What can you do with your own domain name in regards to self hosting? reddit / selfhosted ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-13 09:49 One perk that someone told me about is that you can use your domain to get around not having a static IP (because the DNS will compensate). If I were to get a Cloudflare domain name then what would be some other pros and cons? ---------------------------------------------------------------------- wryterra · 2023-11-13 09:59 Biggest benefit for me is being able to issue valid certificates automatically through letsencrypt. That way I don't have to deal with browser warnings every time I use the web interface of a service at home. ---------------------------------------------------------------------- Id1ing · 2023-11-13 10:04 You'd need to implement Dynamic DNS to update the records. DNS alone won't do that. ---------------------------------------------------------------------- ElevenNotes · 2023-11-13 10:10 This and the same FQDN regardless if you connect from home or from abroad. Single point of truth. ---------------------------------------------------------------------- alconaft43 · 2023-11-13 10:26 certificates + many services on the same IP/port via reverse proxy. Even proper certs for internal not exposed services. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 10:42 Keep in mind that their *names* will be exposed to the whole world via CT logs. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 10:46 * good-looking domains instead of IPs * tons of subdomains instead of ports * universally recognized TLS certs via Let's Encrypt. DNS challenges are the way to go - you don't even have to expose your HTTP server * dynamic DNS, again available via API * `inbox@yourdomain.com` (better not to self-host, but to use an email provider) ---------------------------------------------------------------------- alconaft43 · 2023-11-13 10:46 >CT logs yes, but who cares about record like [bt.home.youcustomdomain.org](https://bt.home.youcustomdomain.org).... ---------------------------------------------------------------------- i_reddit_it · 2023-11-13 10:51 \> One perk that someone told me about is that you can use your domain to get around not having a static IP (because the DNS will compensate). No this wont really help you with that. A domain name ('A' record in a DNS provider such as Cloudflaire) is simply a pointer to an IP address. If you configure this with a non-static address (e.g. your public IP provided by your ISP) then this will at somepoint change and therefore no longer resolve. You would then need to manually update the IP in the DNS record each time. There are services you can run locally to automate this update (check on your router) called Dyanmic DNS. DDNS will basically call a configured endpoint to automate the change. \> If I were to get a Cloudflare domain name then what would be some other pros and cons? Personally I set up an A record to point my domian \`mydomain.com\` to a local IP (19.168.1.x) which is running NGINX proxy manager. With a wildcard CNAME such as \`\*.mydomain.com\` I can add all my local services in NPM with valid letsencrypt certificates. Now I never need to use IP's/ports as I can: \- Access all my local services via valid SSL certs \- Manage them in a single place (NGINX proxy manager) \- Use nice looking URL's using subdomains (e.g \`https://router.mydomain.com\`) \- Same with email addresses. I can use \`whatever-i- want@mydomain.com\` - which I have configured in Cloudflare to forward to my primary gmail account (Just add a \`MX\` entry). ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 10:53 Also, remember that [they stole $35M worth of crypto](https://krebsonsecurity.com/2023/09/experts-fear-crooks-are- cracking-keys-stolen-in-lastpass-breach/) because of the guy who did not care to update his home Plex, *because*... ---------------------------------------------------------------------- fm2606 · 2023-11-13 10:56 Correct. I used NOIP for years until I realized that 1) my IP address is static and 2) my home IP address was being exposed. (Pretty obvious I know but sometimes I am slow on the uptake 😃) My solution was to get a $5 per month vps and reverse proxy and reverse ssh tunnels. The $5 / month VPS ($60/year) was pretty much the cost of NOIP per year to use custom domains. ---------------------------------------------------------------------- fhfs · 2023-11-13 11:06 Might as well use a Cloudflare tunnel. ---------------------------------------------------------------------- alconaft43 · 2023-11-13 11:16 that is bittorent :) but proxy and DMZ is the right way for exposed services. ---------------------------------------------------------------------- keixver · 2023-11-13 11:19 So... You point to an A record of your home's private IP? ---------------------------------------------------------------------- kilhaden · 2023-11-13 11:53 Not needed, you can use a local DNS server to resolve the domain with the local IP. ---------------------------------------------------------------------- trumpet7347 · 2023-11-13 12:00 Wanted to expand on your custom domain for an email since this is something I do to get a more professional email address to put on my resume. A lot of DNS services like Cloudflare or NameCheap will actually let you create email addresses off of your custom domain that will just forward to a different email of your choosing, and generally free or very very cheap as well. If you want to be able to actually send emails from your custom domain, you can setup a Google Workspace account with a single seat for $5 a month and have a fully hosted email solution that uses your custom domain name. ---------------------------------------------------------------------- katrinatransfem · 2023-11-13 12:14 On the DNS server for my local network, yes. Outside, it gets the IP address of my router. ---------------------------------------------------------------------- levogevo · 2023-11-13 12:22 Subdomains for easy external access to local web apps. ---------------------------------------------------------------------- Krieg · 2023-11-13 12:26 Cloudflare tunnels so I don't have to open any port in my network. You can do this even with the Cloudflare free tier. And the byproduct is DNS for free for your domain name, I actually moved the Cloudflare because DNS was getting too expensive with my domain name provider. ---------------------------------------------------------------------- da_frakkinpope · 2023-11-13 12:27 One benefit for me that wasn't immediately apparent is a custom email, paired with something like proton mail and simple login I turned it into a catch all. It's fantastic. Company asks for a email, sure. Walmart@problematicpenguin.org. Now, I can sort anything that arrives to walmart@ right into the spam box. Doesn't matter what address they'd send it from. Fucking. Brilliant. ---------------------------------------------------------------------- jakc13 · 2023-11-13 12:29 Can use dns challenge and not expose your internal ip. https://www.reddit.com/r/selfhosted/comments/vtial9/npm_and_lets_encry pt_certs_without_port_forward/ I use this with node proxy manager and also leverage Tailscale for remote access. All internal apps are behind let’s encrypt ---------------------------------------------------------------------- BabyEaglet · 2023-11-13 12:29 What if you have a wildcart cert, will your subdomains be logged too? ---------------------------------------------------------------------- Goz3rr · 2023-11-13 12:41 I use DNS challenge for the wildcard support, I don't think it matters at all if you did expose to the internet that you use 192.168.0.5 internally ---------------------------------------------------------------------- mtojay · 2023-11-13 12:46 absolutely. but that means you gotta use one and everyone in your home aswell. i created a pihole for our network. blocking a lot of ads. my wife doesnt like it. says it blocks to much for her. but instead of adjusting my rules i just let here use the internet like she wants with a public dns server and i use my pihole no my devices. problem is that she cant resolve mealie, paperlessngx and couple other local services. so instead i just use cloudflare and point it to my reverseproxy local ip for the services she uses aswell. works like a charm. ---------------------------------------------------------------------- FoShizzleShindig · 2023-11-13 12:57 Can also do this with iCloud+ for 99 cents a month. ---------------------------------------------------------------------- kilhaden · 2023-11-13 12:58 I also use cloudflare and a reverse proxy and as you say it works like a charm and is very easy to set up. ---------------------------------------------------------------------- SilverFoxPurple · 2023-11-13 12:59 This. I've done this since 2003 (when I got my first custom domain + email) and I've discovered several forums, services and companies that have either sold their databases or (most probably) got hacked and never made it public. Pro-tip: If you are going to give out the address face to face, they might not trust you or not understand when you tell them that your email address is [theirCompanyName@yourdomain.org](mailto:"theirCompan yName@yourdomain.org). I even had a store blatantly refusing to type that into their system. So, I started using ROT-13 to encode the company/service name, and just telling them the address is [gurvePbzcn alAnzr@yourdomain.org](mailto:gurvePbzcnalAnzr@yourdomain.org). Nobody has ever asked why my email address was so unpronounceable. