Hosting at home & SSL reddit / selfhosted ---------------------------------------------------------------------- mattcd216 · 2023-12-05 16:01 Hi all, Wondering how non-enterprise home users handle https at home as more and more services/clients require https these days. iOS in particular doesn't like http services or even self-signed certs. A lot of browsers don't either. How do you deal with: * Dynamic IPs from your ISP and DNS records for your domains? * Router port forwarding for CA verification? I have an old Synology NAS for storage and a rpi4 (8GB) for apps. Docker was my first thought for running multiple services and I have pihole up and running (web UI over http). I *think* Docker with a reverse proxy in front of the containers will be the solution, but I'm still searching for my level of idiot's guide :) Big fan of Tailscale for remote access and they seem to offer [https](https://tailscale.com/kb/1153/enabling-https/) for their magicDNS machine names, but I'm getting confused around machine name certs and the temporary nature of containers... Self-hosting is a huge topic. Loads of people do it. So, how do you host multiple services at home, securely? Thanks :) ​ ---------------------------------------------------------------------- RyuuPendragon · 2023-12-05 16:14 1. For updating dns, you can use cloudflared api to update ip address. 2. Use nginx proxy manager as reverse proxy and generate letsencrypt for https. ---------------------------------------------------------------------- art_of_snark · 2023-12-05 16:16 Caddy with the cloudflare plugin - ACME via DNS TXT records rather than HTTP. ---------------------------------------------------------------------- thekrautboy · 2023-12-05 16:20 > Dynamic IPs from your ISP and DNS records for your domains? You simply update the A record for your domain with your IP, doesnt matter if its dynamic or not. Some DNS hosts offer a API and you could use tools like `ddclient` to automatically update the record when a IP change is detected. > Router port forwarding for CA verification? Using a supported DNS provider allows you to use Lets Encrypt for free SSL certs with the dns01-challenge, instead of http01-challenge. Meaning you prove ownership through DNS records, not by opening any ports and having a webserver respond. A typical setup would be a reverse proxy like Traefik, Caddy, NPM or whatever, with a supported DNS provider like Cloudflare, deSEC, DuckDNS etc, providing HTTPS for all your services, doesnt matter if they are local only or if you want to open the proxy and some services to the public. Plenty of discussions about all of this exist here already, use the search. ---------------------------------------------------------------------- DangerousDrop · 2023-12-05 16:39 Usually Cloudflare Tunnel. Use `cloudflared` container. Define the tunnel on Cloudflare web UI, pointing at e.g. `http://vaultwarden`, copy the token, and then... ``` tunnel: image: cloudflare/cloudflared restart: unless-stopped command: tunnel run environment: - TUNNEL_TOKEN=abcdef.... ``` for stuff I don't want proxied by CF I use nginx proxy manager. ---------------------------------------------------------------------- mshorey81 · 2023-12-05 16:55 I have a dynamic address from my ISP but it never changes so I don't have to worry about updating it ever. Besides that I forward 80/443 incoming to a VM running Nginx Proxy Manager and force 80 to 443. I use let's encrypt via route53 (I know some will fringe at this) for a couple wildcard certs. On my NPM VM I run Crowdsec and Fail2Ban which update a dynamic Blocklist to my pFsense VM which is also using pfblockerng to block all but north America incoming as well as some other miscellaneous Blocklists all to block at the edge. ---------------------------------------------------------------------- kinl99 · 2023-12-05 16:57 You can use step ca to generate a self signed certificate chain, that can be imported into ios devices with almost no hassle. ---------------------------------------------------------------------- pusillanimouslist · 2023-12-05 17:17 iOS will accept your certs if you create your own root CA and sign keys that way. I use vault for my certificate signing, and cert manager to issue and cycle keys. ---------------------------------------------------------------------- dnthackmepls · 2023-12-05 17:18 I use Terraform to set the Cloudflare DNS record to the local (public) IP, and run that on a cron job to keep it synced. Run on an always on server or a Pi, and it works pretty well. