Selfhosted

60076 readers

973 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

If I use Caddy for reverse-proxying into another local machine... is my local connection not HTTPS? (discuss.tchncs.de)

submitted 9 months ago by unknowing8343@discuss.tchncs.de to c/selfhosted@lemmy.world

17 comments fedilink hide all child comments

Mind that I am very noob into self-hosting, reverse proxies and the like

When I saw that Caddy automatically handled the HTTPS thingies I was like "this is my moment then to go into self-hosting". Caddy seemed so simple.

Turns out... I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue... bum, all my info gets leaked... right?

This might sound weird because it might actually be super-duper complicated but... how come in 2025 we still don't auto-encrypt local comms?

Please be kind. Lot's of love. Hopefully I'll dig my way to self-hosting wisdom.

you are viewing a single comment's thread
view the rest of the comments

[–] N0x0n@lemmy.ml 2 points 9 months ago (1 children)

Or simply create your rootCA, IntermediateCA, keys and certifictes with openSSL.

Neither of those are begginer friendly but openSSL is probably a bit easier to get started. There's a nice book with openSSL (if you are interested I migh look how it's called) and the last chapter is all about how to create your mini-CA and everthing else to serve your proxy with valid certificates for your homelab.

[–] johannes@lemmy.jhjacobs.nl 2 points 9 months ago (1 children)

The reason i chose Step CA over openSSL is because with step CA you can automate certificate renewal without any manual intervention. I don't know how that would work with openSSL except some heavy scripting?

[–] N0x0n@lemmy.ml 2 points 9 months ago* (last edited 9 months ago) (1 children)

Yeah thats correct !

I Wouldn't say heavy though (maybe I see it that way because I got a bit better with bash and the like :p) because you can make use of CRL to revoke your certificates and renew them very easily with your intermediate and ready to use config files.

But yeah, there isn't any automated way to manage certificates like Smallstep does :)

[–] johannes@lemmy.jhjacobs.nl 1 points 9 months ago (1 children)

You mentioned a book though... Now i'm curious ;-)

[–] N0x0n@lemmy.ml 2 points 9 months ago (1 children)

https://www.amazon.com/Demystifying-Cryptography-OpenSSL-3-0-techniques/dp/1800560346

It's really a good book :) And the last part is all about a mini-ca for your homelab !

However, don't use the ED448/ED25519 algorithm based certificates for TLS as mentioned in the example... They are still not supported by any browser !

If you can support the author, please do ! If you're on a budget, it's really easy to find in the piracy corner.

[–] johannes@lemmy.jhjacobs.nl 1 points 8 months ago

Thank you! I don’t mind buying books that are useful, work pays for that ;-)