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 13:00 Or Zoho for $1.25/mo for those who don't have iCloud+ subscription. Also, IIRC [Skiff.com](https://Skiff.com) is currently offering custom domain option for free. ---------------------------------------------------------------------- who_you_are · 2023-11-13 13:02 >tons of subdomains instead of ports Just to be clear for OP, that applies only for protocols that "support DNS" as in, they send the DNS in the protocol. The one I have in mind: http(s) and emails. Games, FTP and most of the protocols don't. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 13:02 No, it will show only `*.example.com` cert. But you will have to share the private key across services, if you run several services. Or issue several wildcard certs. There's no *one-fits-all* solution here. Decide what suits *your* threat model better. ---------------------------------------------------------------------- paulk1997 · 2023-11-13 13:05 There are docker containers that auto update cloudflare a records for dynamic IP. ---------------------------------------------------------------------- paulk1997 · 2023-11-13 13:08 You can auto update your up on cloudflare with a docker container. I'm sure they have an app. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 13:08 I was talking about common *selfhosted-newbie* scheme where they have lots of `http://192.168.1.64:8443` and `http://192.168.1.64:9000` addresses. Instead, one can set up a reverse proxy and use nice-looking `https://cloud.example.com` and `https://panel.example.com` subdomains. ---------------------------------------------------------------------- luukluuk12 · 2023-11-13 13:08 I don’t have any experience myself, but I believe something like nginx proxy manager allows you to do the same with different protocols like ssh (and presumably games too) ---------------------------------------------------------------------- nfiase · 2023-11-13 13:09 im sorry but i just joined this sub and i finally understand the ”containerise everything!!!” meme ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-11-13 13:15 Sharing private keys should be fine imho ---------------------------------------------------------------------- jbarr107 · 2023-11-13 13:21 I use a personal domain and several subdomains to point to my self- hosted services. My access strategy is this: 1. Public services like a website: Cloudflare Tunnel. So I don't have to expose ports. 2. Services restricted to several users: Cloudflare Tunnel + Cloudflare Application. Provides secure authentication prior to access. The user never even gets to my server until they pass authentication, so Cloudflare handles any attacks. 3. Infrastructure Access: Tailscale. Using a Subnet Router, I have full remote and secure access to all of my devices. As far as DNS goes, while my IP is dynamic at my ISP, the reality is that it hasn't changed in years. On those rare occasions when it does, I just update DNS at Cloudflare and move on. The traffic to my homelab is very low, so any such disruption is minor. ---------------------------------------------------------------------- paulk1997 · 2023-11-13 13:26 I am new to docker so getting there. The cloudflare image just works. ---------------------------------------------------------------------- AnApexBread · 2023-11-13 13:34 >they might not trust you or not understand when you tell them that your email address is [theirCompanyName@yourdomain.org](mailto:"theirC ompanyName@yourdomain.org). I even had a store blatantly refusing to type that into their system. I can't even begin to count how many people did not believe that my email ended in a @mydomain.net. If it's not @gmail or @icloud then most people just can't wrap their heads around it. ---------------------------------------------------------------------- nightmareFluffy · 2023-11-13 13:49 Yeah, Cloudflare tunnel takes care of the dynamic DNS. It has limitations, which is why I switched to Caddy and Nginx, but Cloudflare is relatively easy to set up for n00bs and I highly recommend it. ---------------------------------------------------------------------- Lord_Saren · 2023-11-13 13:49 NGINX is great ---------------------------------------------------------------------- sleekstrike · 2023-11-13 13:54 Is there a guide I can follow? Currently I'm using dynv6 and have a bash script that updates my ipv6 every 10 mins or so. ---------------------------------------------------------------------- Bagel42 · 2023-11-13 13:55 Still a bit wrong. You can use things like Portzilla and make it so that certain subdomains are for certain game servers. ---------------------------------------------------------------------- sleekstrike · 2023-11-13 13:56 I have the same setup except I'm using dynv6. Is there a guide I can follow to set this up? ---------------------------------------------------------------------- chazzeromus · 2023-11-13 14:00 it’s pretty sick. i got all my home services SSL terminated with subdomains that aren’t resolvable outside my network. I configured a nice ULA addresses doled out by my dhcp6 by modifying the ipv6 RA to solicit managed ipv6 dhcp and send updates to named so even my apple devices can reach out to them (apple devices tend to fallback to external DNS if AAAA dns records aren’t found) ---------------------------------------------------------------------- mgcarley · 2023-11-13 14:14 I usually get "oh, do you work for...". No, it's just my spam filter. "Why?" "Because I have strict rules where if the sender and recipient don't match, it gets deleted and I'll never see it." And then there's the ones that are like "check your spam folder"... "I don't have a spam folder, because every company has their own email address, so I either get it or I don't, depending on YOUR system and whether it works properly". True or not, "technical jargon" doesn't really get questioned after a certain point. ---------------------------------------------------------------------- ResponsibleEnd451 · 2023-11-13 14:27 You can do all that with a localdomain, for example I use Nginx Proxy Manager with a wildcart selfsigned certificate and Unbound DNS, everything at home can be accessed with https://xyservice.local.home -> no need to buy a domain, for remote access I can use tailscale with my router as the exit node ---------------------------------------------------------------------- grahamsz · 2023-11-13 14:28 I have a not standard TLD and i use whatev.er@whatev.er as the format of my usual email address. I've given up and just give me gmail address when it needs to be face-to-face. ---------------------------------------------------------------------- thatwilsonnerd · 2023-11-13 14:31 You can create groups in pihole. I did that for my wife - her laptop and phone are in a group that doesn’t block ads, but they still use the pihole DNS. ---------------------------------------------------------------------- paulk1997 · 2023-11-13 14:38 If you have dyn, just use dyn. Some people don't want to pay. ---------------------------------------------------------------------- AnApexBread · 2023-11-13 14:43 I've even had some