Comment

Comment on Self hosting and HSTS preload domains

just_another_person@lemmy.world ⁨4⁩ ⁨days⁩ ago

Right, so if it’s going to JUST be available over VPN, you don’t need to use a public TLD, DNS, or HSTS at all. Why use the public TLD with these requirements and expose private IP address space over public DNS if it’s solely purpose isn’t going to be consuming publicly?

source

Sort:hotnew top

wraith@lemmy.ca ⁨4⁩ ⁨days⁩ ago
So I should just host it with an IP address instead of using the domain?

I hadn’t thought to do that, at least not for anything other than short lived internal-network-only projects and tests. An IT guy in the company I work for advised me to just get a domain and host with it/subdomains to make it easier to manage if I wanted to host multiple services.

source
- just_another_person@lemmy.world ⁨4⁩ ⁨days⁩ ago
  Well, that’s the simplest way in practice, but not usability. Let me explain:
  
  You control the IP address space once you’re connected to your VPN, and you control the various settings that connection makes, including DNS.
  
  You have a network already, and a VPN of some sort, so that means you have a network device that is terminating that VPN. Is that a router you’re familiar with, or a box on your network?
  
  source
  - wraith@lemmy.ca ⁨4⁩ ⁨days⁩ ago
    I haven’t set up the VPN yet. I am getting as much info as I can before I start any work. For the sake of this discussion, it would be a box on my network.
    
    source
    just_another_person@lemmy.world ⁨4⁩ ⁨days⁩ ago
    Then you just need to run a DNS Forwarder, or something with a DNS forwarding capability. Your router most likely already has this.
    
    DNS is essentially just a request and a response from a service. These can be public or private. A DNS Forwarder on your network will quickly respond if it knows that something is when asked, and return an IP address. If it doesn’t know what it is, it will ask the public services available.
    
    So if you have an internal-only network, a VPN into that network, and a forwarder or other DNS service on that network, you just tell your VPN client of choice to switch to using that DNS instead of public once it connects. It’s a simple setting that every VPN solution supports, and actually makes you MORE secure by not using public DNS servers by default. You can add any record you want to said forwarder, and it will return whatever value you give it for a given domain name.
    
    Here’s a simple workflow as an example:
    
    Setup all your services
    
    Setup names in your local DNS for each service like “service1.jimmypoops.dev”, or "jellyfin.woopsiedoodle.net"
    
    Install VPN client on your phone and make sure your internal DNS server name is used for that connection
    
    Connect to VPN from phone and request the DNS names you added
    
    You DNS will return the correct IP to visit.
    
    All contained within your local network and VPN by extension.
    
    source