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-05 17:38 This for the certs and then ddclient to update dynamic dns ---------------------------------------------------------------------- silence036 · 2023-12-05 17:44 I have a setup where everyone gets letsencrypt certs: DNS through CloudFlare, so I can use the CloudFlare API for DNS updates. TrueNAS, wifi controllers, opnsense firewalls and samba domain controller servers use some variation of acme.sh script to renew their certs (they have names in the "internal.public-example.com" subdomain). They all use dns01 validation. All my other apps are in kubernetes and use certmanager (also with dns01). ---------------------------------------------------------------------- HiSpartacusImDad · 2023-12-05 17:52 I’m using Traefik as reverse proxy and followed [this excellent guide by Techno Tim](https://technotim.live/posts/traefik-portainer-ssl/). Working flawlessly. ---------------------------------------------------------------------- PresentAd9429 · 2023-12-05 18:13 Nginx reverse proxy manager! ---------------------------------------------------------------------- brisray · 2023-12-05 18:16 I appear to be unusual here as I host on bare metal and don't use Cloudflare, Docker or anything like that at all. DDNS is handled by [DNSExit](https://dnsexit.com/) and the SSL Certificates come from [Let's Encrypt](https://letsencrypt.org/) using [Certbot](https://certbot.eff.org/) to renew them. Security is always a worry, bots found the server inside minutes of me starting it around 20 years ago but it's never been taken offline due to any sort of attack. What I do is keep an eye on the logs, make regular backups and hardened the configuration files as much as I can. ---------------------------------------------------------------------- prime_1996 · 2023-12-05 18:22 I do something similar, but with ansible in a GitHub repo, whenever I need a new record, i just update the playbook. ---------------------------------------------------------------------- wildekek · 2023-12-05 18:45 This is by far the the easiest method if you’re okay with Cloudflare doing their thing. ---------------------------------------------------------------------- dub_starr · 2023-12-05 19:33 Letsencrypt has really made this pretty easy, I use a standard nginx setup with certbot. Since they added support for wildcards, its become even easier ---------------------------------------------------------------------- billiarddaddy · 2023-12-05 19:47 Dynamic DNS, nginx reverse proxy, and let's encrypt. ---------------------------------------------------------------------- anyOtherBusiness · 2023-12-05 20:14 In my local network, a Reverse Proxy that supports ACME DNS challenge for Letsencrypt (Traefik in my case). Wireguard for VPN (wg-easy). A cloudflare-ddns container to update a DNS entry for connecting from outside. ---------------------------------------------------------------------- FalseRegister · 2023-12-05 20:18 I tried this and it didn't work. Apparently, my ISP was making me share the public IP with others as well, so the requests to my IP didn't hit my router. Cloudflare Tunnels all the way. ---------------------------------------------------------------------- port8080dev · 2023-12-05 20:19 Having valid SSL for all my hostables is really convenient. If you ever hand out access to friends and family, the tech barrier decreases a bit. No need for a nasty ssl warning message or "connecting anyway" rigamarole. * ZeroSSL on my nginx proxy for all my local hostables * CloudFlare tunnels with SSL passthru for specific hostables I need exposed * CloudFlare app access limited to a whitelist of Google accounts (for auth) * Public DNS points to CF tunnels * LAN DNS points directly to nginx proxy * Tailscale to LAN and maintains all local DNS so no remembering IPs and bookmarks work locally and remotely Pretty happy overall with the setup. I just recently shared a recipe from my Tandoor instance and all I had to do was add their Google account to my whitelist. ---------------------------------------------------------------------- pusillanimouslist · 2023-12-05 20:40 Follow up. I’m trying to figure out the remote access with tls right now, but I think that you can do this with the following: - Nginx sidecar with TLS termination instead of ingress. - Tailscale access to the pod for remote access. - Custom DNS w/ cnames to redirect mobile traffic to the correct Tailscale node. ---------------------------------------------------------------------- MachDiamonds · 2023-12-05 20:57 1) Dynamic DNS on my router 2) Let's Encrypt certs via DNS verification using cloudflare's API. No need to open any ports. ---------------------------------------------------------------------- jasonweiser · 2023-12-05 21:26 [Here is a really solid guide for setting up the ACME DNS challenge with pretty much any DNS provider](https://github.com/acmesh- official/acme.sh/wiki/dnsapi) ---------------------------------------------------------------------- chrishch · 2023-12-05 22:11 As many have said, cloudflard is the way to go if you can accept Cloudflare's terms. I have it running on a Raspberry Pi 4 along with a few other Docker containers. I also have a couple of simple web sites running on nginx (non-Docker version). Everything is https and no port forwarding on the router is required. Also no need to set up dynamic DNS as cloudflared handles everything. As long as you have a domain name and a Cloudflare account, you can start. ---------------------------------------------------------------------- MLGPonyGod123 · 2023-12-05 22:23 This is how I do it, I use OpenSSL called through a python script to generate me signed certs for my network. Works good enough for accessing it locally without any ssl browser complaints since all my devices have the ca public cert imported. Let's encrypt is probably better for most people that aren't as familiar with pki ---------------------------------------------------------------------- DarkKnyt · 2023-12-05 22:39 I use PFSense to generate my certificates for each service, then I use nginx proxy Manager to reverse proxy everything with those certificates, and then I distribute my root certificates to each of my endpoints which I will access it. ---------------------------------------------------------------------- dgibbons0 · 2023-12-05 23:44 1.) I wrote a 3 line script to update my ip address in route53 2.) I use dns based validation instead of http based validation so i dont have to port forward anything in. (https://cert- manager.io/docs/configuration/acme/dns01/) ---------------------------------------------------------------------- RyuuPendragon · 2023-12-06 00:11 I'm also behind CGNAT, so I'm using npm on cloud vps and connecting my RPI4 with tailscale. ---------------------------------------------------------------------- kihaji · 2023-12-06 00:37 I have all letsencrypt signed ssl certs on a custom domain with no ports forwarded. Steps: 1. Get a domain, park it somewhere like Cloudflare (it's what I use) 2. Set your A Name for your domain to your server/reverse proxy's internal IP eg. 192.168.1.2 3. I use traefik, but Ngnix proxy also works, pull your SSL certs using the DNS Challenge method. With cloudflare this requires you to pass an API key, for others it may mean putting a specific value in your DNS record. 4. Now all your internal sites are SSL secured with legit certificates. Your sites resolve when you are on your internal network, and if you VPN in, they will also resolve 5. Rejoice, because you don't poke holes in your firewall. ---------------------------------------------------------------------- revereddesecration · 2023-12-06 01:07 I have a VPS of the cheapest variety I can find that hosts a VPN server. Then my homelab PCs connect to it. The DNS points to the VPS, which runs Caddy as a reverse proxy and routes traffic to the relevant PCs on the relevant ports. Easy, cheap, secure. ---------------------------------------------------------------------- peacefulshrimp · 2023-12-06 01:39 For external access I use cloudflare tunnels and they give me free SSL, for internal traffic I use Nginx Proxy Manager as reverse proxy and add the SSL though it ---------------------------------------------------------------------- f3bf3b · 2023-12-06 02:09 The easy way is by using cloudflared tunnel because they give you free SSL and other nice features. The other way is by using DNS01 Challenge, you can look it up about how it works. You dont need "true" public ip pointing to your domain, heck you can just point your domain in DNS provider to a local ip behind NAT in your home. DNS01 just need to be able to query the ACME TXT records from your DNS provider. Lets encrypt (certbot) and caddy has plugin for automating the certificates renewal ---------------------------------------------------------------------- Silencer306 · 2023-12-06 07:31 How do you do the dynamic dns? ---------------------------------------------------------------------- kevdogger · 2023-12-06 07:38 Invest in w good router first. I use pfsense but could use opnsense as well. This should be your foundation ---------------------------------------------------------------------- pusillanimouslist · 2023-12-06 08:30 Yeah, setting up vault and cert manager was a giant pain in the behind. Not sure if I’d recommend to anyone less experienced than me. ---------------------------------------------------------------------- gargravarr2112 · 2023-12-06 08:55 EasyRSA internal CA. Don't have anything exposed to the internet though. ---------------------------------------------------------------------- mattcd216 · 2023-12-06 12:20 Lots of replies - thank you so much. Cloudflare