website go "it looks like you're using a work or school email and we need a personal email." ---------------------------------------------------------------------- FanClubof5 · 2023-11-13 14:50 Proton mail will let you do wildcard email and it's only $3-4 a month. If you need smtp support then you can just setup a hydroxide container. ---------------------------------------------------------------------- cholz · 2023-11-13 14:57 Every device in my home (that uses dhcp) gets the address of my adguard home server followed by the gateway as dns servers. For my wife’s devices I just manually set her dns servers to only the address of the gateway. Adguard home does blocking and then the upstream is the gateway. The gateway has static entries for all my home based services and then upstream is cloudflare. This works great because I can have ad blocking by default, and still have dns resolution for my local services even for people who don’t want ad blocking. ---------------------------------------------------------------------- Yeah_Nah_Cunt · 2023-11-13 14:58 How you finding Mealie? Debating between that and Tandoor I like Tandoors UI better but I seem to find lotta people using Mealie so I wanna know why they chose that over the other ---------------------------------------------------------------------- VexingRaven · 2023-11-13 14:59 > needs to use your local dns. Easy with DHCP. > i created a pihole for our network. blocking a lot of ads. my wife doesnt like it. says it blocks to much for her. but instead of adjusting my rules i just let here use the internet like she wants with a public dns server and i use my pihole on my devices. Totally self-inflicted and unrelated. ---------------------------------------------------------------------- VexingRaven · 2023-11-13 15:03 > No this wont really help you with that. A domain name ('A' record in a DNS provider such as Cloudflaire) is simply a pointer to an IP address. If you configure this with a non-static address (e.g. your public IP provided by your ISP) then this will at somepoint change and therefore no longer resolve. You would then need to manually update the IP in the DNS record each time. So... It does help with this. Just not without additional setup. It's still easier to update DNS than update a static IP everywhere it's used. > There are services you can run locally to automate this update (check on your router) called Dyanmic DNS. DDNS will basically call a configured endpoint to automate the change. I use Cloudflare and a script that updates Cloudflare automatically, no need for any other service. ---------------------------------------------------------------------- mtojay · 2023-11-13 15:05 What? I have found a great solution for our needs. Saying "selfinflicted" like it's something I don't like to have when it's literally the opposite. I am super happy with my solution and I am more than happy to let you find your own solution for your needs. ---------------------------------------------------------------------- mtojay · 2023-11-13 15:07 Thx that's a great tip. But I am happy with my solution as it is now. ---------------------------------------------------------------------- mtojay · 2023-11-13 15:09 Yeah it's super neat. If I wouldn't use pihole anyway I would completely stop using a local DNS server tbh. ---------------------------------------------------------------------- VexingRaven · 2023-11-13 15:12 I use this, which supports a bunch of different DNS providers: https://github.com/hbontempo-br/ddns-manager ---------------------------------------------------------------------- mtojay · 2023-11-13 15:12 We like it a lot. Only thing really missing is a proper connection to bring imo. Or at least an add to bring list button under recipes ---------------------------------------------------------------------- VexingRaven · 2023-11-13 15:13 You're implying that using local DNS is a problem because (blah blah my pihole setup). ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 15:21 It really depends. If *you specifically* are actively targeted, then exploiting less significant but vulnerable service could give [Mallory](https://en.wikipedia.org/wiki/Alice_and_Bob#Mallory) a shared private key that can be used for intercepting your communications with more important services, leading to further exploitation. ---------------------------------------------------------------------- tgp1994 · 2023-11-13 15:23 > * universally recognized TLS certs via Let's Encrypt. DNS challenges are the way to go - you don't even have to expose your HTTP server Just a note, as we've had this discussion before: DNS ACME challenges will publish the FQDN of every service you encrypt to a public record, which some sites will scrape up. Just in case this bothers some people. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 15:26 If you want to be compliant, use only RFC8375 `.home.arpa`. If you don't care, use `.lan` or any other name that's not [used as TLD](https://data.iana.org/TLD/tlds-alpha-by-domain.txt) **yet**. ^(Don't be surprised if one day that word gets registered and your stuff) [^(stops working)](https://stackoverflow.com/questions/47768289/chrome- redirects-dev-to-https)^(.) Personally I use the same scheme - local DNS, my own homelab CA (btw I use it for more than just TLS) + reverse proxies on container machines. No NPM though, I prefer plain old nginx. ---------------------------------------------------------------------- WeedLover_1 · 2023-11-13 15:29 better to use zoho. Zoho mails provides you 5 free custom email for free and zeptomail allows you to send k emails for 1 dollars ---------------------------------------------------------------------- supermauerbros · 2023-11-13 15:32 I set the public DNS record to the internal IP for my reverse proxy server. If I'm out of the house wireguard takes over and routes requests to the internal IPs seamlessly. All services have their own subdomain. ---------------------------------------------------------------------- wryterra · 2023-11-13 15:40 Nope. I have a domain that is only used locally and has no public records at all. It exists in Cloudflare but literally only for DNS challenge reasons. That way valid SSL certs are issued for my proxy to use locally. ---------------------------------------------------------------------- wryterra · 2023-11-13 15:41 \+1 for groups. Your local DHCP can provide pihole as the DNS option for all local traffic and groups can exclude specific clients from the blocking behaviour. ---------------------------------------------------------------------- keixver · 2023-11-13 15:45 Got it. Thanks for the answer ---------------------------------------------------------------------- ResponsibleEnd451 · 2023-11-13 15:45 Yeah I know about that but since ICANN rejected .home as a gTLD and said that it will NEVER be, I feel pretty safe and it looks better for my eyes haha. NPM is basically just a gui for nginx(/openresty) which comes handy although I plan to move on to Traefik in the future. ---------------------------------------------------------------------- secopsx · 2023-11-13 15:47 I personally think the comment was fine, if someone stumbles upon this and didn't think of this "scenario", now they know... Isn't that what the internet is for, sharing stories? Go back to your cave hobbit. ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-13 15:48 Adds latency and now Cloudflare sees all your traffic ---------------------------------------------------------------------- secopsx · 2023-11-13 15:49 Who uses DHCP for DNS? That shit is hard coded, with firewall rules blackholing everything that doesn't use MY specificed DNS server. Including DoH, DoT for potential "rogue" devices, or people who like to try to circumvent things in the network. ---------------------------------------------------------------------- VexingRaven · 2023-11-13 15:49 My dude I didn't tell them to go to their cave or insult them, what's your problem? I just said that was a self-inflicted problem, not any problem inherent to using local DNS. ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-13 15:50 > But you will have to share the private key across services Uh no, the cert is only in the reverse proxy unless you're doing zero- trust-networking stuff (in which case it's _still_ not shared, the backend services just need to be trusted by the reverse proxy, no need for public certs) ---------------------------------------------------------------------- VexingRaven · 2023-11-13 15:53 Are you really telling me that you manually set your local DNS server on every device on your network instead of putting it in DHCP? Why? ---------------------------------------------------------------------- DubDubz · 2023-11-13 16:00 But if you buy a domain and setup a vpn then you can use dynamic dns to point to your vpn externally and then use the same domain internally to point to services. Then everything works seamlessly inside and outside with just a single domain. ---------------------------------------------------------------------- secopsx · 2023-11-13 16:00 1.) DHCP is used for internal "clients". 2.) DHCP should never be set for DNS at the router, firewall, l3 switch, or AP level...it should be hard set. \- Why? Because IoT Devices, iPhones, etc like to circumvent using iCloud masking, DoH, or DoT. Therefore I redirect all traffic to my selfhosted dns server (pihole + unbound for recursive, cache, etc functionality) 3.) Network is then further controlled by specified profiles per VLAN for "content filtering" aka pihole,nextdns, insert your choice here. IoT, Kids, Guests are all tailored. Wife and I get "special" profiles. I like granular control...but I also work in the security realm, so I also like overengineered solutions. ---------------------------------------------------------------------- VexingRaven · 2023-11-13 16:02 > 2.) DHCP should never be set for DNS at the router, firewall, l3 switch, or AP level...it should be hard set. How could you have possibly interpreted a suggestion that using DHCP makes using *local DNS* easy as a suggestion to use your ISP's DNS via DHCP? ---------------------------------------------------------------------- DubDubz · 2023-11-13 16:03 I can’t remember, does that happen if you’re using a wildcard? I know there’s a lookup tool but I can’t find it. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 16:09 I was speaking about a case where you *have to* have several private keys, and not about typical homelab setup. ---------------------------------------------------------------------- secopsx · 2023-11-13 16:10 I'm convinced you're one of those people who like to "troll" people along and waste their time. I'll not respond any longer if you don't wish to have a technical or genuine discussion vs. trying to trigger an argument over "misinterpretations". ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 16:12 Well, NPM lacks a lot of features, the first one is mTLS. ^(Or maybe it's just my 11+ years of nginx experience that made me picky? :)) Caddy is also great, btw. Definitely worth a try. ---------------------------------------------------------------------- VexingRaven · 2023-11-13 16:13 My dude you called me a hobbit and told me to go back into my hole then responded to ANOTHER of my comments with perhaps the least charitable interpretation possible and told me nobody does it that way. How can you possibly accuse *me* of trolling? Look in a fucking mirror. ---------------------------------------------------------------------- ResponsibleEnd451 · 2023-11-13 16:26 I have a domain for specific services that I (mostly friends&family) want to access without a VPN and there I’m using Cloudflare Tunnels. ---------------------------------------------------------------------- ResponsibleEnd451 · 2023-11-13 16:35 Nginx is great and I use it a lot without “tools” like npm, but for my little homelab it’s been amazing to write less configs and just add what I want through a web interface :P Maybe I’m just lazy and I don’t feel the need for those extra layers. *at the moment but who knows- I’m regularly redesigning my home network to make it more “efficient” lol. ---------------------------------------------------------------------- Innominate8 · 2023-11-13 16:38 Using an email address on your own domain means you own it as long as you pay for the domain. The email address can then be moved to whatever email provider you happen to be using. ---------------------------------------------------------------------- freedomlinux · 2023-11-13 16:41 https://crt.sh/ ---------------------------------------------------------------------- highedutechsup · 2023-11-13 16:49 Not have to type/remember the full ip. I found the shortest dns possible. 6 characters is all I have to type. ---------------------------------------------------------------------- DubDubz · 2023-11-13 17:00 I’m actually trying to decide how I want to do that now. Debating how much authentication I want in front of those services. ---------------------------------------------------------------------- iavael · 2023-11-13 17:02 > more professional email address Does it even work? ---------------------------------------------------------------------- [deleted] · 2023-11-13 17:03 [deleted] ---------------------------------------------------------------------- DubDubz · 2023-11-13 17:04 Thanks! Looks like it just shows it as a wildcard. Good stuff. ---------------------------------------------------------------------- bristle_beard · 2023-11-13 17:11 Could you explain using cloudflare and a reverse proxy a little more? ---------------------------------------------------------------------- trumpet7347 · 2023-11-13 17:12 Sure, I have a custom domain that is basically MyName.net, and set it up in Cloudflare to forward all emails that go to me@myname.net to go to my private gmail account. It allows me to keep my old email, but give something more professional and rememberable on my resume. This setup only works for incoming emails though, I cant actually send an email from me@myname.net. ---------------------------------------------------------------------- sowhatidoit · 2023-11-13 17:17 Is there a benefit of having your own domain if NONE of your services are exposed to the internet? ---------------------------------------------------------------------- Lee_Ars · 2023-11-13 17:21 > Who uses DHCP for DNS? Normal people. > Therefore I redirect all traffic to my selfhosted dns server (pihole + unbound for recursive, cache, etc functionality) Yeah, you are not a normal person and that is not a normal person use- case. ---------------------------------------------------------------------- iavael · 2023-11-13 17:24 I mean is having your own "professional-looking" email domain really beneficial for CV in your field? As I can say for mine (IT) recruiters don't do much beyond keyword matching between CV and job description. And after that first filter it's 100% that nobody cares about things like what email domain you use. ---------------------------------------------------------------------- certuna · 2023-11-13 17:24 Cloudflare essentially has a menu of three option: 1. Cloudflare can do 'just' DNS, and then it's the same as with any other registrar. You fill in DNS records, they point to your server, and visitors connect directly to your server, with nobody in between. Certificates, you'll have to do that yourself. 1a. Cloudflare has an API through which you can update your DNS records with a new IP address. So if you have a dynamic IP address, you can update your records with [scripts like this](https://github.com/K0p1-Git/cloudflare-ddns-updater). 2. Cloudflare can also proxy your traffic: the DNS record then points to a Cloudflare IP address, they take care of a valid TLS certificate, and proxy the traffic onwards to the IP address of your server (which you'll have to update when it changes). Your server needs to have a public address for this. Cloudflare is a "man in the middle". 3. Cloudflare also has a Tunnel service where your server runs an app that initiates a secure connection to Cloudflare, keeps it alive 24/7, and Cloudflare proxies your visitors inside that tunnel back to your server. Essentially the same as 2. but for servers without remote access, i.e. behind CG-NAT, or dynamic IP address if you don't want to run DDNS scripts. For options 2 and 3, Cloudflare is your public front, and tries to stop known hacking attempts, DDoS attacks etc, and they're very good at that. ---------------------------------------------------------------------- Ch0chi · 2023-11-13 17:28 I use ddclient to auto update my ip address for my cloudflare domains. I've never ran into any issues using that method. Pros of cloudflare are absolutely ddos protection. They also have argos which is nice. ---------------------------------------------------------------------- Nicoloutre · 2023-11-13 17:41 To me the biggest benefit is definitely the MX records if you have an email provider that lets you utilize your domain for custom address like example@yourdomain.com having a personal email with your domain looks more clean, professional and when you will change email provided it will be far more simple. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 17:41 Keep in mind that Zoho free tier does not include IMAP/SMTP. Only web interface or their app. As already stated, their paid plans are dirt cheap. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-13 17:42 well, it's useful not only for CVs :) ---------------------------------------------------------------------- bogdoomy · 2023-11-13 17:49 oh, the worst is the .dev domains. at least 3 people have used .de instead of .dev. i’m thinking i should just give up and register .de as well, and have it forward everything to my main email ---------------------------------------------------------------------- ResponsibleEnd451 · 2023-11-13 17:53 Only make certain services available from outside your network and even then I would advise you to use something like Cloudflare Tunnels + Access or Authelia. I don’t recommend using Let’s Encrypt (except for wildcard- but cloudflare supports that too) because someone could easily get your domains certificate history (crt.sh), also proxy everything through some provider like a cheap vps or just use cloudflare tbh- you don’t want to expose your ip with a ddns because you can be a victim of an attack even if you’re a good guy. You should also watch out for services like search.censys.io and others which could expose your network if you have opened anything to the internet. ---------------------------------------------------------------------- htko89 · 2023-11-13 18:00 Really going to downvote this guy for making his own choices eh reddit? lol ---------------------------------------------------------------------- pm_something_u_love · 2023-11-13 18:06 I use hairpin routing instead of this. My work does the whole two authoritative servers for the same DNS zone thing and I'm soured because it's a pain to support. ---------------------------------------------------------------------- mrcaptncrunch · 2023-11-13 18:11 I do. `*.home.example.com` points to a private IP for a reverse proxy at home which then dispatches internally the requests. ---------------------------------------------------------------------- pm_something_u_love · 2023-11-13 18:14 I use CloudFlare for DNS but don't use the tunneling as streaming over it (Plex, Jellyfin) is against their terms for the free tier. I have become the default streaming platform for my family at this point. But I do wonder how much I can get away with before CloudFlare will give me a warning. ---------------------------------------------------------------------- who_you_are · 2023-11-13 18:38 Hum, then I am missing something because portzilla is just a reverse proxy by the look of it This mean: - you need to use http (games and ftp don't) Or - you have multiple IPs (one per sub domain if I want to keep the example). I assumed OP was in IPV4 and only has one IP. Just to be sure from my other assumptions (kinda ELI5) - DNS doesn't exist on the transport layer. It is converted to an IP and your computer just try to connect to that IP. So whatever DNS you use, if they point to the same IP you have no way to distinguish from what "DNS" they want to go. This is how networking works. Only with IP, no DNS. - some applications (http), added support for DNS. When the user type a DNS, even if your computer still use IP to reach the server, the browser will introduce itself by telling the server the DNS it tried to reach. ---------------------------------------------------------------------- WorthyFroglet · 2023-11-13 18:39 Zoho has a free option as well. ---------------------------------------------------------------------- drinkordie_ · 2023-11-13 18:47 Yes, it's more convenient going to https://radarr.home.lab, which has a proper TLS cert, instead of http://192.168.1.1:8081, even if you're on your home network. ---------------------------------------------------------------------- who_you_are · 2023-11-13 18:49 If it does SSH then you are using it as a http proxy which need some configuration on the client side, which your users, coming from the internet won't do. At best, you have a web application that forwards to a ssh terminate. At that point it would be like telling your user to play via RDP. ---------------------------------------------------------------------- anturk · 2023-11-13 18:51 Yes this is what i wanted to mention you can only use their web app and mobile app in the free tier. But overall Zoho is not bad ---------------------------------------------------------------------- sowhatidoit · 2023-11-13 18:52 That makes sense. Thanks! I have an unused domain - could you tell me how I get started? (without exposing my services to the internet) ---------------------------------------------------------------------- EddieKeytonJr · 2023-11-13 18:52 Valid certificates for all services. Easily remember service locations, expose to off network traffic if needed. It can take the place of a static ip if done correctly. Makes it look better than typing an ip. I can’t think of any cons that I’ve run into yet with a fqdn. ---------------------------------------------------------------------- who_you_are · 2023-11-13 18:55 Oh, then on the LAN that changes everything... I was talking publicly over the internet. ---------------------------------------------------------------------- Krieg · 2023-11-13 18:58 You can use Tailscale to tunnel Plex. And only people in your Tailscale network would be able to access it. ---------------------------------------------------------------------- mtojay · 2023-11-13 18:59 >You're implying that using local DNS is a problem because (blah blah my pihole setup). what a shit take. haha. once again, i will try and word it a bit more carefully for someone who is struggling to properly understand since your reading comprehension might not be the best. my router was configured to give all devices in our network the pihole ip as the local dns via dhcp for quite some time. so she used the pihole dns server without realizing how it works to access our selfhosted services. i set up pihole to be a local dns first and didnt use the adblocking features at first. however after some time i started to configure some adblocking in pihole and was playing around with it. she complained to me and told me she doesnt like and it breaks some of her sites. thats fair. she asked if i could "just go back from the new thing i changed" on our network. but i still wanted to use the adblocking features of pihole i now created. i took out automatic dns server in the router again and put it back to where it was and made sure she was just using the dns server that pihole passed through for external websites anyway - so for her nothing changed except for the inability to acces the selfhosted services via proper ssh urls. so i needed to fix that. and with anything in our hobby there are always multiple solutions to almost every problem. obviously i could choose one of the many different available routes to tackle that. for example i learned today that pihole is able to create groups which would also have been a great way to tackle that. however i chose another way when i set it up. the way was to simply to ditch a local dns server for some services we both use, and rather point dns entries via cloudflare to my internal reversproxy ip. at literally NO point was i implying that using a local dns is a problem. that does not imply at all that this is the only way to do this. not at all. there are multiple ways to do this. i chose one. you would probably choose another one. ---------------------------------------------------------------------- mtojay · 2023-11-13 19:05 yeah that sounds like a great way to solve this ---------------------------------------------------------------------- pm_something_u_love · 2023-11-13 19:05 Tailscale is a VPN right? I'm not sure that would be something family could use on their TVs