Looking to move from Caddy

Comments

• Shimitar@downonthestreet.eu ⁨3⁩ ⁨weeks⁩ ago

  I believe that it’s impossible to avoid ai generated or ai committed or ai designed or ai helped code. Or will very soon be.

  Better to learn to cope with it.

  original

  • confusedpuppy@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    Impossible? There are people who still write code by hand. There are people who oppose AI, some more actively (or destructively) than others.

    Harder to avoid seems like a more reasonable take.

    However I am coping, by actively seeking, talking about and supporting alternatives with the hope of spreading that knowledge to those who would like to avoid the use of AI or enable those who support AI.

    Human creativity has a much longer and far more interesting history when compared to AI or machine learning. AI hasn’t always existed and does not need to have complete influence over our future.

    original

    • forbiddenlake@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Your stance rules out all the big and mature software. No judgement on the stance, but you are asking a difficult question.

      Off that alternatives list, the only one I’ve heard of is lighttpd, and it’s news to me that lighty can do reverse proxying. But I would try that.

      I expect it to be a lot more difficult to find documentation and support for anything more obscure than lighty. Which may be fine for you, just know what you’re getting in to.

      As for certbot, iirc you need to add a renew command to cron, but otherwise certbot will take care of it. I’m sure the cron is in the documentation.

      original

      • -> View More Comments
    • shiftymccool@piefed.ca ⁨2⁩ ⁨weeks⁩ ago

      I know this won’t be popular but… There are still people who cobble shoes too, do you buy your shoes from your local cobbler? All your furniture is made by the Amish?

      Yes, these things are available but you probably are getting your machine-made shoes from some superstore and your mass-produced furniture from ikea. Mass-produced code seems like a weird hill to die on these days with everything else the way it is.

      original

      • -> View More Comments
  • lambalicious@lemmy.sdf.org ⁨2⁩ ⁨weeks⁩ ago

    Harder, yes; impossible, no.

    For example, even if there was currently not an alternative to a specific piece of software (might take a while, might be too niche, etc) nothing says you can’t use the latest version of Caddy or whatever before they got slopified. Lists like Open Slopware help find the correct release version numbers for that.

    original
• slazer2au@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  I use Traefik as my reverse proxy and it deals with my certs automatically.

  Keep in mind just because Caddy has an AI sponsor, it doesn’t mean they are using ai products, it could be the AI platform is using caddy and gave done the bare minimum of sponsoring the project.

  original

  • anamethatisnt@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago

    Traefik merge code written by AI, f.e. github.com/traefik/traefik/pull/13397
    As do Caddy, such as github.com/caddyserver/caddy/pull/7492 and github.com/caddyserver/caddy/pull/7666

    original
  • confusedpuppy@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    I personally feel like taking money from an AI sponsor is enabling behaviour. From that perspective, I do not want to support that type of behaviour.

    original

    • jimmy90@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

      What about nixos and nginx

      original
• littleomid@feddit.org ⁨3⁩ ⁨weeks⁩ ago

  Respectable, but why not NGINX?

  original

  • anamethatisnt@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago

    They seem to merge AI code too, from OPs codeberg link: github.com/nginx/nginx/pull/1451

    original
• anamethatisnt@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago

  I think pivoting to BSD is the easiest way to find solutions that aren’t tainted by AI.
  www.openbsdhandbook.com/relayd/

  An example of OpenBSD denying AI code contributions:
  marc.info/?l=openbsd-tech&m=177411620801633&w=2

  original
• goddard_guryon@sopuli.xyz ⁨2⁩ ⁨weeks⁩ ago

  Careful now

  Image

  (I hope a little bit of tomfoolery is allowed here)

  original
• dlsolo@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  Not glamour but haproxy may be worth the look.

  original

  • NarrativeBear@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    HAProxy seems like it’s always overlooked. I have been using it for years myself, pretty solid and just works.

    If you run pfSense you can also use HAProxy with a GUI.

    original

    • lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago

      Just keep in mind that HAProxy is only a proxy (technically a performance-oriented load-balancer). It’s not a web server.

      I mention it because some of us also rely on our reverse proxy to serve small static webpages for various purposes (I serve a small status page generated by a cron script, for example).

      original

      • -> View More Comments
• lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago

  I’m also using Certbot with DeSEC. I simply run it daily with anacron. If it doesn’t need to renew the certs yet it will say so and stop. That’s basically it.

