How to have NGM handle wildcard certs with dreamhost? reddit / selfhosted ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 16:50 I see that in NGinx Proxy Manager, I can do wildcard certifications from Let's Encrypt if I use a DNS challenge. The dropdown for common DNS providers doesn't include dreamhost. Is there still a way to do it? I could transfer my domain to Cloudflare or one of the other providers in the list, but I feel like I'm missing something obvious I could do instead. ---------------------------------------------------------------------- ElevenNotes · 2023-09-29 17:00 Host your own DNS? Would make you not reliant on the cloud and you have finally full control over your DNS. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 17:23 That's a bit more than I'm looking to take on right now. My current setup is that I have DDNS via a free service provided by my router's company, and managed in the router UI. I then have a domain name registered via Dreamhost with several CNAME records for subdomains that point to the original DDNS name provided by the router company. Ports 80 and 443 on the router point to a container with NGM, and it handles the rest. I'd just like to avoid having subdomain names hanging out there in published records of certificate issuances. ---------------------------------------------------------------------- ElevenNotes · 2023-09-29 17:33 Why? It adds no protection. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 17:42 Because, if for instance I have a subdomain called something like "[nextcloud.example.org](https://nextcloud.example.org)" out listed on those certification records, it's one more opportunity for malicious actors to become aware of my nextcloud instance and target it. My actual subdomain names are much less obvious than that, but it still seems like a useful step (in combination with other more robust security measures). I don't really know anything about RFC2136, other than a quick google showing me that it's a standard related to DNS updating. I'm not clear how that helps me in the situation I've laid out, but I'm not quite following what you're suggesting I do with Dreamhost assuming it does support the standard. NPM is capable of doing what I'm looking for: Obtaining and automatically renewing wildcard certificates from Let's Encrypt, using a DNS challenge. In its gui, there's a dropdown for several DNS providers, to use their API tokens and configurations appropriate to them. I'm unclear whether it's possible to do with Dreamhost since it's not in the dropdown, but looking to see if someone can direct me how if it is. ---------------------------------------------------------------------- ElevenNotes · 2023-09-29 17:45 No its useless, you just query the DNS of your domain and brute force your way through all records. Does not help one little thing to hide your services. Get a provider from your dropdown list in your GUI and be happy or ask dreamhost to support letsencrypt. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 17:56 Sure, if someone is brute-force attacking me, specifically, with some ideas of what I might have running, they could try that. They'd still have a prohibitively large list of possible combinations for possible subdomain names and no indication what service is at each potential hit until they try it, if that's all they're doing. That's not the scenario I'm trying to head off here. I'm trying to avoid the scenario where there's a zero-day exploit for NextCloud (or any other service) and malicious actors start scanning through certificate records for anything that looks from its name like a likely NextCloud instance to target them. I have no reason to believe Dreamhost doesn't support Let's Encrypt (and indeed I can get LE certificates for sites I host with them, rather than self-host, through their control panel). I'm just trying to determine if I can use NPM to retrieve and renew Dreamhost-managed domains despite Dreamhost not being on its drop-down - if there's a way to add it or use a custom configuration appropriate to it. As I said, yes, I could switch to a different provider. And I might, if the answer is that this can't be done via NPM. First, I'm trying to find out if it's an option. ---------------------------------------------------------------------- ElevenNotes · 2023-09-29 18:00 You are using NPM that alone should tell you not to fumble with the configs underneath. Get a provider in your dropdown list. By the way, that zero day and your FQDN will not protect anything. The entire web is under 24/7 surveillance and any port you have open is actively beeing probed for standard software, like nextcloud, no matter what FQDN you use. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 18:07 The only ports publicly accessible are the one pointing to NPM. It of course could be as subject to a vulnerability as any other service, but my Nextcloud and other services aren't on open ports. I'm perfectly willing and able to adjust configurations in the GUI, in config files, in environment variables. I couldn't have gotten as far as setting up my various self-hosted services including NGM if I wasn't. Dismissing someone and telling them not to bother because they have a question about how to do something, to stick to the GUI as if it isn't possible they could handle anything else, isn't really helpful. But I certainly don't know everything, and since I don't know where to start on this particular configuration change, I put out the question. If you don't know the answer - cool, me neither. If you do, great, glad to see it in your next reply. ---------------------------------------------------------------------- ElevenNotes · 2023-09-29 18:12 Again, NPM can't do that no matter how much you want it to. Here is a client that can: https://go- acme.github.io/lego/dns/dreamhost/ ---------------------------------------------------------------------- xstar97 · 2023-09-29 19:03 Transfer the domain(cost money, adds extra time to the lease) or just change name servers over to cloudflare which is free. If this server is local to you...setup a local dns server and vpn server. Pihole and wg-easy(wireguard vpn server, ) are the easiest ones to setup, i currently use adguardhome atm. Pretty much you should locally resolve your domain with the local dns server to point to your npm lan ip. Create dns / cname records in phole or use a wildcard dns filter in adguard home. Set this dns server as your primary dns on your router/ local device. Setup wg-easy to use it as a primary dns for split dns remotely using a vpn tunnel, don't forget to forward wg-easy vpn port 51820 as UDP. Remove the port 80/443 port forwards You should Also set access list in npm for your services so those can only be accessed via the lan ips and your lan vpn ips Validate that you're resolving the domains locally by running these commands on your client device. The commands should return the local lan ip of your npm instance. ```shell nslookup app.example.com dnsIP ``` ```shell nslookup app.example.com ``` This is how i currently operate my services. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-09-29 19:19 I'm not sure I followed all of this, so bear with me if I'm misunderstanding. But wouldn't this only help me for accessing it within my own LAN and when connecting via VPN? If so, that's not my use case. I have several self-hosted services that are currently only available on my LAN or when connecting to it via VPN. I run a Wireguard server on my current router, and connect to that as needed. But I have a small handful of services I prefer to be generally available on the Internet, without needing the VPN for access. Those are services that I either share with other users (like family members who arent very technically inclined) or may that I may sometimes use from devices where I can't install a VPN client (like my work computer). For those, I use other measures like 2FA, application-level brute force mitigation (I'll probably install Crowdsec for another layer), etc. Those are the ones accessible via NGM. I could close off the ports and use Cloudflare tunnels, and might, but that's a project for another day. I might consider moving the domain to Cloudflare for ease of use with NPN; I just wanted to find out first if there's an option to allow it to do DNS challenges with DNS providers other than the ones in its drop-down menu. ---------------------------------------------------------------------- xstar97 · 2023-09-29 19:21 Cloudlfare is the better choice here for dns challenges. You can change the name servers for free and they will manage your dns instead. ---------------------------------------------------------------------- wubidabi · 2023-09-29 21:50 I think you could just spin up a web server on a VM/LXC/Docker/vHost, point your domain to it and then run certbot on the server. Make sure you request a wildcard cert and subsequently import the necessary files in NPM.