etc. ---------------------------------------------------------------------- drinkordie_ · 2023-11-13 19:20 Look into some guides on how to set up a reverse proxy like nginx proxy manager with certbot and cloudflare. Plus pi-hole or adguard for local DNS. ---------------------------------------------------------------------- darkcyde_ · 2023-11-13 19:24 Your wife _wants_ ads? ---------------------------------------------------------------------- mtojay · 2023-11-13 19:25 absolutely not. but apparently she visits some sites i dont and some were broken. so we just went back to her using a local adblocker in her browser. she is happy with it so who am i to complain ---------------------------------------------------------------------- Krieg · 2023-11-13 19:39 Kind of. It is a zero-config VPN that you create yourself between your own machines. It is not a VPN in the sense of NordVPN. ---------------------------------------------------------------------- lannistersstark · 2023-11-13 19:41 >So... You point to an A record of your home's private IP? Another way around this is, get a VPS (Oracle has excellent free ones, Google gives you one free one), and use THAT as a reverse proxy, and route everything from there via wireguard. ---------------------------------------------------------------------- DubDubz · 2023-11-13 19:48 A lot of that is pretty close to my current plan. I’m trying to minimize friction for logins, but hate openly reachable things. I only use wildcards so the domains thing isn’t a huge deal. I do wish apple didn’t gate their auth behind a stupid charge. ---------------------------------------------------------------------- keixver · 2023-11-13 19:50 So use the VPS as an entrypoint. Is there any advantage of choosing the VPS as reverse proxy vs. having that reverse proxy hosted on your local network? ---------------------------------------------------------------------- htko89 · 2023-11-13 20:03 That's sad. I have a dev domain and I hope I don't encounter this scenario. How did you find out? ---------------------------------------------------------------------- Krieg · 2023-11-13 20:07 You can however still use Plex with Cloudflare, you just have to avoid caching. You can Google it and you will find guides. ---------------------------------------------------------------------- rymn · 2023-11-13 20:10 I wouldn't say that's a big benefit to having your own domain when you can easily used duckdns.org to accomplish the same thing ---------------------------------------------------------------------- thekrautboy · 2023-11-13 20:36 > Oracle has excellent free ones hehehe... ---------------------------------------------------------------------- lannistersstark · 2023-11-13 21:16 what hehehe? Oracle DOES have some of the best always-free/payg tier ones. Yes yes I get it oracle bad and all that, but I've personally had 0 issues with them for past 3 years or so. Plus I have backups so eh. ---------------------------------------------------------------------- thekrautboy · 2023-11-13 21:32 https://www.reddit.com/r/selfhosted/search?q=oracle&restrict_sr=on&inc lude_over_18=on&sort=relevance&t=all ---------------------------------------------------------------------- RunOrBike · 2023-11-13 21:32 There’s more to email than most people believe. Tell them that case doesn’t matter. They’ll insist anyway. Explain that there’s _really_ a # in your address. Or ^ or {}… Most just lose their mind and the thought. Even spaces are allowed in the local part (if quoted). That, and so much more… ---------------------------------------------------------------------- eckadagan · 2023-11-13 21:33 > universally recognized TLS certs via Let's Encrypt. DNS challenges are the way to go - you don't even have to expose your HTTP server I use DNS challenges for mine as well, but I have been manually renewing my cert every time. Is there a way to automate letsencrypt/cerbot renewal when you use DNS challenges? ---------------------------------------------------------------------- tenekev · 2023-11-13 21:43 Yes but duckdns has a limit of 5 and issuing certs isn't as straightforward. Also you dont have to chain 4 subdomains to reach your stuff. ---------------------------------------------------------------------- tenekev · 2023-11-13 21:47 There is a docker container for that. ---------------------------------------------------------------------- tenekev · 2023-11-13 21:50 Yes. Convenience. Easier cert management. ---------------------------------------------------------------------- waka324 · 2023-11-13 21:55 Same. Opnsense makes this easy to do, then I don't have to worry about network transitions and whatnot. Only downside is that there are small windows where my dynamic DNS isn't up-to-date. ---------------------------------------------------------------------- lannistersstark · 2023-11-13 22:02 You should read the links you share. ---------------------------------------------------------------------- pm_something_u_love · 2023-11-13 22:04 Can't get a static IP? My ISP offers them for a $45 one off so I just did that. ---------------------------------------------------------------------- wryterra · 2023-11-13 22:05 It's a big benefit to me. duckdns doesn't do what I want it to and by managing my own system I'm fine if it ever goes away. ---------------------------------------------------------------------- rymn · 2023-11-13 22:09 I've been using duct DNS for a while and I'm just using "my name".ducksns.org:port ---------------------------------------------------------------------- thekrautboy · 2023-11-13 22:10 "i am aware they suck and are terrible, but they still offer the best"... ---------------------------------------------------------------------- m4nf47 · 2023-11-13 23:06 I've recently set up hard coded local entries for router.domain and nas.domain but not got around to adding printer.domain yet. In theory it is quite possible to define static DHCP entries for a bunch of different containers with bridged network interfaces then add entries for individual services like filemanager.domain and mediastreamer.domain and downloader.domain and cctv.domain etc. ---------------------------------------------------------------------- moontear · 2023-11-13 23:15 One thing that wasn’t mentioned: I can use *.internal.domain.com and not have that routed on public DNS (using my own DNS with pihole + unbound or adguard). Of course still valid certificate for that domain. It feels good using a domain name I can type it and secondly *.domain.com IS publically routed, meaning all external services go there. The internal stuff I can only access via Tailscale (which automatically uses my dns). ---------------------------------------------------------------------- Knocks83 · 2023-11-13 23:22 Cool thing is you can actually use a public domain to resolve private IPs, I use it for my VPN and local network ---------------------------------------------------------------------- mtojay · 2023-11-13 23:25 i am not quite sure what you mean? but i will try: on cloudflare you add a record to your dns table that points to your local reverseproxy-ip at home. for example: test.yourdomain.com -> 192.168.1.2 (like literally point to your local network ip adress like this) this dns record is then available on the internet. but it points to a local adress. meaning people can call up that website and it will resolve theoretically. but it will only resolve to a local adress. and obviously they are not in your local network, so this will not work. but since you are in your local network and the resolved ip adress acutally reaches your revers proxy it will do all the right things (provided you set it up correctly) ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-11-13 23:30 This is the way. ---------------------------------------------------------------------- bogdoomy · 2023-11-13 23:37 when i bought my flat, my solicitors had me fill out a form to register for communal heating, and when it was transcribed, whoever signed me up put down my address as .de instead of .dev, which caused an awkward phone call as i explained what the situation was to the heating company. after that, whenever i sent an address over the phone or what have you, i always made sure to ask whether they had the .dev TLD correct, and on a couple of occasions they’d had to go back and change the .de to .dev ---------------------------------------------------------------------- ianjs · 2023-11-13 23:51 All my internal home devices resolve to my domain when they pick up an address via DHCP from my pFSense router. This means when I’m home I can just use device@mydomain.com to refer to them. To access them from outside, I have Tailscale on my router (pFsense), laptop, iPad and phone. Effectively I’m _always_ on my local LAN even when I’m outside my house because the router acts as an “exit node” and will resolve the names even if I’m connecting remotely. So I don’t have holes in my firewall because Tailscale doesn’t require one, all comms are across Tailscale so they are encrypted, and it feels like I’m on my local LAN even when I’m remote. Works for me. ---------------------------------------------------------------------- marvelogs · 2023-11-14 00:06 If your domain is not being used, try using something like Newsy - [https://www.newsy.co](https://www.newsy.co) or HN+ [https://www.hn.plus](https://www.hn.plus) \- these tools let you create content community sites automatically and it self-runs. ---------------------------------------------------------------------- bschlueter · 2023-11-14 01:16 I get to see who verifies email addresses correctly with my @example.blue email addresses. Most people get it with minimal correction, but even Apple doesn't programmatically do it correctly. ---------------------------------------------------------------------- Electronic_Wind_3254 · 2023-11-14 01:19 When I used Zoho Free, many of my emails would end up in people's spam folders. My domain is certainly not on any blacklist, it was pointed correctly and with the security and domain validation features enabled and everything configured properly. Deployed it to small business clients as well and same result. Gmail doesn't seem to like Zoho. What seemed to work like a charm was to use iCloud+ Custom Email and just add my custom domain addresses as aliases on Gmail. It's like having a custom domain Google Workspace without paying anything (apart from the iCloud subscription that gives you a ton of space for all your data). ---------------------------------------------------------------------- fjnunn78 · 2023-11-14 01:40 Yes thank you. I need this setup too. ---------------------------------------------------------------------- 546875674c6966650d0a · 2023-11-14 02:32 Email aliases... Russ@randomshit.com Darthmohawk@tie-fighter.com Yourmom@sexylittleb**ch.com Also, reverse DNS if you have an IP block is fun.. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:42 Use a DNS provider with Certbot DNS API support ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:44 That's nothing to do with ACME challenges and everything to do with certificate transparency logs. Nonetheless, yes, security through obscurity is some form of security (not to be used alone) and there are bots and scanners that do indeed monitor the live certificate transparency logs for new web servers to scan for vulnerabilities. So yes, wildcards can indeed help. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:45 If you requested a wildcard then that is all it should show. It will show exactly the certificate you requested, SANs and all. ---------------------------------------------------------------------- eckadagan · 2023-11-14 02:45 I’ll have to see if Godaddy has that ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:48 Much better to just have one exposed SSH host and use the jump option to turn it into a bastion host for accessing other SSH hosts within your network ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:50 At this point it's better to just pay up for a static IP block allocation from your ISP, then you can have multiple devices listening on the same port on different IPs from your allocation. 🙃 ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:51 I really don't understand everyone's rush to use Cloudflare Tunnels. It's great if you're dev'ing and need to expose a development web service (ala Ngrok.) But other than that I see no real reason for adding more points of failure, unless you're stuck behind CGNAT or the like. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 02:57 It doesn't matter whether you open the port directly on your network or on Cloudflare, if your app or webserver has a vulnerability then they can still pop a shell on your network. The only saving grace might be if Cloudflare's WAF intercepts anything malicious. If you're really wanting to be security conscious then it would be much better to have a box/VM/container sitting on an isolated "DMZ" VLAN. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 03:02 You'll probably want to use DNS verification with Certbot if you don't want to expose anything ---------------------------------------------------------------------- Endorsi_ · 2023-11-14 03:38 Hi, I actually couldn’t figure this out a while back and decided to ditch the pihole altogether, but I had groups and it seemed like it was still blocking some? Out of curiosity can your wife click google ads? (The ones at the top after searching) ---------------------------------------------------------------------- AviationAtom · 2023-11-14 04:12 Keep in mind that you aren't limited to GoDaddy for DNS, you can host it anywhere. CloudFlare is popular. ---------------------------------------------------------------------- eckadagan · 2023-11-14 04:26 I currently have my DNS through godaddy for at least the next half year, so I’m there for now unless I want to waste money. But thank you! ---------------------------------------------------------------------- ghulican · 2023-11-14 04:29 I want to be more like you. Content with a solution… I’m just now doubling down on my own standards, and they won’t change……… until I get down another rabbit hole of depression and flip the script again. ---------------------------------------------------------------------- thatwilsonnerd · 2023-11-14 05:25 She can click on those ads now, but when she was in the default group everyone else is in, she could not. ---------------------------------------------------------------------- DimestoreProstitute · 2023-11-14 05:48 What he means is, you can point the NS servers for your domain to Cloudflare and let them handle the resolution of your records, even if GoDaddy is your registrar. It doesn't require to move the domain registration from GoDaddy and its a free service from Cloudflare. I use this myself with one of my domains registered through Hover for Cloudflare's DDNS API ---------------------------------------------------------------------- NullVoidXNilMission · 2023-11-14 07:06 Purelymail ---------------------------------------------------------------------- Krieg · 2023-11-14 07:13 Most script kiddies scan your IP address. I had tons of scans every day and they literally went away when I moved to Cloudflare. My webserver runs on a container of course. ---------------------------------------------------------------------- Yncensus · 2023-11-14 07:27 can recommend acme.sh if on Linux ---------------------------------------------------------------------- Endorsi_ · 2023-11-14 08:08 Tysm for testing! I’ll have to give it another try ---------------------------------------------------------------------- [deleted] · 2023-11-14 08:26 [deleted] ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-14 08:26 What are the risks of letting a stranger know your domain name? I know that Cloudflare has privacy options for hiding WHOIS registration info, but does Cloudflare act as a proxy by default (hide your private IP)? What ways can someone totally screw up by owning a domain name and not knowing what they are doing? ---------------------------------------------------------------------- wryterra · 2023-11-14 09:10 Not much in the terms of real risk to letting someone know your domain name. To be honest using SSL certs you sort of make it inevitable people will know your domain name (and subdomains you have configured in certs). That said, yes, Cloudflare does indeed proxy your public IP even on the free tier and that *is* valuable. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-14 09:18 [acme.sh](https://acme.sh) \+ move your DNS to Cloudflare (free). Actually, you can transfer your domains to CF as well. They have flat no-markup pricing. For example, .com is $9.77 there - and it's the real cost of .com. All extras are just profits for GoDaddy etc. