle instead.

A friend helped me figure out how to use a combination of ipxlat (hopefully a future addition to the mainline Linux kernel) and nftables to be able to forward all traffic on the relevant ports to the Caddy VMs, translating the incoming IPv4 packets to IPv6 packets. So far, this seems to be working well, though I will probably iterate on it a bit more to make it a little less janky.

=> NixOS configuration