Trying to put Let's encrypt to Trilium server
reddit / selfhosted

----------------------------------------------------------------------
9acca9 · 2023-11-09 19:47

im running Trilium in a Arch based distro in the 8085 port.

I have installid trilium from AUR.

I read the documentation in Trilium web, and see that i have to change
config.ini in trilium-data directory but... im having trouble getting
the certificate.

i try this, from lets encrypt web:

    sudo certbot certonly --standalone

and after following the several questions i get this:

    Certbot failed to authenticate some domains (authenticator:
standalone). The Certificate Authority reported these problems:
      Domain: xxxxxxxxxxxx.run.place
      Type:   dns
      Detail: DNS problem: query timed out looking up CAA for
run.place

that is a domain i get from freenom, and it is working. So... what is
the problem here? why dont like the [run.place](https://run.place)?
And... what i can do to fix this?

​

----------------------------------------------------------------------
hannsr · 2023-11-09 20:15

Is that really your domain and how do you determine its working? A
timeout means that letsencrypt did not receive any answer, so that's
where your problem is. If your domain would work, there'd be done sort
of answer - even if it's a "not found".

----------------------------------------------------------------------
9acca9 · 2023-11-09 20:35

mmmm yep, my domain ends in "[run.place](https://run.place)"

is like "[mydomain.run.place](https://mydomain.run.place)"

to go to my servers i just write
[mydomain.run.place:8085](https://mydomain.run.place:8085)

and i reach them.

----------------------------------------------------------------------
9acca9 · 2023-11-09 20:56

Thanks.

I buy now a xyz domain, and i get the ssl certificate.

Thaaaaaaaaanks!

----------------------------------------------------------------------
hannsr · 2023-11-09 22:02

Just to be sure: can you do that from outside your network? Like when
only connected to the mobile network on your phone?

If yes you should immediately change that and look up at least how to
get a reverse proxy up and close your routers ports back up.

----------------------------------------------------------------------
d4nm3d · 2023-11-09 22:18

you generally will never get a letsencrypt for a freenom domain..
letsencrypt limit how many certificates per day for each domain and
the freenom ones hammer it.

----------------------------------------------------------------------
9acca9 · 2023-11-10 01:47

lol, ok.

----------------------------------------------------------------------
9acca9 · 2023-11-10 01:50

>Just to be sure: can you do that from outside your network? Like when
only connected to the mobile network on your phone?

yes, i can.

>If yes you should immediately change that and look up at least how to
get a reverse proxy up and close your routers ports back up.

why?

with a reverse proxy i dont need to have the ports of the router open?

Thanks for the help!

----------------------------------------------------------------------
hannsr · 2023-11-10 07:06

Yeah that's not a good idea. For example port 8085 is pretty sure http
only, so the whole traffic between your device and the server is
unencrypted and basically anyone who wants to can read that traffic.
Including passwords and so on.

With a reverse proxy you can use encryption between your client and
the proxy without configuring it on each service separately. You'll
also only need ports 443 and maybe 80 open and forwarded only to your
proxy.

----------------------------------------------------------------------
9acca9 · 2023-11-10 16:03

this is a beauty. I install Nginx.

And now i close all ports of the router except for 443, and all works
anyway!!! I even close all the port in the server, except for that!

Also i liked more that write the domain with a port as url.

Also it is nice to see "connection is secure".

Thanks for your help!