For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.

      • Possibly linux@lemmy.zip
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        2 days ago

        I don’t get it. Npm is a package manager. It doesn’t handle certificates.

        You need a DNS service like route 53 (AWS) or similar where let’s encrypt connects via an API and creates the DNS token.

        • coolie4@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 days ago

          OP isn’t referring to the package manager. They’re talking about Nginx Proxy Manager

          • Possibly linux@lemmy.zip
            link
            fedilink
            English
            arrow-up
            6
            ·
            2 days ago

            Oh

            That makes sense. We need to stop making two things use the same acronym. Its like people saying HA for home assistant without realizing that HA is normally used for high availability.

      • MangoPenguin@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 days ago

        Then you’re all set, issue certs over DNS-01 challenge in NPM, and create records in your local DNS server that point to the NPM IP for each domain you want to use.

  • slazer2au@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    ·
    3 days ago

    Split DNS on your LAN?

    Only records permitted to be access on your LAN are responded by a local DNS server. While public DNS still available for your public facing services.

    Your wildcard cert will work for both situations as the browser only cares the sni matches the Url in your address bar.

    • bigdickdonkey@lemmy.ca
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 days ago

      I’m using this right now but I’m switching to having all my services under one domain and blocking non internal ips. Technically someone can access your site by providing the host manually, althought it’s unlikely since they would need to know it

      • derek@infosec.pub
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 days ago

        Would you expanding in this concern? I’m not sure I understand but I’d like to.

  • wildbus8979@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    1
    ·
    edit-2
    3 days ago

    You can use the DNS verification method. Either using nsupdate with bind or what ever protocol your DNS provider and favorite ACME (certbot, acme, lego, etc) utility supports. As long as your DNS server is publically reachable that will work, even if the subdomain itself doesn’t exist publically.

  • Matt The Horwood@lemmy.horwood.cloud
    link
    fedilink
    English
    arrow-up
    5
    ·
    3 days ago

    I have that setup, my domain is hosted by OVh and they have an API that you can use to get a wildcard certificate with.

    At home I run pihole and that has some sites in as local IPs, but if you look the same site up from OVH you would get an internet IP

  • DigitalDilemma@lemmy.ml
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    2
    ·
    3 days ago

    How we’ve done it recently:

    1. Put domain on cloudflare or another registrar that supports an API. Generate a token with the right privs.
    2. Use certbot with the cloudflare plugin, and that token, and generate whatever certs you need within that domain using the DNS01 method.

    No need to have port 80 open to the world, no need for a reverse proxy, no need for NAT rules to point it to the right machine, no need to even have DNS set up for the hostname. All of that BS is removed.

    The token proves your authentication and LetsEncrypt will generate the certs.

  • just_another_person@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    2
    ·
    edit-2
    3 days ago

    If you have wildcard certs, you just install them everywhere your services are running.

    As far as redirects go, you just 302 redirect from one host to another.

    Unless you’re asking about resolving hosts on your internal network and public ones differently, which is a lot more complicated than you probably want to deal with if you’re already kind of lost. Just setup a VPN to your internal network and be done with it. Otherwise setup a local DNS resolver to bridge your public DNS and local requests.