  I think it’s a very good idea for your LE renewal to be independent of whatever reverse proxy or web server you’re using.

  Please keep in mind that Certbot is a Python app so you can manage it with venv. Here’s how I install it in a dedicated dir (let’s say /srv/letsencrypt because using /etc is not appropriate and it bugs me 😆):

  #!/bin/bash
  set -e
  apt install python3-venv
  /usr/bin/python3 -m venv .venv
  source .venv/bin/activate
  python3 -m pip install --upgrade pip
  python3 -m pip install --upgrade certbot certbot-dns-desec
  

  And to update it:

  #!/bin/bash
  set -e
  source .venv/bin/activate
  python3 -m pip install --upgrade pip
  python3 -m pip install --upgrade certbot certbot-dns-desec
  

  As for renewing certs (the script is longer, I’m making sure to create dirs and so on but this is the gist of it):

  source .venv/bin/activate
  
  ./.venv/bin/certbot \
  --config-dir "$CFGDIR" \
  --logs-dir "$LOGDIR" \
  --work-dir "$TMPDIR" \
  --domain "*.${DOMAIN}" \
  --domain "*.${DOMAIN}" \
  --authenticator dns-desec \
  --dns-desec-credentials "${SECDIR}/${DOMAIN}.ini" \
  --non-interactive --agree-tos \
  --email "$EMAIL" \
  certonly
  
  openssl x509 -text -in "${CFGDIR}/live/${DOMAIN}/fullchain.pem" |\
  grep -e 'Not Before' -e 'Not After'
  

  For DeSEC you need secrets/${DOMAIN}.ini to contain:

  dns_desec_token = YOURTOKENHERE
  

  Please note that DeSEC lets you restrict what the token can do, but setting the rights on the token has to be done through their API so you need a separate token for the API 😅.

  To use the certs from Caddy, point it at the files under the config/live/${DOMAIN}/ dir (which are symlinks that are maintained by Certbot), NOT the ones under archive/.

  tls /path/to/certbot/config/live/example.com/fullchain.pem /path/to/certbot/config/live/example.com/privkey.pem
  

  Or, if you want to also add mTLS to the mix:

  tls /path/to/certbot/config/live/example.com/fullchain.pem /path/to/certbot/config/live/example.com/privkey.pem {
      client_auth {
          mode verify_if_given # or whatever access mode you want
          trust_pool file /path/to/custom/ca.pem
      }
  }
  

  Let me know if you have questions.

  original

  • confusedpuppy@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

    This is great, thank you for taking the time for this write up :) The provided scripts are a huge help to me

    So far my only question I have is about the directories you use. I was wondering if you could provide the directories you use or even just an example so I could better understand the file tree. I’m very particular with my files and have a whole system dedicated to maintaining neat and organized files

    I agree about not using /etc for server related stuff. I keep all my server/container related stuff in /srv so it’s easier for me to manage

    original

    • lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago

      The dirs are subdirs of /srv/letsencrypt. I like to take advantage of explicit dir assignment if the software allows it, so I don’t have any surprises if the defaults change.

      ROOT=/srv/letsencrypt
      SECDIR="${ROOT}/secrets"
      CFGDIR="${ROOT}/config"
      LOGDIR="${ROOT}/logs"
      TMPDIR="${ROOT}/tmp"
      
      for DIR in "$SECDIR" "$CFGDIR" "$LOGDIR" "$TMPDIR"; do
              mkdir -p "$DIR"
      done
      
      cd "$ROOT"
      

      original

      • -> View More Comments
• curbstickle@anarchist.nexus ⁨3⁩ ⁨weeks⁩ ago

  I’m fairly certain NPM (nginx proxy manager) doesn’t have any llm use inherently within the project, not sure on financial support. Other people have made context providers to use an LLM with NPM, but I don’t believe the core package itself does.