tunnel sounds popular. That would terminate SSL in their edge network, correct? Then 'tunnel' back to my server. I think I would like the certs on my network to avoid routing (even securely) all over the internet (when I am at home!). Anyone have any experience with Tailscale's https offering? I shall be investigating docker with a reverse proxy container in front of the server container(s) and the DNS challenge for certificates. It sounds like I can achieve this without opening up router ports. Then I can use Tailscale to connect when I am away from home. Thanks again - really useful. Great to see how many ways there are of doing this. ---------------------------------------------------------------------- mattcd216 · 2023-12-06 12:21 Love this. Ultimate self-hosting! ---------------------------------------------------------------------- billiarddaddy · 2023-12-06 12:22 Niop.com ---------------------------------------------------------------------- ipopotem · 2023-12-06 12:42 Use Cloudflare Tunnel. [here is a tutorial video.](https://www.youtube.com/watch?v=Q5dG8g4-Sx0) ---------------------------------------------------------------------- TheBlueKingLP · 2023-12-06 13:35 1. My IP address never changed even though it is DHCP. Except the time I replaced the router. 2. I uses DNS challenge and it only requires you to add a TXT dns record to your domain to proof ownership. Done fully automatically with Traefik reverse proxy. ---------------------------------------------------------------------- mattcd216 · 2023-12-06 13:38 Great video - thank you. This would mean SSL is terminated at Cloudflare's end, right? So even if I were at home I would be accessing my home servers (securely) over the internet? ---------------------------------------------------------------------- mwgmwg · 2023-12-06 14:11 Lots of great replies, does. I use PFSense with a private CA to generate certs (mostly a wildcard cert) for my endpoints on k3s with traefik. Anyone have a good way to distribute your private CA to all your home devices? ---------------------------------------------------------------------- ipopotem · 2023-12-06 15:15 The secure connection will only be established when you access the instance using the domain name you set up on Cloudflare, from everywhere including your home. ---------------------------------------------------------------------- jollusandeepkumar · 2023-12-06 16:31 Dynamic IPs and DNS: Sign up for a free Dynamic DNS (DDNS) service like DynDNS or No-IP. Configure your router to update your DDNS provider with your current IP address. SSL/TLS Certificates: Use Let's Encrypt to get free SSL certificates for your domains. Install a reverse proxy (Nginx or Traefik) on a Raspberry Pi or another machine. Configure the reverse proxy to handle SSL and route traffic to your services. Router Port Forwarding: Log in to your router's admin panel. Set up port forwarding to direct external traffic to the correct internal IP and port of your services. Self-Signed Certs: If you must use self-signed certs, be aware some clients won't accept them. Temporary Containers: Use Docker Compose to define and manage your containers easily. Regularly back up your Docker configurations. Tailscale: Use Tailscale for secure remote access, but rely on DDNS and Let's Encrypt for external access. Security: Keep all software, including Docker, up to date. Implement strong authentication methods like 2FA. Consider isolating IoT devices or less trusted services on a separate network. Remember, security is crucial, so stay vigilant and keep your setup updated and well-protected. ---------------------------------------------------------------------- blackstar2043 · 2023-12-07 14:34 To generate domain names without any involvement from third-parties, I run my own CA and DNS internally. The main drawback is that it necessitates the installation of a root certificate on each device. ---------------------------------------------------------------------- mattcd216 · 2023-12-09 12:09 I do like the idea of this option. I already have pihole running, so half way there. You get to completely choose your domain names, too :) ---------------------------------------------------------------------- mattcd216 · 2023-12-28 19:37 Hi all. Thanks loads for the info. I went with the Techno Tim guide for wildcard certs and Traefik reverse proxy - great. Also went with CloudFlare for nameservers and DNS challenge, so no ports opened on the network. Tailscale for remote access. Pihole for local DNS. I now have calendar/contacts, password manager and notes all self- hosted over https :) Everything on docker (apart from Tailscale) on the same raspberry pi. Docker volumes backed up nightly to NAS for safety. Thanks again, big help.