Maybe this is more of a home lab question, but I’m utterly clueless regarding PKI and HTTPS certs, despite taking more than one class that goes into some detail about how the system works. I’ve tried finding guides on how to set up your own CA, but my eyes glaze over after the third or fourth certificate you have to generate.
Anyway, I know you need a public DNS record for HTTPS to work, and it struck me recently that I do in fact own a domain name that I currently use as my DNS suffix on my LAN. Is there a way I can get Let’s Encrypt to dole out a wildcard certificate I can use on the hosts in my LAN so I don’t have to fiddle with every machine that uses every service I’m hosting? If so, is there a guide for the brain dead one could point me to? Maybe doing this will help me grock the whole PKI thing.
mouse@midwest.social 1 day ago
I use Caddy for this. I’ll leave links to the documentation as well as a few examples.
Here’s the documentation for wildcard certs. caddyserver.com/docs/automatic-https#wildcard-cer…
Here’s how you add DNS providers to Caddy without Docker. caddy.community/t/…/8148
Here’s how you do it with Docker. github.com/docker-library/docs/tree/master/caddy#…
Look for the DNS provider in this repository first. github.com/caddy-dns
Here’s documentation about using environment variables. caddyserver.com/docs/caddyfile/concepts#environme…
Docker
A few examples of Dockerfiles. These will build Caddy with DNS support.
DuckDNS
Cloudflare
Porkbun
Configure DNS provider
This is what to add the the Caddyfile, I’ve used these in the examples that follow this section. You can look at the repository for the DNS provider to see how to configure it for example.
DuckDNS
github.com/caddy-dns/cloudflare?tab=readme-ov-fil…
CloudFlare
github.com/caddy-dns/cloudflare?tab=readme-ov-fil… Dual-key
Single-key
PorkBun
github.com/caddy-dns/porkbun?tab=readme-ov-file#c… Global
or per site
Caddyfile
And finally the Caddyfile examples.
DuckDNS
Here’s how you do it with DuckDNS.
Also you can use environment variables like this.
CloudFlare.
Porkbun
sugar_in_your_tea@sh.itjust.works 10 hours ago
I did basically this w/ Cloudflare, and it worked perfectly. I used to do ACME requests, but this is simpler and doesn’t require me to route traffic into my LAN. I now expose a handful of services, but I used to have to expose all services for TLS cert renewal to work.
eneff@discuss.tchncs.de 1 day ago
thank you for providing such a thorough reply, good shit
theparadox@lemmy.world 1 day ago
Thanks for being so detailed!
I use caddy for straightforward https, but every time I try to use it for a service that isn’t just a reverse_proxy entry, I really struggle to find resources I understand… and most of the time the “solutions” I find are outdated and don’t seem to work. The most recent example of this for me would be Baikal.
Do you have any recommendations for where I might get good examples and learn more about how do troubleshoot and improve my Caddyfile entries?
Thanks!
sugar_in_your_tea@sh.itjust.works 10 hours ago
Ah, PHP, there’s your problem. 😀
Honestly, I just proxy to a separate nginx server to handle the PHP bits, it’s not worth cluttering up my nice, clean Caddy setup with that nonsense.
mouse@midwest.social 1 day ago
Unfortunately that’s one area I am bad with, I tend to use reverse_proxy for most such as Baikal running with the ckulka/baikal Docker image (which runs Nginx or Apache), otherwise I only static sites.
I’d start by looking at Baikal’s config for Apache and Nginx, sabre.io/baikal/install/ and comparing to the directives for Caddy, caddyserver.com/docs/caddyfile/directives and
Since it uses PHP, it will need that, caddyserver.com/docs/caddyfile/patterns#php
Upon my searches I came across this, it talks about running Baikal with Caddy specifically. github.com/caddyserver/caddy/issues/497
I hope that this provided some helpful directions.
conrad82@lemmy.world 1 day ago
I do the same!
I have a provider that is not supported by caddy, but I can still use it via duckdns delegation!
github.com/caddy-dns/duckdns?tab=readme-ov-file#c…
Challenge delegation
To obtain a certificate using ACME DNS challenges, you’d use this module as described above. But, if you have a different domain (say,
my.example.com
) CNAME’d to your Duck DNS domain, you have two options:my.example.com
.Monument@lemmy.sdf.org 1 day ago
The advice I needed and have not been able to find. I could kiss you. Or at least give you a fond nod.