  May be what meets your reqs.

  original

  • confusedpuppy@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    I’ve used NPM before and it is quite simple and easy to use, however I do have a preference for CLI tools

    original

    • curbstickle@anarchist.nexus ⁨3⁩ ⁨weeks⁩ ago

      Just use nginx and certbot manually then, its just a pretty front end for them after all.

      original
    • GottaHaveFaith@fedia.io ⁨3⁩ ⁨weeks⁩ ago

      npm is just a wrapper for nginx

      original
• HelloRoot@lemy.lol ⁨3⁩ ⁨weeks⁩ ago

  I’m a gui pleb, so I do all my selfhosting through dokploy, which uses traefik under the hood and I’m quite happy with it so far.

  original
• diecknet@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago

  I used traefik in the past, but moved to Caddy a while ago. In traefik I had to restart the service to apply the renewed certificate, which I found annoying. Caddy on the other hand just works.

  Anyway, are you using anything by the Linux Foundation?

  original

  • confusedpuppy@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

    I use Alpine Linux so yeah, I am using something by Linux

    It’s not ideal but I don’t have the time to find alternatives for everything all at once, just one thing at a time which is the pace I am going. I’ll deal with it when the time comes but it’s in the back of my mind

    original
  • Appoxo@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

    Whaaat?
    I have auto renewing certs on my traefik instance and never had to renew my config except if I modified the config.yml…

    original

    • diecknet@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago

      Hm… Maybe then I’m confusing it with the cert renewal in Home Assistant.

      original
  • q7mJI7tk1@lemmy.world ⁨2⁩ ⁨weeks⁩ ago

    Not about certs, but I found the opposite moving from Caddy to Traefik: in amending the caddyfile, I had to restart the Caddy service which would kill any open connections that were being used. In Traefik, it’s dynamic, so can update the services without having to restart Traefik itself.

    My main move to Traefik was due to file transfers for reverse proxy services like File Browser slowing down after a period of time, whereas in Traefik, they stayed at a constant speed.

    I now run Traefik as part of Pangolin, so most config is set by that.

    original

    • stratself@lemdro.id ⁨2⁩ ⁨weeks⁩ ago

      You can use caddy reload -c /path/to/Caddyfile to reload the config midway through

      original
• stratself@lemdro.id ⁨2⁩ ⁨weeks⁩ ago

  For TLS I am looking into using CertBot and it appears there’s a module (github.com/desec-io/certbot-dns-desec) I can use that works for desec.io to handle my certs.

  You can consider using lego-acme as well. It’s not too different, just that it comes prepackaged with a bunch of DNS providers including desec, so you don’t need to install an additional module.

  Since Caddy is handling my certs automatically, how often would I want to renew my certs?

  By default, certs are valid for 90 days so you’d wanna renew a bit earlier than that. There’s also the option to use 45-day certs or 6-day certs, depending on the profile chosen.

  Would I be required to run the same command periodically to renew my cert?

  Yes, but it’s better if you automate them, like Caddy did, and both Certbot and lego can do this well. I run lego via a cronjob which checks for the certs’ expiry, and renew it when it passes a certain deadline.

  I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI

  Not sure I can recommend anything from that list because I’m not familiar with them, but I’ve heard haproxy to be very performant.

  original

  • confusedpuppy@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

    Thank you, I’ll have a look at lego-acme, it looks interestingly. I prefer to use cron so this is could be something I would consider using.

    original

    • lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago

      FWIW I’ve tried all the major CLI tools for cert renewal (certbot, lego, acme.sh) and certbot was by far the easiest to use. The others were various shades of horrible – bad documentation, obscure error messages, you name it. Wish I had tried certbot first and not wasted my time.

      You can find the magical incantations online and coax them to work eventually but they made me wonder if that’s the kind of tool I want to trust with my cert renewal.

      original

      • -> View More Comments
• Samiaouuu@jlai.lu ⁨2⁩ ⁨weeks⁩ ago

  I think SWAG would be nice for you docs.linuxserver.io/images/docker-swag/

  It’s basically a preconfigured nginx container with certbot builtin.

  original
• nykula@piefed.social ⁨3⁩ ⁨weeks⁩ ago

  Apache has mod_md, a built-in LetsEncrypt-compatible module that requires very little configuration and no external daemons or cron jobs: https://httpd.apache.org/docs/2.4/mod/mod_md.html Three lines per virtual host: MDomain, MDContactEmail and MDCertificateAgreement. Using it in production for three years without any issue. I don’t know what’s Apache stance on LLMs, I guess neither for nor against.

  original
• Chaser@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago

  I use NginX Proxy Manager gor my homelab. For my business setups I use Traefik.

  original