Hey everyone,
I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.
I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.
I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?
I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.
Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.
Thanks for your help!
HTTPS for everything means you have to buy into the cartel of “identity providers” that manage DNS and certificates, even if there are some mostly-good actors in there such as Let’s Encrypt, you still have the external dependency. As we have seen with cases such as Austistici, having that dependency can be a problem. It’s your call if it is in your case or not, but I wanted to raise this point because no one has pointed out that particular weakness vector so far in the thread.
In a very general sense, if your services are under a netbird or any sort of VPN where you control who gets account access or not, you “should not need” HTTPS. Might still be convenient to have.
All you need is a DNS name. You can buy one for a few dollars.
Even if you refuse to buy a domain you could always run your own certificate chain
That sounds interesting. But then you have to convince your peers to install your certificate root, right?
No, you would only use this internally. Overall doing this is a bad idea (if the root gets stolen encryption is useless) but is technically possible if you are looking for a learning exercise. It would be about the same amount of work as Let’s encrypt since you would probably still want to run ACME with fairly short certificate lifetimes.
There’s no cartel, you can buy a HTTPS cert from lots of places all over the world. Most domain registrars can set you up. It just won’t be free like Let’s Encrypt and also will have a very different renewal process (most likely once a year manually rather than every 90 days automatically).
It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.
ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though
Well you could technically also use self signed certificates. But it requires a bit more work as well as installing your own custom CA cert.
Self signed isn’t quite the same as a internal CA
Yeah I oversimplified but doing the whole thing your self is possible.
I use tailscale serve for my selfhosted stuff. (Safari on my phone won’t let me open http sometimes)
Get a better browser? HTTP is as legit a transmission protocol as HTTPS and email are.
All mobile browsers are safari wrappers on iphone