Selfhosted

54123 readers

428 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

Securing traffic between a proxy and a backend over a VPN. How do you get a certificate for an internal domain? (lemmy.world)

submitted 1 day ago* (last edited 1 day ago) by early_riser@lemmy.world to c/selfhosted@lemmy.world

23 comments fedilink hide all child comments

Bit of a followup to my previous post. I now have a VPS with nginx working as a reverse proxy to some services on my DMZ. My router (UDM pro) is running a wireguard server and the VPS is acting as a client.

I've used Letsencrypt to get certs for the proxy, but the traffic between the proxy and the backend is plain HTTP still. Do I need to worry about securing that traffic considering its behind a VPN? If I should secure it, is there an easier way to do self-signed certs besides spinning up your own certificate authority? Do self-signed certs work between a proxy and a backend, or would one or the other of them throw a fit like a browser does upon encountering a self-signed cert?

I'd rather not have to manage another set of certs just for one service, and I don't want to involve my internal domain if possible.

you are viewing a single comment's thread
view the rest of the comments

[–] thelittleblackbird@lemmy.world 2 points 13 hours ago (1 children)

Question, how do you deal with the certificates if you have an external vps doing passthroy?

Because that certificate will not match the domain name of the vps and then everything will fail or at least trigger a lot of alerts.

I really fail to see how an internal backend in a different subnet can send the right certificate

[–] brownmustardminion@lemmy.ml 1 points 11 hours ago (2 children)

There's no certificate at the VPS level. It forwards everything to and from the self hosted reverse proxy.

Now that you mention it though, there may be a slight complication with pinning the reverse proxy to the domain API for cert renewals. I'll have to check how I have mine configured but I may have given my reverse proxy a IPv6 and configured that for cert renewals.

That would mean some down time as you update the IP if your ISP rotates it.

[–] thelittleblackbird@lemmy.world 1 points 4 hours ago* (last edited 3 hours ago)

Still it is not clear to me how the internal reverse proxy may get a valid certificate when the domain name is pointing to the vps. Do you copy later manually to the internal proxy?

And if so, how do you overcome the invalid certificate warning when you are accessing your services locally?

[–] kossa@feddit.org 1 points 8 hours ago

Idk if I understood the problem correctly, but you can renew with DNS challenge, if the real server is not reachable directly.