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-14 09:18 I've done some digging and they [got rid of that loophole](https://www.cloudflare.com/service-specific-terms- application-services/#content-delivery-network-terms) recently. Unless you are a $2000/mo Enterprise customer you need to buy one of their [content developer packages](https://dash.cloudflare.com/stream). Please let me know if I have interpreted this wrongly. ---------------------------------------------------------------------- wryterra · 2023-11-14 09:22 Firstly between a couple of piholes on raspberry pis, a handful of managed switches, a nuc, a couple of Mac minis and some full fat servers (and their IPMI interfaces) I need to resolve the domain to more than half a dozen different IP addresses. In different subnets too. That's strike one. I could route everything to a proxy and use a different port to access different services but off hand I'm using: 3 pihole instances, 3 managed switches, the half a dozen or so servers, a couple of IPMIs, 20 virtual machines, 4 of which are container hosts hosting another couple of dozen containers. True I could write down 60+ port numbers and what they refer to on a note somewhere and refer to it whenever I wanted but much easier to write those down in my DNS records and remember actual domain names. I also use sub-subdomains fairly extensively. [one.pihole.example.com](https://one.pihole.example.com), [two.pihole.example.com](https://two.pihole.example.com), [three.pihole.example.com](https://three.pihole.example.com) [servername.example.com](https://servername.example.com) and [ipmi.servername.example.com](https://ipmi.servername.example.com) [office.switches.example.com](https://office.switches.example.com), livingroom.switches.example.com, [basement.switches.example.com](https://basement.switches.example.com) [servicename.teleport.example.com](https://servicesname.teleport.examp le.com) (where service name could be any of a half dozen services) That's strike two. All of the DNS records to manage all this are replicated across three pihole instances on three different machines on two different UPSs. The best thing about this for me is that if my WAN interface goes down it still works, duckdns would be a single point of failure with two failure cases (duckdns is down or my internet is down). And doing it this way my SSL certs cover everything, including the sub-subdomains and they're auto-renewing, set and forget. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-14 09:31 >You also break the TLS as your traffic passes through Cloudflare's severs, allowing them to see all your traffic (or worse if they have a misconfiguration or vulnerability in their services.) > >If you're really wanting to be security conscious then it would be much better to have a box/VM/container sitting on an isolated "DMZ" VLAN. I kind of get the part about Cloudflare decrypting your traffic to scan it (who even knows what the sell-to-advertisers or compulsory- give-to-big-brother implications might be) but what does the last part of your comment mean? Please explain this to me like you would explain it to a child, because I don't know how networking and security things work. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-14 09:35 I found this out the hard way like 10 years ago when I had my laptop plugged directly into my cable modem with no firewall/router and no firewall software :( ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-14 09:44 I miss the days when you could just do [johnsmith+walmart@gmail.com](mailto:johnsmith+walmart@gmail.com) when signing up on a website, but now everyone either outright rejects it as invalid or parses it out. It was useful because you could see who was selling your email address, but that exposed too many companies and was losing them $$$ so they patched it :( ---------------------------------------------------------------------- Krieg · 2023-11-14 10:31 Maybe to be clear, they still scan of course, but with nothing open they do not try to break in. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 11:43 That's no problem. Get a managed switch (Netgear has one) and you will need a router that can span multiple metworks, if you want to do it right. That will allow you to do multiple network segments, isolated from each other. Another option is to do the poor man's way and have your home lab server run a pfSense or OPNsense VM to route traffic, then create a VM that sits on your DMZ/isolated subnet off the *sense router interface. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 11:45 I meant to clarify that your registrar for your domain can remain separate from your DNS provider, so GoDaddy would still hold your domain, while CloudFlare provides the DNS. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 11:59 It really depends what you're running on your web server. Put a vulnerable version of WordPress on their and they will find it, even on a vHost. The CloudFlare WAF should theoretically filter it out but there is no guarantee. ---------------------------------------------------------------------- da_frakkinpope · 2023-11-14 12:42 See, I keep reading that. Idk for sure if it's because I use a custom domain, but no company has rejected me yet. Closest I got was a, "Is this a real email address?" "Yes" "That's so cool! How is your email mydumbcompany@problematicpenguin.com?" ---------------------------------------------------------------------- jbarr107 · 2023-11-14 14:27 I choose to use CloudFlare Tunnels and Applications because they are free, reliable, and work well. Yes, this is the "selfhosted" subreddit. I get that. But for me, Cloudflare does the heavy lifting in an area where I have little experience, and little desire to reinvent a wheel that already rolls well. Letting Cloudflare manage access lets me concentrate on those self-hosted areas where I want to focus my attention. It's similar to using Gmail and MS Office. Are there better alternatives, particularly self-hosted? Sure, and I can absolutely self-host those alternatives. But in my life, those solutions are more compatible and reliable than going self-hosted so those alternatives are not important to me. YMMV, of course. ---------------------------------------------------------------------- unofficialtech · 2023-11-14 14:53 Zoho's free option no longer allows IMAP connections, so getting your email on a phone or other client isn't possible from what I found. There are mobile apps for zoho mail which you can use, but one of my use cases was document consumption via email to paperless-ngx. ---------------------------------------------------------------------- sowhatidoit · 2023-11-14 16:30 Is CertBot a service I can use? My domain is registered at Porkbun. ---------------------------------------------------------------------- AviationAtom · 2023-11-14 16:32 Certbot is the official ACME cert issuance and renewal tool for Letsencrypt. I'm not sure if Porkbun's DNS service has an API for Certbot (for domain ownership verification) but there are many different DNS services that do have an API fot Certbot. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-15 01:39 Can you put the two situations into context with each other for a noob like me? ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-15 01:46 So the pro is that Cloudflare acts as a bulwark to keep hackers out, but the con is that you just hand them your internet traffic (instead of to the ISP) to sell to mega corps or give to big brother? ---------------------------------------------------------------------- HeadlineINeed · 2023-11-15 03:10 Does this work with Google Workspace/gmail? And how do you do it? If you’re at some new store say hshsb do you create the email before you go or while you’re there? ---------------------------------------------------------------------- certuna · 2023-11-15 07:24 Yep. If you put someone between you and the internet, you're going to have to trust him. ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-11-15 18:52 TIL :) ---------------------------------------------------------------------- da_frakkinpope · 2023-11-16 03:53 You can point simple login to your exosting Gmail account, sure. Simplelogin is a paid service.