Internal ssl with caddy + cloudflare
reddit / selfhosted

----------------------------------------------------------------------
mariomare22 · 2023-12-26 17:51

Hello!

I own two domains both hosted in cloudflare.
domain1.com has A record in CF to my public ip address and all CNAMEs
pointing to A record.
domain2.com has A record in CF to a lan ip address for internal ssl
usage with DNS challenge
i use caddy as reverse proxy and it has been working perfectly for
domain1 accessible from internet with port forwarding 443 on the
router.

I would like to also reverse_proxy with https to services like
portainer from my local network only and https.
Can you please provide me with examples to do so?

Thank you

----------------------------------------------------------------------
wowkise · 2023-12-27 05:26

Best approach i would advise is to do split DNS, externally your
domain2 would point to your public ip and locally points to your local
ip. Use local dns resolver to achieve this. I personally use single
domain for both external/internal access with a whitelist approach
where i only allow specific vhosts to be externally accessible.

----------------------------------------------------------------------
mariomare22 · 2023-12-27 07:13

Thank you! But in this case the domains will be accessible visible
from internet.
Regarding split dns, I have pihole running so not an issue in pointing
to the local ip but still what should i put in CF?

----------------------------------------------------------------------
wowkise · 2023-12-27 08:22

There are many ways to do it if you dont want external access at all
you should be using firewall. if you want to allow some access to
specific vhosts then check this
https://serverfault.com/questions/696960/block-nginx-for-everyone-
except-office-ip

----------------------------------------------------------------------
PovilasID · 2023-12-27 08:55

I would setup DNS forwarding to local DNS server and a local reverse
proxy like Ngnix manager or traefik that uses DNS challenge to obtain
SSL certs.

This will allow you to use same domain but not leave local network if
something fails and if local config DNS  and reverse proxy fails you
still have public routing as a backup

----------------------------------------------------------------------
mariomare22 · 2023-12-27 10:24

I wanted to do this, but with caddy following
https://youtu.be/qlcVx-k-02E?si=OuQq2C2DydSZh464

And it’ not working

----------------------------------------------------------------------
mariomare22 · 2023-12-27 10:25

I want to use 2 different domains one for internet use and one for
local use only with ssl

----------------------------------------------------------------------
PovilasID · 2023-12-27 16:09

I had tried similar thing to this video with traefik but it was
throwing "THIS IS PHISHING SITE errors"

Only thing that worked was using this [https://www.youtube.com/watch?v
=syzwLwE3Xq4](https://www.youtube.com/watch?v=syzwLwE3Xq4)

This allows you to use cloudflare's DNS challenge to get SSL certs
just use some legitimate ip not something from private IP range and
you can also use DNS forwarding. I have a docker urnning on
nonstandard DNS port so I can in my router point to a local IP. If DNS
record is pointing to a local IP it will open it and does not matter
that the SSL for it was for different IP.

----------------------------------------------------------------------
mariomare22 · 2023-12-28 23:50

Thank you all! Apparently everything works perfectly with NPM. I have
migrated everything