KairuByte

My dude, look into tailscale. Same concept, just as easy to set up, and likely more features. And it’s human made, human tested, and used by a large number of different type of end users.

Just be glad it gets a second season at all. The number of anime that are dead on the vine for no apparent reason is crazy.

Yes, it’s also how I run all my services. I checked just this moment, and locally my certs verified by field is Let’s Encrypt, while remotely that field is Google Trust Services

I have never personally provisioned a cert from Google. I have only ever utilized Let’s Encrypt. That leaves just one involved party that could have requested, received and presented this cert: Cloudflare.

Tunnels aren’t inherently CDN, you can tunnel UDP info for instance (if you use cloudflared on both sides) and inherently transient things such as websockets.

I’ve had none of my media be cached in their CDN for instance. In fact you’d likely have to do some hoop jumping to make it happen.

No it was definitely removed, they now have essentially “don’t be an ass with the bandwidth.”

Does this hot end smell like chloroform to you?

They don’t care, that line in the ToS was removed years ago now.

How is your DNS set up for that subdomain? Is it on a wildcard DNS record?

I mean, if you put restrictions on the requirement sure. At that point it kinda becomes a loaded question though.

If you remove the restriction, just use a cloudflare tunnel.

Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I’m fairly certain that would be absolutely required when using their DNS proxies.

Oh… boy, that’s an angle I hadn’t considered.

Doesnt any dns challenge currently just look at domain.com to see if it can create the lower cert?

Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).

Oh this looks very promising, thank you!!

I’m not currently using kubernetes but its something I’ve thought of looking into before. I’ll definitely give that a look for better terminology though!

I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.

I’ve always wondered, doesn’t Backblaze cut exfiltration costs to zero if you proxy it through cloudflare? Why isn’t that an option so you’re only paying for storage costs and not bandwidth?

Honestly, the one major thing I want from Authelia is the ability to add to it without deauthenticating the entire userbase.

Well, that and an easier way to organize than everything in one single file…

HTTPS traffic is still HTTP traffic. There’s just an encryption layer in there.

And yes cloudflare absolutely supports https.

My understanding is that there is no hard limit. At some point they will decide “this is business level traffic” at which point they will start harassing you to purchase a business plan.

That cutover point is unknown. I’ve never even seen an estimation of when it happens, so it could very well be the type of traffic instead of the amount.

They also only allow HTTP traffic for the free tier, which is another way they push you towards business tiers.

Not to mention, the amount of data you can run through it is nuts. I’ve been running Stremio web through it for months without issue to watch content at work.

Personally I didn’t want to have to hand out VPN credentials to everyone, so I went with a cloudflare tunnel with Authelia as the method of authentication.

Doesn’t the DS… just have a browser? Meaning you’re just pointing at a web page here?

Very much in the same vein as Azure.

Thank you, I appreciate this!

Any comparison to tandoor? I see we can import from it but I have a hard time trying to get free time to test things like this. X.x

<.< Let me just throw two scenarios at you real quick to show you why that’s a problem:

That third party can easily just use your connection to view and download CSAM and all external monitoring would suggest that activity was coming from within your network. Because it is.

That third party has full network access to anything your PC does (or at least that nic) which includes anything in your local network. Insecure IoT, other PCs, etc.

Is that name missing a T?

I like TacticalRMM though may be a little more in depth than you’re looking for.

no notes.

Wait…