HTTPS for my offline LAN access only containers?
reddit / selfhosted

----------------------------------------------------------------------
Illuminated_Humanoid · 2023-10-06 21:56

Hi friends,


I decided to remove my self-hosted containers from the public internet
to LAN access only via tailscale for security reasons. One issue I ran
into right away was with Vaultwarden. When I installed it, the create
account page says it only works with HTTPS and wouldn't let me
continue.


So my question is, what is the easiest way with the least amount of
work to use SSL for all my containers within my LAN only? I have all
my stuff hosted on my Synology NAS.


​

https://preview.redd.it/zwi575jjlnsb1.png?width=1776&format=png&auto=w
ebp&s=a16879ef34814ec6a8d3f0fc06192adc77c436c6

----------------------------------------------------------------------
Reverent · 2023-10-06 22:07

Run it all through a reverse proxy that uses DNS challenges with a
cheap domain so you don't need to expose it.

It's either that or use self signed certs, it's not like you'll get
your friends to install a root cert or something.

----------------------------------------------------------------------
Illuminated_Humanoid · 2023-10-06 22:23

Is the latter less work?

----------------------------------------------------------------------
thekrautboy · 2023-10-06 22:24

This has been asked and answered so many times here already, please
just use the search. Your situation is not unique.

[Linking to one of my own
posts](https://www.reddit.com/r/selfhosted/comments/146c2yd
/guide_free_dynamic_dns_nginx_proxy_manager_lets/) just as a example.

If you just want self-signed SSL and nothing else, look at using
https://hub.docker.com/r/steveltn/https-portal/

----------------------------------------------------------------------
Reverent · 2023-10-06 22:30

No, reverse proxies can work very easily, especially using something
like caddy.

----------------------------------------------------------------------
Illuminated_Humanoid · 2023-10-06 22:35

>If you just want self-signed SSL and nothing else, look at using
>
>https://hub.docker.com/r/steveltn/https-portal/#

This is what I needed. Thank you!!

----------------------------------------------------------------------
thekrautboy · 2023-10-06 22:41

https-portal is extremely easy to use, and it acts like a reverse
proxy, but of course the certs it can create are either self-signed or
"Lets Encrypt" with the http01-challenge, which means having the
https-portal container reachable from the open internet (port-
forwarding). If you want to use dns01-challenge for example, then you
need to use a different deployment.

----------------------------------------------------------------------
Illuminated_Humanoid · 2023-10-07 00:58

Yeah, I just realized that, which means https-portal is not a good
option for me. My network is firewalled, so there is no outside
access. This is confusing stuff. Wish it was a bit easier.